ec2-3-144-43-13.us-east-2.compute.amazonaws.com , 52739th | 1999/10/18 UPDATED |
1996.4.1 got new car 1996.4.10 got underground ROM 1996.4.13 known waht is CPU 1996.4.18 got CPU users manual 1996.4.18 start making disassembler 1996.7.17 analyze communication interface circuit 1996.7.18 done disassembler, stating ROM analyze 1996.7.20 discoveried communication routines 1996.8.10 made RS232C adapter 1996.8.16 read ROM image from my car 1996.8.21 discoveried checksum routine 1996.8.23 discoveried address of the accell openity 1996.8.24 bought parts for make an external ROM board 1996.8.26 discoveried address of water temp 1996.9.5 discoveried address of air-flow speed limitter engine load R.P.M. start makeing external ROM board 1996.9.6 discoveried address of battery voltage 1996.9.11 done external ROM board, cut off speed limitter 1996.9.17 got information rev limitter, boost map 1996.9.23 starter SW, airconditioner SW, powersteering SW, D-test SW, ReadMemory SW, neutral SW, AccellPedal SW, Idleing SW 1996.9.25 ignition point, injector interval timer
there is reserved socket for an external ROM, this socket is reserved for FUJITSU MBM27C1028. but, this ROM is already out of market. we can not get this ROM. so we must make an adapter of external ROM for 27C256.
I analyzed program routine for communication, I found two commands read and write only. I seems SELECTMONITOR gets engine data is read from ECU work area direct.
communication format is, 1,953.6bps(CLK/2048) S8E1.
ECU detects end of command is counting received data length. ECU executes a command as soon as data received.
command | phase | length | +0 | +1 | +2 | +3 | description |
---|---|---|---|---|---|---|---|
memory read | command | 4 | 0x78 | addr MSB | addr LSB | ' R ' | read data from absolute memory. repeate until get another commands. |
result | 3X | addr MSB | addr LSB | DATA | - | ||
memory write | command | 4 | 0xaa | addr MSB | addr LSB | DATA | write data to absolute memory |
result | 3 | addr MSB | addr LSB | DATA | - | reread data from wrote address | |
clear | command | 1 | 0x12 | - | reset command phase | ||
result | 0 | - | |||||
get ROM ID | command | 4 | 0x00 | ' F ' | ' H ' | ' I ' | get ROM ID |
result | 3 | ID #0 | ID #1 | ID #2 | - |
command | phase | length | +0 | +1 | +2 | +3 | +4 | +5 | +6 | +7 | description |
---|---|---|---|---|---|---|---|---|---|---|---|
memory read | command | 6 | 0x7f | MSB | LSB | ' R ' | - | read data from absolute memory | |||
result | 8 | addr MSB | addr LSB | DATA | CR | LF | |||||
memory write | command | 6 | 0x20 | MSB | LSB | DATA | - | write data to absolute memory | |||
result | 8 | addr MSB | addr LSB | DATA | CR | LF | reread data from wrote address | ||||
clear | command | 1 | 0x12 | - | reset command phase | ||||||
result | 0 | - |
ID | name | desc | A/D# | monitor addr | int addr | unit |
---|---|---|---|---|---|---|
F01 | VB | battery | 2 | 0x1335 | 0x1046.w | Mon:E[V] = N * 0.08 |
F02 | ||||||
F03 | VSP | speed VSP | 0x1336 | 0x1075 | V[Km/h] = N * 2 | |
F04 | EREV | engine RPM | 0x1338 | 0x121c.w | Mon:R[RPM] = N * 25, internal:R[RPM] = 120000000 / N | |
F05 | ||||||
F06 | TW | water temp | 1 | 0x1337 | 0x1268.w | |
F07 | ADVS | ignition point | 0x1053 | BTDC[deg] | ||
F08 | QA | air flow signal | 0 | 0x1308 | 0x1042.w | ( Vadc = N / 200 ) |
F09 | LDATA | engine load | 0x1305 | |||
F10 | THV | throttle signal | 4 | 0x1329 | 0x1262.w | Mon:THV[%] = N / 2.56 |
F11 | TIM | injector time width | 0x1306 | 0x10c0.w | $1306 = $10c0.w / 64, $10c0.w * 4usec = real INJ time?, $1306 * 64 * 4 * 1000 = real INJ time[msec] | |
F12 | ISC | ISC valve duty | ||||
F13 | O2 | O2 sensor signal | ||||
F14 | O2Max | O2 sensor signal Max | ||||
F15 | O2Min | O2 sensor signal Min | ||||
F16 | ALPHA | A/F correction coefficient | ||||
F17 | RTRD | ignition point correction | ||||
F18 | WGC | boost control duty | ||||
F19 | BARO.P | open air pressure | 5 | 0x1340 | P[mmHg] = N / 2 - 260? | |
F20 | MANI.P | current boost | 5 | 0x1341 | 0x12c4.w | P[mmHg] = N / 2 - 260? |
F21 | ||||||
F22 | ||||||
F23 | EXTEMP | exsaust temp | ||||
FA0.1 | IG | IGN SW | ||||
FA0.3 | UD | TEST SW | 0x1343:5 | 0x2200:1 | ||
FA0.4 | RM | READ MEMORY SW | 0x1343:4 | 0x2200:2 | ||
FA0.6 | AS | ACCELL SW | 0x1343:3 | 0x2200:6 | ||
FA0.7 | NT | NEUTRAL SW | 0x1343:2 | 0x2000:0 | ||
FA0.9 | SS | STEERING SW | 0x1343:0 | 0x2200:7 | ||
FA1.1 | ID | IDLE SW | 0x1344:7 | 0x2000:4 | ||
FA1.2 | AC | AIR CONDITIONER SW | 0x1344:6 | 0x2000:1 | ||
FA1.3 | AR | AIR CONDITIONER RELAY SW | ||||
FA1.4 | R1 | RADIATOR FAN1 SW | ||||
FA1.5 | R2 | RADIATOR FAN2 SW | ||||
FA1.6 | FP | FUEL PUMP SW | ||||
FA1.8 | KS | KNOCK SIGNAL | ||||
FA2.1 | MC | N/A | ||||
FA2.2 | IC | N/A | ||||
FA2.3 | BR | OPEN AIR SWITCH SOLENOID | ||||
FA3.10 | O2 | O2 MONITOR | ||||
[OTHER] | ||||||
STARTER SW | 0x2000:2 |
![]() -- LINK FREE -- |
||
HOME | LAST |