OK, promise is a promise. I will try to do it in steps and be informative, but at the same time I do not want to provide you with all my knowledge, I think that you should try things yourself if you are brave enough (and have tons of time to spare too
). At this point I would also like to strongly state that despite the things I am planning to write about my knowledge is limited in certain areas (I am for example very poor with electronics). Then all the info is based on and for IAW ECUs old families 16F, 8F/18F, and 18FD, with the emphasis on 8F/18F, which I dissected in great detail and reprogrammed to deal with my turbo
. Finally, I will not answer PMs about this, ask here, and I will try to answer if I can/want
Finally, it is not my intention or will to teach you about binary code, hex code, assemblers in general, etc. There is plenty of information about that in Google and following the links provided at the top.
First of, some background and useful information to the stuff that is out there:
The page about Motorola HC11 CPUs
Technical documentation for HC11
A page about disassembling HC11 programs
Tuner Pro web page, tools, and other (definition) files: http://www.tunerpro.net/
For the sake of having all the links in one place: 16F Technical Documentation
There are such technical documentations for 8F/18F ECUs and 18FD ECU too, in Italian, I got them from barnacle (cheers again
), but I committed myself to not publishing them (the legal status is not clear to me), so ask him for that and see if he wants to share.
Moates Ostrich EPROM emulator: http://www.moates.net/ostrich-20-the-new-breed-p-169.html
How to hook up diagnostics to your IAW ECU
Background information
All of the mentioned ECUs run on the mentioned Motorola HC11 CPU. The program for all of them is placed in a 64K EPROM chip, 27C512 is its proper code. To do anything useful with the ECU it needs to have an EPROM socket instead of the chip soldered in.
The differences between the ECUs (will talk about differences in the programs themselves later) are the following:
Otherwise they differ slightly inside in terms of the RAM memory size and some other bits that I do not care to know about. On the outside, apart from the injection differences they are practically identical and use the following sensors and outputs:
Sensors/inputs: RPM sensor, Water Temperature (WT) sensor, Air Temperature (AT) sensor, Throttle Position (TP) sensor, Manifold Absolute Pressure (MAP) sensor, Oxygen (Lambda) Narrowband Sensor
Outputs: Injectors, Ignition Coils (wasted spark principle), Stepper (Idle) motor, Charcoal canister, Fuel pump relay, RPM gauge signal, Warning Light signal
Reprogramming ECUs & Mapping
Most of the program running your engine is something I would call "solid state", that is, the program and tables (maps) are burned into the read-only EPROM chip. Only a few bits sit in the EEPROM (this is writeable) and can be changed in a relatively easy way (through the diagnostics connection). Here I am mainly talking about autocalibration parameters. Autocalibration is a very interesting and fascinating beast, more on that later.
So, the general scheme to reprogram one of these is:
The second option is of course the most interesting one. Using this emulator not only you do not have to re-burn the chip every time you change something, you can also run in in live mode, meaning it can be updated while the ECU works. This last part sometimes gets tricky: once in a while the ECU resets itself during such a live update effectively killing the running engine. So it is not a good idea to live update the emulator while the engine is at high loads.
The one fiddly bit one has to remember about when staring on the remapping adventure with EPROM chips is that the ECU program contains a checksum check of the EPROM data. Any change to the EPROM contents will invalidate this checksum and the ECU will conclude that there is an EPROM error. This may result (depending on the version of program) in the ECU refusing to start the engine, or it will start the engine but will keep the Injection Warning Light on. The solution is to switch this checksum check off by changing one of the bit flags in the EPROM file itself (yes, you guessed it, you have to find that bit too).
Making the Process More Civilised
Editing EPROM files with binary editors has obviously certain inconvenience factor. What you do instead is use TunerPro and/or TunerPro RT. The RT version can upload the changes in the EPROM file directly to the EPROM emulator. It can also do live updates and it can also live trace cells in maps based on the connection it makes to the ECU through the diagnostics cable. Suppose that after analysing the EPROM file you figured out that a fuel map is of size 16x16 and is placed at address hex 0
EAD. You load the EPROM file into Tuner Pro, you create a new table/function, and describe the map that you identified, including the X and Y labels, conversion formula for the data in the table (in particular useful for ignition tables to know exactly what the advance is in degrees before TDC). The x and y labels (RPM and MAP pressure values) you can enter manually or you can try to identify where the so-called scales are in the EPROM file and point Tuner Pro to these locations. In any case, there is plenty of example files (both bin and definitions (.xdf files)) on the TunerPro website to look into. After defining a table you can simply double click it and edit it in a human friendly form.
As said, you can do live updates to the the emulator while you edit the tables. For that Tuner Pro RT has to be used and switched into emulation mode (otherwise you can only upload a complete file to the emulator and this effectively resets the ECU). What you still would love to have is to be able to trace cells in tables while the engine runs to show you which values were just used. This is also possible, but I have not yet tested it. For our ECUs Tuner Pro RT beta 5.0 is needed and a IAW diagnostics connection definition for it. Luckily there is one available (since recently), look on the Tuner Pro website for file named Lancia_v1_1.adx. This file is said to work with all IAW HC11 based ECUs. However, I looked into it, and as much as I can see that it in principle should, there are some minor mistakes in it (from the top of my head the ignition advance formula is wrong for our ECUs). I have not had time to play with it yet and for my purposes I actually use a small quickly hacked Java application of my own for live mapping. Anyhow, in theory, after hooking up the .adx file to Tuner Pro RT the only thing left to do is to link the x and y axis of the tables to live ECU parameters and the cell / table tracing is ready. Exactly as you have with all those facncy MS and other stand alone ECU tools. I am promising myself to try out this thing with Tuner Pro and also correct this .adx file to work correctly with our ECUs.
Bootstrapping the Disassembly/EPROM Analysis Process
OK you say, but how the feck am I supposed to know what is in these EPROM files. If you want to take the lazy way, you can try using the WinOLS program (sorry, no link, I am too lazy and do not care for this program) that tries to find maps in EPROM images simply by guessing it out of the shape of the data in the image. Guessing means testing it out, and if the program/you is not right you can get interesting ECU behaviour, including engine damage.
The other, more proper, but more difficult way, is to disassemble the program and try to figure what it is doing. The link at the top gives actually a good tutorial on how to do that. For our ECUs the great help is the diagnostics interface definition (16F Technical Documentation). What I did is I first located the diagnostics (serial communication) routine in the program. To help you with this looking for the ISO code string in the program is very helpful. Once the diagnostics code have been identified we can see where the injection times, ignition advance, rpm, etc. are stored, because from the technical documentation we know what the diagnostics should give on what request. Once you know where for example the ignition advance is stored, you can try to see how this gets calculated.
Having said all this, for those who got excited already, I need to destroy your day a bit. It took me close to 2 years of some of my spare time to analyse and experiment with the ECU to fully dissect the 8F/18F program. This is also the reason why I am not that eager to share too much of this, so that eBay will instantly become full of modified programs. But, for the brave ones that want to try things out I attached some images to this post, compliments of the Polish Centomania forum :worship:.
In the next parts I will try to give you a general description of how the ignition system works, the fuelling system, and autocalibration. The idle control code is still a little bit of a mystery to me though. And then perhaps a few insights on how I went about convincing the 18F program to understand what a turbo is
.
First of, some background and useful information to the stuff that is out there:
The page about Motorola HC11 CPUs
Technical documentation for HC11
A page about disassembling HC11 programs
Tuner Pro web page, tools, and other (definition) files: http://www.tunerpro.net/
For the sake of having all the links in one place: 16F Technical Documentation
There are such technical documentations for 8F/18F ECUs and 18FD ECU too, in Italian, I got them from barnacle (cheers again
Moates Ostrich EPROM emulator: http://www.moates.net/ostrich-20-the-new-breed-p-169.html
How to hook up diagnostics to your IAW ECU
Background information
All of the mentioned ECUs run on the mentioned Motorola HC11 CPU. The program for all of them is placed in a 64K EPROM chip, 27C512 is its proper code. To do anything useful with the ECU it needs to have an EPROM socket instead of the chip soldered in.
The differences between the ECUs (will talk about differences in the programs themselves later) are the following:
- 16F family for 1.1 and 1.2 SPI engines, single injector system
- 8F/18F for 1.2 old MPI (Punto / Palio 75), multiple but batch-fire injector system
- 18FD for 1.2 16V, multiple half sequential injector system
Otherwise they differ slightly inside in terms of the RAM memory size and some other bits that I do not care to know about. On the outside, apart from the injection differences they are practically identical and use the following sensors and outputs:
Sensors/inputs: RPM sensor, Water Temperature (WT) sensor, Air Temperature (AT) sensor, Throttle Position (TP) sensor, Manifold Absolute Pressure (MAP) sensor, Oxygen (Lambda) Narrowband Sensor
Outputs: Injectors, Ignition Coils (wasted spark principle), Stepper (Idle) motor, Charcoal canister, Fuel pump relay, RPM gauge signal, Warning Light signal
Reprogramming ECUs & Mapping
Most of the program running your engine is something I would call "solid state", that is, the program and tables (maps) are burned into the read-only EPROM chip. Only a few bits sit in the EEPROM (this is writeable) and can be changed in a relatively easy way (through the diagnostics connection). Here I am mainly talking about autocalibration parameters. Autocalibration is a very interesting and fascinating beast, more on that later.
So, the general scheme to reprogram one of these is:
- take the chip out and download its contents to your PC. For this you can use a Willem EPROM programmer, tons of which are available on eBay.
- "know" what to change in this EPROM file. This is the difficult part, a good starting point for this is the link provided above on disassembling HC11 programs.
- once we know where the interesting tables/maps are in the program we can change them (for now just say using any binary file editor) and then
(1) either write the new bin file to a fresh blank chip (using the same Willem EPROM programmer)
(2) or use the Ostrich EPROM emulator from Moates
The second option is of course the most interesting one. Using this emulator not only you do not have to re-burn the chip every time you change something, you can also run in in live mode, meaning it can be updated while the ECU works. This last part sometimes gets tricky: once in a while the ECU resets itself during such a live update effectively killing the running engine. So it is not a good idea to live update the emulator while the engine is at high loads.
The one fiddly bit one has to remember about when staring on the remapping adventure with EPROM chips is that the ECU program contains a checksum check of the EPROM data. Any change to the EPROM contents will invalidate this checksum and the ECU will conclude that there is an EPROM error. This may result (depending on the version of program) in the ECU refusing to start the engine, or it will start the engine but will keep the Injection Warning Light on. The solution is to switch this checksum check off by changing one of the bit flags in the EPROM file itself (yes, you guessed it, you have to find that bit too).
Making the Process More Civilised
Editing EPROM files with binary editors has obviously certain inconvenience factor. What you do instead is use TunerPro and/or TunerPro RT. The RT version can upload the changes in the EPROM file directly to the EPROM emulator. It can also do live updates and it can also live trace cells in maps based on the connection it makes to the ECU through the diagnostics cable. Suppose that after analysing the EPROM file you figured out that a fuel map is of size 16x16 and is placed at address hex 0
As said, you can do live updates to the the emulator while you edit the tables. For that Tuner Pro RT has to be used and switched into emulation mode (otherwise you can only upload a complete file to the emulator and this effectively resets the ECU). What you still would love to have is to be able to trace cells in tables while the engine runs to show you which values were just used. This is also possible, but I have not yet tested it. For our ECUs Tuner Pro RT beta 5.0 is needed and a IAW diagnostics connection definition for it. Luckily there is one available (since recently), look on the Tuner Pro website for file named Lancia_v1_1.adx. This file is said to work with all IAW HC11 based ECUs. However, I looked into it, and as much as I can see that it in principle should, there are some minor mistakes in it (from the top of my head the ignition advance formula is wrong for our ECUs). I have not had time to play with it yet and for my purposes I actually use a small quickly hacked Java application of my own for live mapping. Anyhow, in theory, after hooking up the .adx file to Tuner Pro RT the only thing left to do is to link the x and y axis of the tables to live ECU parameters and the cell / table tracing is ready. Exactly as you have with all those facncy MS and other stand alone ECU tools. I am promising myself to try out this thing with Tuner Pro and also correct this .adx file to work correctly with our ECUs.
Bootstrapping the Disassembly/EPROM Analysis Process
OK you say, but how the feck am I supposed to know what is in these EPROM files. If you want to take the lazy way, you can try using the WinOLS program (sorry, no link, I am too lazy and do not care for this program) that tries to find maps in EPROM images simply by guessing it out of the shape of the data in the image. Guessing means testing it out, and if the program/you is not right you can get interesting ECU behaviour, including engine damage.
The other, more proper, but more difficult way, is to disassemble the program and try to figure what it is doing. The link at the top gives actually a good tutorial on how to do that. For our ECUs the great help is the diagnostics interface definition (16F Technical Documentation). What I did is I first located the diagnostics (serial communication) routine in the program. To help you with this looking for the ISO code string in the program is very helpful. Once the diagnostics code have been identified we can see where the injection times, ignition advance, rpm, etc. are stored, because from the technical documentation we know what the diagnostics should give on what request. Once you know where for example the ignition advance is stored, you can try to see how this gets calculated.
Having said all this, for those who got excited already, I need to destroy your day a bit. It took me close to 2 years of some of my spare time to analyse and experiment with the ECU to fully dissect the 8F/18F program. This is also the reason why I am not that eager to share too much of this, so that eBay will instantly become full of modified programs. But, for the brave ones that want to try things out I attached some images to this post, compliments of the Polish Centomania forum :worship:.
In the next parts I will try to give you a general description of how the ignition system works, the fuelling system, and autocalibration. The idle control code is still a little bit of a mystery to me though. And then perhaps a few insights on how I went about convincing the 18F program to understand what a turbo is
Attachments
Last edited: