First Flashed DSM ECU! (98/99 Flashing FAQ)

[_Madman_]

Originally Posted by draculia

I swapped pins 1, 2, 14, and 15 for the injectors per RRE's CAS swap tutorial. For the coils I swapped pins 10 and 23.

Like here: RRE Instructions

It didn't seemed right when I tried

Hmm, I just noticed RRE has waveforms from both sensors: RRE 1G CAS In a 2G Wave Forms

[ed_GST]

Went to the car en checked the cruise control module
Since i will need the pin for the flash port

Pin 10 Yellow/Red
Pin 11 Blue/Red

I will use pin 10 since is the same size as pin 79 in the ECU harness

[draculia]

No no no, you're counting in the wrong direction, you're looking at pins 3 and 4. Pin 3 is also only used on automatics, but as you said the pin is the wrong size. Pin 4 goes to the TPS. Count in the opposite direction and you see pins 10 and 11 as red w/yellow stripe and red w/white stripe respectively.

Edit: Updated original post with correct wire colors.

[ed_GST]

Well i used as reference the Cruise Module itself

The upper row has a 13 in the lower 26, circled it but i don't know if you can notice

Do you have the diagram for this module ?
PM it to me or post it if you can

[draculia]

Yes, the module is correct, the side with the 6 big pins is where you start the count from, with pin 1 being the upper left. Now if you look at the second pic of the connector that you posted you will notice that the left side has only 4 big pins, which is to say that the upper left pin is pin 13 in that particular pic.

[_Madman_]

If someone wants to see axes with other ROMs you can try to adjust the axis addresses like so:

Target ROM Reference Offset
20560010 = 20550011 +0x920
23640004 = 20550011 -0x8A0

The 23640004 will most likely go wrong somewhere, but it might work. You can use calculator in scientific mode to get the new addresses by subtracting or adding to ones from the 20550011 definition.

[Ceddy]

Originally Posted by _Madman_

If someone wants to see axes with other ROMs you can try to adjust the axis addresses like so:

Target ROM Reference Offset
20560010 = 20550011 +0x920
23640004 = 20550011 -0x8A0

The 23640004 will most likely go wrong somewhere, but it might work. You can use calculator in scientific mode to get the new addresses by subtracting or adding to ones from the 20550011 definition.

Nice work.

I have been making some good progress with the OBD2 code.
Hopefully I'll have a patch for the OBD2 Readiness and Completion Tests, soon.
For guys that have problems with Emissions.

There is also an OBD2 RequestId that gives airflow in Lbs/Min, be nice to add that to MUT, I don't think there is MUT RequestId that gives a normal airflow reading.

[Burnett03]

I have a black 2g ecu but the numbers are worn off so i can't read any of them.. How the hell do you open up these plastic ecus?

[Burnett03]

Edit, nevermind i see the black tabs to remove it now. Turns out i have the ECU that is needed to flash.. I currently run ECMLINK so i really have no use for it but still neat that i have one!

[draculia]

OK so we know that I'm new at this, but I'm still having issues with things not editing correctly and RPM and Load showing gibberish. I opened the rom with a hex editor and I see the term EM2055 way down. When I was looking at the addresses in Ceddy's definition xml I noticed some of them are beyond what shows up in my rom. The last address in my rom is 1ffff. I have no idea what any of that means really, I'm just starting to explore things. I noticed that the 'E' in EM2055 is located at 1f2fe, and in Ceddy's definition it shows 2f2fe for the location to look. I tried editing Ceddy's def to 1f2fe, but that just made things unreadable. Anyways, feel free to tell me what I'm looking at, cause I'm and idiot

[_Madman_]

You need to add 0x10000 to all addresses, I guess it's because of the fact that the H8 processor is a little bit complex from memory point of view.

Do you need def for some other ROM?

P.S.: Is it just here, or it takes an hour to open new page on DSMtuners?

[spooled_u]

Originally Posted by _Madman_

P.S.: Is it just here, or it takes an hour to open new page on DSMtuners?

It's 5:48 AM here on the East Coast and Tuners is loading quick. However, as the day progresses it gets worse.. much worse. Last night I had a hard time searching and navigating anywhere.

You're not alone...

[rstchris]

Hey, MADMAN! when you come up with cool features like compettetors have will you be selling the goods to us? I'm interested in injector sizing and launch control and maybe boost by gear (only 1st and 2345 can be same) at this time. I will have a cable asap and have the ecu now.

[_Madman_]

It seems that only one who can make something like this happen is Ceddy So he can better answer your questions.

[Ceddy]

Originally Posted by rstchris

Hey, MADMAN! when you come up with cool features like compettetors have will you be selling the goods to us? I'm interested in injector sizing and launch control and maybe boost by gear (only 1st and 2345 can be same) at this time. I will have a cable asap and have the ecu now.

Injector Sizing and Latency is done. My 1150 cc/min idle like stock.

A stationary RevLimit should be easy to add. (Launch Control)

Boost by Gear is fairly complex coding wise, and is beyond my abilities. Maybe some of Tephra's code could be adapted. I'm trying to get all the little stuff done before tackling the big stuff.

[draculia]

My rom id is 20550010. Would the fact that I have an older revision be the reason why I don't get the correct axis labels on the maps? Should I have any issues if I flash revision 0011 to mine?

[m_0ney_pit]

check the pc board against the board ceddy wrote the definition for if its the same board (revision C I believe) then its probably ok to cross flash to a different rom revision of the same year(10<->11). I believe its been said before its probably not ok to cross flash years though.Has any one heard of the 99' ecu having the H8-FA processor vs the 98 with the H8-F? whats the difference?

The thing is I don't think anyone knows 100% if its ok until it gets tried and so far no one has tried what you are wanting to do.

I'm not responsible if you brick the ecu.

Originally Posted by draculia

My rom id is 20550010. Would the fact that I have an older revision be the reason why I don't get the correct axis labels on the maps? Should I have any issues if I flash revision 0011 to mine?

[_Madman_]

Originally Posted by draculia

My rom id is 20550010. Would the fact that I have an older revision be the reason why I don't get the correct axis labels on the maps? Should I have any issues if I flash revision 0011 to mine?

So you mean they really differ?!!

Can you upload your ROM somewhere? Finding out axis offset with actual ROM would be pretty easy. It's possible to translate from one revision to another via few simple operations, if you know the offsets.

What is bad, is that ECU flash uses the ASCII ID to identify ROMs, therefore if we have different revisions, they might not work with ECUFlash identified definitions and allow people to screw thing up.

[draculia]

Ok, I did a compare between 20550010 and 20550011 and found that about half of the rom is different. Most of the maps were off using Ceddy's definition for the 0011 revision, not just the rpm and load axis on the fuel and ignition maps like I though earlier.

Long story short, I decided to flash the 20550011 rom to mine. Now everything reads correctly, and it didn't seem to cause any issues.

Now only if my harmonic damper didn't decide to start falling apart, then I could play around some more with this.

[the_mork]

Besides launch control you can actually make a launch map which will stop you from driving through holes in your maps trying to get boost up at the line. It would take more code but it sounds like the drag racers love it.

Gear dependent boost control is actually not hard from a code standpoint on the evo8 ecu, it turned out that the ecu itself already had it but that it was defined incorrectly and set outside of an achievable range. I think it will take a lot more exploring before we know if the DSM ecu has that same sort of routine. Tephra just made it nice and (I think) added some other basic functionality.

I'm not sure how much time you spend looking at what has been done on the evo8 ecu but most of the things available have a fairly decent explanation of not only what it took to get it to work but also how it was found.

Does anyone know of any communities dedicated to earlier evos? I would think that the evo3-6 ecu work might be a useful parallel discussion.

Many people ignore it and it isn't a glamorous section but MAF scaling and size would be very useful for people wanting to run one of the larger MAFs and as well it is IMO very useful for pinning down a really good tune.

Knock control (RPMvsLoad, knock multiplier, etc) in order to help the people with phantom knock.

Periphery bits would be huge too for people who need to pass emissions.

I'm not running a DSM ecu so this list isn't actually a feature request just one guy's opinion on what is important if you're making a list.

[_Madman_]

It's quite possible that the code base is very similar for Evo and DSM ECUs. H8 ECU is optimized for C programming, so I bet they just had the code and compiled it to different platforms. Some things differ, but knowing that periphery bits, ECUID+Rev., and map styles are quite similar, I wouldn't be surprised if there is some extra code in there.

Great news about cross revision flashing! But still, do you have your original ROM somewhere?

P.S. Talking about Evo, that's actually a good idea. Their base maps are already tweaked for 16G turbos and bigger injectors, knowing that they (5/6) run the same ECUs they should be a nice source to take base maps from. Especially for 16G swaps.

Evo's (5/6) do have same compression ratio engines, right?

[draculia]

Originally Posted by _Madman_

So you mean they really differ?!!

Can you upload your ROM somewhere? Finding out axis offset with actual ROM would be pretty easy. It's possible to translate from one revision to another via few simple operations, if you know the offsets.

What is bad, is that ECU flash uses the ASCII ID to identify ROMs, therefore if we have different revisions, they might not work with ECUFlash identified definitions and allow people to screw thing up.

I emailed it to Ceddy.

I didn't know I had revision 0010 until I used Ceddy's updated definition which can show the revision number. I guess its not really and issue now though if flashing different revisions is ok.

[_Madman_]

Originally Posted by draculia

I emailed it to Ceddy.

I didn't know I had revision 0010 until I used Ceddy's updated definition which can show the revision number. I guess its not really and issue now though if flashing different revisions is ok.

It could help to write an automatic tracer that finds the maps. The more ROM images we will have, the easier it will be to find similarities.

20550011->20560010 only needs axis patching, maps are at the same locations. At least it seems so if you rename and update the 20550011 def file with 20560010 signatures.

It's quite possible your ROM matches EM2364 map locations, or some other. Or maybe the mystic EM2384 ROM, which is defined in ECUFlash, but no one has an image of it at all.

One more question, do you have an auto or manual car?

[draculia]

I believe this ecu came from a 98 gst manual don't know if it was cali or fed either

[shark]

Ceddy,
What changes to the IDA Pro tutorial do you do to make it work with the h8500 processor?
IDA Pro tutorial request - evolutionm.net

Like ram memory start and length?

And what version are you using?

Thanks
Red

[_Madman_]

AFAIK, only Ida Pro Standard or Ida Pro Advanced will work if you want to use Ida. One free alternative here: pgmfi.org • View topic - Hitachi H8/532 MCU Dump, need information - (Acura Legend)

You can look up the memory layout in processor data sheet here: http://www.xtreme3s.net/H8500/H8%20539F.pdf

Or just follow the attached image here: EvoScan and EcuFlash tuning

Ceddy says the ECU is in mode 4.

Concerning RAM/ROM, if you have to specify, you can load everything as RAM, because RAM is sort of upgraded ROM anyways That should work...

You can read most of the hardware stuff here EvoScan and EcuFlash tuning or just follow the hardware specifications.

Interrupt table (which leads to code) can be found at page 72 in the spec http://www.xtreme3s.net/H8500/H8%20539F.pdf

There should be 80 jumps to code at the beginning of ROM. All this stuff should be true for any H8/500 ROM including the DSM ECUs.

[draculia]

Just a small update. On the way to work today I tripped the CEL. I haven't pulled the code yet to see what it is, but I didn't have any with the 20550010 rom.

Edit: Ok so I pulled the codes. I had them for the speed sensor, injectors, fuel pump, baro sensor, and knock sensor. I didn't have any of these last night when I test drove it. I cleared them, but they came right back. I ended up flashing back to the 2055010 rom, and no CEL.

[_Madman_]

That's bad

EDIT: Oh, but did you disconnected the battery for 15 or so minutes so that ECU clears all the memory? It's quite possible that the learned data is kept somewhere outside the CPU, and the new one doesn't match the old one.

[draculia]

I did not since I'm at work and limited to the time I could mess around with it. I didn't want to endup stranded on the way home or something.

If some of the data is indeed stored elsewhere, wouldn't I have tripped the codes right away? Either way, it doesn't make sense to me why I had no codes yesterday, then a whole bunch today.

If I have time tonight I'll do a full reset and try the 20550011 again.

[_Madman_]

I think we should move to a unified XML structure for definition files.

My suggestion is to rename EM2055.xml Ceddy posted to 20550011.xml and replace following part inside:

<romid>
	<xmlid>EM2055</xmlid>
	<internalidaddress>2fefa</internalidaddress>
	<internalidstring>EM2055</internalidstring>
	<caseid>MD346675</caseid>
	<make>Mitsubishi</make>
	<market>USDM</market>
	<model>Eclipse</model>
	<submodel>GST FWD</submodel>
	<transmission>Manual</transmission>
	<year>1998</year>
	<flashmethod>mitsukernel</flashmethod>
	<memmodel>H8539F</memmodel>
</romid>

with:

<romid>
	<xmlid>20550011</xmlid>
	<internalidaddress>1021a</internalidaddress>
	<internalidhex>20550011</internalidhex>
	<caseid>MD346675</caseid>
	<make>Mitsubishi</make>
	<market>USDM</market>
	<model>Eclipse</model>
	<submodel>GST FWD</submodel>
	<transmission>Manual</transmission>
	<year>1998</year>
	<flashmethod>mitsukernel</flashmethod>
	<memmodel>H8539F</memmodel>
</romid>

Then delete all EMxxxx.xml files in OpenEcu\Rommetadata\Mitsubishi\Eclipse folder.

This naming scheme works and will save us a ton of trouble with different revisions in future.

I haven't verified if this doesn't affect flashing, but it shouldn't.