ECUflash EvoScan and EcuFlash tuning

[_Madman_]

We have these new kids on the block so I decided to make one thread that gathers all the information about them in one place.

As of now, the latest version of EvoScan (EvoScan OBDII Mitsubishi MUTII DataLogger Scantool) is 2.5, and the latest version of EcuFlash (EcuFlash - OpenECU) is 1.38

Let’s look at the EvoScan first

EvoScan is a dataloging software that you can buy for around 30$. It was used mostly by Evo and Impreza crowd, but it has also been verified to work on some DSMs.

The 97 (metal) and 98/99 (plastic) DSM ECUs can be logged with a sample rate of 70-110 samples/sec using Mitsubishi/EFI settings, with [email protected] and [email protected] Both 97 and 98/99 ECUs can be logged with Hybrid settings as well, with [email protected] and [email protected] Dsm-onster reports (http://www.dsmtuners.com/forums/tun...-evoscan-ecuflash-tuning-3.html#post151651614) that some of the pre-97 ECUs can be logged at sample rates of ~100 samples/sec as well

I had trouble achieving acceptable data rates or connect to older ECUs though, so I’m still investigating.

You can also log ABS ECU with EvoScan, but in order for it to work you need to get a cable without pin 9 from Limitless. I’m not sure about how accurate the data from the ABS ECU is on DSMs though. I know I can connect to ABS ECU, but so far values were wrong for my 98/99 ECU, 96 ABS combination. Might be that my ABS ECU is fried though, because ABS light is on all the time.

In order to use EvoScan, you need to connect your laptop to the car via the black large OBD2 plug only, if you have two plugs on your cable, the second one is for EcuFlash.

EvoScan can also read and clear Diagnostic Trouble Codes and it has Actuators for injectors, fuel pump, some solenoids etc.

Now the EcuFlash

EcuFlash is free flashing software that allows you to read, modify and write ROMs to ECUs. So far mainly used by Evo and Impreza crowd, seems it has finally gained ability to flash 98/99 ECUs as well. GSXDNA in (http://www.dsmtuners.com/forums/tuning-engine-management/307561-new-ecuflash-1-38-2g.html) thread reports that he has managed to successfully flash the 99 ECU. Unfortunately, as it turns out, only the stock ROM can be flashed back for now (http://www.dsmtuners.com/forums/tun...14-evoscan-ecuflash-tuning.html#post151637356), there is probably a checksum that doesn't allow to flash back modified ROM easily. It also seems that there are problems with (early)98 ECUs, so you need a 98(late)/99 ECU to be able to read it.

In order to read or write the ROM you will have to connect to your car using both plugs on the diagnostic cable, OBD2 and the Flash plug.

Flash plug socket is only available on 98/99 cars as far as I know. If you swap the plastic ECU to an older car, you can add the socket or connect to ECU directly via pin 79 as reported by Ceddy in (http://www.dsmtuners.com/forums/tun...561-new-ecuflash-1-38-2g-2.html#post151634961) thread, but you still need an 98/99 ECU!!! So far I don't have information that would say that 97 ECUs are flashable.

Pinouts for 2G can be found here: (http://www.dsmtuners.com/forums/articles-tuning-ecu/281763-2g-turbo-ecu-pinout-w-wire-colors.html)

The 98/99 ECUs are based on H8 processors. Based on EcuFlash output GSXDNA posted (http://www.dsmtuners.com/forums/tun...07561-new-ecuflash-1-38-2g.html#post151604992), it must be H8/539F model. Here is the datasheet of the actual processor (http://www.xtreme3s.net/H8500/H8 539F.pdf)

Ceddy in (http://www.dsmtuners.com/forums/tuning-engine-management/307561-new-ecuflash-1-38-2g.html) thread said, that Evo crowd has been learning the ROM contents of their ECUs using IDA disassembler (Hex-Rays IDA Pro Disassembler: What's new Page - version 5.3) which can be downloaded for free if you use it for noncommercial purposes. So it might be possible to learn what DSM ECUs do, the same way. I don’t know if disassembling a ROM is legal though, and if you need additional data to do so. If you know something more, let me know.

You can also learn a lot from ROM if you just look at it via HEX editor like (Freeware Hex Editor XVI32)

A word of warning, if you are going to swap 96 ECU to 98/99 then you need to compensate for the CAS. 97/98/99 CAS is on the opposite side of the engine head, so signal is inverted, you have to swap plug wires and injector pins to compensate, here is what I did (http://www.dsmtuners.com/forums/tun...07561-new-ecuflash-1-38-2g.html#post151631922). I'm not 100% sure I didn't messed up, but the car runs fine so 99% that it's OK

I'm also posting this link about all (most) available DSM ECUs for a reference (Eclipse Talon Laser Galant 3000GT Stealth ECU ID Reference).


Additional information and uncertainties regarding data logging with EvoScan

I am only starting to learn the datalogging so I will try to list all the options you can log with the EvoScan and what I think they do. So please send me PMs and/or post here if you know that the description is wrong, that option doesn’t work on DSM ECUs or is calculated incorrectly. I hope we will be able to gather the ultimate tuning list this way real fast.

Injector sizing
One of the things that EvoScan doesn't detect automatically is injector sizing. By default it leaves it at 513. From discussion at (http://www.dsmtuners.com/forums/tun...561-new-ecuflash-1-38-2g-2.html#post151634961) it seams that it's best to enter the real value of the injectors you are running. Stock 2G-T and 1G-T/MT would need 450, stock 1G-T/AT would need 380. But please look at the dsm-onster warning below (http://www.dsmtuners.com/forums/tun...14-evoscan-ecuflash-tuning.html#post151635786), and do report back if you find out anything more.

Logging options
The EvoScan allows you to log following options:

Throttle position sensor:
Logs how open or shut the throttle valve is. I have yet to see a DSM where it displays less than 12% with accelerator fully released, so values of 12-100 seems to be normal. You can tweak the formula so that it starts from 0% if it bugs you.

Engine RPM:
Self explanatory.

Battery level:
Displays how much juice the ECU is getting, 13-15 is OK, anything below or above is probably bad.

Airflow/Rev:
------no idea------

Coolant Temp:
The temperature of the coolant, not sure from which sensor, I have a feeling that it’s from the one in engine block, although EvoScan says it’s from radiator.

Air Temperature:
Seems to display temperature of the air under the hood, but not after Turbo and intercooler

MAF Air Temperature Scaled:
Usually around 2 deg higher than air temp, could be under the hood temp as well

Coolant Temperature Scaled:
------no idea------

Timing Advance:
The timing advance in degrees, some guidelines of what to expect would be great. If someone knows the stock maps they could be a good reference point. As far as I know there are different maps for high octane and low octane operations and ECU can interpolate between them depending on knock. *my speculation*

Air Flow:
------no idea------

Barometer:
The barometric pressure that ECU sees.

Target Idle RPM:
------no idea------

Fuel Trim Low:
------no idea------

Fuel Trim Mid:
------no idea------

Fuel Trim High:
------no idea------

O2 Feedback Trim:
Supposedly the percent of fuel that ECU adds or subtracts from standard fuel map depending on O2 sensor response in closed loop.

O2 Sensor:
First O2 sensor, useless for tuning as it’s a narrowband and is used only during closed loop. Displays voltage that should be floating on idle and get saturated under heavy acceleration.

O2 Sensor 2:
Sensor behind the cat, shows constant 0v on my car all the time, although it’s there.

Speed:
Doesn’t seem to work on (late)97 and floats even when car is standing still on my 96 car with 98/99 ECU.

Still, 98GSXtreme07 reports that he had no trouble logging this parameter and that it's pretty accurate. He used Mitsubishi setting.

Injector Pulse Width:
------no idea------

Injector Duty Cycle:
------no idea------

Fuel Consumption:
Calculated value. Depends on duty cycle, rpm, injector pulse width, speed and other variables. If one of them is wrong, this one is wrong.

Gear:
Calculated value from speed and RPM’s

Air Volume:
------no idea------

(Boost) MAP:
Boost pressure, I don’t know how accurate it is.

JDM MAP:
Same as above but for JDM’s?

Wide Band AF:
Data from external wideband attached to serial port of your laptop.

Knock Sum:
*

ISC Steps:
------no idea------

Crank Signal Switch:
------no idea------

Idle Position Switch:
Probably the sensor that tells the ECU that you have fully released the accelerator.

Power Steering Switch:
*

AC Switch:
*

AC Relay Switch:
------no idea------

Inhibitor Switch:
------no idea------

AFRMAP:
------no idea------

Load Calculated:
------no idea------

Load11bit4:
------no idea------

ECU Load:
Variable that displays the load of your engine, required for most graphs

Injector Latency:
------no idea------

Load MUT 2 Byte Mod:
------no idea------

RPM MUT 2 Byte Mod:
------no idea------

Air Flow MUT 2 Byte:
------no idea------

Estimated g/Rev:
------no idea------

Estimated Lbs/Min
------no idea------

Estimated HP:
Calculated HP, could be pretty accurate if you set up all the params like vehicle weight, gear ratios, etc, etc.

Estimated TQ:
Same as above, but torque

E1 RAM:
------no idea------

E4 RAM:
------no idea------

Knock Voltage:
On DSM you should look at Knock sum, this is meaningless

Octane Level:
This might indicate if youe ECU is switching to lower octane fuel map because of excessive knocking.

knock_adc:
------no idea------

knock_base:
------no idea------

knock_var:
------no idea------

knock_change:
------no idea------

knock_dynamics:
------no idea------

knock_flag:
------no idea------

EGR Temp:
------no idea------

Wastegate Duty Cycle:
------no idea------

Load Error:
------no idea------

WGDC Correction:
------no idea------

ZTX…/LC1…:
External wideband data

Custom:
Custom requests to ECU



As you see there are ton of things that I don’t know yet, so if you know something, let me know. I will update the post so that we can have one place where to look for settings and formulas that are correct for our cars. I will update the post as soon as I discover something new as well.

 

[dsm-onster]

Great stuff. I don't know how much of it is accurate since I'm much lower on the learnign curve than you right now . Looks right to me. This is a great way to put all the meat in one place.

Dumb question. . .The 1997s don't have the reflash plug. But does that mean that they arn't reflashable? Has someone wired in a 1998-1999 reflash plug, just to see?

Also stock fuel pressure for the m/t 1g is 37 (not a/t) psi not 43.5 psi which injectors are rated for as industry standard. Won't this need to be corrected for in the injector sizing field? For 1g cars with stock fuel pressure, the 450cc injectors actually only flow 415cc. 450cc X sqrt( 37psi / 43.5psi ) = 415cc

 

[_Madman_]

EDIT: Yes, you can add a flash plug to older cars. This post was sounding that you can flash 97 ECU. Sorry, fixed.

 

[dsm-onster]

Yes you can reflash the 1997 ecu? WOW!

So to summarize the potential 2g ecu tuning options. That means that only one year 2g ecu is not reprogramable. 1996 is not flashable, does not have an eprom, nor does it have a good logging rate, which renders EvoScan practically useless. 1995 has the eprom which can be changed and 1997-1999 can be reflashed directly. You'll need to wire in the plug for the 1997, but the logging output is as fast as a 1998-1999. And all reflashable ecus log as fast as a 1995 with dsmlink. All 2g ecus swap in directly, except you'll need to tackle the 1995-1996 inverted cas and firing order issues. EvoScan with the recommended cable is by far the best option for logging a 1997-1999 ecu. The data sample rate is the best. And it shows a knock sum. ECUFlash is freeware that uses the other plug on the EvoScan recommended cable to flash 1998-1999 ecus since they have a flash plug. And, with a wire-in of that same plug for a 1997 car, you can use ECUFlash for the 1997 ecu.

We need to get those rom images disassembled!!!!

 

[delta448]

I've been following along with the other couple of scan/flash threads, my understanding isn't at the level to really be of any great help right now, (researching as much as I can, would appreciate any and all links to more info) but I'm very interested in the possibility of successfully reflashing a 97 ECU.

Does anyone know, -are the chipsets nearly the same comparing the 97 metal case to 98+ plastic cased ECUs? From my understanding, the 97 connects to EvoScan at the same speeds as 98+...

Has anyone ever tried adding the additional flash plug to a 97 with success at establishing a connection? I don't yet have EvoScan/EcuFlash and my ECU doesn't have a flash plug added yet... but I'd be willing to offer my help if its very likely at all to be workable. Just please bear with my ignorance, and be specific as I attempt to learn. I want to jump onboard here if I'm able to help.

Like many others out there, my budget's tight, DSMLink or AEM is looking out of reach at the moment, and a re-flash solution would surely offer as much tuning capability as I'd likely ever need. I feel bad for all the '96 owners, it looks like they may be the only 2G owners still without a possible solution for an easy setup capable of ECU ROM modification.

edit: Matt posted as I was typing... can anyone else confirm for he and I?

 

[_Madman_]

No-no-no! 97 is not reflashable as far as I know, you need the plastic case ECU which is 98/99. What you can do is add 98/99 ECU to your car and make a socket for pin 97 of ECU connector, then you will be able to reflash you 98/99 ECU from a car that didn't had flash plug originally.

I will take a look to make sure the main post doesn't leave impression that you can flash 97, because so far no one have found a way. I'm really sorry for not being clear, it's Friday...

 

[delta448]

Madman, do you know what the differences are between a 97 and 98+? Do they use different processors or memory addresses? Would it be possible to physically modify the 97 boards to match the 98+?

 

[dsm-onster]

No-no-no! 97 is not reflashable as far as I know, you need the plastic case ECU which is 98/99. What you can do is add 98/99 ECU to your car and make a socket for pin 97 of ECU connector, then you will be able to reflash you 98/99 ECU from a car that didn't had flash plug originally.

I will take a look to make sure the main post doesn't leave impression that you can flash 97, because so far no one have found a way. I'm really sorry for not being clear, it's Friday...

No problem. 1998-1999 ecus are going for $50. Have a beer.

You must be logged in to view this image or video.

It's Friday.

Since 1997 ecus are not editable, can you still cut on/off the fuel pump, individual injectors, fuel pressure solenoid, wastegate solenoid set base timing without grounding, radiator fan high, radiator fan low with EvoScan? My brother's walbro/AFPR setup sucks for cold starting. We'd like for the pump to cut on when the ignition is on. I did this with my 1g dsmlink setup and it greatly saves starter wear.

 

[Gamble97]

Is the 98-99 ecu a direct swap with a 96 car or do you have to change anything? (like firing order etc)

 

[_Madman_]

Is the 98-99 ecu a direct swap with a 96 car or do you have to change anything? (like firing order etc)

You can swap them, but CAS is inverted so you need to fiddle with few things, here are the pictures of what I did (http://www.dsmtuners.com/forums/tun...07561-new-ecuflash-1-38-2g.html#post151631922)

Madman, do you know what the differences are between a 97 and 98+? Do they use different processors or memory addresses? Would it be possible to physically modify the 97 boards to match the 98+?

I think they both might be H8/5xx, but only the later ones area easily flashable. I could tell you more if I could get my hands on CPU serial number of 97 ECU.

Theoretically all ECUs should be flashable, but you might have to desolder parts of them. And that's PITA.

Since 1997 ecus are not editable, can you still cut on/off the fuel pump, individual injectors, fuel pressure solenoid, wastegate solenoid set base timing without grounding, radiator fan high, radiator fan low with EvoScan? My brother's walbro/AFPR setup sucks for cold starting. We'd like for the pump to cut on when the ignition is on. I did this with my 1g dsmlink setup and it greatly saves starter wear.

Well, you can activate all the actuators, log, read and clear DTC, but that's it.

It will be way easier to tune if you have SAFC though, as you will have very accurate data and plenty of it. The maps the EvoScan can draw are awesome as well.

I added en example of (engine load/rpm/timing advance-max) graph straight from the EvoScan, logged from 97 GST.

You can even load reference maps in the lower part if you can get them from your ROM or 98/99 ROM, as they should be equal.

 

[dsm-onster]

I can get the serial number. My brother's 1997 AWD talon is right in my yard now...

This evoscan is awesome !!! So I can set his pump to always come on when the ignition is on, regardless of being hooked up to a laptop/evoscan? Or is that not going to happen. . . Either way, evoscan is better than EVERY logging program out there. Even the obd1 guys should be jealous. . . Unless evoscan works well with dsm obd1.


EDIT: batteries in camra are dead. Give me 20 minutes. I'll take a pic of the insides, too. Maybe that can help us determine if the 1997 is fairly easy to make reflashable.

 

[bane3d]

Well, my 97 gsx is down right now and I don't see it being back up for at least a month, maybe 2. If you can promise me that you won't fry it, I can pull it and ship it to you for testing if you'd like.

d

 

[dsm-onster]

Pics of the 1997 ecu with sial number. This is a august 2006 car, 1997 model year:

 

[Ceddy]

Wow, lots of good info.

I have bad news on the reflashing end of things.

I contacted Colby the creator of EcuFlash, I basically said I could read my 98 ecu, but couldn't flash it.

His reply was:

This is a known issue. The H8 kernel is unable to flash until I can figure out why the H8 is setting a flash error lockout bit before my kernel loads. If I can fix this, everything will work. Unfortunately, I have spent an inordinate amount of time on this already, without success.

Colby

So flashing isn't working for us right now, hopefully this will be fixed in the future.
I've heard that a commercial company has been able to flash the Evo 5/6 ecu, which use the same H8 processor as 98-99s, so it is definitely possible.

 

[dsm-onster]

Damn! Hopefully the info doesn't get locked down by a capitalist, just to make money.

 

[_Madman_]

Well, my 97 gsx is down right now and I don't see it being back up for at least a month, maybe 2. If you can promise me that you won't fry it, I can pull it and ship it to you for testing if you'd like.

d

Well, my car is down as well DSMs...

But, no, thanks, I think shipping is way too painful I live on the opposite side of the pond, so getting anything across is a real PITA... Trust me I know

It's better if we just find the CPU serial number so we can understand which CPU family it actually is, or if we can find someone who knows anything about 97 ECUs.

Or maybe we can just try to read the ROM by using EcuFlash and extra wire for pin 79? I hope it won't fry the ECU...

Pics of the 1997 ecu with sial number. This is a august 2006 car, 1997 model year:

I tried to look up the serials, but the Google seems to come up empty-handed. As far as I understand the CPU is the (6371FEF766722) chip.

By the pin count, it seems to be the closest match to my old 96 JDM ECU CPU I have on the table right now. Pictures can be found here (http://www.dsmtuners.com/forums/newbie-forum/307384-injector-plug-swap.html#post151605331). The CPU on my ECU seems to be the one that is overexposed in the first picture, part number MH6311F.

Do you have another serial under the (6371FEF766722) sticker, like MH/MD/M?. Maybe that will come up with some search results...

 

[_Madman_]

Wow, lots of good info.

I have bad news on the reflashing end of things.

I contacted Colby the creator of EcuFlash, I basically said I could read my 98 ecu, but couldn't flash it.

His reply was:


So flashing isn't working for us right now, hopefully this will be fixed in the future.
I've heard that a commercial company has been able to flash the Evo 5/6 ecu, which use the same H8 processor as 98-99s, so it is definitely possible.

I think I saw some info about lock out in the H8 specs, but there is so much info I just can't remember where. Since you know where to send the info, maybe you could send a link to the spec we have in this thread (http://www.xtreme3s.net/H8500/H8 539F.pdf), maybe that will help... Or, if you can PM me his contacts, I might try to contact him and search for additional data that might help him write the software for DSMs...

I will try to do my best here as well, I'm only software developer, but I hope I'll be able to find something that might come of use in this flashing thing. I have partially understood the way the program loads on H8 processor, now I'm trying to understand how the memory behaves. The specs are good and the information from (Disassemble a Bosch ME7.5.5 with IDA Pro) is helpful as well, but I can't figure out which mode exactly is our ECU supposed to work, only that it's in one of the 'Extended Maximum' modes, as the standard ROM is bigger than 64KB... (see the picture about memory layout below, taken from the specification)

I know for sure that in order for H8-539F to work it must read the first 4 bytes in ROM (RESET or startup interrupt), take the second byte as the 64KB page offset and bytes 2/3 as the function offset, and start executing function there. The start-up function must load the data offsets then (to know where most of the things like different fuel/timing variables most likely are stored) and then proceed with the actual execution.

 

[Ceddy]

Pics of the 1997 ecu with sial number. This is a august 2006 car, 1997 model year:

Your 97 ecu is identical to my 95 non-eprom ecu.
Both have board # JE331B719C.
They just have different code revisions on the CPU.
The CPU is a MH6371F-ED04, a 68HC11 type like the 1Gs.
The EVO 4s also use the MH6371F.
This chip is not flashable.

You must be logged in to view this image or video.

You must be logged in to view this image or video.

 

[Ceddy]

I think I saw some info about lock out in the H8 specs, but there is so much info I just can't remember where. Since you know where to send the info, maybe you could send a link to the spec we have in this thread (http://www.xtreme3s.net/H8500/H8 539F.pdf), maybe that will help... Or, if you can PM me his contacts, I might try to contact him and search for additional data that might help him write the software for DSMs...

I will try to do my best here as well, I'm only software developer, but I hope I'll be able to find something that might come of use in this flashing thing. I have partially understood the way the program loads on H8 processor, now I'm trying to understand how the memory behaves. The specs are good and the information from (Disassemble a Bosch ME7.5.5 with IDA Pro) is helpful as well, but I can't figure out which mode exactly is our ECU supposed to work, only that it's in one of the 'Extended Maximum' modes, as the standard ROM is bigger than 64KB... (see the picture about memory layout below, taken from the specification)

I know for sure that in order for H8-539F to work it must read the first 4 bytes in ROM (RESET or startup interrupt), take the second byte as the 64KB page offset and bytes 2/3 as the function offset, and start executing function there. The start-up function must load the data offsets then (to know where most of the things like different fuel/timing variables most likely are stored) and then proceed with the actual execution.

I found this info on one of the boards:

tell me about it, now we know why it took colby so long to even release the read routines.

Some interesting things to note about the H8/539F.

The PROM mode memory map runs from 0000-1ffff.
The MCU mode memory map runs from 0000-2ffff.

When we read the ROM, we get the information from H10000-h2ffff.

The information in h0000-h3fff is identical to h10000-h13fff.

The information from h3fff-hffff is not readable in prom mode.

This means when we see an op code targeting that region, it really targets a memory location that is not in the file that we read.

This also means that when we see an op code that targets h1ffff, it really targets hffff in our file.

See Hardware Manual P.509(P.523 in pdf file) Table 18-4

The H8 with its memory modes makes things complicated.

I contacted Colby thru the Bug Report in EcuFlash.
I suspect any info we can find he already has.
I think the problem is the Mitsu kernel is not allowing his kernel to load, or possibly the kernel is being locked out because of a memory mode that is being used.
The Evo 5/6 and 2000+ Eclipse are all waiting for H8 support also, so hopefully someone will make some progress.

 

[dsm-onster]

Is there another difference? The 1997 ecu logs much faster than a 1995, right?

 

[_Madman_]

I found this info on one of the boards: (...text...)

There was one bit that was locking part of the address space, I will try to look it up in the spec. If the bit is set you'll get an error on read/write attempt in some memory areas.

I will also try to understand the memory mangling you described. So far the entry point really seems to mismatch and/or point to the wrong address.

One question concerning failed flash though, have you tried test writing your stock ROM back? Is it the problem with all ROMs or only the modified ones? I noticed that GSXDNA was flashing back his unmodified ROM.

I also noticed that ECU numbers are different for some 98 ECUs (Eclipse Talon Laser Galant 3000GT Stealth ECU ID Reference). GSXDNA had a 99 ECU, so it can only be plastic one. But some 98 cars have early ECUs, the same ones that goes on the late 97's and is very similar from logging standpoint with EvoScan. It might be that the ECU in 97(late)/98(early) are also H8 ECUs, but are locked compared to 98(late)/99 ECUs. Which model do you have?

Is there another difference? The 1997 ecu logs much faster than a 1995, right?

Turns out the late ones. The cars I logged were both late 97. I would like to hear more on this issue as well.

A picture of how 98(late)/99 ECU looks like:

 

[dsm-onster]

Turns out the late ones. The cars I logged were both late 97. I would like to hear more on this issue as well.

Well, we'll find out. My brothers car is an early 1997 and we have recommended cable being shipped right now.

 

[98GSXtreme07]

Huh... For some reason, not sure if it was because my other GSX was newer or ECUFlash was older, but I can't get EcuFlash to work anymore. It now times out and says "not responding". It worked on my other GSX and would read the ECU but on this GSX it just won't read. I can only get this far and as soon as I press "read" it doesn't respond. Any idea's?

<a href="http://imageshack.us"><img src="http://img412.imageshack.us/img412/2978/errorns5.jpg" border="0" alt="Image Hosted by ImageShack.us"/></a>

 

[_Madman_]

Here are few interesting things from H8 spec:

Page 1:
A ZTAT™* (Zero Turn-Around Time) version of the H8/539 is already available, with on-chip
ROM that can be freely programmed by the user. However, the PROM in the ZTAT version can be
programmed once only. Flash memory, on the other hand, is electrically programmable and
erasable, so that it can be reprogrammed while mounted on the circuit board. Moreover, the
single-transistor structure of flash memory—in contrast to the two-transistor structure of
EEPROM—makes it suitable for large-capacity applications.

Page 2:
Memory
• RAM : 4-kbyte high-speed on-chip RAM
• ROM : 128-kbyte flash memory
(Eight large-block divisions, eight small-block divisions)

Page 4:
Operating modes Seven operating modes
1. High-speed 16-bit bus modes, starting in 2-state 16-bit mode at reset
• Expanded minimum mode (mode 1)
• Expanded maximum modes (modes 3 and 4)
2. Low-speed 16-bit bus modes, starting in 3-state 8-bit mode on reset
release
• Expanded minimum mode (mode 6)
• Expanded maximum mode (mode 5)

Page 499:
Flash memory contents can be erased and reprogrammed up to 100 times.

Page 515:
H8/539F branches to H'F380 in RAM area and executes user program downloaded into RAM


It seems that information Ceddy found is indeed correct, and there's more to all this stuff than it seems.

I'm not sure if page 515 is talking about the actual bootup, but if it is, then it seems that real program code is copied to the memory area we don't have in our ROM, then CPU starts executing there.

If I understood correctly, the ROM that can be downloaded/flashed will be only 2/3 of the code we have on our ECU. We can duplicate the first page (64KB) from ROM to the beginning of the ROM file, leave first 0x3E00 bytes intact. but then we have to figure out what is copied in the rest (0x3E00-0xFFFF) bytes, only then we will have full memory layout of our ECUs.

 

[_Madman_]

Huh... For some reason, not sure if it was because my other GSX was newer or ECUFlash was older, but I can't get EcuFlash to work anymore. It now times out and says "not responding". It worked on my other GSX and would read the ECU but on this GSX it just won't read. I can only get this far and as soon as I press "read" it doesn't respond. Any idea's?

<a href="http://imageshack.us"><img src="http://img412.imageshack.us/img412/2978/errorns5.jpg" border="0" alt="Image Hosted by ImageShack.us"/></a>

Could be that the ECU is different. So I understand you do have a flash plug in your car?