ECUflash First Flashed DSM ECU! (98/99 Flashing FAQ)

[Burnett03]

Edit, nevermind i see the black tabs to remove it now. Turns out i have the ECU that is needed to flash.. I currently run ECMLINK so i really have no use for it but still neat that i have one!

 

[draculia]

OK so we know that I'm new at this, but I'm still having issues with things not editing correctly and RPM and Load showing gibberish. I opened the rom with a hex editor and I see the term EM2055 way down. When I was looking at the addresses in Ceddy's definition xml I noticed some of them are beyond what shows up in my rom. The last address in my rom is 1ffff. I have no idea what any of that means really, I'm just starting to explore things. I noticed that the 'E' in EM2055 is located at 1f2fe, and in Ceddy's definition it shows 2f2fe for the location to look. I tried editing Ceddy's def to 1f2fe, but that just made things unreadable. Anyways, feel free to tell me what I'm looking at, cause I'm and idiot

 

[_Madman_]

You need to add 0x10000 to all addresses, I guess it's because of the fact that the H8 processor is a little bit complex from memory point of view.

Do you need def for some other ROM?

P.S.: Is it just here, or it takes an hour to open new page on DSMtuners?

 

[rstchris]

Hey, MADMAN! when you come up with cool features like compettetors have will you be selling the goods to us? I'm interested in injector sizing and launch control and maybe boost by gear (only 1st and 2345 can be same) at this time. I will have a cable asap and have the ecu now.

 

[Ceddy]

Hey, MADMAN! when you come up with cool features like compettetors have will you be selling the goods to us? I'm interested in injector sizing and launch control and maybe boost by gear (only 1st and 2345 can be same) at this time. I will have a cable asap and have the ecu now.

Injector Sizing and Latency is done. My 1150 cc/min idle like stock.

A stationary RevLimit should be easy to add. (Launch Control)

Boost by Gear is fairly complex coding wise, and is beyond my abilities. Maybe some of Tephra's code could be adapted. I'm trying to get all the little stuff done before tackling the big stuff.

 

[draculia]

My rom id is 20550010. Would the fact that I have an older revision be the reason why I don't get the correct axis labels on the maps? Should I have any issues if I flash revision 0011 to mine?

 

[m_0ney_pit]

check the pc board against the board ceddy wrote the definition for if its the same board (revision C I believe) then its probably ok to cross flash to a different rom revision of the same year(10<->11). I believe its been said before its probably not ok to cross flash years though.Has any one heard of the 99' ecu having the H8-FA processor vs the 98 with the H8-F? whats the difference?

The thing is I don't think anyone knows 100% if its ok until it gets tried and so far no one has tried what you are wanting to do.

I'm not responsible if you brick the ecu.

My rom id is 20550010. Would the fact that I have an older revision be the reason why I don't get the correct axis labels on the maps? Should I have any issues if I flash revision 0011 to mine?

 

[_Madman_]

My rom id is 20550010. Would the fact that I have an older revision be the reason why I don't get the correct axis labels on the maps? Should I have any issues if I flash revision 0011 to mine?

So you mean they really differ?!!

Can you upload your ROM somewhere? Finding out axis offset with actual ROM would be pretty easy. It's possible to translate from one revision to another via few simple operations, if you know the offsets.

What is bad, is that ECU flash uses the ASCII ID to identify ROMs, therefore if we have different revisions, they might not work with ECUFlash identified definitions and allow people to screw thing up.

 

[draculia]

Ok, I did a compare between 20550010 and 20550011 and found that about half of the rom is different. Most of the maps were off using Ceddy's definition for the 0011 revision, not just the rpm and load axis on the fuel and ignition maps like I though earlier.

Long story short, I decided to flash the 20550011 rom to mine. Now everything reads correctly, and it didn't seem to cause any issues.

Now only if my harmonic damper didn't decide to start falling apart, then I could play around some more with this.

 

[the_mork]

Besides launch control you can actually make a launch map which will stop you from driving through holes in your maps trying to get boost up at the line. It would take more code but it sounds like the drag racers love it.

Gear dependent boost control is actually not hard from a code standpoint on the evo8 ecu, it turned out that the ecu itself already had it but that it was defined incorrectly and set outside of an achievable range. I think it will take a lot more exploring before we know if the DSM ecu has that same sort of routine. Tephra just made it nice and (I think) added some other basic functionality.

I'm not sure how much time you spend looking at what has been done on the evo8 ecu but most of the things available have a fairly decent explanation of not only what it took to get it to work but also how it was found.

Does anyone know of any communities dedicated to earlier evos? I would think that the evo3-6 ecu work might be a useful parallel discussion.

Many people ignore it and it isn't a glamorous section but MAF scaling and size would be very useful for people wanting to run one of the larger MAFs and as well it is IMO very useful for pinning down a really good tune.

Knock control (RPMvsLoad, knock multiplier, etc) in order to help the people with phantom knock.

Periphery bits would be huge too for people who need to pass emissions.

I'm not running a DSM ecu so this list isn't actually a feature request just one guy's opinion on what is important if you're making a list.

 

[_Madman_]

It's quite possible that the code base is very similar for Evo and DSM ECUs. H8 ECU is optimized for C programming, so I bet they just had the code and compiled it to different platforms. Some things differ, but knowing that periphery bits, ECUID+Rev., and map styles are quite similar, I wouldn't be surprised if there is some extra code in there.

Great news about cross revision flashing! But still, do you have your original ROM somewhere?

P.S. Talking about Evo, that's actually a good idea. Their base maps are already tweaked for 16G turbos and bigger injectors, knowing that they (5/6) run the same ECUs they should be a nice source to take base maps from. Especially for 16G swaps.

Evo's (5/6) do have same compression ratio engines, right?

 

[draculia]

So you mean they really differ?!!

Can you upload your ROM somewhere? Finding out axis offset with actual ROM would be pretty easy. It's possible to translate from one revision to another via few simple operations, if you know the offsets.

What is bad, is that ECU flash uses the ASCII ID to identify ROMs, therefore if we have different revisions, they might not work with ECUFlash identified definitions and allow people to screw thing up.

I emailed it to Ceddy.

I didn't know I had revision 0010 until I used Ceddy's updated definition which can show the revision number. I guess its not really and issue now though if flashing different revisions is ok.

 

[_Madman_]

I emailed it to Ceddy.

I didn't know I had revision 0010 until I used Ceddy's updated definition which can show the revision number. I guess its not really and issue now though if flashing different revisions is ok.

It could help to write an automatic tracer that finds the maps. The more ROM images we will have, the easier it will be to find similarities.

20550011->20560010 only needs axis patching, maps are at the same locations. At least it seems so if you rename and update the 20550011 def file with 20560010 signatures.

It's quite possible your ROM matches EM2364 map locations, or some other. Or maybe the mystic EM2384 ROM, which is defined in ECUFlash, but no one has an image of it at all.

One more question, do you have an auto or manual car?

 

[draculia]

I believe this ecu came from a 98 gst manual don't know if it was cali or fed either

 

[shark]

Ceddy,
What changes to the IDA Pro tutorial do you do to make it work with the h8500 processor?
IDA Pro tutorial request - evolutionm.net

Like ram memory start and length?

And what version are you using?

Thanks
Red

 

[_Madman_]

AFAIK, only Ida Pro Standard or Ida Pro Advanced will work if you want to use Ida. One free alternative here: pgmfi.org &bull; View topic - Hitachi H8/532 MCU Dump, need information - (Acura Legend)

You can look up the memory layout in processor data sheet here: http://www.xtreme3s.net/H8500/H8 539F.pdf

Or just follow the attached image here: http://www.dsmtuners.com/forums/tun...14-evoscan-ecuflash-tuning.html#post151636159

Ceddy says the ECU is in mode 4.

Concerning RAM/ROM, if you have to specify, you can load everything as RAM, because RAM is sort of upgraded ROM anyways That should work...

You can read most of the hardware stuff here http://www.dsmtuners.com/forums/tuning-engine-management/311214-evoscan-ecuflash-tuning.html or just follow the hardware specifications.

Interrupt table (which leads to code) can be found at page 72 in the spec http://www.xtreme3s.net/H8500/H8 539F.pdf

There should be 80 jumps to code at the beginning of ROM. All this stuff should be true for any H8/500 ROM including the DSM ECUs.

 

[draculia]

Just a small update. On the way to work today I tripped the CEL. I haven't pulled the code yet to see what it is, but I didn't have any with the 20550010 rom.

Edit: Ok so I pulled the codes. I had them for the speed sensor, injectors, fuel pump, baro sensor, and knock sensor. I didn't have any of these last night when I test drove it. I cleared them, but they came right back. I ended up flashing back to the 2055010 rom, and no CEL.

 

[_Madman_]

That's bad

EDIT: Oh, but did you disconnected the battery for 15 or so minutes so that ECU clears all the memory? It's quite possible that the learned data is kept somewhere outside the CPU, and the new one doesn't match the old one.

 

[draculia]

I did not since I'm at work and limited to the time I could mess around with it. I didn't want to endup stranded on the way home or something.

If some of the data is indeed stored elsewhere, wouldn't I have tripped the codes right away? Either way, it doesn't make sense to me why I had no codes yesterday, then a whole bunch today.

If I have time tonight I'll do a full reset and try the 20550011 again.

 

[_Madman_]

I think we should move to a unified XML structure for definition files.

My suggestion is to rename EM2055.xml Ceddy posted to 20550011.xml and replace following part inside:

<romid>
	<xmlid>EM2055</xmlid>
	<internalidaddress>2fefa</internalidaddress>
	<internalidstring>EM2055</internalidstring>
	<caseid>MD346675</caseid>
	<make>Mitsubishi</make>
	<market>USDM</market>
	<model>Eclipse</model>
	<submodel>GST FWD</submodel>
	<transmission>Manual</transmission>
	<year>1998</year>
	<flashmethod>mitsukernel</flashmethod>
	<memmodel>H8539F</memmodel>
</romid>

with:

<romid>
	<xmlid>20550011</xmlid>
	<internalidaddress>1021a</internalidaddress>
	<internalidhex>20550011</internalidhex>
	<caseid>MD346675</caseid>
	<make>Mitsubishi</make>
	<market>USDM</market>
	<model>Eclipse</model>
	<submodel>GST FWD</submodel>
	<transmission>Manual</transmission>
	<year>1998</year>
	<flashmethod>mitsukernel</flashmethod>
	<memmodel>H8539F</memmodel>
</romid>

Then delete all EMxxxx.xml files in OpenEcu\Rommetadata\Mitsubishi\Eclipse folder.

This naming scheme works and will save us a ton of trouble with different revisions in future.

I haven't verified if this doesn't affect flashing, but it shouldn't.

 

[draculia]

Hey, I like that. It displays both roms that I have unlike the other definition files I have.

If this definition works with 20550011 and 20550010 as well as others, then shouldn't it have a more universal name?

 

[_Madman_]

Hey, I like that. It displays both roms that I have unlike the other definition files I have.

If this definition works with 20550011 and 20550010 as well as others, then shouldn't it have a more universal name?

No!!!!!!!! The 20550010 header will be different, note the difference in internalidhex and xmlid, also the addresses will differ between ROMs. You noticed during flashing that they are not compatible, that's why we are better with this naming scheme. Also information about car is different.

EDIT: Hmm, come to think of it, you actually have a very good idea there! We could create DSMBase.xml definition that has the unchanged parts like periphery bit, ecuid addresses and scalings defined, but these definitions could only contain maps that differ.

 

[Ceddy]

You need to Reset the ECU when flashing different images.

You should reset when flashing the same image also, but its not as important.(I think)

When flashing an image that has different RAM addresses(They all have different addresses so far), you will get bad values in stored items. Like your fuel trims will be -50000%. This will cause you to trip CEL codes and most likely make your car run badly.


You can reset the ECU by disconnecting the battery, then turn headlights on to drain power, and wait a few minutes. You can check if you have a successful reset by logging your Fuel Trims they should all be back to zero.

If you have a lot of stereo equipment(Like a Cap, or big Amp), it can take longer for power to drain.


Updated the FAQ, thanks to MadMan for the new DEFs.

Just a small update. On the way to work today I tripped the CEL. I haven't pulled the code yet to see what it is, but I didn't have any with the 20550010 rom.

Edit: Ok so I pulled the codes. I had them for the speed sensor, injectors, fuel pump, baro sensor, and knock sensor. I didn't have any of these last night when I test drove it. I cleared them, but they came right back. I ended up flashing back to the 2055010 rom, and no CEL.

That's bad

EDIT: Oh, but did you disconnected the battery for 15 or so minutes so that ECU clears all the memory? It's quite possible that the learned data is kept somewhere outside the CPU, and the new one doesn't match the old one.

 

[mike96]

No!!!!!!!! The 20550010 header will be different, note the difference in internalidhex and xmlid, also the addresses will differ between ROMs. You noticed during flashing that they are not compatible, that's why we are better with this naming scheme. Also information about car is different.

EDIT: Hmm, come to think of it, you actually have a very good idea there! We could create DSMBase.xml definition that has the unchanged parts like periphery bit, ecuid addresses and scalings defined, but these definitions could only contain maps that differ.

question... what about something similar to what the evo roms do. they have a base XML that has most of the info for the appropriate table (IE table name, category, 2D/3D, scaling, etc. etc.) and for each rom definition (90550001 or 96530006) that XML holds the rom specific info (IE table address, scaling address...) occasionally you find rom only tables in the individual XML like JSCbanks speed density patches. but that way as you find a table in one rom it can be added to the base "2Geclipse.xml" and that rom specific xml then when you find that corresponding table in another rom you just need to add the minimal info...... actually now that i think about it, it can be a pain in the but when someone decides to change table names around when they release a new version of ecu flash, or someone’s own custom xml and you loose half of your definitions and have to go and fix it all..... again.... either way i guess they would both have their ups and downs.....

edit: oops i didnt notice that you already mentioned that. my bad

 

[the_mork]

A much easier and more effective way IMO to drain any residual charge from the battery is to unhook the negative cable then touch the negative cable to the positive cable. I have a capacitor and it always works instantly.