pgmfi.org

Hacking up Honda's ECU
It is currently Sat Oct 04, 2025 6:38 am

All times are UTC - 5 hours [ DST ]




Post new topic This topic is locked, you cannot edit posts or make further replies.  [ 6 posts ] 
Author Message
 Post subject: The beginning...
PostPosted: Wed May 15, 2002 5:16 pm 
Offline
Senior Developer

Joined: Tue Jul 27, 2004 2:09 am
Posts: 4384
Location: Cincinnati, Ohio
91crxsi posted 01-10-2001 02:27 CT (US)
--------------------------------------------------------------------------------
Hi, All,
Listen up - I just installed a JRSC in my '91 CRX Si and it's great, but it got me thinking about an ECU upgrade for better performance. Well, all the aftermarket ECU makers (Zdyne, etc.) want to charge an arm and a leg for one of these boxes, and their whole business is based on the fact that we don't know enough about the ECU to do it ourselves. That doesn't seem fair, does it?

Being the curious type, I cracked open my stock ECU and did a little investigation. What do you think I found? Did Honda design their ECU around a proprietary chip? Not at all!! It's an 8051-compatible processor, and the 8051 is practically the single most popular microprocessor on the planet! At least it was - it's been around since 1980. Not exactly cutting edge technology here. And if you think about it, why wouldn't they use a widely available part when they're trying to mass-produce economy cars? The idea that Honda uses some highly sophisticated, indecipherable custom chip is just propaganda foisted on us by people wanting to make a buck on custom ECU chips.

Anyway, I happen to have access to an industrial desoldering station, an EPROM reader and an 8051 assembly language development system. Stay tuned as I expose all the juicy details...

91crxsi

PS - note: the information I'm divulging applies only to the '91 CRX Si ECU, as far as I know.



Spindle posted 01-10-2001 17:45 CT (US)
--------------------------------------------------------------------------------
So in other words, your gonna program an ECU for me? Or, write a computer program, and make a patch cable so we don't have to spend, oh, $900 bucks for it?
-Spindle
IP:

88_SC_CRX_Si posted 01-10-2001 18:15 CT (US)
--------------------------------------------------------------------------------
Yes, keep us informed!!! I would like to get it on that.:)
"Noth'in like Induction...";)

-Ryan-

IP:

91crxsi posted 01-10-2001 20:24 CT (US)
--------------------------------------------------------------------------------
The plan is - remove the stock PROM intact (not as easy as it sounds), read the program off it and try to make sense of it. I think this will take me a couple of months.
As for programming your ECU, let's just say that I'm not planning on making a business out of this. I'll be happy to share any info I can, but for the time being I'm not planning on doing this for a living.

91crxsi

IP:

91crxsi posted 01-10-2001 20:36 CT (US)
--------------------------------------------------------------------------------
Hi, All,
Today's juicy tidbit:

The stock PROM is a 32 kilobyte ROM. The ENTIRE program to control EVERYTHING the ECU does fits within this chip. To give you an idea of how little this is, freecell, that cheesy solitaire game that comes with Windows, takes up 37K. A 32K mp3 file would play for less than 2 seconds. Over 40 different ROM images would fit on a floppy disk. More if you compressed them.

What's my point? Only that, while there are still thousands of lines of code to pore over, it's not millions. And it shouldn't take all that long to go through it. Expect weekly updates as soon as I get the PROM removed and read.

91 crxsi

IP:

91SiNYC posted 01-10-2001 20:40 CT (US)
--------------------------------------------------------------------------------
you dont need to remove the processor...hondata.com makes a rom stacker that need to be soldered on top of the evisting ROM, and then you can hook it up to a desktop computer and read all the codes and fuel/ignition maps.....and change it all how you see fit....basically you program your own chip...ZDYNE bites ass! dont ever buy from them
IP:

91crxsi posted 01-10-2001 20:45 CT (US)
--------------------------------------------------------------------------------
91SiNYC:
Why does ZDYNE "bite ass?" Also, do you have a Hondata ECU? I'd love to get a look at Hondata's or ZDYNE's ROM images some time, but first things first - gotta see what the stock program looks like.

91crxsi

IP:

Steve Jones posted 01-10-2001 21:47 CT (US)
--------------------------------------------------------------------------------
I did a quick query for 8051 development at http://www.topclick.com , and I found more sites than I can list here.
8051 development can be fun!

IP:

davens posted 01-11-2001 01:23 CT (US)
--------------------------------------------------------------------------------
91SiNYC---have you tried a zdyne unit, or even a hondata unit for that matter? I'm just wondering because it seems you have some pretty strong preference for the hondata.
I'm sure you would base such a strong opinion on first hand experience.
IP:

88_SC_CRX_Si posted 01-11-2001 08:54 CT (US)
--------------------------------------------------------------------------------
What's up with ZDYNE bitting?
Planning to get SECU this spring.

"Noth'in like Induction...";)

-Ryan-

IP:

91crxsi posted 01-11-2001 17:07 CT (US)
--------------------------------------------------------------------------------
I agree that the ZDYNE SECU sounds sweet. If I had a spare $1,000 I'd run right out and buy one, too...
IP:

91crxsi posted 01-11-2001 22:11 CT (US)
--------------------------------------------------------------------------------
TODAY'S UPDATE: "WHAT WAS I THINKING?"
Well, I just decided to go for it today. I was all set to a professional job of non-destructively removing the PROM from the ECU but after about an hour and a half of very careful desoldering, it was becoming clear that I wasn't going to get the thing out that way.

Desperate, I decided on more extreme measures - I found a pair of wire clippers and clipped the leads. WHAT WAS I THINKING? How am I going to get around without an ECU???

Anyway, I now have a loose PROM with trimmed leads, which I'm planning to solder onto a socket, so I can plug it into my EPROM reader. Will this madness work?? Did I already fry the PROM? Stay tuned and find out next time...

91crxsi

IP:

davens posted 01-12-2001 12:20 CT (US)
--------------------------------------------------------------------------------
uh, you started hacking around with your ecu without having a spare and you need the crx for transportation? 1d10t...
IP:

91crxsi posted 01-12-2001 22:16 CT (US)
--------------------------------------------------------------------------------
davens:
I have another car (otherwise, yes, that would be dumb).

Today's update: "Mission successful!"

Well, I removed the PROM yesterday and read it - seemed like everything was normal, until, upon closer inspection, every single byte was an odd value. That's odd. :P I figured that the D7 pin of the EPROM wasn't getting good contact when I read the chip last night, so I re-read it again this morning and voila! I now have a copy of the stock PROM. Anyone who wants proof can leave me their email and maybe I'll send you a copy.

Cool. This still left me with an ECU missing a chip, though. So I cleaned up the empty spot on the PCB where the ROM used to be, soldered in a chip socket, went and bought a new EPROM for $3 at the local electronics store, burned the image of the stock PROM into it, and plugged it in. Checked all my contacts with a digital multimeter and everything was good to go.

The real test will be plugging the thing back into my car and turning the ignition!

Anyway, like I said if interested in a copy of the ROM, let me know. I haven't had time to really go through it to figure out what's going on, but I did check the fuel and ignition maps and they look clean (i.e., the data wasn't corrupted). I won't know for SURE until I get home and fire up the car.

The saga continues...

91crxsi

IP:

91crxsi posted 01-13-2001 12:18 CT (US)
--------------------------------------------------------------------------------
Update: The car's running fine.
IP:

SlowC posted 01-13-2001 16:22 CT (US)
--------------------------------------------------------------------------------
holy underware.. I wish i had the ability to do that! You plan on changing the codes?
Is that your next project?
IP:

KSR posted 01-14-2001 18:06 CT (US)
--------------------------------------------------------------------------------
Hm... what a minute... If you can remove the ship and copy the original data back into a blank chip... can you erase and re-write another set of data onto that chip? Like a re-writeable CD? Hm.....
How much does it cost for this EPROM reader and writer? This sounds VERY interesting.... It's all a matter of trial and error to get a better fuel map, right? Or am I just dreaming?

Perhaps you can re-write the MAP sensor data to accept positive boost pressure. Wow.. the possibilities are endless....

PLEASE... let me know more... I'm very interested.. If you don't mind, please send me a copy of the EPROM data... I would love to see what it looks like.

Thanks

IP:

simplecrx posted 01-14-2001 20:17 CT (US)
--------------------------------------------------------------------------------
This is exciting. I hope someone finds out how to reprogram the chips because I am totally down to pay for the reprogram at the fraction of the cost. Shoot . . . 92CRXsi, you could just go buy a ton of these chips and reprogram them. That way you don't have to worry about people coming back to you telling them that their ecu is screwed. I wonder if someone is willing to donate a zdyne or other reprogrammed chip so you can read the code and copy it. Hee hee . . .then we can all get copies. I guess I'm too business minded . . . all about profit. It just seems like a possibility to just copy the code from one that's already been done becuase zdyne has not copy righted their code.
IP:

Mr Kwicko posted 01-14-2001 21:38 CT (US)
--------------------------------------------------------------------------------
If you're *NOT* thinking of making a business out of this, then maybe you should! It sounds like you're onto something, and I'll bet ZDYNE, et al, wouldn't be too happy about it. Just think: you could essentially reprogram or "rechip" ECUs for others at under $300 a copy, and you'd be making some serious jack in your spare time. At the same time, you'd be providing a very valuable alternative to the ZDYNE and similar chips.
As long as you've invested the time and the curiosity, you might as well get PAID for it, right?

IP:

Dave_Darling posted 01-14-2001 21:56 CT (US)
--------------------------------------------------------------------------------
Keep in mind that copying the code from a Zdyne PROM is rather illegal. If you sell it for anything at all, they can sue the socks off of you. In fact, if you just give it away, they can also sue the socks off of you.
Come to think of it, even copying the Honda PROM may be illegal. I suppose you can claim "fair use" for one personal copy for a backup, but that would probably be pushing things.

If you want to reverse-engineer the PROM and figure out a program that's better, the more power to you! Don't expect it to be trivial, though. You'll have to figure out what part of it is code, and what is data. Then figure out how the data is used. Then re-map the data, and test the results. To really tune the ECU properly, a dyno would be the best bet. Lots and lots of dyno time, if you are making very many changes.

There are reasons that well-done aftermarket ECUs cost so much. They take a good bit of work to do properly.

--DD

IP:

simplecrx posted 01-15-2001 12:25 CT (US)
--------------------------------------------------------------------------------
I asked my brother about EPROM chips and he was telling me that certain ones have security features that basically have a password encoded. Maybe zdyne does that. He was also telling me that where his lab(student for Mech E phd)there's things that read it. So I was thinking if anyone has a zdyne chip who wants to check out the code for "personal" use. I don't want to break any laws, but reading code and posting it on the web can't be illegal since it's only for personal use. Take for example, movies that you buy at home you can make copies if only you keep it at home. Along with taping football games, if you use for personal use, it's not illegal. So ideally posting the code is like posting the words to a song on the web as long as you're not making money or selling anything. It's considered free information right? If I buy a CD and take all the words out and post it, I'm not breaking any copyright laws.
Tell me if that sounds right? Like I said, this is interesting. I have an extra 88-89 teg ecu which I was gonna sell, but may contemplate about testing some stuff out.

Dave makes really good points, but then if zdyne is able to change honda codes, then it must be somewhat legal unless they have a contract with honda itself.

IP:

7PSI CRX posted 01-15-2001 00:00 CT (US)
--------------------------------------------------------------------------------
Code is just code.
It's basically just a chart of injector pulse / ignition timing under variable conditions. (RPM, water temp, throttle position, altitude, O2 content, and such)
No one has a patent on a car running 18 degrees advance and an injector pulse of 170ms with a water temp of 170, throttle opening of 65%, at sea level, at 4500 RPM, Know what I mean?

[Edited by 7PSI CRX on 01-15-2001 at 01:24]

IP:

weasley posted 01-15-2001 08:25 CT (US)
--------------------------------------------------------------------------------
I'm no computer geek (j/k!!) but instead of trial and error, could you write a CRX emulator? Then you could make adjustments to the code and see what it does to your 'soft' CRX before you plugin to your 'hard' one...?
IP:

StorminMatt posted 01-15-2001 08:49 CT (US)
--------------------------------------------------------------------------------
Well, it is not surprising to know that it is so easy to read and program an EPROM for an ECU. The harder part is actually interpreting the code. In other words, how do the numbers in the ROM relate to actual engine variables such as degrees of advance, injector duration, intake vacuum, etc? I think this is what you pay the guys at Zdyne big bucks for. Not the actual removal and replacement of an EPROM. I don't know how easy this is. But I can tell you that as of now, Zdyne still has not completely cracked the code on 1992-1995 ECU's. So it can't be that easy to figure out. It would also appear that this information is top secret.
IP:

Dave_Darling posted 01-15-2001 12:10 CT (US)
--------------------------------------------------------------------------------
Simple, 7PSI, those do not fall in the "fair use" category. If you keep the copy for yourself, you may be able to argue it. If you post it on the web (even for free!), you're breaking the law. Plain and simple.
Take this example: You buy a copy of Win2K. You read the data off the CD, you put it on a website so that anyone can download it. Does MS come after you? You bet they do!! And also everyone who downloaded it, too! Everyone who downloads a copy from your site is someone who doesn't buy from them. And they have the legal right to do that--you are breaking the copyright law by doing it.

It's the same with the code and data inside the PROM.

Look, I'm not going to tell you that you "can't" do something. I'm not even going to tell you "not" to do something. I am trying to inform you of the possible consequences of your actions, to let you make informed decisions. That's all.

--DD

IP:

91crxsi posted 01-15-2001 15:20 CT (US)
--------------------------------------------------------------------------------
Hi, All,
I'm really glad there's so much interest in this project. And I knew that sooner or later, the issue of money would come up.

First of all, let me say that I never wanted to make a penny off this. I only wanted to prove to myself (and you) that it can be done. I'm happy that I've done that. I've never been good at just accepting it when someone says, "You can't do that." If the folks at Hondata and ZDYNE had not tried to reverse-engineer the Honda ECU, they would not be in business today.

I just thought it sounded fishy when they all said the CPU was proprietary. That makes no sense in a mass-produced vehicle. Honda is a car company, not a computer company. Why would they bother? And I was right. The CPU is 8051-compatible, and EXTREMELY common. The control code is less than 16K - puny by today's standards.

As for Dave_Darling's legal concerns, let me ask this - is it legal to take a copy of Honda's ROM, modify it, and SELL it? Can you imagine how far a computer software company would get if they said they could take your copy of Windows and modify it for you so it would be 30% faster, without signing some agreement with Microsoft?? If it is illegal, ZDYNE and Hondata are in deep doo-doo. I didn't modify my copy at all - IT'S COMPLETELY STOCK, byte-for-byte.

But suppose that it IS legal to modify the code/data, as ZDYNE and Hondata have done. Then why would it be illegal to disclose the location of the fuel and ignition maps, and how to modify them? Which, by the way, is what I'm planning to do. What you all do with that information is up to you.

As I see it, this is no different than taking Eclipse injectors and swapping them in for the stock ones, or swapping out I/H/E components. Is Honda going to come along and sue anyone who does it, or anyone who tells others how to do it? Give me a break.

91crxsi
PS - I guess I won't distribute the ROM image, for now. Besides, I've already told you everything you need to know to do it yourself. But please stay tuned for more info on the fuel/ignition maps, as well as some analysis of the program.

IP:

Dave_Darling posted 01-16-2001 14:07 CT (US)
--------------------------------------------------------------------------------
> As for Dave_Darling's legal concerns, let me ask this - is it
> legal to take a copy of Honda's ROM, modify it, and SELL it ...
No, it is not. The legal way that things like that are done is by taking the specifications and the hardware that hooks up to whatever it is you're trying to "copy", and work out for yourself exactly what must be done to produce equivalent results. Then a different team of people take that information and design a piece of hardware/software/whatever that does the same job with the same inputs and outputs. It is an overly-complicated process, but that's the way that it has to work in order to not get hit with copyright suits. And that's one reason that aftermarket "chips" aren't a dime a dozen.

The story of how IBM lost the battle against "PC Clones" back when directly applies here. The way that the clone-makers succeeded was by doing the above process.

Note that Honda's copyright does not apply to the chip itself, merely to the code and data stored inside of it.

I think that the idea of decoding the Honda PROM is a fascinating one--even a worthwhile one. And I'm not going to call the cops in on anyone who does it--I'm not nearly that much of an ***hole. Like I said, I just want you to go into this with an appreciation of the possible consequences.

--DD

IP:

91crxsi posted 01-16-2001 14:26 CT (US)
--------------------------------------------------------------------------------
Dave_Darling:
I appreciate your concern. I'm not interested in getting into any sort of legal mess. All I ever wanted to do was to crack that ROM and understand it. Ignorance has elevated it to an almost magical status, and as an engineer, I knew that was total bunk. And as far as revealing any "top secret" information about Honda's PGM-FI, think about it - it's written in 8051 assembly language, the PROM is NOT read-protected, and it's been out there for 10 years. Do you really think that the other auto manufacturers couldn't have done in 10 years what took a single individual a week?

Let me say this now: I'm not in this for the money. I'm not planning to spam the web with free copies of the Honda ROM. I'm simply going to go through the code/data and share what I learn about it. If you think there is a problem there, please let me know.

I know that I did say earlier that I would send a copy of the ROM data to anyone who was interested. I think that might not be wise. However, having said that, I do believe that if you already own a CRX Si ecu, then you, in effect already paid for the stock program. My data, then, might be considered a backup copy of a program you already paid for. Possibly you could sign some kind of agreement to the effect that you already have a copy of it and this is just a personal backup. We'll see. But again, as I said earlier, you already have all the info you need to do it yourself, and I will, over the next few months, share with you what I discover of the inner workings of the program.

91crxsi

IP:

Dave_Darling posted 01-16-2001 17:33 CT (US)
--------------------------------------------------------------------------------
If you are really concerned with the legalities, I suggest talking to a lawyer. He might even tell you that I'm full of it--it woudn't be the first time!
If not, I'd think that you're too small for Honda to go after anyway. You can definitely claim that your copy is a "backup", and try to get it in under "fair use" that way. I don't know how well it would go over--but a lawyer probably would.

I'm totally out of my league when it comes to sharing general information about the code and data on the chip. If I offered anything, it would be pure guesswork. Again, an intellectual property lawyer would know, or would be able to find out.

I personally hope you do decipher the chip, and that you tell us CRX fans what's going on inside there. It's nice to have an appreciation for what is actually going on under the hood/under the passenger's feet. And I would bet that we are a small enough set of people that Honda won't notice anything that might technically be an infraction of their copyright. But if they do notice, and they want to play hardball about it, they do have the legal right.

I really don't want to rain on your parade. It sounds like a really cool thing to do!

--DD

IP:

91crxsi posted 01-17-2001 15:54 CT (US)
--------------------------------------------------------------------------------
Update:
Hi, all,

Many of you wanted to know what type of chip I'm using. It's a standard 27C256 32Kx8 CMOS EPROM. The chip I removed was, I believe, 65 nanosecond, commercial operating temperature range (-40 to 85 C). The replacement chip I got was 55 nanosecond, 0-85 C. It's not exactly the same, but the access time is faster, which is not a problem, and living in sunny CA, I don't think the change in operating temp range will matter. I just went to the local electronics store and bought whatever they had in stock. If you look around you should be able to find a closer match.

Another thing - the ECU I have has a spot on the printed circuit board for a serial port connector, CN3. It's just next to the biggest IC. I don't know (yet) if the stock code supports serial communications, but obviously someone at Honda (or Denshigiken) was forward-thinking enough to include hardware support for it.

As for the code/data, I've found the location and layout of the fuel and ignition maps, and I have a fairly good idea of how they correspond to RPM and degrees of advance / injector duration. I've also gone through about 1K of the code, not that I completely understand what's going on there. I expect things to become clearer as I get a chance to see more of the program.


91crxsi

IP:

91crxsi posted 01-18-2001 20:44 CT (US)
--------------------------------------------------------------------------------
Today's tidbit: Ignition/Fuel map location, and, The Serial Port - it works!
I said that I would tell you where the ignition and fuel maps are: the ignition map starts at ROM address 3DF3, and is an array of 15 by 17 bytes. The injector pulse duration map is in two parts, one starts directly after the spark advance map and is also 15*17 bytes, and the second part is just 15 bytes, from 3FF1 to 3FFF. I'll tell you how to interpret (and modify) them soon!

Also, the serial port. It looks as if the stock ECU WILL respond to serial communications, although in a pretty simplistic way - if you send it a nine bit number, it will reply with the RAM data stored at that address. For example, if you wanted to know what was stored at location 0F0, you would send 011110000 (in binary) and it would reply with the value of the data stored at location 0F0. So, in its stock form, the only thing the ECU's serial port does is give you read-only access to the 512-byte RAM chip. If you know how to interpret the numbers, though, that info could be quite useful. Hopefully I'll be able to do that soon.

ZDYNE (and I think Hondata) use the serial port to interact with the CPU in more sophisticated ways, such as uploading/downloading maps and the like. I suppose Honda engineers could have even used the same approach to reprogram their test chips, although the more likely scenario is that they used EPROM emulators.

As an aside, I bought a set of 450cc injectors today (from an old Mitsubishi Eclipse) for $50. They'd never work with the stock PROM, but with a modified pulse duration map...

91crxsi

IP:

NC_Rex posted 01-18-2001 21:16 CT (US)
--------------------------------------------------------------------------------
You know these guys running the superpro Computers, the most widely used dfi-type computers, ...well they all share the code and code it here and there. Heck even when you buy these control systems like Tec-II and Zdyne, these ones that have the serial interface and are able to be modified with an upload, these come with base programs for your basic B16A, B16A turbo, NOS, etc...different engines, different years of Honda's. They comes with preprogrammed parameters for upload and to base your further work on with. So if you could get ahold of these windows programs and their software and watch the information come across or reread the reprogrammed PROM and compare it to the file with the lookup tables and data, then you could mostlikely draw a comaprable conclusion, and thus figure out what they do for larger injectors, and the this and that. Heck, I'd like to see if you could actually read a PG7 88-89 Teg ECU and PM7 88-91 ZC ECU and tell me differences on those things. You could probably then restack the information onto an Si ECU or HF ECU and test it out on someones ZC Hybrid CRX and see how well it works - in the name of research of course. Man way to go, your really onto something. Heck you just have to identify the blocks where the RPM limiter resides, and you can bump it up easily, maybe even give yourself a shiftlight from the ECU, just like the Rev-activated Zdyne ECU's that activate the VTEC, but just use it for a shiftlight. Man so many possibilities, have fun man. Let me know how it turns out man.
- Jon
IP:

91crxsi posted 01-18-2001 22:31 CT (US)
--------------------------------------------------------------------------------
NC_Rex:
You know, there have been several people who have asked me about PROMs from other ecus. I never intended for the scope of my investigation to extend beyond my own.

However, that being said, if you people really are that interested, I'd be happy to take your ecu's and perform the same surgery I did to mine: cut out the old PROM, copy it onto a floppy for you, burn a new EPROM, solder in a chip socket, pop in the new EPROM and ship it all back to you (including your old PROM).

What would this cost you? I figure about $5 for parts (an EPROM, chip socket, solder and floppy), $10 for shipping and $15/hr for labor (about half of what I make in my real job). That should bring the total to around $45 to $60.

Remember, the new EPROM's program will be identical to your old one. I'm not going to get into modifying chips (not yet, anyway).

Also, and I must stress this, I CANNOT guarantee and WILL NOT be held responsible if for some reason I can't read the original chip!! So it's up to you. If I can't read the chip, I'll still go ahead and solder in the chip socket and send you a blank EPROM. That would be the best I can do, unless someone else just happens to send the exact same model ecu and I have it around.

This will be done on a first-come first-served, when-I-have-the-time, until-I-get-tired-of-it basis, so please contact me asap if interested.

91crxsi

IP:

AbaZ posted 01-19-2001 03:56 CT (US)
--------------------------------------------------------------------------------
this is very interesting! hell I would pay you 100 bucks to do mine!
Jeff


IP:

lotus911 posted 01-19-2001 08:59 CT (US)
--------------------------------------------------------------------------------
ME TOO!
IP:

KSR posted 01-21-2001 12:07 CT (US)
--------------------------------------------------------------------------------
I'd pay you more if you can get into modifying the chip like a Zdyne.
IP:

CRwreckz posted 01-22-2001 12:10 CT (US)
--------------------------------------------------------------------------------
Just a thought, what if you got a hold of a zdyne chip and read the program and compared it to the stock program, then you would know what is part of the actual operation and which regulate the rest. Not to say I'd pay a G to just rip it out and start probing around. I'm wondering, what are you using to read this? Is it possible to (or rather wouldn't it have been possible) to use a clip to take readings from the different points? If you do decide to send the code out email me, coolio16@juno.com, I am more than interested as to how it is regulating settings and how it could be possible to squeeze more. CRwreckz
IP:

91crxsi posted 01-23-2001 12:05 CT (US)
--------------------------------------------------------------------------------
Hi, All,
As I said before, you may contact me and make the necessary arrangements if you want me to do the manual labor for you (to read your PROM). Refer to my previous post.

Update:
Thanks to Scott (TaeSoc@aol.com) for lending me his '91 CRX Si ecu and '90 PR3 ecu for further experimentation. As expected, the CRX ecu looks identical to mine, and I expect the PROM to be identical. The PR3, while physically similar, is very different inside. It looks like it uses the same kind of PROM, but the CPU is an OKI 66K series, which is not 8051-compatible. In plain English, the code for the PR3 can't be understood by a PM6, and vice versa. It also can't be disassembled by an 8051 disassembler. That's a bummer because 8051 disassemblers are easy to come by (free on the net) and OKI 66K disassemblers, as far as I can tell, are not.

Bottom line: reading the PR3 PROM should be no harder than reading the PM6. It's just the interpretation and reprogramming that could be more difficult. Also, I didn't see a serial port connector anywhere...

As far as my PM6 code analysis goes, I've gotten to about 2K of it by now (just a guess). Nothing really exciting yet, just diagnostics and housekeeping routines. I'll let you know when I find anything you might be interested in.

FUTURE PLANS
I'm planning on writing a Windows program that allows you to edit your maps directly, or rescale your injector pulse maps for different-sized injectors, as well as advance/retard your whole timing map by some constant, or a function or RPM/load. Not very sophisticated, but you have to start somewhere! I'm not sure what the best method would be - maybe just a Microsoft Excel spreadsheet with formulas! Anyway, what do you care, right? As long as it works! I don't have my own website, so I'll be emailing the working version to Steve Jones of the CRX Resource to post here.

91crxsi

IP:

91crxsi posted 01-23-2001 22:21 CT (US)
--------------------------------------------------------------------------------
Here is a link to where you can buy EPROMs, EPROM programmers, even EPROM emulators for ultimate flexibility. Check it out, and start your own experiments!
http://www.transtronics.com/memory/EPROM.htm

91crxsi

IP:

7PSI CRX posted 01-24-2001 00:00 CT (US)
--------------------------------------------------------------------------------
Now that you can read and duplicate a chip, Can you modify it?
I'm really interested in Zdynes' launch control...

Throttle to the floor, engine only revs to 2500 while the clutch is engaged, let go of the clutch, and rpms increase.



[Edited by 7PSI CRX on 01-24-2001 at 05:08]

IP:

KSR posted 01-24-2001 11:19 CT (US)
--------------------------------------------------------------------------------
91CRXsi. Now how hard is it to do all this programming, even with the equipment? The equipment looks cheap enough, but how much more work is it to crack those codes, especially for someone like me who just basically knows their way around windows, and that about it... I'm not good with soldering chips. So... how hard would it be?
Hehe... come to think about it... I think I wait for you to figure it out instead.

IP:

KSR posted 01-24-2001 11:21 CT (US)
--------------------------------------------------------------------------------
Just a thought... would the Si ecu be able to process the excel codes fast enough?
IP:

91crxsi posted 01-24-2001 15:20 CT (US)
--------------------------------------------------------------------------------
7psi:
Yes, I can modify it. Whether I can modify it to do something useful, well that's another thing. :)
ZDyne's launch control - it sounds the same as Hondata's. In fact, so many of the features of the two ecus sound alike that I often wonder if they are alike. Anyway, the logic behind it is not that complicated: if the clutch switch is engaged, choose rev limit A, if disengaged, choose rev limit B. All I need to do is find out where in the code the status of the clutch switch is being checked, and add that one extra little task. The hard part, actually, is finding it. Making the change shouldn't be that difficult.

KSR:
I hope we can all get away from talking about analyzing the Honda ECU in terms of "cracking codes," because that point of view is based on the myth that the information is somehow hidden and undecipherable. I've been trying to get across the point that the Honda program (at least for the 91 CRX) is written in MCS-51, which is the most popular microcontroller language in the world.

That said, it is true that it does take some work to read and understand assembly language programs, and it's probably beyond what most of us are really interested in getting into. That's why I'm taking it on myself, and why I want to explain what I find in simple, usable terms.

The Excel spreadsheet idea is not that the ecu will run Excel - that's impossible. What I meant was that you'd be able to enter your map data into a spreadsheet and Excel would calculate byte values which you would then edit into your ROM image and burn into your eprom. Eventually, I'd like to write a standalone program that can do the same thing, plus modify your ROM image for you, as well as scale the whole map for bigger injectors and stuff.

91crxsi

IP:

91crxsi posted 01-24-2001 00:00 CT (US)
--------------------------------------------------------------------------------
UPDATE - ignition map calculations!
Someone (who will remain anonymous) showed me what ZDyne considers to be the stock PM6 ignition advance map, and based on this info, I've derived the following formula for calculating the byte value to put in the ROM for a given ignition timing:

BYTE = timing * 25/9 + 15,

where timing is degrees BTDC of advance. Since a byte can be anywhere from 0 to 255, or -128 to 127 for signed bytes, that translates into a timing range of either -5.4 to 86.4 degrees BTDC or -51.48 to 45.72 degrees BTDC. Ample range for any normal situation.

Example: at idle, advance is 18 degrees BTDC. Using the formula above, the byte value in the timing map should be:

18 * 25/9 + 15 = 60 (decimal value)

The stock map is a grid of 15 load points by 17 RPM points, for a total of 255 points. That would be pretty tedious to convert each point by hand, so I've created an Excel spreadsheet to do the calculations for you!

Here's how it works: it starts out with the stock PM6 data. You can then alter each point by hand and the spreadsheet automatically calculates the correct byte value to place in the ROM (it also tells you where to put it). The missing step is that you have to enter the data (don't forget to convert to hexadecimal) into your ROM editor and burn it onto your EPROM. Maybe I'll get around to writing this program later, too.

Anyway, I'll send Steve Jones of the CRX Resource a copy of the spreadsheet so everyone can get it.

Cheers,
91crxsi

PS - this is only correct if the ZDyne data was correct. Anyway, you'll be at least as accurate as a ZDyne user would be...

[Edited by 91crxsi on 01-24-2001 at 22:07]

IP:

NC_Rex posted 01-25-2001 02:25 CT (US)
--------------------------------------------------------------------------------
HondaHackers rule!
Yeah I can send a ZC ECU for you to dupe. I just don't know about all you said.

However, that being said, if you people really are that interested, I'd be happy to take your ecu's and perform the same surgery I did to mine: cut out the old PROM, copy it onto a floppy for you, burn a new EPROM, solder in a chip socket, pop in the new EPROM and ship it all back to you (including your old PROM).

What would this cost you? I figure about $5 for parts (an EPROM, chip socket, solder and floppy), $10 for shipping and $15/hr for labor (about half of what I make in my real job). That should bring the total to around $45 to $60.

I was thinking more like, $5 for the ship - I would buy to make things easy on you, $15 for shipping both way because I am helping you out by giving you the prom program because I am a nice guy and think Honda owners should have a cheaper alternative and I know you'll uphold that, and if you break my ECU I will be very pissed, but won't bother with the $15 per hour because then you would be doing charging me for giving you a favor and I want my ECU back - your not doing me a service, so why would you be charging me?? Kinda follow? I am helping you out giving you an opportunity and paying $20 out of my own pocket for something my ITT graduate brother that works for Motorolla can do on his handheld! So please don't think I am paying you for your work, because I'm just doing you the favor.

Just let me know. If you do a good job, I may just let you borrow my Spoon or STEC PR3 ECU's that I brang back from Japan.

- Jon

IP:

91crxsi posted 01-25-2001 00:00 CT (US)
--------------------------------------------------------------------------------
NC_Rex:
If your brother can do it for you, I suggest asking him. I've already been lent a stock PR3 and I'm in contact with owners of teg ecu's and even the ZDyne, not to mention the work I'm doing on my own ecu, so my plate's pretty full at the moment. If you want to do me a "favor" and send me a ZC ecu to look at, that's fine. But I'm not particularly interested at this time.

Thanks, anyway,
91crxsi

PS - come to think of it, if you really want to do me a favor, save your $20, have your brother read your PROM for you and email me the image.

[Edited by 91crxsi on 01-25-2001 at 15:53]

IP:

gavnook posted 01-27-2001 12:53 CT (US)
--------------------------------------------------------------------------------
One little thing: I think all that talk about hondas having these uncrackable computers and crap is just based on the fact that they've never, to my knowledge, built the ECUs to be easily changeable. Perhaps I'm wrong, but I think other car companies, GM especially, have built their computers with replaceable chips. I wouldn't be suprised though if aftermarket GM computer stuff was little more advanced than that. However, this is based on vauge memories of when I used to get Hot Rod magazine.
I am completely amazed how simple this is. They had me fooled. I think the main reason ecu mods have been so slow comming is that you don't find a lot of people with a lot car-tech knowledge who know anything about programming microprocessors. Also, how big do you think the market is? Yes there are thousands of hondas with fog-lights and 17" wheels, but how many of their drivers know what an ECU is?

IP:

locash1 posted 01-27-2001 01:11 CT (US)
--------------------------------------------------------------------------------
I've been following this thread for awhile, and find it rather interesting, so I will continue to read it.. I have been into the ecu reprogramming game for about 2 years now, and have learned quite a bit of information, most of which gained by analyzing the stock ecu and others modifications to it. I own an all options Zdyne SECU and multiple "every option listed" Hondata ecu's, and am an authorized Hondata installer/reseller. Also, I do honda/acura ecu reprogramming as a side business. I'll give you a small bit of information, just to save you the trouble.. The Zdyne ecu uses an encrypted processor to handle most of the work, the EPROM is replaced with a battery backup EEPROM unit, for flash programming, which is VERY slick, and also, non-duplicatible. The hondata unit is a different game altogether, storing a large part of the information on an encrypted PIC chip on a separate circuit board, which basically allows the unit to use the other maps that the user burns into the replaceable eprom. Anyway, what I am saying is that you cant just "copy" either of their work, not only is it illegal, but it is encrypted. Anyway, I wish you luck in your endeavors, and I applaud the effort given, obviously there is one person in the group that is doing it for fun and to help others out with this technology.. If ecu reprogramming didnt pay most of my bills, I'd be giving the info out for free also, but currently, I cannot afford to do as such.. But, I am in no way going to attempt to stop the efforts, as I was once in your shoes.. In fact, I am even willing to help the person spearheading this project, by giving him some rom files to study, and maybe a few pointers if needed..
Anyway, good job guy(s), and welcome to the world of honda ecu reprogramming..

-joe


IP:

91crxsi posted 01-27-2001 00:00 CT (US)
--------------------------------------------------------------------------------
I'd appreciate any info you can share, Joe! I think that, when most of us think of aftermarket ecu's, it's ZDyne, Hondata, Locash, Spoon, am I forgetting anyone? There aren't that many players, are there?
From what little I know of the ZDyne SECU, it's obvious that their setup was well thought out. They are fortunate Honda wasn't as security-conscious as they are, or my guess is they'd still be trying to make a viable product. And for those that just modify the PROMs, that niche wouldn't even exist.

I hope that we can de-mythologize the Honda ecu. It's just a dedicated computer with less computational horsepower than a dinosaur PC. It's not magic. At the same time, however, let's not deprive the aftermarket ecu/chip vendors of their *fair* wages. The service they perform is no different than an auto mechanic. We pay them because they have the special tools and expertise. If we had the skills and equipment they did, we could do our own repairs. But because we're either unable or unwilling to do it ourselves, we pay them. That's just the way it is. I don't believe that, even with the information I'm divulging, there will be that many people that will bother doing this themselves.

91crxsi

[Edited by 91crxsi on 01-27-2001 at 03:52]

IP:

7PSI CRX posted 01-27-2001 08:45 CT (US)
--------------------------------------------------------------------------------
Do it myself?
No way!
What I would like is to have:

An ECU with a replaceable chip. (snap in, with different programs on each chip) You can do that now, correct?
How much would an individual chip like that cost?

Or an ECU with a chip that can by modified in car via uploads. (ZDyne)

Snapping in a different chip would be no problem, and having a few different "programs" would be really awesome.

Updating a chip via PC I think would be a little more complex, unless, like you said, you can easily copy spreadsheet values into the "Right Place", and had a backup copy of your original program in case of mixup or problems.

Both should have "fail-safe" modes.


IP:

91crxsi posted 01-27-2001 12:59 CT (US)
--------------------------------------------------------------------------------
7PSI:
I believe we can do that. As of today, I'd know how to modify the ignition map for you. Soon, I hope to have the injector map figured out. I already know that you can modify the program from a PC using an eprom emulator, although I'm not sure I'd want to be tooling around town with an emulator plugged into the socket instead of a real chip. Should be ok, but...

Anyway, that would be the easiest way of having a PC-modifiable program.

Once I get the injector map figured out, I'll post it.

91crxsi

IP:

KSR posted 01-27-2001 19:46 CT (US)
--------------------------------------------------------------------------------
91crxsi.
I just can't wait till you figure everything out and create a program to modify the fuel maps, etc.. just like the Zdyne.. that would be amazing... I woudl purchase one off of you right away...

IP:

locash1 posted 01-27-2001 20:02 CT (US)
--------------------------------------------------------------------------------
I don't actually make fully programmable ecu's for the public, as I am not a software programmer. There is one fully programmable honda ecu of mine out there, and it works lovely and reads/compensates for boost, but it was VERY time consuming, and I am not willing to make another.. On the other hand, I do basic reprogramming of honda/acura ecu's, by analyzing the code, and using products from Techtom to find items that I wasn't previously capable of. There are some really cool things you can do with a honda ecu, it all comes down to how much time you want to spend figuring it out.. Most of my research has been with the dohc vtec ecu's, since those are the motors I am interested in, and deal with on a daily basis.. Back to the topic, since I havent spent much time with the sohc ecu's, I am curious to see what you figure out. By the way, those of you that want a fully programmable honda ecu should really look into the Zdyne and Hondata units, you'd be amazed at what they can do for the price..
Also, as a reply to Matt Storm's previous post (note: I am not out to make Matt Storm look like a clown, I just disagree with most of what he has to say), Zdyne knows all about the 92-00 Honda ecu's, and they have a fully programmable unit out there in a forced induction 99 Civic Si right now, but since there is (1) person doing all the design work (Bill), as well as trying to keep up with current orders, and run another business that actually pays the bills, at the same time, AND have a family life, its just going to take time before the product is released to the mass public.. Understand what I am saying here? Please don't make assumptions and relay them as correct information, as it just makes you look foolish when the truth is revealed.

Sorry, I got way off topic there, but I had to vent. Back to the games.. 91crxsi, feel free to contact me if you are in need of any rom files, and no, I wont make you desolder my ecu's to get them. :)

And for those of you that suspect it, yes, I work for HASport also. (day job)

-joe
locash@locashracing.com

IP:

killerb posted 01-28-2001 16:53 CT (US)
--------------------------------------------------------------------------------
just a note on the copyright thing:
If you take a copy of any code and use it for personal use no one is goning to care if you have it unless they are really nuts. If you send code to be looked at ie. an original copy of the honda code on the eprom chip then there is nothing wrong with this think of it as you would borrowing a book from some one, tecnicly you should go buy the book bbut instead you borrow it and don't pay anything for it.....this is the key point If you were to SELL copies of the code then it is illegal but if you give the code away then there isn't a problem because you are just sharing information.
Is there anyway someone can send me a copy of the original code, for my personal use I would like to have a back up and possible look into the actual code when I get a little further in my studies here in Canada

thanks

IP:

killerb posted 01-28-2001 17:00 CT (US)
--------------------------------------------------------------------------------
hey,
if the ecu is just a dinosaur computer what about building a "newer" one with custom case that could fit say under the seat or in the trunk that was hooked to a small screen in the dash, that way you could build it out of like pentium stuff that you can get for like next to nothing from various stores etc. I remember seeing a guy that built a mp3 system for his car and custom built a computer for it using like old 486 stuff.
just think of it as a way to change programs like have a program for true out power and have another for fuel economy and another for different conditions the possibilities are endless.......or maybe this is all just fluff from my brain that only will work in my dreams.

IP:

CRX150 posted 01-29-2001 02:57 CT (US)
--------------------------------------------------------------------------------
Oh yes Please E-Mail me with your finding so far I have an 86 Si and an extra Ecu That I would love to play with I have little to lose, my total investment in my CRX ahs been $150.00 and I'm not afraid to play!!!!:-)
IP:

91crxsi posted 01-29-2001 14:30 CT (US)
--------------------------------------------------------------------------------
TODAY's UPDATE: The PR3!
I managed to read a PR3 PROM over the weekend. I haven't actually verified it by running a copy on the car (a friend's B16A), but it looks pretty clean to me.

Anyway, the big news is that the fuel and ignition maps look like they are the same format as the CRX's! Not the same curves, but the same format (15 by 17 and all that). This makes me wonder if ALL Honda ecu's use the same format for their maps. So, understand one and you understand them all! That would be awesome.

Thanks to all you guys who have supported my research with donated computers and files. This is turning out to be bigger than I ever expected...

Finally, let me reiterate that it's not about the money. I'm not trying to take the "spoon" out of anyone's mouth (pun intended). Sure, I'll consider doing a favor for a friend here and there, but I'm really only interested in learning, not selling chips. My offer to read and socket your ecu's is still good, but please get your aftermarket chips/ecus from the vendors who rightfully own them.

91crxsi

IP:

SlowC posted 01-29-2001 16:47 CT (US)
--------------------------------------------------------------------------------
91crxsi
I've followed this every since day 1... I wish i had the knowlegde and know how. I have looked EVERYwhere and would like to know where to start so i can learn this on my own. Instead of bugging you and taking up your time. Please any help would be appreciated and i will be very thankful!


IP:

91crxsi posted 01-29-2001 18:22 CT (US)
--------------------------------------------------------------------------------
SlowC:
Well, the web is your friend. Not every Honda ECU is run by an Intel-compatible chip. Some are OKI nx 66K. But quite a few are Intel. Like mine, an 80C154. I think some early teg ecu's and the 88-89 CRX ecu's use an 83C154, which is the same as mine, except the PROM is contained within the same chip as the CPU. So, it's not exactly true that these ecu's can't be "chipped." It's just a lot more expensive, equipmentwise. An EPROM reader/programmer can be had for around $150, whereas a CPU programmer (what you need for the 83C154) is going to be $500+.

Anyway, as I was saying, the web is your friend. For spec sheets on your CPU, goto Intel.com. That's also a great source for info on the MCS-51 family of microcontrollers. Especially info on the instruction set and whatnot.

Next, grab some free tools, like a disassembler, which is a must if you want to analyze the code. My personal favorite (so far) is dis8051, which not only disassembles 8051/8052 code, but also includes a list of cross-references or memory locations. This is great to get a feel for which subroutines and lookup table locations are more important to look at. Also, a good hex editor makes looking at and changing maps a lot easier. For this, I like WinHex. You can arrange your data in 15-byte-wide rows, which is perfect for the maps, and it tells you what the value of each byte is in 8-bit unsigned integer values.

Of course, the most important thing, if you plan on doing anything with this info, is to get an EPROM programmer. Here again, the web is your friend. Just do a search for "EPROM programmer" and you'll find tons of them. Any one that can handle a 27C256 EPROM (i.e., probably any one that can program a 28-pin chip) will do.

Then buy yourself a soldering iron, eprom, chip socket, solder, needle-nose wire cutters for cutting out your stock prom, maybe some kind of solder sucker. And a floppy for your ROM image once you get it...

So that's it. EVERYTHING I needed to know about this, I found on the web. So it's out there. Just gotta go and get it.

Best of luck,
91crxsi

IP:

7PSI CRX posted 01-29-2001 19:37 CT (US)
--------------------------------------------------------------------------------
I've been following your posts also.
Great stuff! Keep it comming!


IP:

SlowC posted 01-30-2001 16:52 CT (US)
--------------------------------------------------------------------------------
91crxsi:
Thanks for all the great info. I was just stumped on how many pins the ECU chip had and the names and codes of them all. You gave me ALOT more info then i was expecting.. thank you!


IP:

91crxsi posted 01-30-2001 21:51 CT (US)
--------------------------------------------------------------------------------
TODAY'S UPDATE: CRX MAP CALCULATOR!
Hi, folks,

Previously, I posted a message that I had figured out how to program the ignition map. Now, I've got the injector map figured out. I've created an Excel spreadsheet that allows you to enter in the desired ignition timing and pulse duration and it calculates the byte values to enter into your ROM. It also shows you where to put them. With this little tool you can create your own custom CRX maps any time you want!

The calculation of the byte values for the pulse duration map is a little more involved than for the ignition map, so I'm not posting it here, but you don't really need to worry about it, since the spreadsheet will do all the work for you.

I'll wait until I get a bunch of separate requests for it and then I'll email it to everyone at once.

COMING UP SOON: ARE ALL HONDA ECU MAP FORMATS THE SAME?

stay tuned (pun intended),
91crxsi

IP:

killerb posted 02-03-2001 09:21 CT (US)
--------------------------------------------------------------------------------
Hey what kind of place would use these eprom readers? I want a copy of the code but don't want to spend like $1000 bucks on everything needed to get it.

IP:

91crxsi posted 02-03-2001 19:55 CT (US)
--------------------------------------------------------------------------------
killerb:
I'm not sure what kind of place has these readers. I know my workplace has one, and I'm sure the chip dealers all have one. Actually they are fairly inexpensvive - maybe around $150. If you go to an electronics store, you can sometimes rent them, as well. But I think that $150 is a small price to pay, especially considering that you will NEED one if you plan to program any eproms yourself, and you'd probably pay at least $150 to have someone else do it for you.

91crxsi

IP:

91crxsi posted 02-05-2001 21:29 CT (US)
--------------------------------------------------------------------------------
Today's Update: I'm still here...
Some of you have wondered if I'm still around because I haven't posted any new info in a few days. Yes, I'm still here, and I'm still looking through the code. It's just that it's pretty slow going and I haven't found anything particularly exciting in the past few days (unless you call a multi-byte multiplication routine exciting).

So far, I've gone through about 1/4 of the code. That probably took me at least 15 hours. I'm not exactly a whiz when it comes to reading assembly language code with no comments and only a vague idea of what it's supposed to be doing. Anyway, whenever I run across something that might interest the casual observer, I let you know. It's just that lately, there hasn't been anything to report.

One thing I can tell you is that I've had the chance to compare stock vs. aftermarket versions of both the PM6 and PR3 and, byte-for-byte, there's very little difference between them. I'm pretty sure I know where the bytes that set the rev limiter are on the PM6, but I don't know how to interpret/set them yet. And on the PR3, I'm down to about 5 different possible locations. It's a little harder with the PR3 because I don't have an easy way of knowing what's code and what's data. On the PM6, I just look at the disassembler output and it's pretty obvious.

more to come,
91crxsi

IP:

SlowC posted 02-09-2001 15:37 CT (US)
--------------------------------------------------------------------------------
Anything new ans exciting? I have looked and looked for days but no new info.... I hope everything is going smooth...

IP:

cingham posted 02-12-2001 14:49 CT (US)
--------------------------------------------------------------------------------
ooohhhhh aaaahhhhhh I read this whole post, I crave more 91crxSi keep cracking and I'll start gaining a small force of Si ECU's. Than we can under-cut the big dawgs and buy NSX powered CRX's
IP:

bodiby posted 02-15-2001 17:18 CT (US)
--------------------------------------------------------------------------------
I have looked at the code of what is supposed to be an upgraded ZC program and I can find the maps. I will soon have a stock ZC program to compare against (unless my freind destroys the chip).
Has anyone found info for the OKI processors (ZC uses OKI not intel)? Assemblers, compilers, etc? I know it must be out there, I just haven't looked hard enough.

IP:

SlowC posted 02-19-2001 17:30 CT (US)
--------------------------------------------------------------------------------
Well I designed a selector switch for the ecu, with the flip of a switch, you can choose stock/performance, stock/stock or performance, performance. This will be good for emissions and then racing all in one. I want to make a test switch soon!
IP:

91crxsi posted 02-19-2001 19:53 CT (US)
--------------------------------------------------------------------------------
Hi, All,
I'm glad to see that others are getting into the act and trying out their own experiments. Best of luck to you all!

I'm just writing today to let you know that this thread is not dead, although I have been away for a while. I'm still going through the PM6 code and I'm between 1/4 to 1/2 through it. I'm currently going through the code in the $3xxx range and it seems mostly to be math functions and A/D access. Not much to excite the average Joe.

If I get any leads on programming tools for the OKI chips, I'll let you know.

Thanks for your patience and continued interest,
91crxsi

IP:

91crxsi posted 02-22-2001 21:04 CT (US)
--------------------------------------------------------------------------------
Today's update: Does the stock PM6 have a bug??
Hi, all,

Well, analyzing assembly language code is about as exciting as watching paint dry, but every so often something interesting comes along. I've gone through about 5K out of 16K - and this is after about a month - so it will be a while before I'm done here.

The latest interesting bit of trivia is that there appears to be a bug in the stock code (that's what it looks like to me, anyway). There's a small snippet of code that seems to be written to read a value from a specific memory location, do some tests on it and return a modified value to the same location it came from. The problem is, instead of reading from a location, it's loading an absolute value. So it would be doing the same thing every time.

I'm not far enough along to be able to tell what this code fragment is used for, so I don't know offhand what the impact of this bug is. But I'm pretty sure it's wrong.

For those of you not particularly interested in programming, check back in, oh, 2 months or so.. :P

91crxsi
PS - rest assured that something more substantial and exciting is on the way..

IP:

AL posted 02-24-2001 15:30 CT (US)
--------------------------------------------------------------------------------
hi there 91crxsi,
It is really long time no see, I am really glad that u are back. Just wonder is your e-mail at yahoo still work? I try to e-mail u couple time but no reply?
Anyway, I have some progress on the Ign map, I made up a spreadsheet and did some alternations on the mid range of the Ign mapping and also did the checksum insert.IT WORKS!!!!! with no Engine lite.The car reponse time is a lots better than before and that probably due to the retarded timing of the stock Ign mapping.I guess the next step is just need to make a more agressive Ign to perfert it then I will start try out the Fuel mapping.
There is also something I find, remember there is a NEC big chip with BACK-XXXXX on top that we are not sure what it is before. It is probably a back up programming unit. I try to run the car without the rom. The car will go into limp home mode but it is still driveable.
On the last post u saying u can access the ram by input some data into the certain address and there will a response from your input, what tool(s)did u use to do that?Emulator?? I would like to hear from u if is ok :)?
Just wonder did u try out your Mitsu injector?? Hope it will work. I notice the pattern on the PM6 Fuel map,corret me if I am wrong. The valves seem to me are "off time vs on time"(pulsewidth) in that row of 15 LOAD point? Does it have any fomula u can use to create this kind of pattern?
Last thing, can u also tell me where is the rev limiter and map sensor location on the PM6 or even the pattern will help. Really greatful u are here to help us out.Thanks again.
Good luck all.
AL

IP:

silver88si posted 02-25-2001 02:12 CT (US)
--------------------------------------------------------------------------------
i have a question for u guys
i put a b16a1 jdm ecu in my 88 crx si
it ran fine and it seemed to be a faster
i threw codes but it ran fine
why did it work.
i also used a 90 crx si ecu and it was no different even though there is an extra sensor on the back of the intake manifold
on the 89-91
i threw no codes at all

also why does the 89 integra ecu always seen to throw code i which is the oxygen sensor.


IP:

ClubSiRacer posted 02-27-2001 00:00 CT (US)
--------------------------------------------------------------------------------
Interesting work being done here... I just wonder how it may work with newer ECU's? Did Honda decide to use the same programs & PROM's with their newer ECU's or are they more involved? Perhaps someone will be willing to donate a newer one for "testing".
While i'm asking, someone here surely has to be famaliar with the Hondata system. I was told you needed a burner to make changes where as the Zdyne uses a serial cable to upload changes directly. Has anyone read about the new LINK system for Hondas? http://www.carmodifications.com/Link_Po ... plugin.htm

Oh, and i'm looking to buy a used ZDYNE SECU Gold if anyone is selling one. Please email siracer@clubsi.com

[Edited by ClubSiRacer on 02-27-2001 at 22:40]

IP:

91crxsi posted 02-28-2001 13:55 CT (US)
----------------------------------------------


Top
 Profile  
 
 Post subject: continued
PostPosted: Wed May 15, 2002 5:18 pm 
Offline
Senior Developer

Joined: Tue Jul 27, 2004 2:09 am
Posts: 4384
Location: Cincinnati, Ohio
91crxsi posted 02-28-2001 13:55 CT (US)
--------------------------------------------------------------------------------
The newer ECU's use OKI processors, which are higher-powered from a computational and I/O standpoint. So the programs are totally different. Plus, they are necessarily more complex due to the OBD I and OBD II support mandated by Uncle Sam.
I don't know too much about the Hondata system but I think you're right about having to modify the EPROM to make changes. An EPROM simulator might be worthwhile here.

Finally, who would sell a ZDyne Gold? :P I don't know if there's any good reason not to hang on to it if you have one, esp. considering how much it cost you...

Anyway, today's update is that I'm officially over 50% through the code (at least a first pass)! At this rate, I'll have gone through the whole ROM by some time in mid-April. At that time, I have to go BACK and revisit the whole code base to try to figure out what's going on at a higher level. Yeah, it's tedious, but I'd say it'd be worth it, don't you think?

Slowly but surely,
91crxsi

IP:

ClubSiRacer posted 02-28-2001 15:04 CT (US)
--------------------------------------------------------------------------------
Figures that Honda would change chips in newer ECU's. Then again, that just makes it "faster" than before which is good to an extent.
Yea, it looks like i've gotta buy the ZDYNE outright. Too bad I dont have a core to send him. Anyone have a cheepo core I could have or buy real cheep?

IP:

KSR posted 03-01-2001 02:22 CT (US)
--------------------------------------------------------------------------------
Hey.... I can get a Zdyne Gold ecu for about $1300CDN.. I don't know what that is in US.. It's actually brand new and never been used. So if you're interested.. let me know.
IP:

ClubSiRacer posted 03-01-2001 16:36 CT (US)
--------------------------------------------------------------------------------
KSR, would this be one you already have or do you simply order them through ZDYNE at a discount? I'd be very interested... You have mail!
IP:

Yell88CRXsi posted 03-01-2001 16:59 CT (US)
--------------------------------------------------------------------------------
Silently watching and applauding your hours of work. I have a PR3, and everything that I'm reading here is good news to me. One day, I hope to have a copy of your PR3 code, and with a laptop...and a prayer...I hope to operate on mine :)
Thanx for the long hours.
Yell88CRXsi

IP:

NC_Rex posted 03-01-2001 00:00 CT (US)
--------------------------------------------------------------------------------
OBD Codes Explained
Everybody gets the OBD Thing confused, read this please.

[Edited by NC_Rex on 03-01-2001 at 20:53]

IP:

whoizrob posted 03-02-2001 03:08 CT (US)
--------------------------------------------------------------------------------
Just a thought. With the majority of a car's identity based in it's ECU, namely the PROM thats been such hot news lately, would it be possible to take one PROM from a host ECU, copy it and place it into a different ECU thereby changing the cars "identity"? I know that some ECUs have different wiring harnesses and being that I am fairly new at this thing I dont know if they have entirely different connectors or are the same connectors with simply empty or filled slots. I was hoping that perhaps when I go LS/VTEC I could grab a copied B16 PROM or similar and pop my LS PROM out of my ECU and do a switchero. I mean how different besides the processors are the ECUs? I suppose it's like Desktops where within a certain limit diff. CPUs can be flopped about but you jump up a generation and the parts aren't compatible...
Is this all idle speculation and uniformed wishful thinking? Thanks and sorry if the question is a bit basic.

Rob

PS. I applaud the adventuresome spirit of this experiment and love it when the little guy thinks and prooves that he can do better than status quo...


IP:

gobailey posted 03-02-2001 05:25 CT (US)
--------------------------------------------------------------------------------
So, does anyone know what the guts of a first gen si's ecu are made of? I wonder if the chips/data are very closely related to the PR3 you are playing with. I know someone that could make me some chips, but I don't know how on earth I would figure out where the ign and fuel maps are on mine. Anybody know what kind of chips an '87 si uses?
Grant

IP:

NC_Rex posted 03-02-2001 12:40 CT (US)
--------------------------------------------------------------------------------
91crxsi - which newer ecu's used the OKI processors? The B16A 89-91 ECU from Japan - or are you referring to the 92+ ECU's?
IP:

bodiby posted 03-02-2001 15:02 CT (US)
--------------------------------------------------------------------------------
NC_REX - One example is the PM7 that you sold me! I also have an ecu from a 92+ Integra LS that has an OKI processor.
IP:

91crxsi posted 03-02-2001 17:35 CT (US)
--------------------------------------------------------------------------------
Hi, guys,
It's actually not enough to say whether the processor was made by OKI or not. My CPU is made by OKI but it's Intel 8051 compatible. The giveaway is that it says (C) Intel 1980 on it. The Intel-compatible chips are 40 pins, while the OKI nX chips are 64 pins.

As for what cpu the 1st gen CRX uses, good question. My guess would be 8051-type. But I don't know for sure. The PR3 I looked at was made in 1990, the year before my PM6, but it already has an OKI chip. My guess is that pretty much every Honda from 1992 on is OKI (or at least not 8051-type).

And as for whether or not you can just swap out the ROM, my guess would be no. There's a lot more to an ecu than just a cpu and a PROM. Although, who knows? Maybe if both ecu's use the same cpu, it *might* work. The program would run, but if all the hardware is mapped to different memory locations, it wouldn't work properly.

Finally, let's not make too big a deal out of whether an ecu is Intel or OKI. It's true that there are a lot more resources for working with Intel cpu's out there, but the OKI's are also common, just not AS common. Hopefully I can get to work on them, too, eventually...

PROGRESS REPORT: I estimate that I'm through just over 60% of the code. I'd guess that it will take about another 30 hours to get through the rest. I'll know a lot by then, but I'll still have to go back and start putting things together by doing a higher level analysis.

91crxsi

IP:

honboy posted 03-07-2001 00:00 CT (US)
--------------------------------------------------------------------------------
91 crx si is [edited]
That language is not EVER appropriate.

[Edited by Steve Jones on 03-07-2001 at 17:23]

IP:

91crxsi posted 03-07-2001 15:42 CT (US)
--------------------------------------------------------------------------------
honboy,
Thanks for the compliment. I'm really an amateur when it comes to assembly language programming. It's just that not many other people with any kind of expertise in programming have been interested in analyzing the Honda ROM, except for the likes of Hondata, ZDyne, Mugen, etc.

I'm not familiar with the ballade jspec crx, although it sounds pretty exotic. Believe me, cpu's don't speak Japanese. :P Maybe what that person meant was that the source files' comments were in Japanese, which is entirely likely. It doesn't really matter, though - you'll never see those files, anyway, and the assembly language is the same either way. I'd love to have a look at your ecu but of course I doubt if you'd be willing to part with it!

TODAY'S PROGRESS REPORT:
Since my last update (3/2/01), I've really been trying to use as much of my free time as I could to work on this project. I'm glad to say that I've made good progress - I'm now just about 80% done with the first pass through the code. If I can keep this rate up, I'll be all the way through by the end of next week! Which is not to say that I'll have a complete picture of what's going on in there, but at least I will have seen the code in its entirety and can begin to piece things together to see what's going on.

stay tuned,
91crxsi


IP:

SlowC posted 03-07-2001 23:20 CT (US)
--------------------------------------------------------------------------------
91CRXSI
Keep up the good work. All i can say is that i've looked into all this and there is way to much for me. I will stick to my "building race engines" and let the electrical technical work be done by one with the patience and technical know how when it comes to that.......... Good luck and hope that you can learn something more out for yourself and maybe make yourself a little extra money for this sort of thing....
To all that has the patience and know how or this sort of thing... I wish i were you, i have the interest, just not the patience...
SlowC
IP:

91crxsi posted 03-09-2001 13:36 CT (US)
--------------------------------------------------------------------------------
TODAY'S UPDATE: First Pass Complete!
It took long enough, but I've finally finished going through ALL the PM6 code and commenting everything I could make sense of. I can't say that I understand it all 100%, but I can say that I've at least seen it all.

Next, I need to go back and figure out exactly what's going on in there. I will break the code down into subroutine blocks, and try to figure out what each section is for.

Hopefully I'll be doing some simulation, too. In order to do that, though, I'll need to write a few routines of my own, since the PM6 code seems to use an "A5" command which is not a standard 8051 command. Why Honda chose to do this is a bit of a mystery to me, since what the A5 command does can be easily done using a few standard commands.

Finally, I was going to wait until at least 25 people had asked me for the fuel/ignition map calculator before sending it out. I think it's around 20 people now, so I'll go ahead and email those who requested it.

91crxsi

IP:

i Want An SI posted 03-09-2001 14:24 CT (US)
--------------------------------------------------------------------------------
Keep the good work up!
IP:

AL posted 03-09-2001 17:00 CT (US)
--------------------------------------------------------------------------------
Right on, keep it up!! Hope will hear from u soon.
IP:

honboy posted 03-10-2001 12:38 CT (US)
--------------------------------------------------------------------------------
i profusely apologise to all who felt offended by my profanities the other day - im australian mate - its just natural to relay gratification in such a manner- sorry if this is uneccessarily clogging up the site .keep up the good work 91
what extend of dismantlement do i have to got through to take my ecu apart for you - im hmmmmmmm somewhat willing to participate giving the rarity of my case - you see - i live in Western Austalia and only 7 exist here-there were8 but the supercharged on found a pole............
so do you just need a chip or the whole board? im fairly experienced with electronics
IP:

KSR posted 03-11-2001 13:30 CT (US)
--------------------------------------------------------------------------------
91CRXSi... keep up the good work..
Waiting anxiously..

IP:

SlowC posted 03-11-2001 16:54 CT (US)
--------------------------------------------------------------------------------
honboy,
It is good to see that apology, even though i was not able to see what it was that you said, it is rare to read an apology on here!!!
SlowC
IP:

honboy posted 03-12-2001 07:07 CT (US)
--------------------------------------------------------------------------------
thanks slowC- i basically said that hes an fn legend is all........not much else - 91 saw it- didnt sound to me like he was offended-
IP:

91crxsi posted 03-12-2001 21:49 CT (US)
--------------------------------------------------------------------------------
Hi, All,
How's it going? Today's tidbit: CHECKSUMS

What is a checksum? It's a quick and dirty way of checking to make sure your ROM hasn't been corrupted.

How is it calculated? Well, take all the bytes in your ROM image and add them together, keeping only the lowest 8 bits. Then subtract that number from 0. You get some number. That's a checksum.

When the program calculates a checksum on the ROM and it comes out different than what it was expecting, it codes. That's why you can't just change a few bytes of the stock ROM and expect it to work without making sure that the checksum comes out right.

I have a small collection of ROM images now, and it seems that almost all of them (stock and otherwise) have a checksum of exactly zero. The Mugen PR3 is a notable exception. Maybe they bypass the checksum calculation part of the program.

It also doesn't matter if it's a chip for an Intel CPU or an OKI CPU. So if you're planning on modding your own chips, make sure that you're making the checksum come out to zero (by playing with the value of an unused byte) or the ecu will probably code when you try to test it out.

91crxsi

IP:

7PSI CRX posted 03-13-2001 07:37 CT (US)
--------------------------------------------------------------------------------
I got your email yesterday,
Thank You Johnathan!

Also thanks for the COMPLETE INSTRUCTIONS on what to look at, and to save a copy as a read only.

I've been following your post here since:
Day 1,
Line #2
"Hi, All,
Listen up - I just installed a JRSC in my '91 CRX Si and it's great,"

Well, I also have a JRSC, and I'd like to know, now that you know much more about Honda ECUs and maps, is,
What have you done in the "Real World?" (pardon my expression)
What I mean is "YOUR CAR".

Do you still use the rising rate fuel pressure regulator?

Is the timing on your car set as JR says?

Or do you have a "working copy" of a modified ecu map installed in your car?

Or are you "planning" this step as soon as you read and compare "many different" ecu maps?

I literally have.....

THOUSANDS OF QUESTIONS!

Don't forget my email address!

And if you don't mind, keep me updated!

Thanks again,
John


IP:

91crxsi posted 03-13-2001 13:24 CT (US)
--------------------------------------------------------------------------------
Hi, 7PSI,
Right now I'm running the JR-recommended setup (except for a 3.2" pulley instead of the 3.4"). I have a set of 450cc injectors off a Mitsubishi Eclipse Turbo, but haven't installed them yet, as one of the plastic pintle caps came cracked and I wanted to get them flow tested. Once that's done, I'll install them and get rid of my RRR. I was under the impression that RRR was there, not because the stock fuel map couldn't handle it, but because the stock 240cc injectors can't flow enough at 36psi. Is that true or not?

Also, (and this is a bigger task) I have yet to figure out how to modify the program to understand and handle boost. I've heard that the stock MAP sensor is good up to around 1 bar, which gives us JRSC users plenty of headroom (7psi is just under 0.5 bar, right?). So the hardware is in place. It's just a matter of figuring out how to get the program to switch over to boost maps when the MAP sensor sees boost.

It will be great to do away with the RRR and temperature compensation resistor and do the setup "right," (i.e., how Honda might do it if the car had come from the factory with a supercharger).

I'll let you know how things go.

91crxsi

IP:

AL posted 03-13-2001 13:59 CT (US)
--------------------------------------------------------------------------------
91crxsi,
Sound very interesting, I hope u can figure out about switching the regular map to boost map soon because I am planning to turbo charge mine by the end of the summer. As of now I just ran the minor modified map and it already have good improvement. Hope u guys will have good result of the modified map and have lots of fun...
AL

Alex

IP:

honboy posted 03-14-2001 06:09 CT (US)
--------------------------------------------------------------------------------
if you want to know about chips that learn about boost- look at a nissan sr20det computer- they adapt to different situations just from the sensors and store the data - boost levels are found just by the airflow sensor -damn things are super human- thought it may help-?
IP:

cingham posted 03-15-2001 00:00 CT (US)
--------------------------------------------------------------------------------
no post just wanted to be #100 on the longest post ever
____________________________________________

And here I was, expecting something Earth-shattering for the 100th post...

[Edited by Steve Jones on 03-16-2001 at 18:25]
____________________________________________

if you saw me in public it's pretty earth shattering

[Edited by cingham on 03-19-2001 at 17:15]

IP:

honboy posted 03-19-2001 07:56 CT (US)
--------------------------------------------------------------------------------
KABOOOOOOOOOM
-oops - #101 did it
IP:

91crxsi posted 03-19-2001 00:00 CT (US)
--------------------------------------------------------------------------------
Hi, guys,
Today's update: THE END (for now)

Well, this post *is* getting extremely long - perhaps it's time to retire it... But here's one last update before I go...

I'm making decent progress through the code the second time around. I'm beginning to see the "big picture" structure of the program more:

up to 15FF, it's all the interrupt handling routines (things like, it's time to turn on/off the injectors, it's time to check the analog inputs, it's time to respond to some serial communications, etc.).

The program actually "boots up" at 1600. There it goes through some preliminary memory tests and sets up some variables with default values. Then in the 1800's the program pretty much goes into an infinite loop. That is, it just keeps doing the same thing over and over again (interrupted by the occasional interrupt mentioned before).

The loop has two main subroutines - one at around 1900 and another starting around 2000. These take up all the ROM up to around 3000.

From 3000 to 3600, there's some secondary subroutines used by the main ones.

From 3600 to about 3B00 it's a hodge podge of data tables.

From about 3B00 to about 3E00, there's some more subroutines, including the code that works with the timing and fuel maps. The timing map begins at 3DF3 and the fuel map goes from 3EF2 to 3FFF.

4000 to 4375 appears to be a collection of last-minute additions to the code (patches, bug fixes, etc.)

The whole program spans from 0000 to 4375. The rest of the ROM (4376-7FFF) is unused.

That's all - for now. I most likely won't have anything very exciting to report for quite a long time, so rather than keep you waiting here in suspense, I'm going to end this post here, and start up a fresh thread when I have accumulated a number of interesting findings for you.

Thanks all for your support and interest. I'll be back!

91crxsi

PS - by the way, while I may know something about computers, I'm pretty mechanincally inept. Can anyone tell me how difficult it would be to change my water pump (in my '91 CRX Si, of course)?

[Edited by 91crxsi on 03-19-2001 at 15:09]

IP:

i Want An SI posted 03-19-2001 15:15 CT (US)
--------------------------------------------------------------------------------
lol thanks for all the info...
as far as your water pump goes...you can do it without taking off the timing belt, but if youre due for a timing belt anyways do them both at the same time....

if you do the timing belt, unless you have an impact gun you wont be able to get the crank pulley bolt off...

to do the water pump alone i believe you still need to get the crank pulley bolt off

IP:

synoptic posted 03-25-2001 22:35 CT (US)
--------------------------------------------------------------------------------
I read all this in one shot !
That's a cool project !
So, If you can guide me on interprating the returned values of "submitted" adress value when using serial communication, I'll try to make a coolie programm that diplays Graph and such on a laptop if you plug it into the serial port of the ECU. :)

I feel like I want a K2000 :)

See ya.

PS, oh, can you tell me how you did plug a computer into ECU ? By soldering a DB-9 plug or what ?


IP:

zccirex posted 03-26-2001 00:00 CT (US)
--------------------------------------------------------------------------------
okay the the question of legalities keeps coming up,and i dont understand why,after all there are repair manuals that give out information and they arent affiliated with honda.and besides,does it say anywhere on the car,ecu or anywhere else that you cant tamper and exchange information?selling might be a problem but just passing around info cant possibly be illegal.the only thing that comes to mind that says not to tamper with anything is that it might void the warranty.raise your hand if you still have a factory warranty on your rex.i may be wrong but thats my logic to it,the most they could do is to make a new design for new models to prevent this from happening later on.
[Edited by zccirex on 03-26-2001 at 12:02]

IP:

91crxsi posted 03-26-2001 14:42 CT (US)
--------------------------------------------------------------------------------
i Want An Si: Thanks for the tip. I traced my coolant leak to a worn-out radiator cap, so I'll hold off on the pump surgery for now. Thanks.
synoptic: I never actually connected a computer to my ecu. You would need a high-speed serial comm port, and when I say high speed, I don't mean 56K. The comm port on the PM6 is 375K, a baud rate most computers don't normally support. But there are third party peripheral boards that do go up to 375K and beyond, so you may be able to do this.
As far as the physical connection goes, you'll need to solder a connector to the pads next to the 64-pin chip (the biggest one on the pcb) labeled CN3. CN3-2 goes to the CPU's receive pin and CN3-4 goes to the transmit pin. I'm pretty sure it follows RS-232, so take a look at an RS-232 FAQ for the pinout on a DB9 cable. Good luck. Let me know if you are successful! By the way, as far as I can tell, all the measured variables like RPM, MAP, etc. are stored in the ecu RAM so if you made this program you'd be able to read out those variables. Even log them... It would be a very useful tool indeed! Actually, come to think of it, this program and the necessary hardware probably already exist and are collecting dust somewhere in a lab at Honda Japan. :P

zccirex: I totally agree that everything you say sounds completely reasonable, but I'm not a lawyer, and I'll hazard a guess that nobody else on crx.org is, either. So I don't know for sure. I'll wait for an expert's decision. Either it is illegal or it isn't: how we feel about it really doesn't make any difference in the end.

As I said, I'll start a new thread sometime in the next few months with a more substantial progress report.

Peace,
91crxsi


Top
 Profile  
 
 Post subject: Part II
PostPosted: Wed May 15, 2002 5:21 pm 
Offline
Senior Developer

Joined: Tue Jul 27, 2004 2:09 am
Posts: 4384
Location: Cincinnati, Ohio
91crxsi posted 09-16-2001 22:38 CT (US)
--------------------------------------------------------------------------------
Hi,
About 9 months ago I pulled the EPROM out of the PM6 in my '91 CRX Si and read the program off it. Since then I've spent hundreds of hours analyzing the code and the data to find out exactly how the ecu works. Some of you may have seen my old thread, "ECU Secrets Revealed!"

Well, I have finally gotten to the stage where I'm confident enough to try some actual mods to the Honda PGM-FI program on my own car. Here are a list of mods I've either done or plan to do:

remove non-standard codes from program - DONE. No performance benefit, but it makes me feel better.

fix bug in stock program (!) - DONE. No perceived benefit, but it was DEFINITELY a bug.

figure out why the car sometimes dies at idle when cold - not yet. This one drives me crazy. Not even sure it's a program bug, but I think it is. One thing I know is if the vacuum line to the dashpot on the throttle is disconnected, my rpm's go up to about 3000 at idle (without the throttle depressed). So maybe it's a problem with the dashpot? Don't know - mechanical stuff is not my thing.

remove checksum check - could do, but won't. No clear benefit from doing this.

add datalogging - DONE. I should be able to run my car with my Palm Pilot connected to the ecu and collect info on RPM, speed, coolant temp, air temp, MAP, etc.

make ecu "boost-tolerant" (i.e., won't throw a code when MAP sensor sees boost) - DONE

create basic fuel and ignition maps for boost - working on it, maybe done in a week? Then I can get rid of my rising rate regulator, intake air temp compensation resistor and reset my ignition timing to stock. Those were all band-aids that I won't need anymore once the ecu is set up properly.

simple VTEC control - planned (not a high priority as I currently have a JRSC'd D16A6)

drag and full-throttle-shift RPM limiters - planned

self-learn mode - planned - but I have no idea how to accomplish it, yet.

Anyway, if you have any other cool ideas, let me know. I'd like to eventually be able to do everything that ZDyne and Hondata do, for less (i.e., nothing! :P ).

91crxsi



BIG RICH posted 09-16-2001 23:00 CT (US)
--------------------------------------------------------------------------------
Man that's cool. I wish I could do that stuff.
IP:

Leb_CRX posted 09-17-2001 02:22 CT (US)
--------------------------------------------------------------------------------
word! wanna sell us your NEW improved ECU once it gets up and running? 5$ best offer :)
hehe

|eb_CRX

IP:

7PSI CRX posted 09-17-2001 03:56 CT (US)
--------------------------------------------------------------------------------
The next thing on your list has to be a removable/replaceable chip, or a chip that can be updated/re-written, or whatever you'd call that.
I also liked the idea about having two seperate programs on one chip.

And, if you're gonna' go all-out,
the clutch launch rev-limiter idea.
(whenever the clutch is depressed, max RPMs of about 3,000 RPM even with full throttle)

After you started that last thread, I went and got myself a spare PM-6 ECU, which you will find in your mailbox as soon as you say "go".

(along with a nice check, of course!)

IP:

xtensive posted 09-17-2001 11:42 CT (US)
--------------------------------------------------------------------------------
Hey,
I'm starting to trail behind you now! Slow down! ;-) Out of curiousity, did you replace the MC too, or just the 28 PIN ROM chip? I'm still waiting on the friggin' AT89C55 chip to get here, so I can test my stock ROM image in it, but I ordered it last Monday with the 2nd day Air option, and well, it hasn't gotten here as of yet, due to our current crisis. I've got the 88 ECU if you remember, so I have to replace the whole MC, and I am HOPING that the AT89C55 chip will suffice. Keep us posted on your progress!

Mike

IP:

91crxsi posted 09-17-2001 13:50 CT (US)
--------------------------------------------------------------------------------
BIG RICH:
Well, once I get everything working, I'm planning to share the fruits of my efforts with you all.
Leb:
Haha - I never went into this for the money, but hey 5 bucks will buy me a decent meal at McDonald's. :)

7psi:
My chip already is removable/replaceable. Has been since January. Of course your case is a little more complicated, since you have to pop the mcu out, but only a little. If I were you, I'd look into installing a ZIF socket, as removing/inserting a 40-pin IC into a regular socket can be tricky. I don't care so much because the eprom is only 28 pins and if I mess it up I'm only out a couple bucks.
The 2 separate programs is really an EASY mod. I hesitate to do it only because it requires a hack job on the ecu board, and I've been trying to minimize the hardware changes.
Thanks for offering to pay me to upgrade your pm6 - I could use a few more happy meals. :P

xtensive:
I didn't have to replace the mcu, although I may look into that in the future. Newer mcu's are so advanced compared to the stock chip - one modern 8052-compatible chip can literally replace maybe a half-dozen IC's in the original ecu, and are much more powerful computationally. The only trick is making sure the timing isn't messed up.
Maybe you should consider upgrading to a newer ecu with an eprom. Don't people successfully run their '88's with '91 ecus?

91crxsi
PS - if anyone has any more cool ideas, pls share! Thx

IP:

xtensive posted 09-17-2001 14:27 CT (US)
--------------------------------------------------------------------------------
Hey 91CrxSi,
I'm using the 88 'cause that's what I had when this whole idea poped into my head. The teg ECU is running my car, so this guy was just sitting around, begging to be taken apart ;-) Anyways, if the AT89C55 doesn't work, I may try a different one, or breakdown and get a 90-91 ECU to play with. I am really curious on the datalogging though. How are you getting the readings? Also, what Palm program are you using to interpret them? I'd also like to take a look at the spreadsheet you had talked about earlier on regarding the fuel mappings.

Glad to hear you are actually running a self hacked ECU successfully too!!!

Mike

IP:

Leb_CRX posted 09-17-2001 15:30 CT (US)
--------------------------------------------------------------------------------
good point....hmmmmm it IS a happy meal at mcdonalds...deal off!
actually keep us informed man, I been trying to follow this since day 1, quite interesting!

|eb_CRX

IP:

kamikazeWangan posted 09-18-2001 23:18 CT (US)
--------------------------------------------------------------------------------
Hey where do you stand right now with being able to do anything in reguard to the 87 si ecu? What mods?
-Ben-
87crx si

IP:

Longrex posted 09-18-2001 23:41 CT (US)
--------------------------------------------------------------------------------
add datalogging - DONE. I should be able to run my car with my Palm Pilot connected to the ecu and collect info on RPM, speed, coolant temp, air temp, MAP, etc.
EXCELLENTA!!! Now, GOd! great! Indigenous - even... But can you help me identify my "teg" ECU? In magic marker scribble it says: 88 Integra 668-Y, (or:668-4 {?}), printed on the metal next to the sticker:'88.2.19, and a symbol. The sticker says:37820-PG7-A020/682-111512/8W.Is this for automatic or manual? I have an '89si and a 91 DX with automatic, which car should I try to put it in? any bennies to the positive besides down-time?

IP:

91crxsi posted 09-19-2001 12:26 CT (US)
--------------------------------------------------------------------------------
kamikaze:
I'm not familiar with the '87 ecu. Maybe you should ask xtensive - it's probably more similar to his 88 ecu. Is the 87 even fuel injected?
Longrex:
As far as your teg ecu goes, don't know. Are there any model number experts out there? And pardon my ignorance, but what the heck does "any bennies to the positive besides down-time" mean? :P

I'm really not a Honda ecu expert - just specializing in the '91 pm6. Maybe I'll look into others later, particularly these older ones as many of them are 8051-based. It will be a while (maybe never) before I delve into the OKI-based ecu's. It might be easier, though, to master one ecu and figure out how you'd need to adapt the connectors to work with other cars.

91crxsi

IP:

Don the CDN posted 09-19-2001 14:09 CT (US)
--------------------------------------------------------------------------------
All I can say is holy pooh. I was just wondering about what ever happened to your endevers as this page was opening. now here is a Suggestion for you... modify air fuel ratio's can that be done? How does the Palm Pilot plug in work? I mean can you actually modify any thing with the Palm Pilot or it's basically just a read out? Vtec Controller. Does anyone know if the 1st gen B16A PR3 ECU is 8051-based? Or is it OKI-based? Cool stuff dude I want me a Hacked Si ECU for the next CRX Si SE... Heck I still have my original Si ECU.
IP:

91crxsi posted 09-19-2001 16:26 CT (US)
--------------------------------------------------------------------------------
Don:
Yes, I could modify the air-fuel ratio, if: 1) I knew where the closed-loop control code was, and 2) I had a wide-band O2 sensor installed. Without 2), it's not really possible with a narrow-band "lambda" sensor to tell how lean or rich you are with a high degree of certainty. The only thing you'd know for sure is that you're either at stoich, lean or rich, but not HOW lean or rich.

About the Palm Pilot plug-in. It doesn't have to be a Palm Pilot. Any device that can serve as a terminal with a serial port will work (like a laptop, for instance). It's just that I don't have a laptop, can't afford one and I had an old Palm Pilot sitting around. Right now, my code is set up to just spit out data. But there's no reason it couldn't be modified to accept input from the Palm Pilot to change things, such as fuel/ignition maps, redlines, etc. It would just take more work.

VTEC controller - already considering this, but haven't started working on it yet.

I've opened a 1990 PR3 and it's NOT 8051-based. I don't know if the earlier models are or aren't.

91crxsi

IP:

crx140 posted 09-19-2001 00:00 CT (US)
--------------------------------------------------------------------------------
I've got an '89 PR3...I didn't read your other threads but speed limiter and vtec crossover are very key in this ECU. I would also like to ditch one o2 sensor. Is it readily apparent (if I open the case) whether or not mine is 8051 based?
[Edited by crx140 on 09-19-2001 at 23:57]

IP:

91crxsi posted 09-20-2001 13:30 CT (US)
--------------------------------------------------------------------------------
crx140:
Sure - remove the top cover and look for a large chip with 40 pins, probably in the lower right corner (when the connectors are on your left). Anyway, if it's there, let me know what's printed on it. If you don't see it, or if you see it but there isn't a "Copyright 1980 Intel" on it, you're out of luck.

91crxsi

IP:

George_R posted 09-21-2001 12:25 CT (US)
--------------------------------------------------------------------------------
Hi Everyone,
91crxsi,
I've got a '88 JDM CRX Si (i.e. ZC) with the stock ZC ECU - a PM7.
From what I can gather, the MC is the same as yours, an OKI M80C154, but it doesn't say anything about "copyright 1980 Intel" as you said it should.
Apart from this one, there are three other OKI chips:

64Pin M6260A
24Pin M51528-15
28Pin M38256AP

I'm guessing that the last one contains the ROM Image and so would be the one to read the data off.
It seem's to conflict with what xtensive mentioned in a previous post though, about his PM7 having the 83C154 with the internal ROM.

Does what I've said make sense - I sure hope so :)

Anyway, thanks for any help,

George


IP:

91crxsi posted 09-21-2001 02:59 CT (US)
--------------------------------------------------------------------------------
Hi, George_R,
That 80C154 SHOULD have the Intel copyright on it - legally speaking. No matter - it's still an 8051-compatible chip.

You're right about the last chip. That's your eprom. It's interesting to me that your's (a PM7) has an eprom while xtensive's (a PM6) does not. There doesn't seem to be any consistency to which ECU's have eproms and which put the code in with the microcontroller chip. There also doesn't seem to be a clean delineation in time from when ecu's used 8051 chips and when they switched to the OKI-based chips. For example, my friend's 1990 PR3 is OKI-based, while my 1991 PM6 is still 8051. I guess you can't really tell until you open the box and look inside...

But hey, that's great about your PM7 - it means that if you can extract the eprom and read it, we might be able to discern what are the differences between the ZC program and the USDM Si program. Cool. I'd love to have a look at the PM7 code if you ever manage to read it!

Thanks for the info,
91crxsi

IP:

George_R posted 09-21-2001 07:08 CT (US)
--------------------------------------------------------------------------------
Hi again 91crxsi,
Thanks for the info. I'm a bit hesitant to start pulling my ECU to bits due to the fact that I can't find any replacement EPROM's faster than about 100ns here in New Zealand (p.s. do they have to be a certain size/specification?).
Also, being a student, I'm a bit short of cash, so purchasing an EPROM burner isn't a priority at the moment - I might see if I can use one at Uni though.
The last problem is that I've only got one ECU - although finding another wouldn't be a problem, but again, it would be expensive. :(
Also, I was wondering how exactly you were doing the data logging - is it through the CN3 connector or some other way?
If I ever get the ROM image, I'll be sure to send you a copy (it may not be for a while though)

Cheers,

George

IP:

91crxsi posted 09-21-2001 13:46 CT (US)
--------------------------------------------------------------------------------
Hi, George,
I think I may have misled people about the necessary speed of the eproms. I've used a 150 ns eprom in my car for several months now with no apparent problems. These should be easy to come by. Make sure it's 28 pins, of course, and at least 32K. 64K chips should be ok, too. And make sure it's an EPROM, not a RAM or ROM or EEPROM. Also, if you plan on reprogramming it, make sure it's not OTP, which stands for "one-time programmable." Although once I did get a chip labeled OTP that was actually reprogrammable, but that's another story...

I understand your hesitance to hack on your ecu. I was the same way. But let me reassure you, if you remove the stock eprom and can read it, it's really no problem to solder in a chip socket, burn a copy of your stock program onto a new eprom and pop it back it. Your ecu won't know the difference. Just think of the eprom as a very low tech disk drive.

Anyway, I don't mean to pressure you - just trying to lessen your anxiety should you choose to give this a try.

About datalogging - yes, it's thru CN3. The 80C154, in typical 8051 fashion, has a serial port, and it can be accessed via CN3. How convenient of the Honda engineers to leave this connector available to us. :) In fact, in stock form, you can communicate with the ecu and find out what's stored in different memory locations, except for 2 things. 1) they use an oddball baud rate that practically no PC supports and 2) they use a 9-bit protocol while most serial communications programs people use have 8 bits (not including parity and start/stop bits). So I had to reprogram the serial comm to use a standard baud rate and data format.

91crxsi

IP:

cingham posted 09-21-2001 16:03 CT (US)
--------------------------------------------------------------------------------
one of the guys on my team has a chip reader too, but we are getting some programs for free pretty soon.
all we need now are some clean chips
IP:

CRXinNZL posted 09-21-2001 17:19 CT (US)
--------------------------------------------------------------------------------
George.
I live in Akld, NZL. Where are you?
I work for a computer hardware importer and distributor, and by chance we import EPROM burners :-)

Easy enough to hook one up in the office and download the code. My `88 Si ZC is currently in a state of "I don`t want to start for you" (see ongoing thread). However, once I get it going I want to examine the ECU code. I havn`t pulled out the ECU to determine which chips it`s using, but I want to datalog. Mainly because of the huge pain in the arse CAMS the previous owner installed. The idle just SUCKS, and I wanna see what I can do without buying a $2500 wolf 3d ECU. Let me know where you are - maybe we can both screw up our ECU`s :-)...





IP:

George_R posted 09-21-2001 19:28 CT (US)
--------------------------------------------------------------------------------
Hi,
CRXinNZL,
Unfortunately I live down in Palmerston North - a bit far away :(
Now that I know I can get replacement EPROM's, I'm not so hesistant to start ripping apart my ECU - still a bit hesitant considering that if I wreck my ECU I can't get to Uni, but not nearly as much :)
Does your company sell retail? If so, how much for the EPROM burners? If they're more than $NZ115 don't worry, as I can build one from a kit for that price.
Hopefully if we both try and pull apart our ECU's, we won't both kill the EPROM and have to buy another ECU!!! :)

91crxsi,
You've done a good job of lessening my anxiety :). All I need now is a couple of days where I have access to a burner and don't mind not having a car (in a worst case scenario ).
Also, about the data logging, once I get a replacement EPROM installed and have the image file, would you mind showing me your code for altering the baud rate/data format - because data logging would be pretty awesome!!!

Cheers,

George


IP:

George_R posted 09-21-2001 00:00 CT (US)
--------------------------------------------------------------------------------
Sorry, Quadruple Post
[Edited by George_R on 09-22-2001 at 05:40]

IP:

George_R posted 09-21-2001 00:00 CT (US)
--------------------------------------------------------------------------------
Sorry, Quadruple Post
[Edited by George_R on 09-22-2001 at 05:41]

IP:

George_R posted 09-21-2001 00:00 CT (US)
--------------------------------------------------------------------------------
Sorry, Quadruple Post
[Edited by George_R on 09-22-2001 at 05:42]

IP:

D15si posted 09-21-2001 21:19 CT (US)
--------------------------------------------------------------------------------
Hey,
I don't really know about any of this but for the record I would like to state that the 87 si IS Fuel Injected. so... does that mean I could play with my ECU as well?

IP:

91crxsi posted 09-22-2001 12:49 CT (US)
--------------------------------------------------------------------------------
D15si,
You could always play with your ecu. Whether you could actually do anything *useful* with it, well... :)

But seriously, why not crack it open and see what's inside? That'd be the only way to know for sure whether you can do anything with it.

Let us know what you find,
91crxsi

IP:

7PSI CRX posted 09-22-2001 00:00 CT (US)
--------------------------------------------------------------------------------
Is this the chip?
Click To Enlarge




And here is a LARGE pic
of the inside of my PM6.

It's the chip right between the
"center" cover mounting screwholes
on the right side of the box,
correct?


http://server35.hypermart.net/heyrizz/J ... %20002.jpg




[Edited by 7PSI CRX on 09-22-2001 at 15:25]

(Tried to make the pic smaller)

Does that make the page load any quicker?


[Edited by 7PSI CRX on 09-24-2001 at 17:21]

I realized the smaller pic does not load any faster, so I put the URL instead.

[Edited by 7PSI CRX on 09-28-2001 at 17:26]

IP:

George_R posted 09-22-2001 18:46 CT (US)
--------------------------------------------------------------------------------
Hi 7PSICRX,
The chip you have a closeup of is the processor. The PROM (the chip with the program on) is the one labeled M38256AP-65 in your case i think (mine is M38256-50, but it's a PM7). It's the 28 pin chip two below the processor in your pic (with the big 65 on it).
My PM7 look's identical to your PM6, with the exception that mine seems to have 50ns PROM, yours having 65ns PROM.

Hope that helps,

George


IP:

91crxsi posted 09-24-2001 01:41 CT (US)
--------------------------------------------------------------------------------
Hi,
I don't think the 65 on your eprom refers to its speed. I used to, but now I think that's incorrect. The eprom I pulled from my friend's PR3 has a big 58 on it, and I've never heard of a 58 ns eprom before.

Instead, I think it probably has to do with what program is stored inside of it. I'm sure Honda bought a large enough quantity of these from OKI that they had them print numbers on them to identify which program each chip contained. That could be wrong, too, but it seems like a logical guess.

91crxsi

IP:

George_R posted 09-24-2001 04:21 CT (US)
--------------------------------------------------------------------------------
Hi,
I wasn't too sure about that 65 being the access time either - It would explain why you are able to run 150ns EPROM with no probs.

Sorry for the misinformation 7PSI CRX,

George

IP:

CRX Si posted 09-24-2001 10:50 CT (US)
--------------------------------------------------------------------------------
I love reading about this. I was just wondering where you where on this. Keep up the awsome job.
IP:

xtensive posted 09-28-2001 11:09 CT (US)
--------------------------------------------------------------------------------
Woo hoo, the AT89C55 FINALLY arrived yesterday from Germany, so I can start testing this weekend. If this works, then it proves that the 88-89 ECU can be chipped as well, even though the MC and ROM are on the same chip, with no external ROM source. The chip I'm replacing is the 40 pin OKI 83C154 MC from my 88 Si ECU. I'll keep you updated on if it works or not.
Mike

IP:

91crxsi posted 09-28-2001 12:04 CT (US)
--------------------------------------------------------------------------------
Hey, xtensive,
Good luck with your ecu surgery! And rest assured, it can be done. ZDyne proved it a while ago!

91crxsi

IP:

91crxsi posted 10-02-2001 21:20 CT (US)
--------------------------------------------------------------------------------
Hey,
I thought I'd give you an update of what I've been able to figure out, compared to what a ZDyne super ECU can do:

Full 3D adjustment of fuel and spark while the engine is running: I know how to manipulate the fuel and spark maps, but not when the engine is running (not yet, anyway).

Forced induction timing and fuel: DONE

VTEC control: I know how to do this, but haven't tried it yet.

NOS control and timing retard: (see VTEC control)

A/C shutoff: don't know how to do this yet

Launch Clutch Cut, Full Throttle Clutch Cut, Hot/Cold Rev Limits (as well as switchover temperature adjustment): just found the code that does this two days ago! (thanks to a comparison of an aftermarket program to stock. By the way, this particular chip vendor claims to raise the limiter to 8000 RPM, but they actually just remove the limiter altogether)

Target Idle: haven't found this one yet, either.

I'm aiming to have all of the above (except NOS and VTEC control, which I'm not that interested in, with a JRSC'd D16A6) figured out and working in my ecu by the end of the year.

91crxsi

IP:

7PSI CRX posted 10-03-2001 03:36 CT (US)
--------------------------------------------------------------------------------
I was looking at the stock CRX fuel map, and a few of the Zdyne samples using the stock injectors.
Does anyone know the maximum milliseconds the injectors can stay open before maxing out,(100% duty cycle) at say 7,200 RPM?

I know you should not run the injectors over 85% duty cycle, but how do I convert that into milliseconds at say, 7,200 RPM???????

It seems to me that the stock injectors are already working hard, with up to 10-11 ms @ 8,000 RPM.

Are bigger injectors absolutely necessary with the stock fuel pressure?



IP:

91crxsi posted 10-03-2001 13:41 CT (US)
--------------------------------------------------------------------------------
7psi:
I'm no expert on fuel injection, but you may want to check out RC Engineering's website. They have a fuel injector calculator worksheet at http://www.rceng.com/technical.htm#WORKSHEET

Enter the following:
Crankshaft HP: 118
# injectors: 4
BSFC: 0.6 (for your JRSC)
Max. duty cycle: 0.85 (they recommend 0.8)
fuel rail pressure: 36psi (stock)

You'll see that this corresponds to 240cc, which is the stock injector flow rate. What this means is that if you don't swap injectors (and don't have a RRR), your max theoretical HP at the crankshaft is about 118. If you have a 1:1 RRR, your rail pressure will rise to 36+7=43psi at 7psi boost, and that will work out to about 129HP with stock injectors.

I don't know what the max pressure the stock pump can support is, but I'd willing to bet it can't be much more than 60 psi. Running at an overrated pressure for an extended period of time is probably not good for the pump, either. But if you did run at 60psi, your theoretical crankshaft BHP would go up to 152. 60psi seems dangerously high for a fuel system designed to work at 36psi, though (over 60% above normal).

By contrast, with 450cc injectors and stock fuel rail pressure, your theoretical max BHP at the crank is 241, everything else being equal. However, this assumes the pump can maintain that flow rate, which a stock pump might not be able to do. But if you did use 450's at stock fuel pressure, you should be able to go up to 160 HP without ever exceeding a 65% duty cycle, which seems like a much better solution than running the stock injectors at 60 psi and 85% duty cycle.

Maybe this is all B.S., but it seems to me that if you want to approach B16A horsepower levels, you're *probably* going to need to swap injectors.

91crxsi

IP:

91crxsi posted 10-03-2001 13:48 CT (US)
--------------------------------------------------------------------------------
By the way, does anyone know what the max flow (in cc/min) the stock pump can support is?
IP:

88_SC_CRX_Si posted 10-03-2001 14:03 CT (US)
--------------------------------------------------------------------------------
In order to to change decimal to hexadecimal in Excell. Goto the Tool Menu then Add-Ons, click the second option Analysis ToolPak. Then you can use DEC2HEX (number, number of places). Just use the number option, ex: DEC2HEX (100). That will return the hex number you want. Goto help and do a search on "decimal to hexadecimal" if you have any questions....
"Noth'in like Induction..." ;)

-Ryan-

IP:

88_SC_CRX_Si posted 10-03-2001 00:00 CT (US)
--------------------------------------------------------------------------------
Does anybody have a link to the other orignal post back in January. Been trying to find it, and not having much luck.:(
The fuel pump is suppose to flow, when testing is: 236 cc/min in 10 seconds.

I remember reading that the pumps can flow a little over a 100 psi for a short time. Then it starts crapping out from overheating. The JR FMU (RRR) is pushing it around that psi. Thats why it's so hard on your injectors, and I went with a CarTech to bring it down.

TIA....

"Noth'in like Induction..." ;)

-Ryan-

[Edited by 88_SC_CRX_Si on 10-03-2001 at 17:05]

IP:

91crxsi posted 10-03-2001 18:31 CT (US)
--------------------------------------------------------------------------------
88_SC:
Thanks for the info! Just wanted to clarify two things - first, is DEC2HEX a part of the standard Excel package or do you have to have this Analysis Pack installed? I have Excel 2000 and DEC2HEX works just like you said, but I'm not sure it's part of Excel '97. Does anyone know? If it is, I can send out an updated map calculator.

Second, on the fuel pump flow rate, is it 236 cc/min in 10 seconds or 236 cc in 10 seconds? I'm assuming it's the latter, which would work out to 236*6 = 1416 cc/min. This seems more reasonable than 236 cc/min, which could only support 4 240cc injectors at 24% duty cycle. If that's right, it means the stock pump flows enough for 4 350cc injectors at 100% duty cycle or 4 450cc injectors at almost 80% duty cycle. Either way, that translates to more HP than the stock engine can probably handle. So I don't think you need a bigger pump, do you?

Thanks,
91crxsi

IP:

7PSI CRX posted 10-03-2001 18:48 CT (US)
--------------------------------------------------------------------------------
I'm sorry guys, I misstated my question.
How long (ms.) is the most you could leave any injector open at say 7,200 RPM?

If someone would do the math for me....


Is a millisecond equal to 1/1000 (one thousandth) of a second?

If so, I could figure it out myself.


Top
 Profile  
 
 Post subject: Part 2.2
PostPosted: Wed May 15, 2002 5:22 pm 
Offline
Senior Developer

Joined: Tue Jul 27, 2004 2:09 am
Posts: 4384
Location: Cincinnati, Ohio
ccjb100 posted 10-03-2001 22:42 CT (US)
--------------------------------------------------------------------------------
Correct. A millisecond is 1/1000th (.001) of one second...

Chris-BoT

IP:

88_SC_CRX_Si posted 10-04-2001 08:41 CT (US)
--------------------------------------------------------------------------------
Analysis ToolPak is part of the standered package the best that I can tell. But, I am around Office Pro 97' & 2000, so I don't know about just plain Office. It just has to be loaded with Excell 97' or 2000' using the Add-Ons. I guess it has to do with memory management, since it does not load it automatically. Why load something that 99% of the peeps would never use. hehehehe
Your right about 236 cc in 10 seconds. So it adds up to the 1416 cc's in a minute. That was the same thing I came up.:)

"Noth'in like Induction..." ;)

-Ryan-



IP:

7PSI CRX posted 10-04-2001 17:44 CT (US)
--------------------------------------------------------------------------------

Here's my calculation.
I figure it can go to 14ms at least.



7200 rev/minute
Equals 120 rev/second

0.008333333 ms per rev

0.01666666 ms per intake valve opening (4 stroke engine)


0.014166667 = 85% Duty Cycle
0.013333333 = 80% Duty Cycle
0.016666667 = 100% Duty Cycle



Here's the "top end" of the stock CRX Fuel map.


RPM 4"HG 1"HG "+1.3psi
500 8.4 9.54 10.76
600 8.4 9.54 10.76
700 8.25 9.7 10.92
800 8.4 9.77 10.99
900 8.48 9.85 11.07
1100 8.63 10 11.22
1300 8.71 10 11.22
1600 8.71 10.08 11.3
1900 9.24 10.23 11.45
2200 8.55 10.31 12.06
2600 9.09 10.84 12.21
3100 9.01 10.84 12.21
3700 9.24 10.54 12.37
4400 10.38 11.75 13.13
5300 11.6 12.67 14.5
6300 11.3 12.9 14.65
7400 11.3 12.9 14.65




IP:

88_SC_CRX_Si posted 10-04-2001 20:11 CT (US)
--------------------------------------------------------------------------------
Those of use with JRSC's have to keep in mind about the resistor that was added to the IAT sensor. This was to fool the ECU into thinking the air is colder, then it really is. That allowes the the pulse width to be wider then it normally would be from stock. Sooo, keep this in mind when the time comes, or you could inadverntally max your injectors out.
"Noth'in like Induction..." ;)

-Ryan-

IP:

91crxsi posted 10-04-2001 20:30 CT (US)
--------------------------------------------------------------------------------
7PSI:
You've touched on something I've been struggling to understand for some time now. I'm assuming you arrived at your fuel pulse times from looking at ZDyne's software. I've seen it, too, and the pulse times just don't make sense to me. Why?

You note, correctly, that at 7200 RPM, each cylinder has 16.6 msec between intake valve openings (IVO). But think about the sequence of events in between each IVO: air is drawn in for about a half cycle, air is compressed for a half cycle, there's an ignition spark some number of degrees BTDC, the space expands (power stroke), and exhaust gases are expelled. Now here's the question: how can you be injecting fuel for 85% of that whole process??? You'd have to be injecting fuel during the intake stroke, during the combustion event, during the power stroke AND during part of the exhaust stroke. It just doesn't make sense to me. Which leads me to believe that ZDyne's numbers can't possibly be correct.

Can anyone help me out here???

91crxsi

IP:

7PSI CRX posted 10-05-2001 04:22 CT (US)
--------------------------------------------------------------------------------
I took those numbers right from your "CRX Map calculator", Jonathan.

At that RPM, believe it or not, the air in the intake manifold actually never stops and starts along with the valve opening and closing.

It's flows nonstop, so yes, the injectors can stay open that long, no problem.

I know some cars, (Saturn) pulse all 4 injectors at the same time with no provisions for individual cylinder timing.

I kinda think Honda does the same......


IP:

88_SC_CRX_Si posted 10-05-2001 05:19 CT (US)
--------------------------------------------------------------------------------
Thats called sequential, and non-sequential fuel injection. Honda's are sequential, they only pulse every other time. Where as, the non-sequential pulse every time.
"Noth'in like Induction..." ;)

-Ryan-

IP:

91crxsi posted 10-05-2001 14:44 CT (US)
--------------------------------------------------------------------------------
7psi wrote:
"I took those numbers right from your "CRX Map calculator", Jonathan."
Yes, and I took those numbers right from Zdyne's at the time I made the calculator. I didn't think about whether ZDyne's numbers made sense at the time, but now I'm having a hard time understanding it.

If Honda opens the injectors every other time, as 88_SC says, that would make more sense to me. But then that would mean that 85% duty cycle is 85% of 8.3 ms at 7200 RPM, not 85% of 16.6 ms.

Maybe Zdyne's numbers are all off by a factor of 2?

Still confused,
91crxsi

IP:

7PSI CRX posted 10-05-2001 16:06 CT (US)
--------------------------------------------------------------------------------
Those numbers have to be correct for the stock injectors.
If you look a a fuel map for the 440 injectors, they are about half.

IP:

91crxsi posted 10-06-2001 12:20 CT (US)
--------------------------------------------------------------------------------
I'm not sure about that. The fact that the numbers for 450's are about half that of the stock injectors only proves that the ratio between them is about 2 to 1. It doesn't prove that the stock numbers are correct, as both could be wrong.
Take a look at ZDyne's injector pulse width at WOT/redline, for example. 14.65ms at 7200 rpm. If we say that one duty cycle at 7200 rpm is 16.6 ms (which I'm still not sure about), that works out to more than 85 percent duty cycle.

Now go back to RC Engineering's website and plug that in to calculate the theoretical horsepower with 240cc injectors:

horsepower = (240/10.5)*4 * 0.85 / (BSFC 0.5) = 155

So we should be producing 155HP with our stock injectors. That's way off. If we insist that the injectors are running at 85%, BSFC would have to be over 0.7 to make the HP numbers come out correct. Everybody knows how efficient Honda's engines are. There's no way the BSFC is greater than 0.7.

So something's wrong - either my calculations or ZDyne's. But anyway, it sort of doesn't matter, since you know the maps work, whatever the real pulse duration is.

91crxsi

IP:

7PSI CRX posted 10-06-2001 00:00 CT (US)
--------------------------------------------------------------------------------

quote:
--------------------------------------------------------------------------------
Take a look at ZDyne's injector pulse width at WOT/redline, for example. 14.65ms at 7200 rpm.
--------------------------------------------------------------------------------

Those #s you just stated there are for +1.3 PSI, no?

The closest to WOT is 1" HG vac., and that works out to 12.9ms. Plug that number into RC's calculator and let me know what comes up as far as HP.

I know it's not a big difference.....


I think the numbers are correct, but you can run an experiment for us, no?






[Edited by 7PSI CRX on 10-06-2001 at 16:30]

IP:

xtensive posted 10-06-2001 19:27 CT (US)
--------------------------------------------------------------------------------
Hey all! I finally got all the pieces together, and burned the stock image to the AT89C55. Crossed my fingers, and fired her up. She started just fine, but the trouble light is on solid :-( The good news is that it appears that the AT89C55 can replace the OKI M83C154, now I just have to figure out why the computer is tripping the indicator, saying the ECU is dead. She was running rich, so I assume went into limp mode. Anyways, just an update. I'm really excited at this point, as I never thought I'd even get this far!
Mike

IP:

91crxsi posted 10-06-2001 23:10 CT (US)
--------------------------------------------------------------------------------
xtensive:
I wouldn't get too excited, yet. If you really did burn an exact copy of the stock image into your new chip and everything was working properly, there's no reason it should have given you the check engine light.

Remember, there's a backup system in the ecu that can run the car if the eprom (in my ecu, I know you don't have one) or even the mcu is completely removed. So the fact that your car starts and runs doesn't necessarily prove that the AT89C55 is working. It may be functional, but something's obviously wrong if you're getting the check engine light. If, as you wrote, your ecu is "tripping the indicator, saying the ecu is dead," it's probably because it is.

Good luck,
91crxsi

IP:

xtensive posted 10-07-2001 13:56 CT (US)
--------------------------------------------------------------------------------
Hmmm, I compared the data byte for byte and they are the same. The only difference I can find is that the 89c55 chip has 20K memory, where as the 83c154 has 16K, and I noticed that the bin files I'm saving for the OKI are 16K and the ATMEL files are 20K. Could it be possible that the ECU checks for memory consistency, and gets an out of range value from the ATMEL chip so it defaults to limp mode? I can't find a bit of difference anywhere else. I also tried a stock ZC bin. The burner that I have defaults to burning the full 20K and it has settings specifically for this chip so I'm not sure how to get around that. I'll keep hacking away at it though.
Mike

IP:

91crxsi posted 10-08-2001 13:01 CT (US)
--------------------------------------------------------------------------------
Hi, Mike,
I don't think the 16K/20K thing has anything to do with it. That shouldn't matter. Maybe if you emailed me both files, I could take a look at them and see if I can tell you anything?

As I mentioned before, my stock program makes use of a non-standard command that might only work on the OKI-brand 8051-compatible chips. Yours may be the same way. If that's the case, simply ensuring that your ROM image is identical to the original will not guarantee that it will run properly in your Atmel chip.

91crxsi

IP:

xtensive posted 10-08-2001 13:27 CT (US)
--------------------------------------------------------------------------------
You may be right on that. Assembly language isn't exactly my strong suit. I did find a few "not defined" errors when I disassembled it and tried to re-assemble it through an 8051 standard compiler. I bet those are the instruction sets you are talking about. What exactly is the instruction you are refering to? What program did you use to disassemble the hex code? thanks!
Mike

IP:

xtensive posted 10-08-2001 15:24 CT (US)
--------------------------------------------------------------------------------
Ok, I FINALLY figured out what you were talking about...I guess I'm about 8 steps behind you ;-) It is actually a proprietary instruction set used by the OKI xxC1xx chips. The undefined instruction is stored in A5H and refers to a "skip opcode" proceedure. Since there is no way to modify the instruction set (unless I want to hack into the actual chip!) I am currently trying to figure out what this instruction does, and write a proceedure to call everytime it accesses A5, and stick it in a free momory allocation (NOP) with a return string. If you know what this instruction is (A5H), I'd love to hear from you!
Mike

IP:

Dave_Darling posted 12-24-2001 13:19 CT (US)
--------------------------------------------------------------------------------
Sorry to get in on this at so late a date, but I just found a link to the post. (Thanks, cingham!)
Remember that in a four-stroke engine like the CRX uses that the camshaft turns at half the speed of the crankshaft. So an engine spinning at 7200 RPM has a camshaft that is only spinning 3600 RPM. The ignition and injection happen in time to the cam, not the crank, so you're getting 60 injections per second--not 120.

It doesn't hurt performance much if at all to "fire" the injector at the back of the closed intake valve. Many FI setups do just that, and they work just fine. (Ask any 911 [74-83] owner, most watercooled VW [~78-85?] owners, etc.) The fuel momentarily sits in the intake port until the valve opens. If the charge is decently atomized in the first place, it will tend to stay atomized for long enough. The fact that the intake valve is hot after the engine is running for a while helps keep the fuel atomized as well.

You can actually, in theory, have your injectors open 100% of the time. There is a funky hydro-mechanical FI system known as CIS, or Continuous Injection System, that does just that. (Used in the 911s and VWs mentioned above, as well as many other late-70s through late-80s European cars.) In fact, this is really horrible for the injectors used on our cars, so you don't want to go over about that 85% duty cycle, but if the injectors could take it it would not hurt the running of the car at all.

Hoe this helps.

--DD

IP:

cingham posted 12-25-2001 04:20 CT (US)
--------------------------------------------------------------------------------
he he he i do my part. I've been reading this thread since day one, for got to link it.

IP:

honboy posted 12-25-2001 06:46 CT (US)
--------------------------------------------------------------------------------
hey 91crxsi remember me ? from your first post all that time ago i posted some hehe graphic language expressing my wild admiration for your work .good to see your still at it .... i was the one with the Jspec '83 (PM6 ECU) ... well now i have access to (possibly donateable) ECU's of teh same engine and Jspec ZC one's... many others i can obtain easy... AUS spec or Jspec ...... contact me off list if your interested, i love the cause as i wish i could do it myself....
crxclub@warp1.net.au


adam .co-founder perthCRX club of Western Australia

http://www.perthcrx.cjb.net

IP:

EvilxKid posted 12-27-2001 03:06 CT (US)
--------------------------------------------------------------------------------
i have been trying to read honda chips for a while and it says there proteced. im using a picstart plus development programmer. what are you guys using. i also have a spoon sport ecu. if i can crack it i can send the hex image to you guys if you want them. also i was wondering what program you are using to read the chips. mine is a little out dated. any info would be nice.
i have also heard of old therads on breaking the chip code. how can i find these threads.

thank you
Jeromy/panda


IP:

7PSI CRX posted 12-27-2001 04:50 CT (US)
--------------------------------------------------------------------------------
Here's all his others'.

http://resource.crx.org/ubb/Forum2/HTML/003852.html

http://resource.crx.org/ubb/Forum2/HTML/006779.html

http://resource.crx.org/ubb/Forum2/HTML/006449.html


IP:

91crxsi posted 12-30-2001 21:49 CT (US)
--------------------------------------------------------------------------------
Hi to all the faithful readers!
I haven't been on the CRX Resource for some time now. I've been a little preoccupied with something (someone) that I find infinitely more interesting than my CRX (blasphemy!). I'm referring to my new baby girl. Besides being cute as the dickens, she is also very demanding of my time (poor mom has to feed her every 2-3 hours or so, round the clock). But I have not forgotten you guys, and the project. It's just not as high a priority now. Another factor is that I've done most of what I set out to do - change fuel and ignition maps at will (I'm finally running with 450 cc injectors), set up the ecu to handle boost (I have my JRSC working without the RRR), modified the rev limiter and set up a launch rev limiter (although I don't find the latter very fun), and figured out how to datalog, although I think the serial port on my stock cpu may not really work after all.

Well, here's my reasons on why it's better to use a modified ECU than to use the "tricks" that come with the JRSC. 1) You should use the sensors the way they were meant to be used, not hack and splice wires or feed them the wrong signal just so the ECU won't complain. 2) Using a RRR is tough on the fuel system components - not good to run the stock fuel pump at higher than standard pressure. It can take it, of course, but why stress the pump when you don't have to? Contrary to popular belief, the RRR is there not because the stock fuel pump can't put out enough fuel to support your increased HP demands, but because the INJECTORS can't flow enough at 36psi - they just max out. So the real solution is to uprate the injectors, leaving the fuel pressure alone, or even lowering it, and adjusting your ecu to match. Also, I probably had to repair at least 3 fuel line leaks due to the overpressure. That gets old fast. 3) Retarding your spark timing by rotating the alternator is - retarded. I didn't realize it at the time, but I lost a tangible amount of torque at low rpms due to retarding the whole spark curve 10 degrees. This is partially masked by the fact that I have a JRSC, but when it's not on, your car is WEAKER than stock! The intelligent solution is to retard the ignition only when needed, i.e. when there's boost. And the "right" way to do that is INSIDE the ECU, not with fancy add-ons (apologies to APEXi). I think something like the AFC or ITC would be great, but once you've found the perfect setting for your car, how often will you need to fiddle with it or check it? I don't have any personal experience with these gadgets, so if anyone wants to say anything in defense of them I'm all ears.

Anyway, sorry about my ranting... to answer the other messages, Dave_Darling, thanks for the info. It may very well be that the CRx's injectors are open while the intake valve is closed. If that is the case, it makes ZDyne's numbers a lot easier to believe. I'm still a little suspicious of them, though. Eventually I hope to find the definitive answer in the code.

EvilxKid, I'm not sure which chips you're trying to read. If you are trying to read the EPROM, I don't believe there IS a way to copy-protect them (somebody prove me wrong). But if you are trying to read the MCU, then that's a different story altogether, and if the copy protection is set, I think you're out of luck (please, somebody prove me wrong!). ZDyne protects its intellectual property this way (good move! :P ).

Finally, I think I'm at the stage in the project where anything else I discover is not going to be very interesting to most of you, so I'm not planning on doing any future updates, except to answer specific questions.

Have a Happy New Year,
91crxsi

IP:

7PSI CRX posted 12-30-2001 23:42 CT (US)
--------------------------------------------------------------------------------
Happy New Year to you and yours!
IP:

gooberu posted 12-31-2001 12:55 CT (US)
--------------------------------------------------------------------------------
i am interested in taking a look at the coding of the ecu. I have really not taken a good look at them to see how you would connect them to a laptop, anyways could anyone explain how you connect them to the laptop and where they get the program to look at the ecu from. I have 3 laptops so that is no prob, i only have 1 ecu unless i get another at the junkyard. Any info would greatly help.
IP:

George_R posted 02-06-2001 18:35 CT (US)
--------------------------------------------------------------------------------
Hey 91crxsi,
Are you still looking through the forums??
Anyway, I have a couple of questions for you if you don't mind:
How exactly do you switch over to the other fuel/ignition map's when the MAP sensor see's boost (I have a couple of my own ideas, but I'd like to see how you did it :) )??
Also, could you send me the locations of where some of the main sensor values are stored in Internal RAM - I think that the MAP sensor value is in either 036h or 038h and the RPM is stored in 03Bh. I'd like to know where the Vehicle Speed Sensor (VSS) value is stored, then I may be able to find the speed cut. Any other sensor values you know would be great too.

Thanks for any help,

George


IP:

cui posted 02-07-2001 13:10 CT (US)
--------------------------------------------------------------------------------
That explains why people hated JRSC...and I have seen quite a few engine fires on the blown civics.
just too many aftermarket "tuners" push out half a*s products to make a quick buck.


IP:

cyclonus posted 02-07-2001 14:39 CT (US)
--------------------------------------------------------------------------------
has anyone found a dissasembler for the OKI 66k series ? ... I really wanna get into this for all the OBD1 people.... Does anyone have a 66k ROM ? ... I think i may have enough info to make a dissasembler
IP:

91crxsi posted 02-13-2001 13:45 CT (US)
--------------------------------------------------------------------------------
Hi, all,
Man, it's been a while since I checked on the forums...

I'm glad that others are getting into the act and doing their own research on the ecu. In that sense I feel my mission has been accomplished.

George,
You have the MAP and RPM sensors mixed up. Don't feel bad - I made the same mistake before! :) As for the speed value, it's stored at 6Ch (you heard it here first :) ). I haven't figured out the relationship between 6Ch and MPH exactly (or kph, in your case), but my guess is that MPH = 6Ch * (about 0.5). This takes into account certain assumptions about the transmission and wheel/tire size. I'm nearly certain it's a linear relationship.

cui,
Don't get me wrong. I am in no way dissing the JRSC. It is truly a great product. Mechanically speaking it's top notch. It really works, and works well. I think that they HAD to limit themselves to making mods outside of the ecu to maintain CARB legality. That's understandable. But to really do a JRSC setup "right," IMHO, you should do away with the RRR, the air temp sensor kludge, the MAP sensor relocation (dislocation in my opinion) and the boost relay, and get into the ecu and modify the code so that it properly handles a blown setup. As ZDyne likes to put it, a "factory" setup. The JRSC is not a half a*s product. It is a whole a*s product. ;P

cyclonus,
The OKI website will tell you where you can BUY 66K programming tools. Unfortunately, the OKI nx66K is nowhere near as popular as MCS-51 chips, and I have searched in vain for a freeware assembler/disassembler. You CAN, however, download the nx66K spec from OKI - it tells you everything you need to know to MANUALLY disassemble 66K machine code, or roll your own dissassembler. I was actually tempted to try this at one point. Then I came to my senses. :P It's not that you COULDN'T actually do this - it's just that it would be a ton of work and you'd be likely to make a little mistake and end up with nothing. Plus, even after you were to create a disassembler program, you'd still have to actually pull a PROM, read it, dissassemble the code, and then the REAL work begins - actually poring over the code and figuring out what it does.

Take my research for example. I got the disassembler free off the net. That was no problem. Pulling the PROM, reading it and disassembling it took all of a day. Trying to figure out what it does has taken me over a year! And I'm still not done. But I will say that I learned the majority of the interesting things after only a few months.

I won't say it can't be done, but I think in the case of the 66K's your best bet is to buy the software and hope you find enough interesting stuff in the code that you'll be able recoup your costs by selling a few modified ecu's. This is probably what ZDyne has been working on..

91crxsi

IP:

shang posted 03-28-2001 18:01 CT (US)
--------------------------------------------------------------------------------
Hi 91crxsi. I am currently working on a senior project, which is to build an engine management system.
Right now we have access to a pr3 ecu. We uploaded the bin file and tried to decompile it with d51 an 8051 decompiler.
The code broke down to about 440 pages.
We were corresponding with "extensive" alias "mobstyle" and he seemed to disapear as soon as we gave him the HONDATA program. odd...
Do you have a copy of the pm6 bin file, we have decided to shift our energy to that since it is 8051 compatable?
Is there any other 8051 compatable that you know of?
mailto:jdahlberg26@earthlink.net

IP:

s1267712 posted 03-29-2001 12:35 CT (US)
--------------------------------------------------------------------------------
91crxsi,
I am planning to in the future do a turbocharged b16 swap into my 91 civic si. Would you be willing to finish the work on the ecu and do the vtec work? I would naturally be willing to pay you for your work and it sounds like a sweet ecu, as good as a zdyne, with better support and from a guy who really cares. Anyway, one last question, would I be able to do an engine swap with your ecu (once it has v-tec support)?

Thanx Man,
Evan
s1267712@cedarville.edu

IP:

91crxsi posted 03-29-2001 05:20 CT (US)
--------------------------------------------------------------------------------
shang,
Yes, besides the PM6, there are a number of Honda ecu's that use 8052-based mcu's. For example, the PK2-26, from an old Prelude, the PR4, the '88 ZC ecu (don't know the name of it). In addition, the '87 Civic Si uses an 8085, which is even more archaic than the 8051. Freeware tools should be available for that mcu, too.

I can understand your targeting the PR3, as it is more "sexy" than a PM6. Unfortunately, it uses an OKI chip, and I don't think the tools for disassembling the ROM can be obtained for free. :(

About your senior project - you may be overly optimistic about trying to recreate Honda's PGM-FI. It probably took dozens of man-years for Honda (a very-well-financed, global corporation) to develop it. It took me almost a whole year just to read through the PM6 code and comment it, and I'd say I only really superficially understand what's going on in there. You're probably better off getting some textbooks on engine management systems and designing your own simple system. But it's up to you, of course.

Evan,
Sure, but I can't guarantee that it will work - I've already killed one ecu that I was working on... :P

Does anyone know all the rules for when VTEC engages? I know that it's some combination of rpm, load, throttle position and coolant temp. Are there any other variables? Would it be ok to just engage at a fixed rpm? I haven't put much thought into this, as I have a JRSC'd D16A6 (SOHC, non-VTEC motor).

Anyway, how much more power does VTEC on top of a turbo produce anyway? With all that boost isn't your volumetric efficiency pretty much maxed out already??

If anyone can answer my questions please reply!

Thanks,
91crxsi

IP:

dohcvtec posted 03-29-2001 08:35 CT (US)
--------------------------------------------------------------------------------
you can't say i'm really interested in your work!
VTEC rules
i know it's a combination of those sensors plus the speed sensor > 35 kph. i could scan the page in the CRX SIR UK manual that mentions it...
you should know by now that VTEC ecu's have 4 maps instead of the two for non-vtec ecu. my guess is that Honda tunes the maps for each cam profile separately, and then setting the vtec point is a matter of experimentation, may be a few dyno runs (or a lot!)

as for the forced induction and vtec
i think that the JRSC only increases vol. eff. at low rpms, so keeping vtec shall be very helpful in that case!

for the turbo case i believe it's helpful anyways because it increases lift and valve overlap, and that is good for increasing the overall gas flow velocity. just a quick note, high powered H22A's i've seen in magazines (Prelude VTEC 2.2 engine aka the whale) when used for turbo application have their VTEC system enabled all the time....

hope this helps


IP:

crxrocks posted 03-29-2001 09:44 CT (US)
--------------------------------------------------------------------------------
xtensive is still around, I doubt he skipped out on you. He has been really busy with work lately. Give him a chance to get back with you.
Chris

IP:

shang posted 03-29-2001 11:01 CT (US)
--------------------------------------------------------------------------------
91crxsi,
try this link http://www.honda-tech.com/zerothread?id=153242. This had some interesting tables.
I have 3 people working on this project so I'm not alone. Do you think the oki 66x mightbe motorolla base?
Is there anyway I could get a pm6 file from you? We are working on purchasing a pm6 ecu right now, but we don't want to wait weeks before breaking down the code.
would be interested in a schematic for eeprom programmer and software (shareware)?


IP:

dohcvtec posted 03-29-2001 14:12 CT (US)
--------------------------------------------------------------------------------
shang
i can email you the pm6 file and others...
the oki 66x is based on a core called the nX-200, and it is the same (with some enhancements for newer ecu's) for Honda ecu up to OBD2 (2001). i can contribute to your project...

if you interest the files email me...

some time in the next week i'll release an updated version of 91crxsi spreadsheet (if he allows it)...

IP:

shang posted 03-29-2001 17:16 CT (US)
--------------------------------------------------------------------------------
dohcvtec and 91crxsi,
That would be great if you could e-mail us a pm6 file. I have read up on the data sheets a couple of months ago at OKI regarding the msm66x301, I figured the only way to do it was by writing our own disassembler which I could do, I'm wondering if that's what Hondata and Zdyne did? I found opcodes for the rs-x400s.
I left it alone after contacting OKI and getting little support from their "support" team.
So anyhow we've switched gears to the pm6 rather than the pr3. We don't want to reinvent the wheel, just modify it...
I don't have your e-mail but mine is jdahlberg26@earthlink.net.
Thanks


IP:

George_R posted 03-29-2001 18:09 CT (US)
--------------------------------------------------------------------------------
Hi 91crxsi,
Thanks for the VSS sensor memory location.
However, I'm pretty sure 03Bh is the RPM point, because if they are around the other way, that would mean that the maps are 15 RPM points by 17 load points, which is the opposite to what you have said in the past.
Perhaps I'm missing something?

Cheers,

George


IP:

cyclonus posted 04-01-2001 03:59 CT (US)
--------------------------------------------------------------------------------
OK .. So far no one has been able to get me a OBD1 rom... so ima try to read it myself. I'm using a P74 ecu and since this it does not have any rom chips inside .. my conclusion is that the MCU is holding the info. The OKI site said that the 66207 holds up to 32k (internal Rom). Now my question is how do i read the program from this ECU? ...I dont wanna desolder the entire mcu and try to resolder it later ..
any thoughts ?

IP:

91crxsi posted 04-01-2001 17:31 CT (US)
--------------------------------------------------------------------------------
Hey, guys,
dohcvtec - thanks for the info - i'll have to learn more about the wonders of vtec.

shang - i checked out the url - unfortunately the original post has been edited so that there's no info to be found :( If dohcvtec doesn't get you that pm6 file, let me know and I'll send u a copy. About the OKI mcu, it's not Motorola-based, it's OKI-based! As far as I know, it's proprietary to OKI. You can freely download all the info on the chip you want, but no free software that I can find.

George_R,
How are things down under? You're right - 3bh is related to rpm, not MAP. Did I say otherwise? I did have them reversed at first, but you've got it straight now.

cyclonus,
If you're trying to read the program off a 66207 MCU, you might as well forget it, unless you have the hardware to a) read the chip, b) reprogram the chip and the software to c) disassemble the chip. My guess is that it would be prohibitively expensive. Better off finding an ecu with an Intel-based mcu and reading the eprom. If you insist on using your P74 (by the way, what car does that come from?), about the most you will be able to do is change the fuel and ignition timing maps, as these have (conveniently) the exact same format as the 8051-based PGM-FI programs.

Incidentally, I removed the mcu from a pm6 and noticed that it had "83C154" imprinted on the circuit board underneath it. Apparently, the PM6 was based on an earlier design that had a program that could fit entirely within the 16K internal ROM of a 83C154. As so often happens with software, the original release was patched and patched and ballooned beyond the 16K limit. So Honda replaced the 83C154 with the ROM-less 80C154 and had to put the program on an external 32K EPROM (of which only about 17K is used). What a stroke of luck for us hackers! :P

91crxsi

IP:

dohcvtec posted 04-01-2001 17:36 CT (US)
--------------------------------------------------------------------------------
91crxsi
what nasty things are you doing to that ecu?....
removing the mcu wasn't in my list, but well you're the man!

keep us informed of your achievements


IP:

91crxsi posted 04-01-2001 18:05 CT (US)
--------------------------------------------------------------------------------
hi, dohc vtec,
Well, I wanted to replace the mcu with one that ran a little faster and had some internal ROM in it. That way I can read-protect my mods if I need to (the way ZDyne does with their ecu's). Also, with a chip socket in there, I can plug in an in-circuit emulator and really see what's going on with the program as it's actually running. Unfortunately, I killed the pm6 I was doing this to... Just have to get another one and keep trying...

91crxsi

IP:

cyclonus posted 04-01-2001 18:06 CT (US)
--------------------------------------------------------------------------------
I'm not so much worried about the dissasembler sisnce i have spoke to alot of people who started to to make one. ANyways i found the only way to get my hands on a rom is to buy one off ebay. Someone sells modified Roms for p74/p75 and all i need to do it just read it off the chip. I will also need to do some modifications to the ECU to use the external rom, but that nothing hard.
IP:

George_R posted 04-02-2001 04:14 CT (US)
--------------------------------------------------------------------------------
91crxsi,
Things are fine down here in NZ :) How's it up there?

Further up in this thread I had said that 03Bh was the RPM and either 036h or 038h was the MAP sensor - which you then said were around the wrong way.
If they were wrong, it would mean modification of all of my comments and would mean much of what i'd worked out would be useless - I'm extremely happy I did have them the right way around :) cheers for confirming that :)

I was wondering how exactly you got the datalogging working - because my ECU doesn't want to return any data when I send it a memory address.
Because I'm only using an 8 bit protocol, I think the Serial Interrupt code is not doing what I want it to - but if I try and modify that code it just goes into the backup ROM mode after 30 seconds or so of running.
Do you use a 9 bit protocol or have you worked around that problem somehow?

Also, any help on changing over to other maps when it sees boost would be greatly appreciated. I've got everything set and should have my turbo installed within a month or two.

Cheers for any help,

George


IP:

shang posted 04-02-2001 21:03 CT (US)
--------------------------------------------------------------------------------
91crxsi,
Thank you, dohcvtec did send us some files. If you can think of anything else that would help, please e-mail it to me. We are taking apart the code now, could you possibly e-mail me the addresses in the 8051 assembly for the input/output ports? Anything you could send would be much appreciated.
Thanks
jdahlberg26@earthlink.net
IP:

91crxsi posted 04-04-2001 16:18 CT (US)
--------------------------------------------------------------------------------
George,
The serial protocol used in the stock pm6 is pretty uncommon. It's a 9-bit protocol running at (I think) 375 kbps. Anyway, the bottom line is it's non-standard, and there's no off-the-shelf serial port you can buy that will communicate with it.

You had a good idea about modifying the code and setting up the serial port to an 8-bit protocol. Also make sure the baud rate will be close to standard. I think, assuming the chip is running a 12 MHz clock, you can get reasonably close to 4800 or 9600 baud (but not exactly). Coincidentally, these are the baud rates ZDyne's serial port uses. Big surprise.

I think the problem you were running into was that your modified program was failing the checksum test. The stock ecu does an 8-bit checksum on the range 0000-4FFF. It has to come out zero. You can modify any byte from 4380-4FFF (they're all unused and FF) to make the checksum come out zero. Of course you can do anything you want from 5000-7FFF, since it's not checked.

Hope this helps,
91crxsi

IP:

George_R posted 04-04-2001 18:03 CT (US)
--------------------------------------------------------------------------------
Hi 91crxsi,
Yeah, the checksum might infact be the problem. I assumed it checked the checksum over all address locations - doh!!
And yeah, about the baud rate, I was initially using 1200bps due to thinking that
the rates had to be exact - but then I found out otherwise and am now using 28,800 which also is only 0.2% off.

Thanks for the help,

George

IP:

George_R posted 04-05-2001 05:57 CT (US)
--------------------------------------------------------------------------------
Hmmm, actually the 8 bit checksum on my standard bin file for 0000-4FFF comes out to A2. Whereas for the whole 0000-7FFF it comes out as 0.
That's probably why I assumed it was the whole bin file that was included in the checksum.
Now what do I do?? Any suggestions?
Cheers,

George

IP:

91crxsi posted 04-05-2001 11:58 CT (US)
--------------------------------------------------------------------------------
Hi, George,
That's odd. Could you send it to me so I can compare it with my pm6 bin?

91crxsi

IP:

synoptic posted 04-05-2001 14:37 CT (US)
--------------------------------------------------------------------------------
Can someone give a "Status" of this post ?
I mean, where are you guys now ? When will we be able to have resource.crx.org ECU ?
etc.


IP:

George_R posted 04-05-2001 15:13 CT (US)
--------------------------------------------------------------------------------
Hi,
I'm pretty sure I've already sent it to you, but I've sent it again anyway.

Cheers,

George

IP:

xtensive posted 04-05-2001 16:44 CT (US)
--------------------------------------------------------------------------------
Hey Shang, I didn't forget about you. Things have been super hectic in my world these past 6 weeks! I got the info you sent me, and have been meaning to get back to you. I just sent you an e-mail.
My status on this project is pretty slow at this point. I have accumulated 3 Si ECU's two with the 83C154 chip, and finally broke down and got a later model with the 80C154 chip. I also have an integra ECU I'm playing with (also the 83C154). I have successfully burned an image of the 91 ECU ROM onto an AT28C256 EEPROM chip and am running my CRX with it now. As for the disassembly part, that is much more difficult. I friggin' HATE assembly code. I have found some nice 8051 dissasemblers throughout my saga though if anyone is interested.

91CRXSI, I e-mailed you awhile back about your spreadsheet...does such a beast still exist? Good luck all!

Mike

IP:

dohcvtec posted 04-05-2001 17:39 CT (US)
--------------------------------------------------------------------------------
xtensive
Mr 91crxsi spreadsheet exists and i have it.
i'm currently adding some useful macros to spreadsheet, making modifications to the stock pm6 rom quite straight forward. as soon as it's ready i'll release it if 91crxsi wants. it has no addons like datalogging, vtec or boost. but who the hell cares right now....


Top
 Profile  
 
 Post subject: Re: The beginning...
PostPosted: Wed May 15, 2002 5:27 pm 
Offline
Senior Developer

Joined: Tue Jul 27, 2004 2:09 am
Posts: 4384
Location: Cincinnati, Ohio
xtensive posted 04-05-2001 17:45 CT (US)
--------------------------------------------------------------------------------
Dude, you have no idea how much work that would save me!!! E-mail me when it's finished and I'll buy you a beer!
Mike

IP:

89_CRX_ED9 124PS posted 04-06-2001 14:47 CT (US)
--------------------------------------------------------------------------------
hy all,
nice, that this tread is still alive :-).

Some news from the European front :-).

I've bought an 90er PM7 ECU with 27C128 Eprom on it, and i've read it out.
if someone have interrest in the bin file
mail me.

Also i startet a project Serial->Serial conversation with an pic for Convert the ECU Baudrate to 2400->56000 Baud for easy use with PC, Coding is done 80%.
But it would be nice if someone can make a software for PC that can display the Sensors Stored in Ram to the screen, I'am not so common with PC Programming.

I've also have an 89 Ecu the one with the 83c154 on it. From someone i've got a 85C154
i'ts the same as the other on, but with an Piggy Back Eprom Socket.
My tunning file wont't work :-(.

xtensive:
The Atmel controller won't work, cause the OKI has some more Register's an funktions that the atmel won't have.

How did you read out the 83C154 ?

Any Kind of information (Rom files register maps of the Ram and so on ) is warmly welcome'd.

Greetings from Germany
mc_eddy

p.s. Sorry about my English

IP:

89_CRX_ED9 124PS posted 04-06-2001 14:52 CT (US)
--------------------------------------------------------------------------------
sorry,
my mail adress: mc_eddy@gmx.de
IP:

91crxsi posted 04-06-2001 00:00 CT (US)
--------------------------------------------------------------------------------
Hi, all,
Hey, George_R, my mistake on the checksum business. I thought you were talking about a pm6. The fact that they use the same addresses to store rpm and MAP sensor info is a remarkable coincidence, in my opinion. Anyway, it appears that your pm7 bin has code from 5000-50F3 (Maybe a very late patch). This would most likely mean that the pm7 checksum checks up to 50FF at least. If that's the case, then you should modify a byte from 438B-4FFF or 50F4-50FF. 4FFF seems like a decent choice. Then check to make sure the checksum from 0000-50FF comes out zero. I think this should do it for you. I'll go ahead and disassemble the ROM and see if I can find the checksum code and give you a definitive answer, but I'd be willing to bet that what I said above will work.

See if this helps,
91crxsi
PS - dohcvtec - i'm fine with you releasing your updated version of my original sheet. I'd like to see what improvements you made! One obvious one would be to use the DEC2HEX() function on the byte values so you don't have to convert them yourself.

[Edited by 91crxsi on 04-06-2002 at 19:18]

IP:

George_R posted 04-07-2001 18:30 CT (US)
--------------------------------------------------------------------------------
Hi 91crxsi,
Sorry, I forgot to tell you it was a PM7. I'll try doing some modifications once my UV bilb arrives and I can start erasing EPROMS for reuse (they get expensive after you've bought a few :))

Cheers,

George

IP:

dohcvtec posted 04-07-2001 18:38 CT (US)
--------------------------------------------------------------------------------
hi everybody!
i'd like to see Mr. eddy's work, seems interesting also....
91crxsi
a friend is doing the coding for me, he's a full time VBA programmer, so i guess i'll come with something nice.
did you had any time to check the pr4 ecu code?

IP:

xtensive posted 04-08-2001 12:45 CT (US)
--------------------------------------------------------------------------------
Hey mc_eddy,
The Atmel I am using is the 28C256 that replaces the 28 pin PROM on the 90-91 PM6's. I couldn't find a suitable replacement that actually worked to replace the 83C154 chip so I moved on to the 90-91 ECU with the 80C154 and 28 pin PROM chip. The 28 pin PROM is much easier to work with! I've got dumps of that chip and comparing files with the superchips bin you sent over if your interested. the 90-91 ECU's are much easier to work with from what I've found.

Mike

IP:

89_CRX_ED9 124PS posted 04-08-2001 14:30 CT (US)
--------------------------------------------------------------------------------
hy xtensive, nice idea to replace the 27c128 with an EEprom :-).
I've replaced the 83c154 by an 85c154, but
my tunning file wont work ECU says something about error code 11, grrrrr.

So i've bougt an 80c154 ECU, your'e right will make work easier.

If you have some Bin files, please Mail them to me.

Greetings
mc_eddy


IP:

dohcvtec posted 04-08-2001 17:47 CT (US)
--------------------------------------------------------------------------------
Mr. eddy
i'm 99.99% sure your problem is with checksum...
enlighten us a bit more and we'll help you


IP:

xtensive posted 04-08-2001 18:53 CT (US)
--------------------------------------------------------------------------------
Hey dohcvtec,
Can you e-mail me the spreadsheet? I might have some ideas on adding options for Boost, and (hopefully) data logging. TIA!

xtensive@MobStyle.com

Mike

IP:

91crxsi posted 04-09-2001 12:14 CT (US)
--------------------------------------------------------------------------------
mc_eddy / dohcvtec,
I'm 100% sure the problem is not the checksum. If you get a checksum error, the ecu will revert to the backup system. You will not get any ecu code at all. I'm curious - what ecu are you using that gives you a code 11?

xtensive,
Adding boost handling and datalogging requires changes to the CODE. A spreadsheet only really helps when you're modifying maps, not writing new code. I'm not sure what good it would do in this case.

91crxsi

IP:

89_CRX_ED9 124PS posted 04-09-2001 12:24 CT (US)
--------------------------------------------------------------------------------
hy,
The ECU will be an 90 PM7-X04.
First time when i saw that i've check'ed
it twice, cause i wouldn't belive that too.
But it is Code 11, Dont know what this mean,
maybe the ecu will show it when a programm
modification will be done that was not right ?.

greetings
mc_eddy

IP:

George_R posted 04-09-2001 20:46 CT (US)
--------------------------------------------------------------------------------
mc_eddy,
Checking my UK workshop manual, Code 11 is the IMA sensor (Without CATA). According to 3gprelude.com:

IMA Sensor
Idle Mixture Sensor maintains the correct air/fuel ratio at idle.

Here's a pic of where the IMA sensor is located:


Hope that helps,

George


IP:

dohcvtec posted 04-10-2001 06:48 CT (US)
--------------------------------------------------------------------------------
makes sense... since it's located near the ecu maybe when you remove the ecu it got disconnected...
IP:

synoptic posted 04-10-2001 11:34 CT (US)
--------------------------------------------------------------------------------
The Idea of having the values read from the ram and showed on a Computer screen is really cool !

I can have access to MicroElectronics equipment, so If I can help in anyway, tell me!

IP:

89_CRX_ED9 124PS posted 04-10-2001 13:13 CT (US)
--------------------------------------------------------------------------------
hy,
->George, thank you but my Ed9 have an Cat ?.
maybe the tuned file that i use dont have an.

->Coding is done 95 percent, sone i'll make some test's :-)).

greetings
mc_eddy

IP:

poweredbyvisa posted 04-13-2001 01:55 CT (US)
--------------------------------------------------------------------------------
A couple of things:
I have a couple of aftermarket .bin files to run on 90-91 PM6/PM7

ZC program would be one of them


I was wondering if anyone could tell me how I can modify the vtec point in the PR3 and/or P28 ecu's

Say I wanted to take the vtec point from one program and put it in another

where exactly when I open the file in the hex editor can I find that point?


Also have any of you guys chipped the 88-89 si ecu's ?if so how.

IP:

91crxsi posted 04-14-2001 23:30 CT (US)
--------------------------------------------------------------------------------
poweredbyvisa,
Funny screen name! :P Well, if the bins run on a 90-91 PM6/PM7, they should run on the 88-89 as well, I think. At least I've personally verifed that the '89 Civic Si ecu program is identical to my '91 CRX Si program.

What did you mean by ZC program? That's not an aftermarket bin.

As for the VTEC point in the PR3 and P28 ecu's, those two ecu's are not 8051-based, so I don't know if anyone knows the answer to that one, except Honda and people who make money off the fact that they know and you don't. I can't help you with this one, anyway..

good luck,
91crxsi

IP:

89_CRX_ED9 124PS posted 04-15-2001 16:21 CT (US)
--------------------------------------------------------------------------------
hy all,
-> I have a couple of aftermarket .bin files to run on 90-91 PM6/PM7 ??.

Sorry about my bad english, but can someone translate that to me please ?.

What do you mean Tuned files ?
Sounds very interresting, cause i'am on the search for it ;-).

Greetings
mc_eddy

p.s. Coding of my project is done,and maybe this weekend i'll do some test's.
Is someone able to say me the Ram adresses of O2,RPM,MPH,and other interresing sensors pleas.


IP:

TexasRexas posted 04-15-2001 16:43 CT (US)
--------------------------------------------------------------------------------
What is the size and how many prongs is a standard PM7 chip?
IP:

xtensive posted 04-15-2001 18:48 CT (US)
--------------------------------------------------------------------------------
TexasRexas,
The standard PM7 and 88-89 PM6 ECU uses the OKI 83C154 40 pin chip. The 90-91 PM6 uses the OKI 80C154 40 pin chip with a 28 pin PROM chip.

Mike

IP:

dohcvtec posted 04-15-2001 20:13 CT (US)
--------------------------------------------------------------------------------
xtensive
not righty my 88 zc ecu (PM7) have a eprom, just like the non -A080 PM6...
check this, but remember a 2 meg jpeg is not fun until you zoom into it :)
http://home.coqui.net/javipow/pm7p1.jpg


IP:

TexasRexas posted 04-15-2001 20:35 CT (US)
--------------------------------------------------------------------------------
Okay. hold on, you say your ZC ECU (pm7) i thought PM7 was 88-89 Teg' ECU, or is that the PG7 , if so what is the PM6?
IP:

shotty posted 04-15-2001 21:06 CT (US)
--------------------------------------------------------------------------------
The teg ECU is the PG7. the ZC ECU is the PM7
IP:

dohcvtec posted 04-15-2001 21:21 CT (US)
--------------------------------------------------------------------------------
PM6---------- is civic ex manual tranny / civic si/crx si ecu...
altough in 88 there where ecu's with number 37820-PM6-A080 which didn't have an eprom.
IP:

xtensive posted 04-16-2001 10:24 CT (US)
--------------------------------------------------------------------------------
Wow, that's crazy! That PM7 you have has the 83C154 AND a 28 pin PROM! I've never seen that before! I've got an 88 Si ECU (PM6), an 89 Si (PM6) that both have the 83C154 chip and no PROM. The 91 si ECU I have has the 80C154 and the PROM. The 89 Teg ECU (labeled PM7 FYI) has the 83C154 with no PROM. The fact that that 88 ECU has both internal ROM on the Microcontroller, AND a PROM is quite strange...I wonder what exactly the internal ROM is holding on the 83C154 chip, and why the need for an additional PROM on top of that? I don't suppose you have a bin of that PROM? I was under the impression that Honda didn't move to the external ROM method until 1990, except on the PW0/PW3 ECU's that use a non-8051 processor. Is that a Euro ECU?
Mike

IP:

91crxsi posted 04-16-2001 13:08 CT (US)
--------------------------------------------------------------------------------
Hi, guys,
On the printed circuit board of the PM6, if you remove the 80C154 (don't do this, by the way), you will see "83C154" printed clearly in white. So apparently, this ecu was originally designed to use an 83C154. Then the program bloated beyond the 16K capacity of the internal ROM. I don't know if MCU's with 32K ROM existed back then, but I guess Honda (or is that Denshigiken?)engineers decided it was cheaper to add an external 32K EPROM. It's quite possible the ecu manufacturer had an inventory of 83C154's to use up after the switch. If that's the case, it's quite possible there is an older version of the PGM-FI burned into the 83C154 that is simply unused.

91crxsi
ps - mc_eddy, what coding have you done that doesn't involve knowledge of the locations of the rpm and mph sensors?

IP:

89_CRX_ED9 124PS posted 04-16-2001 18:10 CT (US)
--------------------------------------------------------------------------------
hy,
91crxsi->,
Since now i only send an adress to the ECU with my laptop, and the ECU reply with the value of the adress.The Baudrate is convertet with an 16f628, maybe i'am going to build an Display for replacement of the car clock, maybe.

Greetings
mc_eddy


IP:

dohcvtec posted 04-16-2001 19:23 CT (US)
--------------------------------------------------------------------------------
-->xtensive
sir the pm7 ecu i have is JDM (it has a kanji character on the side). i do have the .bin file from the prom. From what i've been able to check, it's veery similar to the pm6 prom, but you can't just swap proms. btw the car starts and doesn't go to limp mode, it just doesn't shut off the check engine.

do you have a dump of the 83c154 based pm6? or the pm7?

email me again 'cause i lost your email addy

IP:

xtensive posted 04-16-2001 21:26 CT (US)
--------------------------------------------------------------------------------
Hey DohcVtec,
The e-mail link won't show me your e-mail address, so e-mail me, or post here. I do have a bin for an 89 PM7 that I have (83C154, no external PROM), and a bin for the 91 PM6 I can send your way. And actually, you should be able to burn the PROM image from any 8xC154 based ECU and "plug and play" so to speak. The base code looks very similar, and it is using the 8xC154 chip so it should work fine. The only difference between the two is the external versus internal rom. That's not why we're doing this though... ;-)

Mike
xtensive@Mobstyle.com

IP:

dohcvtec posted 04-17-2001 06:27 CT (US)
--------------------------------------------------------------------------------
xtensive
here's my email: javipow@coqui.net
i don't need the 91 pm6 file, i already have that one. send me the pm7 promless file... i'll attach the pm7 bin that i have.
Why am i pluging proms into to other ecu's?
i'd like to know better the hardware diferences between the ecu's, because i guess the i/o mapping is not equal....

IP:

xtensive posted 04-20-2001 13:51 CT (US)
--------------------------------------------------------------------------------
Hey 91crxsi,
I don't know if you still check this forum or not, but we had talked about an instruction set that wasn't defined (A5) in the 8051 code. Did you ever figure out what this is used for?

Everytime I reference it, it looks like a jump mark to "db 0a5h". I can't find reference for what exactly the db code does, but this could be my disassembler on the whack with the A5 instruction as well. Thanks for any info. I've just been working around it at this point.

Mike


Top
 Profile  
 
 Post subject: Re: The beginning...
PostPosted: Wed May 15, 2002 5:32 pm 
Offline
Senior Developer

Joined: Tue Jul 27, 2004 2:09 am
Posts: 4384
Location: Cincinnati, Ohio
George_R posted 04-21-2001 05:57 CT (US)
--------------------------------------------------------------------------------
Hi xtensive,
I'm 99.9% sure that the A5H command is a 3 byte MOVBIT bit1,bit2 command (bit1->bit2).
It was first suggested by someone on the 8052.com forum.
I've got a copy of an 83c154 manual in which this is specifically stated aswell. If you want a copy of it, just give me an email (g_ricketts@hotmail.com)
My decompiler also chucked out a db 0A5h command, but when I changed them to the proper values the next commands (which were screwed up due to A5 not being decompiled properly) actually confirmed it is a 3 byte command (eg. a couple of calls were made to known subroutines).

Hope that made sense :)

Cheers,

George

IP:

rexxy posted 04-21-2001 20:12 CT (US)
--------------------------------------------------------------------------------
i have a b16a in my 91 si but my ecu is pr3 auto it redlines at 7200rpm how can i turn it to manual also i would like to take out one of the o2 sensor???please help if you can
IP:

T J posted 04-22-2001 16:27 CT (US)
--------------------------------------------------------------------------------
Jonathon, way to go on keeping up with the ECU research!!!
Are you aware that there is a place in Austrailia selling do-it-yourself wideband o2 kits? They'll sell you a PCB and a kit of parts to solder on, or you can buy prebuilt kits. They use a Honda Civic VX/HX o2 sensor (apparently widebands from the factory!) which can also be obtained from NAPA auto for less than $100. The whole kit will cost you less than $200 and it includes a display which reads out instantaious A/F. The A/F is also loggable, but you gotta provide your own software.
Here is the link to the AU wideband kit:
http://www.techedge.com.au/vehicle/wbo2/default.htm
rexxy: since you happen to be the last to post, I can tell you that if you contact a guy that goes by "locash", he can transform your PR3 into a 5-speed ECU for reasonable $. He "fixed" mine. His website is http://www.locashracing.com

-TJ


IP:

Indian Moe posted 04-23-2001 00:00 CT (US)
--------------------------------------------------------------------------------
Hey 91crxsi do you know how to work on a b16 ecu. I have the p72 ecu and i would pay you if you could either tell me or make my ecu understand boost. this would help me a bunch thanks ryer. i know i can just use a check value but i would really like to keep my bay clean looking and just have my ecu understand boost thanks ryer
[Edited by Indian Moe on 04-23-2002 at 09:38]

IP:

91crxsi posted 04-23-2001 14:33 CT (US)
--------------------------------------------------------------------------------
Hey, Indian Moe,
I don't know too much about the P72 - it uses a non-Intel-compatible microcontroller, so I don't have the resources to disassemble the code. Sorry.

I have heard that you can run a B16A with the ZC ecu, which, if it's the PM7, is 8051-based and is actually very similar to the PM6, which is the '88-91 CRX/Civic Si ecu. You could probably copy the ignition and fuel maps from the P72 into a PM7 (or PM6 for that matter) and have a pretty good approximation of the P72, performance-wise. There are literally dozens of other maps that the ecu uses for different things, like compensating for coolant temperature, intake air temperature and whatnot that will cause the ecu to perform differently than the P72, but it probably won't be too far off. After all, the engine blocks aren't THAT different, are they?

One thing that the PM6/PM7 doesn't have is VTEC control. But, as Zdyne has shown, it's possible to add it in.

Here's a possible kludge - copy the low-rpm half of the non-vtec maps and the high-rpm half of the vtec maps from a p72 into a pm6, and then have an external vtec controller box control the switchover of the solenoid at a fixed rpm. Pretty crude, and may be a little erratic at/around the switchover point, but it's worth a shot.

91crxsi

IP:

dohcvtec posted 04-23-2001 17:28 CT (US)
--------------------------------------------------------------------------------
91crxsi
-- msm 66201/207 instruction set manual. does that ring a bell to you?
check your email....


IP:

91crxsi posted 04-25-2001 19:24 CT (US)
--------------------------------------------------------------------------------
dohcvtec,
Yes, I do have a copy of that manual, so technically, I could disassemble an OKI-based program, but only BY HAND. Which would be totally crazy. I've heard several people say they were working on writing their own disassemblers, but so far no one I know has claimed to have succeeded. There would be a lot of interest in that (or a bootleg copy of a commercial product - just kidding, of course!). I have more than enough to keep me busy just trying to figure out the pm6 and the other 8051-based ecu's.

Anyway, it seems to me that it'd be easier to come up with a pm6-based system that could be tuned to control other engines (B16, B18, etc.) than it would be to crack a non-Intel ecu.

91crxsi

IP:

89_CRX_ED9 124PS posted 04-27-2001 00:00 CT (US)
--------------------------------------------------------------------------------
hi,
today i find some time to get tru the PM7 prog. Code.
The thing that semms to be interresting for boost is the field from 3DF2 to 3EF3, is it right that it is the Ignition field?.
Further from 3EF3 to 3FF1 there is another data field for what is this ?

greetings
mc_eddy

p.s. this topic is getting longer and longer maybe we should make a new on ?.

[Edited by 89_CRX_ED9 124PS on 04-27-2002 at 16:24]

IP:

xtensive posted 04-28-2001 21:33 CT (US)
--------------------------------------------------------------------------------
Hey mc_eddy,
The tables from 3EF2 thru 3FF0 are for injector pulse duration.

I'm curious as to how your plan on compensating for boost? I only see the code reference the fuel and igintion tables a single time (for each set of 15x17 tables), at 0571h it moves the iginition maps to 16 bit data pointer, and at 3039h it loads the injector pulse maps to 16 bit data pointer. I'm not sure where it references the actual size of each set of tables though...(ie 15x17, etc.)

Also, it looks like the MAP sensor voltage range is set at 036h, and 038h mulitplied by .1, but I still haven't found where it triggers an error for positive boost, or anything else for that matter. I know 91crxsi said he had gotten his ECU to read boost, just not sure how...any clues?

Mike

IP:

cyclonus posted 04-29-2001 12:01 CT (US)
--------------------------------------------------------------------------------
someone needs to learn how to read Thai and find out what these guys are up to.
http://eficlub.hypermart.net/

they have a copy of a b18c rom, so they obviously were able to read the code from the built in rom in the 66k oki mcu.

IP:

89_CRX_ED9 124PS posted 04-29-2001 00:00 CT (US)
--------------------------------------------------------------------------------
hi xtensive,
first thank you, do you remember
the prog i`ll send to you ?(Mister ED).

It`s great you can view the Fuel, and
Ignition Table as an 3d Object and change
them bit by bit.
If you want i can Send you a very short
discription from me in English (Bad).

To the fuel map`s, are i`am right that you only need to change the fuel map for Tunning ?. Or will you have to change the Ignition Table too ?.

I think the injector pulse duration will be calculated out of the Fuel-Map ,if this is BS than please correct me, cause i`ll try to get some bigger Injectors to run on my car.

An other thing you`ve said you use an 28C256 instead the Eprom, is it not better to use an 29C256 cause the pin design is the same as the stock eprom?

questions, over question

Greetings
mc_eddy


[Edited by 89_CRX_ED9 124PS on 04-29-2002 at 06:37]


xtensive posted 04-29-2001 00:00 CT (US)
--------------------------------------------------------------------------------
Hey mc_eddy!
Yes, you are correct with the 29C256 as opposed t the 28C256. The 28C256 does not work well, but the 29C256 works perfectly, and is re-flashable.

I do remember that program (I still have it too), but it was in German, and I could not understand it ;-) If you have a quick English how-to that would be great!

You shouldn't need to change the ignition tables until you start getting into boost.

Oh, and the fuel maps are the same as the injector pulses. Basically it is just telling the injector how long to stay open, and that is based on vacuum to the FPR, which should be a constant, and not a variable (Unless you have a RR regulator or such), so the fuel tables are the same as the injector pulses, just in different terms...make sense?

Cheers,

Mike
xtensive@MobStyle.com

[Edited by xtensive on 04-29-2002 at 10:53]

IP:

89_CRX_ED9 124PS posted 04-29-2001 11:14 CT (US)
--------------------------------------------------------------------------------
re hy :-),
So do i understand right that i have to Change Both Fuel map AND injector pulses map
to reach more power ?

I've send you a really short Discription
of the MisterEd Programm, if you have Questions please mail me.

Greetings
mc_eddy





IP:

91crxsi posted 04-29-2001 13:17 CT (US)
--------------------------------------------------------------------------------
cyclonus,
There's a difference betweeen being able to "read" the code and being able to understand the code. Just like being able to see their website vs. understanding what's written there. I don't read Thai, so I don't know whether they have done anything with the B18C chip that goes beyond modifying maps, but I kinda doubt it. If they have, that would be great!

91crxsi


IP:

cyclonus posted 04-29-2001 13:30 CT (US)
--------------------------------------------------------------------------------
91crxsi,
The b18c is from an OBD1 ECU. So far to my knowledge.. no one has been able to read the code from these ECUs cuz the code is in the MCU built in ROM. Anyways .. these guys did it ... and i just wanted to see if they are public about it .. or just trying to make a buck.

Understanding the code is nothing big and we cant worry about it unless we have read the rom to begin with. Lets being by reading or dumping the code first ... shall we..


IP:

xtensive posted 04-29-2001 13:33 CT (US)
--------------------------------------------------------------------------------
Hey again,
As I understand it (I could be wrong), the fuel maps are the same as the injector pulse maps. They are the same set of maps.

There is one set of maps from 3DF3 thru 3EF1 that the ECU uses for timing retard, and another set from 3EF2 thru 3FF0 that it uses for fuel injector pulse width. Both of these are dependant on MAP voltage (vacuum in the TB). So there are really only one set of tables that the ecu looks at for fuel which are the injector pulse maps. those are your fuel maps. The other set of tables or MAPS are simply for ignition advance/retard.

Mike

IP:

89_CRX_ED9 124PS posted 04-29-2001 00:00 CT (US)
--------------------------------------------------------------------------------
hi,
xtensive ,that could make sens, so you have to change the fuel Table, that would no be so a prob. :-).

Does someone until now have reached a complete Disassembly of the stock ECU program ? (no A5h instruction).
Or otherwise could someone tell me how to replace the a5h Command, i'am using
Dis51 to disassemble it.

I would put it into my Keil Compiler,
that has great Support for OKI 83C154µC,
with Simulator on so on.

Oh my ECU-Laptop Interface first beta test will be done this weekend, i hope they both will Survive :-).


Greetings
mc_eddy


p.s. 91crxsi-> have my e-mail reached you ?,
don't know if the adress where right .-(.



[Edited by 89_CRX_ED9 124PS on 04-29-2002 at 14:45]

[Edited by 89_CRX_ED9 124PS on 04-29-2002 at 14:47]

IP:

xtensive posted 04-30-2001 12:57 CT (US)
--------------------------------------------------------------------------------
Ok 91crxsi, give us a clue...please?
The MAP voltage that the ECU reads is between 2.8 volts and 4.3 volts (without erroring out). 2.8 volts is normal vacuum (14.7 PSI, or 1 BAR), and it increments by .1 volts x 15 up to 4.3 volts which turns out to be 16 PSI (or just over 1 BAR (1.3 PSI)). Where is this specified in the ECU? I cannot find anything relating to the MAP voltage. The 15x17 tables end up being exactly 255 bits (wow, big surprise), and I believe that, ahem, some companies that modify the ECU don't actually use the 25x17 tables, but rather an average of the 15x17 tables utilizing the increased voltage (up to 9 PSI give or take, 4.8~9 volts) to compensate for boost. Where are the MAP voltage parameters located, or better, how do you let the MAP voltage exceed 4.3 volts without throwing an error? Some of us are just a *bit* slower ;-)

Mike
xtensive@MobStyle.com

IP:

blundar posted 05-09-2001 00:00 CT (US)
--------------------------------------------------------------------------------
Wow. You guys rock.
[Edited by Steve Jones on 05-09-2002 at 05:53]

IP:

blundar posted 05-13-2001 16:08 CT (US)
--------------------------------------------------------------------------------
I am pleased to announce a new forum for this discussion to continue, a forum where files like rom dumps or excel spreatsheets with program points can be attached to messages.
Everyone here is cordially invited over to http://pgmfi.crx-forum.org

Thanks for the name Cyclonus. Look forward to seeing some good progress!


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic This topic is locked, you cannot edit posts or make further replies.  [ 6 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Bing [Bot] and 11 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group