Break-thru: Reading ACD ECU with EcuFlash
#561
Guys, you do not need ti build a new harness to reflah acd ecu, you only need to put the single wire in pin 25, than connect o.p. in stock obd socket and the reflesh connector to the 'new' wire.
look this thread: page 2 #16
https://www.evolutionm.net/forums/ec...789-acd-2.html
look this thread: page 2 #16
https://www.evolutionm.net/forums/ec...789-acd-2.html
I'm new here.
One question.
I just want to read ACD data at the moment. (No reflash)
Even though, do I need to connect pin 25 to O.P reflesh connector?
When I tried to read ACD without pin 25 connection, it failed.
Or, using ecuflash 1.44, is that the reason?
#564
ACD only model
My EVO8JDM is RS model.
ACD only model (No AYC).
ACD ECU No. is MR580728.
When I first tried to read ACD ECU, error came up shows something like there is no metadata.
So I copied 400021 rommetadata and edit xmlid and internalidhex to 401001.
After modify I was able to read the data but X axis and Y axis seems going wrong.
For example Speed starts from 111... to 0 and to 60, Throttle 3... to 49.
I think I need to modify metadata but don't know how and where.
Can anybody help me?
Thank you in advance.
ACD only model (No AYC).
ACD ECU No. is MR580728.
When I first tried to read ACD ECU, error came up shows something like there is no metadata.
So I copied 400021 rommetadata and edit xmlid and internalidhex to 401001.
After modify I was able to read the data but X axis and Y axis seems going wrong.
For example Speed starts from 111... to 0 and to 60, Throttle 3... to 49.
I think I need to modify metadata but don't know how and where.
Can anybody help me?
Thank you in advance.
#565
I have small question. If I remove ABS fuse (to disable ABS), ACD and AYC still work normaly?
I have read different information, but today tested small logging, but didn't see difference at the moment.
Thanks
I have read different information, but today tested small logging, but didn't see difference at the moment.
Thanks
#568
Newbie
Disassembly 2.0
Just thought I'd dig this up from the grave and see if there's any interest (and ability) for people to understand some more of the how's and why's of this ACD/AYC unit. The practice of tuning these things now is more than common, and people get the results (including myself), but I'd love to know more about how it's doing it. Merlin has put heaps of effort into table definitions in his tuning thread. But i kinda wanted to get back into the disassembly of this thing...simply because I'm curious.
I've started my own disassembly of the roms, and while I have no idea what so ever in CPU's, programming and disassembly, but using the H8/500 PDF's I've been able to join a lot of dots by reverse engineering the current concepts of what it's doing with what inputs to make the connections in the disassembled code. But, there's still a lot that my skill level cannot decipher.
For example, the "Accel" and "Decel" tables. Ceddy below was on track. Address F080 has bit #5 tested to decide whether to do tables *.1, or table *.2. From doing my own logs of this address, I'm yet to find what triggers bit 5 for the decision.
Sabin above did test this address (page 18 in this thread), however I got different results. It appears that Sabin had bit 0 triggered. And I also got opposite with the brake pedal, in that mine added 2 bits, not subtracted. But otherwise my bit results in regards to input triggers were the same.
static return for me was 128 = bit 7. Now i believe I found what sets bit 7 to 1, and I think it's a battery level test. Ie, if the bat voltage is between an upper voltage level (@1008) and a lower voltage level (@1009) then set bit 7 @F080 to 1 (= 128 when logged in evoscan).
So back on track, i conclude results were as follows:
Bit 0 - ?
Bit 1 - Brake pedal = added 2 to 128
Bit 2 - Hand brake/ebrake = added 4 to 128
Bit 3 - accumulator pressure ok = added 8 to 128 once accumulator reached upper pressure limit (set to 0 when pressure was below lower pressure limit)
Bit 4 -
Bit 5 -
Bit 6 - Mode change = added 64 to 128 only when pressed
Bit 7 - Battery Volts ok = 128.
Kinda stuck until i find via logging what triggers bits 0, 4 and 5. I've found the sub-routine where they get set in the code, however I don't know what input signal is going into the port. Unfortunately on a hardware level, there are virtually nil direct signal paths from the plug pins to the CPU. The PCB is also triple layer, so a lot of tracks disappear and continue on the middle layer of the board, making it very hard to trace where the pin on the plugs go.
Anyway, I've probably rambled enough now....I'll quit while I'm ahead in case there's no interest in discussing further disassembly on this. There's heaps of other stuff I'd love to decipher in this, but as i mentioned to start with, my understanding of CPU's and how they work is virtually nil. Would love some new and old code guru's to help.
I've started my own disassembly of the roms, and while I have no idea what so ever in CPU's, programming and disassembly, but using the H8/500 PDF's I've been able to join a lot of dots by reverse engineering the current concepts of what it's doing with what inputs to make the connections in the disassembled code. But, there's still a lot that my skill level cannot decipher.
For example, the "Accel" and "Decel" tables. Ceddy below was on track. Address F080 has bit #5 tested to decide whether to do tables *.1, or table *.2. From doing my own logs of this address, I'm yet to find what triggers bit 5 for the decision.
static return for me was 128 = bit 7. Now i believe I found what sets bit 7 to 1, and I think it's a battery level test. Ie, if the bat voltage is between an upper voltage level (@1008) and a lower voltage level (@1009) then set bit 7 @F080 to 1 (= 128 when logged in evoscan).
So back on track, i conclude results were as follows:
Bit 0 - ?
Bit 1 - Brake pedal = added 2 to 128
Bit 2 - Hand brake/ebrake = added 4 to 128
Bit 3 - accumulator pressure ok = added 8 to 128 once accumulator reached upper pressure limit (set to 0 when pressure was below lower pressure limit)
Bit 4 -
Bit 5 -
Bit 6 - Mode change = added 64 to 128 only when pressed
Bit 7 - Battery Volts ok = 128.
Kinda stuck until i find via logging what triggers bits 0, 4 and 5. I've found the sub-routine where they get set in the code, however I don't know what input signal is going into the port. Unfortunately on a hardware level, there are virtually nil direct signal paths from the plug pins to the CPU. The PCB is also triple layer, so a lot of tracks disappear and continue on the middle layer of the board, making it very hard to trace where the pin on the plugs go.
Anyway, I've probably rambled enough now....I'll quit while I'm ahead in case there's no interest in discussing further disassembly on this. There's heaps of other stuff I'd love to decipher in this, but as i mentioned to start with, my understanding of CPU's and how they work is virtually nil. Would love some new and old code guru's to help.
#569
EvoM Guru
iTrader: (4)
I'm interested in following along with your work. I still haven't invested much time into understand the ACD ECU because I haven't been able to change it in my class. I have a spare ACD sitting around for experiments, though.
I still need to get Evoscan ACD logging working. Maybe I'll find some time to try that later this month.
I still need to get Evoscan ACD logging working. Maybe I'll find some time to try that later this month.
The following users liked this post:
ROB-80E (Apr 8, 2019)
#570
Newbie
I wouldn't be saying any of my work so far is ground breaking. That credit definitely goes sba, Ceddy, Acumus, and Merlin. I've just been recompiling it all as to say and trying to get clearer path ways. And my work moving forward definitely involves others input.
The following users liked this post:
Fox_IX (Apr 8, 2019)