EvolutionM - Mitsubishi Lancer and Lancer Evolution Community

EvolutionM - Mitsubishi Lancer and Lancer Evolution Community (https://www.evolutionm.net/forums/)
-   ECU Flash (https://www.evolutionm.net/forums/ecu-flash-179/)
-   -   Break-thru: Reading ACD ECU with EcuFlash (https://www.evolutionm.net/forums/ecu-flash/473547-break-thru-reading-acd-ecu-ecuflash.html)

sba Feb 19, 2010 05:56 AM

1 Attachment(s)
About logger:

you need to use OP: 1.3U with L-line also connected.
attach the .xml file with all the requests. I have figured out a couple of them and renamed them. After that, i will also try to figure out scalings.

I will post as i find out more!

fostytou Feb 19, 2010 09:40 AM

The logger connected for me (USDM IX) last night, but I only had Acamus' 3 IDs in. None seemed to change.

I'll see if I can work out some of the other ID's later.

sba Feb 19, 2010 10:51 AM

2 Attachment(s)
Thanks to the program made by Acamus, I finished looking for the idRequests based on the inputs. I found (i think) all the responses for all the inputs.

You will find attached the .xml file for Acamus logger for those you wants to try different things (just change the extension).
Also, you will find a .txt file which contains also all the idRequest, they're names and the values when nothing is connected.

For wheel speed, i found that every wheel has two different idResponses and also there are two idResponses commune for all 4 wheels.

For steering wheel, i found three different idResponses, for all three different variable resistors inside the sensor.

For brake & hand-brake, i found that the value is changing by +1, going from 16 to 17 or from 4 to 5 based on On/Off status.

For TPS & OilPress, the value is changing based on the voltage, but i didn't made any supposition about the 0% value and 100% because depend of the resistance of the TPS sensor and i didn't measure yet one.

For 0x22, the value is changing between 81 and 82 without any link to anything. Voltage, temperature, anything i can change and verify.

For 0x1F & 0x20, the value is 128 all the time. In my opinion, it is something that it will measure in both ways equally, but i couldn't figured out yet based on what.

For 0x31 - 0x41, the value is all the time 255. Can this be the outputs?

For Battery, everything is figured out. :)


If everyone has a different opinion about anything, feel free to say and to verify. I can be wrong and i admit that.

I'm waiting for devs to make they're magic now.

PS: If anyone wants to test anything in a safe manner, i can do that. I have the right tools to recover my ECU in case of anything.

MR Turco Feb 19, 2010 11:19 AM

this is great guys. My car might be coming down again so might be a while before i can play... :(

sba Feb 19, 2010 11:25 AM


Originally Posted by MR Turco (Post 8012413)
this is great guys. My car might be coming down again so might be a while before i can play... :(

Don't be upset, because we have to work more until something is really ready. For the moment, you cannot write the ecu with EcuFlash and so, you cannot test anything. Also the definitions are just starting to get properly made. After that, it is time for playing...but let's be there and see after.

Stay tuned!

scheides Feb 19, 2010 11:40 AM


Originally Posted by colby (Post 8008241)
Sorry for the late reply. If you have a spare ACD, I would be happy to pay to have you send it to me to look at and figure out what might be going wrong with the flashing. If not, I may try to find one myself...

Colby

I have a spare ACD ECU that I picked up specifically because I knew it would come in handy for this particular project, by me or someone else :D PM me your address, I'll mail it out this weekend ;)

Ceddy Feb 19, 2010 11:43 AM

1 Attachment(s)
Nice work!

I'll try to back track the MUT Requests to the Table Axis tonight.

Did the Wheel Speed Requests change when you applied a voltage?
From the code it looks like they are on a pulse counter, and react to a frequency not a voltage.


Edit:

0xEF, EE, ED, EC = ROM Calibration Id

0x31 -> 37 = Port Data Register 1 -> 7 (These are Input/Output Bit Flags)
0x3A -> 3C = Port Data Register A -> C

0x3E, 3F = ROM Logger Id

0x1B, 25 = AYC Related, I think. Only loggable under certain condition.


Edit x2:

0x19 Spd_Com2 is directly tied to all the 3-D tables Y axis.
So looks like all the Y axis are Vehicle Speed.

Code:

mov:g.w @F208_BigY_Axis:16, r0     
cmp:i.w #0xB0:16, r0
bhi    loc_1AAD2:8           
clr.w  r0                   

loc_1AAD2:                                     
mulxu.w #0x45B:16, r0         
mov:g.b r0, @F4FC_WSpd_Comn_2:16

If Y_Axis less then 0xB0, then Spd_Com2 = 0

Else Y_Axis * 0x45B / 0x10000 = Spd_Com2 [Keeping low byte only]

NM Figured out. They are keeping most significant byte, dropping lower 2 bytes(r1).

Y Axis units = Spd_Com_2 units * 58.78

So if EvoScan conversions are correct, axis looks like this in kph. (Looks correct)
Attachment 147607

Spd_1 Logger units should be x = kph
Spd_2 Logger units should be x/5 = kph

evonut270 Feb 19, 2010 12:20 PM

whats required to get to log the ACD i have the 1.3U cable.

sba Feb 19, 2010 12:25 PM


Originally Posted by Ceddy (Post 8012518)
Nice work!

I'll try to back track the MUT Requests to the Table Axis tonight.

Did the Wheel Speed Requests change when you applied a voltage?
From the code it looks like they are on a pulse counter, and react to a frequency not a voltage.


Edit:

0xEF, EE, ED, EC = ROM Calibration Id

0x31 -> 37 = Port Data Register 1 -> 7 (These are Input/Output Bit Flags)
0x3A -> 3C = Port Data Register A -> C

0x3E, 3F = ROM Logger Id

0x1B, 25 = AYC Related, I think. Only loggable under certain condition.

The wheel speed is a pulse counter and i had to simulate it as i could. So i made a intrerupt signal with 2 wires. But, because the signal was not consistent, i cannot make a right idea about anything. I will make a "signal maker" for rpm and other things like that for the future.

This ECU doesn't have any AYC inside, in theorie.

There is also a wire between ACD and Engine ECU, but i cannot find out yet if EFI to telling something to ACD, or ACD to EFI and in that language. So in order not to really fry my ACD, i didn't connect anything to that pin yet. I'm still searching what is happening on that wire in a working car.

I didn't see ROM Logger ID and ROM Cali ID. Sorry :)

sba Feb 19, 2010 12:52 PM

deleted

sba Feb 19, 2010 12:55 PM


Originally Posted by evonut270 (Post 8012680)
whats required to get to log the ACD i have the 1.3U cable.

Unfortunately, there is not a real logger out yet. It is just a tool that Acamus made it for me to find out requests and inputs.

But if you really want to try it yourself, everything is written in this thread.

CAUTION: if you don't know what you are doing, you can fry or brick your ecu!!!
Better leave it alone until everything is figured out completly.

fixem2 Feb 19, 2010 01:24 PM

IS the only way to read the ACD ROM to pull it from the ACD ECU while out of the car? Just curious if we can get someone from each year of the ACD in USDM and EDM cars, may see differences that will help tell the developers more information on the tables.

Ceddy Feb 19, 2010 01:27 PM


Originally Posted by sba (Post 8012711)
This ECU doesn't have any AYC inside, in theorie.

The ACD Only and ACD & AYC roms are very similar. I think they just turn AYC off in the ACD Only rom.

rolly1818 Feb 19, 2010 01:46 PM


Originally Posted by Ceddy (Post 8012980)
The ACD Only and ACD & AYC roms are very similar. I think they just turn AYC off in the ACD Only rom.

the gruppe-s ACD tune disables AYC on the whole, other ACD control boxes does the same that i think it may be easiest?

does this apply to the JDM IX in as well i know all of you guys are in the US?

Ceddy Feb 19, 2010 01:52 PM

1 Attachment(s)
I think this should work with all 8 & 9s, except the S-AYC maybe.

A Tables are Throttle Position x Vehicle Speed
Attachment 147611
(Could possibly be TPS Delta)


All times are GMT -7. The time now is 02:46 PM.


© 2024 MH Sub I, LLC dba Internet Brands