1G Eprom Editing - Hardware, Software and Info

[Miles Frederick]

I am starting this thread as means of consolidating the vast amounts of scattered information out there.  Also to discuss the hardware and software available for tuning / emulating / burning eproms.

First of all the hardware.  I picked up an Ostrich Emulator a few months back made by Craig Moates http://www.moates.net/product_info.php?cPath=24_45&products_id=57.  The cable plugs into your socketed eprom ecu in place of the eprom, allowing you to either adjust anything on the fly using a notebook, or unplugging the ribbon cable from the unit and bringing it in to work on.  Attaches to a pc via USB.  Changes can be made one at a time and activated on the fly while the car is running.  Or entire bin files created and uploaded all at once.  It has worked flawlessly for me over the past few months.  Opening it up reveals a surprisingly complex circuitboard, quality seems to be top notch.

Also available from Moates.net is the Burn1 http://www.moates.net/product_info.php?cPath=24_46&products_id=48  Which can be used instead of an Ostrich, although pulling your ecu to insert chips would get tiresome very quickly.  But I can see it useful to tune a car via ostrich, once happy with the settings burn the chip, freeing up the ostrich for another vehicle.

Flash chips are available from moates.net as well for $6 usd each http://www.moates.net/product_info.php?cPath=26_38&products_id=38



Now on to the software :

Tunerpro is a freeware open ended tuning software.  It features a script file .ecu allowing you to make custom definitions to assist in easy adjustments of your settings rather than editing the hex directly.  

Tunerpro RT is a shareware real-time version designed to operate with the Ostrich, required in order to upload or download anything to/from it.  It is $30 usd to register, but there is a $15 discount if you purchase the Ostrich, although it is not crippled aside from a 10 second delay on startup.

Screenshots of my setup :

Here's a shot of the fuel map editor.  Points on the graph can be dragged, or target afr numbers can be entered manually.  Note : Target Afr numbers are not likely to be accurate, but are very consistent and easy to tune by.







Same deal, here's the timing map editor.  Load vs RPM







Here's the rest of the settings configured sofar :

Rev Limit (rpm)
Stutterbox (rpm)
No Lift to Shift (rpm)
Injector Size Compensation (cc)
Fuel Cut Limit (g/rev)
Maf Multiplier, Scalar and Compensation (For fine tuning mafs)
Octane Table (Not in use, Octane map is bypassed completely in the bin)
Idle Map (rpm vs temp)
Fuel Injector Deadtime (deadtime vs voltage)
Closed Loop Throttle Position and Airflow (Both must meet the set conditions in order to switch to open loop)
Cyclone Intake Activation RPM and HZ (Both conditions must be met to trigger activation.  Simply activates the purge control solenoid, so could be used as a trigger for water injection, nitrous, etc.






There's even a speed density conversion (using egrt wiring as the input for a map sensor and airt input for a gm air temp sensor) being worked on which is showing some preliminary success.


Now for the files : (NOTE: .bin files may have to be right clicked and saved)

TunerPro v3
http://www.smilocomp.ca/files/SetupTunerProFree_v309.exe

TunerPro RT v3
http://www.smilocomp.ca/files/SetupTunerProRT_v310.exe

Winhex (Shareware) for editing hex files directly
http://www.smilocomp.ca/files/winhex.zip


Stock E931 5-speed Image and .ecu definition file :

http://www.smilocomp.ca/files/E931-32k-Stock5speed.bin
http://www.smilocomp.ca/files/E931_32k-Stock5speed-ecu.ecu

Modified E931 5-speed Images w/ .ecu definition file :

All bins below have :
Stutterbox
No lift to shift
Octane Map Bypassed
Injector Pulsewidth Cap Removed
Doubled Airflow logging for MMCD to 3212hz

+

1g maf w/ Phantom Knock Eliminator (Knock ignored below load point which corresponds approximately to 5" hg)
http://www.smilocomp.ca/files/1gmaf-nlts-octane-ipwcap-3212hz-phantom.bin

1g maf w/ Extended Fuel and Timing Maps (Max load doubled from 2.06 to 4.13 g/rev)
http://www.smilocomp.ca/files/1gmaf-nlts-octane-ipwcap-3212hz-extended.bin

1g maf w/ Extended Fuel and Timing Maps and Phantom Knock Eliminator
http://www.smilocomp.ca/files/1gmaf-nlts-octane-ipwcap-3212hz-extended-phantom.bin

2g maf w/ Phantom Knock Eliminator (Knock ignored below load point which corresponds approximately to 5" hg)
http://www.smilocomp.ca/files/2gmaf-nlts-octane-ipwcap-3212hz-phantom.bin

2g maf w/ Extended Fuel and Timing Maps (Max load doubled from 2.06 to 4.13 g/rev)
http://www.smilocomp.ca/files/2gmaf-nlts-octane-ipwcap-3212hz-extended.bin

2g maf w/ Extended Fuel and Timing Maps and Phantom Knock Eliminator
http://www.smilocomp.ca/files/2gmaf-nlts-octane-ipwcap-3212hz-extended-phantom.bin

The .ECU file for the above modified bin's
http://www.smilocomp.ca/files/E931_32k_3-NLTS-ecu.ecu



Here's the one modified to control a Cyclone (or anything else from the purge control solenoid)

It includes the above listed features, setup for 2g maf w/ extended fuel and timing maps (no phantom knock eliminator)
http://www.smilocomp.ca/files/2gmaf-nlts-octane-ipwcap-3212hz-extended-cyclone.bin

And the .ecu file to go with it

http://www.smilocomp.ca/files/E931_32k_3-NLTS-Cyclone-ecu.ecu

The above bin files definitions were made possible by to the info at the DSM-ECU group at groups.yahoo.com

For further reading visit :

http://autos.groups.yahoo.com/group/dsm-ecu/
http://users.wpi.edu/~ktarry/dsmtech/dsmromedit.html
http://www.fullthrottletech.com/forumdisplay.php?f=8

[Great post Miles, this is the kind of article I'd like to see more of in this forum     - MS]

[Martin Raska]

Great post for those interested.  That is interesting the TunerRT Pro.  It automatically recognized the Motorola op code, I guess it's pretty common in the ECU world.  The layout looks nice, very easy to use.

Other relavent links:

AT29C256 Datasheet.

Note, the following links are not dsm specific, and the 68HC11 is not even the microcontroller used in the ECU, it is just a well documented Motorolla microcontroller processor that you could use to learn about how ours functions more, and the Motorolla op codes if you are devoted enough to try and decode the hex into assembly, and learn the assembly or if you already know it have some fun.

68HC11 Manual

68HC11 Instruction Set Table.  Many shared instructions.

[Bryan Rozon]

Anyone know where I can order a few Atmel AT29C256 eproms, 28 pin dip? I can't locate any in Calgary

[Artem Goloubov]

Anyone know where I can order a few Atmel AT29C256 eproms, 28 pin dip? I can't locate any in Calgary

Good luck, hard to get thru retail, these things are obsolite.

[Miles Frederick]

You can get them for $6usd at http://www.moates.net/product_info.php?cPath=26_38&products_id=38 or $4.50usd if your not in a hurry at http://www.futurlec.com

[Wayne Wright]

I'm ordering the BURN1 tomorrow, I don't own a laptop so it just makes more sense for me to go the burner route, and I have not problem tuning that way.

And, I'm giong to grab 5-10 chips so I can sell em to the island folks if they ever need one.

Just want to thank Miles for the awesome post, I have tons of reading to do and can't wait to learn the in and outs of this stuff.

Man, all the capabilities of the DSMLink for 100$....just not as convenient, (no real time on the flyness for me) and less support, although there is quite a bit for a "freeware" DIY based project.

I didn't really come accros a walkthrough of how the program works. Do you have to load a XDF or ECU file first, to give TunerPro RT the Hex code translation. Then, load the Bin's? I was fucking round with it a bit last night, whenever I opened a value, (e931 BIN) let's say rev limit, changed it to 8500.00, clicked save then exited the box and brought it back up it was at 7500 again.

Where can I find a good manual for TunerPro RT....then I can stop asking dumb questions....

I looked on the TunerPro site, did I just miss it?

Thanks again,

Wayne

[Miles Frederick]

It sounds like you're using a newer version of Tunerpro.  Once you open the bin and import the .ecu file hit ctrl - f2 and change the bin size (hex) to 8000.  Then from the xdf menu save as and give it a name.  In the future just use that xdf you created.

Also, I find version 3 available in the first post to be free of clutter.  The new version has a bunch of new features, the biggest one is aldl logging, but unfortunately hasn't been implemented for dsm's as of yet

Also if using the burn1, you may as well just use Tunerpro (non RT), as you don't need the realtime functionality and there is no registration nag.

As for manuals go to the help menu and help topics.   Select Contents on the left hand side.

I've been very happy with my ostrich.  Not to discourage you from the burn1, but even without a notebook it's really nice to be able to simply unplug the ribbon cable, carry it in and make your changes bring it out and plug it in.  Whereas changing the chip in your ecu can be a bit of a pain (disconnecting ecu or battery, opening case, etc)  One way to avoid that perhaps it to cut a hole in you ecu case and soldering a long pinned wire wrap type dip socket, then plug in a zif socket.  It should lift the chip enough to change it without removing the ecu case.  The advantage of the burn1 of course is that you can make as many chips for as many cars as you want at $6 ea

[Wayne Wright]

See now I don't know what to do....cause like you brought up I could just unplug the Ostrich and bring it in, adjust and plug it back in...but I think the REAL advantage is the on the fly tuning....which I can't take advantage.

This build is already costing me way more then I can logically afford....so I'll like likely go with the BURN1, and hell if I sell 4 chips for 25$ a pop over the years to some DSM'ers, then it pays it self off.

[Andrew Scott]

Buy a $100 laptop

It'll pay for itself in datalogging alone

[Wayne Wright]

I cant seem to find one for that price that will handle logging mulitple values well.

I was planning to get set-up with TMO, I have the Standish box, so I bought a 50$ laptop, worked for a week then crapped out, it loads fine in safe mode,  but I can't communicate through ports in safe mode. When in normal mode, it just freezes right after the windows login screen.....mouse don't move, nothing.....I think it's a fried sector, or some interface that doesn't get used when in safe mode....I dunno......but with the Ostrich and @$#% laptop I'm looking at 350$....BURN1, just over a hundred all said and done.....but I would rather have the Octrich obviously....

I'm buying a few other parts as well right now, taking my car off the road cause my insurance expires on the 27th, and I owe $1700 till I can renew it, so I"m just kind of ignoring that dept and using the time to get all my mods giong....then while I'm doing the install I'll save up and pay it off hopefully right as I'm done all the work......or a week later.

But then when I think long term, the Ostrich would be better, but I'm sure both will be handy by that time.....

I'll figure it out...

Thanks guys.

[Andrew Scott]

reformat your $50 laptop and reinstall windows. Even if your drive has a bad sector, if you do a deep format, the bad sector will be marked and ignored

[Wayne Wright]

Hey Miles,

Do you know the Hex addresses for implememting the security type features that the TMO chips had?

Thanks,

[Miles Frederick]

No, unfortunately I can't find any info regarding that.  Not quite as sophisticated, but something I've considered doing is to add a switch to the fuel pump relay (rewired) and hide is somewhere in reach, but not easily visible.

  I'm playing around at the moment with a knock light to either turn on the check engine light at a specified knock threshold, or perhaps fire the purge control solenoid, which could turn on an led and/or buzzer.  I'll post some info on this once I confirm it's all working properly.

  What I really want to try next is Nick Sander's implementation of speed density.  He has a highly modified bin image to replace the maf with a gm map and gm iat sensors (wired into the barometric and iat inputs), and adjust settings on the fly with a palm (pocketdyno software).  I've only read a few reports but people seem to be having good results with it.

[Wayne Wright]

If I had a widebandm with a 5v and 1v output, would the stock ECU be able to benefit? Like I know the stock ECU reads the A/F on a 1v scale, but when the wideband (UEGO) outputs the 1v signal, is it a "narrowband" so to speak, or a true wideband signal scaled down to 1v?

Hopefully someone understand my guestion, just wondering if I had the wideband's 1v signal plugged into my ECU if it's just a normal shitty reading, or one that I could accurate tune for target A/F' ratios.....

Thanks.

Oh, and if the entire point of a wideband is the 5 volts, and the 5 volts is what makes the signal a wideband, then forgive me and ignore the question.  :laugh:

[Miles Frederick]

Actually, someone on the dsm-ecu group posted some code awhile ago to make the ecu read a wideband 0-5v signal.  A few people have reported good success.

I have been running this code for quite a while now
with my own modifications. Works fine for me.

--- Kyle Zingg <blackhole23@...> wrote:

> Just to close my multiple threads in the archives on
> this subject,
> Nick's code changes to support a wideband O2 input
> in place of the
> stock narrowband unit work fine. All fuel trims are
> updating properly
> (my previous issues were unrelated to the WBO2).
>
> In short, the code changes needed consist simply of
> inverting the O2
> lean / rich switch points because at low volt WB is
> rich and NB is
> lean and changing the branch carry code to reflect
> that inversion. For
> the full code check message# 3267.
>
> FWIW my Zeitronix / Bosch WB02 I find that setting
> both switch points
> the same yields a max cycle rate of ~2.6Hz at
> cruise, a bit less than
> a fresh stock NB.
>
> Kyle "BlackHole"

Oops..
I guess I was a little out of it today. You and KyleT
are correct, and there is no 0x31 involved anywhere.
Also, WB is rich at low volt, while narrowband is
lean at low volt.

The two values seem to be 0x1a -> the value to cycle around
and 0x1f -> a control value, below and above which the car
is running in "lean" or "rich" mode. I would guess that
it's a bit higher so that it won't toggle as much in closed loop?

So, I think the proper change would be:
// old
< d69e: 96 ce ldaa *0xce // O2 sensor
< d6a0: 81 1f cmpa #31 // if O2 < 31 (.5v) (lean)
< d6a2: 24 03 bcc 0xd6a7 // (branch carry clear)

// new
> d69e: 96 ce ldaa *0xce // WBO2 sensor
> d6a0: 81 7a cmpa #122 // if WBO2 >= 122 (2.4v) (lean)
> d6a2: 25 03 bcs 0xd6a7 // (branch carry set)

d6bf: d6 ce ldab *0xce // WBO2 sensor
d6c1: c1 7a cmpb #122 // if WBO2 >= 122 (2.4v) (lean)
d6c3: 25 03 bcs 0xd6c8 // (branch carry set)

d7fc: 96 ce ldaa *0xce // a = WBO2 sensor
d7fe: 81 80 cmpa #128 // WBO2v >= 128 (2.5v) (lean)
d800: 32 pula // a = O2trim
d801: 25 07 bcs 0xd80a // if WBO2v >= 2.5v

e61c: 96 ce ldaa *0xce
e61e: 81 7a cmpa #122 // WBO2 < 2.4v (rich)
e620: 24 02 bcc 0xe624

f08b: d6 ce ldab *0xce // WBO2 sensor
f08d: c1 80 cmpb #128 // WBO2v >= 128 (2.5v) (lean)
f08f: 25 0d bcs 0xf09e

I'll post context in a file, since yahoo removes text formatting..

-Nick

--- In dsm-ecu@yahoogroups.com, "Kyle Zingg" <blackhole23@w...> wrote:
>
> Nick,
>
> > Max (0x31) is the value above which the car will throw a CEL,
> > Closed loop will cycle as close above and below the other
> > value as it can. Lean is <= 0x1a and will increase O2 trim,
> > rich is > 0x1a and will decrease O2 trim. So the ECU is
> > always increasing or decreasing fuel.
>
> Okay, this makes a lot more sense. Thanks for the clarification, this
> looks very doable.
>
> > I think the locations are:
> > d6a0, d6c1, d7fe, e61e, f08d.
>
> Here's what I've got for code fragments on each side of those
> addresses, does this look correct? I'm still struggling with reading
> hex and picking out the opcodes.
>
> d69f: CE 81 1F
> d6c0: CE C1 1F
> d7fd: CE 81 1A
> e61d: CE 81 1F
> f08c: CE C1 1A
>
> So just change the target value 1A [26d=0.51v=14.7AF] for the
> narrowband O2 to 78 [120d=2.35v=14.7AF] for the wideband O2? That's
> way too simple. I'm still a little fuzzy on how to change the
> 0x1F / 0x31 DTC limit, I didn't follow Josh & Nick comments [msg
> 3249]. 31h=49d=0.96v, which makes sense as an upper O2 voltage bound.
> But then what is 1F?
>
> Kyle "BlackHole"
> [feeling dumb enough to be a potential Mitsu Darwin award winner]