utc_pyro

Does not work with my OpenPort 2.0.... Some one with a 1.3 or vag-com cable want to try?

It does not mention the 5eat being supported, but we can take a peak at the source to see how the TCU talks.

I think we can at least make logging definitions for RomRaider, and probably edit his files to work with the 5eat. It looks like it's all in C. SSMprotocol2_def_en.cpp is good

Were did you find that?

edit: Just ordered a VAG-COM cable .

To reprogram it, we need the data sheet of the processor (or a least a good idea of what it is). That way we'd know what to expect code wise and thus how to disesembe it. It may help to decode those programing pads, may not, but it should help.

After we figure that out, sniffing the SSM3 flashing the TCM could tell us HOW the rom is loaded onto the TCM. We can supply that info to Coby at Tactrix for ECU flash support of it, allowing us to flash our new versions down the road.

After that, we load up IDA (if it works with said core) and start figuring out how the thing thinks and how to change it's mind .

For now getting logging support, we need to figure out how the TCM talks via SSM (if it even does). Thus wen need to develop the deffinitions for it and get the direct SSM address. Thus the work over on RomRaider doing a "port scan" on the K-Line.

TI have a background in power electronics so I am designing a circuit that will use the stock fuel pump control to reduce the speed of the pumps for idle and low load situations.

How about just use the stock ECU PWM output to drive a power mosfet? You really have no reason to run the thing at 100% most of the time (it will DECREASE the life of the pump), just let the ECU do it's thing but with less total inline resistance fore the pump?

Does the fuel pump controller vary the voltage through resistors? Or is the pump somehow pulsewidth modulated?

It's PWM.

As fishbone said, the line pressure (resistor mod) is not the only thing they do. They also do what's often called a "shift kit" to bump up the pressure and activating speed coming out of per given solonoid input value. This is done by changing the springs and drilling out the ports to each solonoid. There are diy kits for the 5-speed auto 350z that have been talk about adapting to our cars, but no one has tried it yet. It's the same basic transmission core as we have, but we have a diffrent housing and AWD system attached.

So, who wants try try the resistor mod first . If doing just inline, measure the resistance of your solonoid and pick a resistor that will keep the total under ~10 ohms (keeps the CEL away) and probably less than 50% of the coil's value.

Eh, guess I was wrong. It's PWM, so put it inline. If you look at the pictures on the first thread, it's driven by the 2nd mosfet from the top (presuming the plugs are on the bottom").

Actually putting one in series and another in parrellel would give the best results, as the TCU could not correct out the offset. Hum...

Let me verify the pinout on the test TCU tonight and trace it to it's power source. If it's PWM, inline. If it's that analog current source, parallel. Based on how the 4EAT works, I'd say parallel but let me check before you start hacking on your wiring.

I guess I could go try that new USB scope/logic probe out on that wire and see what it's doing as well. It was partially paid for by the test fund, so I better use it on this

NSFW, thanks for the great info there. I'll get on trying those beta ones and trying to find them myself over the next few days.

If I remember right, there was someone on here a while back who built a sniffer, asked his dealership if they would use their SSM3 on his car so he could record the communications, and they refused. Or something like that. I don't remember any details really, it was a couple years ago.

If it's hooked up in such a way they dont know it's there, how could they refuse . That said, my local dealer's service people arnt fun to deal with (every thing I've been there and asked about particular service for my car I ended up saying screw it and doing it my self), but a road trip/cross country flight to visit with subarutech77 might do us some good.

Pin 12 on B55 is starting to intrigue me... Maybe it's UART like all the other direct buses in the car and easy to sniff.

Oh, and pin 9 on B54 (the left connector on the TCU) is the one for the line pressure solenoid. Lower current though the solenoid = more pressure. IPT may have been putting the resistor in line (not sure on this!), but based on some of the documentation I've been reading the 5AT(5EAT)'s TCU will try and output a particular current. If you put the resistor inline, the TCU will try and correct it out. You'll probably get a slightly lower current, but not as much as if you put it in parallel.

This is the GREEN wire coming off B54 on the TCU to B11 (the squareish connector unter the intercooler). From there, it's pin 19 (blue wire) to the transmission/valve body.

To get a 25% bump (presuming worst case senerio of 3 ohm coil), put a 9 ohm resistor in parallel.

http://www.romraider.com/forum/viewtopic.php?f=8&t=2991&start=0

It's not as filled in as I remember, but should give a nice starting point. I can make some educated guesses what some things (like the temperatures) are to at least get started.

Just had a quick thought while driving home: doesn't the 5EAT have some kind of warm-up mode, where if the ATF isn't up to temp, it will shift harder/hold the rpms longer?

It does that, but the shift hardness portion may have more to do with the mechanical aspects of it. Also you'd never go into TC lock if you did that.

NSFW, it's not going to be that bad . The info is already published, it's part of the documented paramiters in SSM that Subaru published (or leaked?) for third partys to make scan tools. It's aprt of the basic peramiters that the Rom Raider team never figured out, they just didnt have cars that were reporting this info.

There is a post over on the RomRaider forums where Merchgod(?) filled in the list of missing data values compared to a legacy GT ecu init string. Looked like they matched up right in order with the Subaru document, but there was no intrest in writing the definitions to match for the Logger.

I'd do it my self if you could give me a few pointers were to start. Just the logger definitions, nothing in the actual ECU.

I have the TCM pinouts if anyone is interested, I'll try getting the wire colors later as both connectors to TCM are the same(05 Legacy anyways), will require more digging in service manual

Can you get sme more detail on the wires that goe to the valve body that are just a block saying it goes to it? I just got a logic analizer (it literally just got here yesterday) so I can sniff them my self now, but it's not going to be easy figuring it all out that way. Spesifically, we need to know what pins are what solonoids.

Or let me know what you guys need, and I'll try to get it for you

I haven't been able to get the wife's car and the ssm3 in the same spot to check her TCM cal id. Would the program you are trying to use to scan for the TCM help if it can use the reflash?

Eh, I doubt it seeing as I never saw anything else respond except the ECU. What we'd need to do to get better info on how to interface with the TCU without cracking it, we'd need to sniff your SSM3 tool while it's talking to a TCU. That said, what state are you in

Really I need to figure out what standard those 9 debug pins on the TCU board are and what the CPU is based on to get started with reverse engineering it. Without that, we can only find work arounds (resistor mod, logging support, maybe a piggyback).

You know what we kinda forgot about? The ability to read the ATF temperature. I simply don't know what that is reported by or where the sensor is located and HOW it is reported (does it go to the TCU/ECU, or straight to the light on the dash?) but we know there is one.

I've done some more research, and it's probably reported to the ECU. We just need to find a way to add a few ranges to RomRaider and then figur out the scaling/offset. Maybe NSFW could help as he seems to be quite active on there forums finding new definitions?

Probing my car via SSM never got a response from anything but the ECU, so it must be the "gateway" to the CAN bus. That or this SSM "port scan" application that was given to me still does not like my laptop.

We actually have TWO temp sensors in the 5AT, one right after the torque converter (hottest place) and one in the pan (or the return from the cooler). These are NTC thermistors, and report directly to the TCU (it has a few analog inputs).

What part of the car did they mount the resistor on BTW? You happen to be able to trace the wires to pins on a connector? Also, if you can touch a multimeter to the leads on it and measure the resistance we can tell how it hooks up to the valve body and how to make it work on the older cars.

Thanks M Sprank!

Thats me. I have the external resistor. Porcelain style. Like you get at Radio Shack. I can see it zip tied to a harness of wires. I can take a pic and check resistance value. The car is on stands while I strip it sine it got rear ended. My VB is for sale too, lol. It is the very first 2008 VB IPT ever did. I drove the car there and left it with them for the day.

Yep, that would be a "power resistor", capable of handling higher current. If I'm reading the speck sheet right on the leniar current regulator the TCU uses to regulate the pressure, it can put out a few amps.

If you could take a pic AND check the value it would be much appreciated. When checking the value, you'll see the resistor and the solenoid's current in parrellel. If you can see a value marked on the resistor, we can back out the coil impedance. I can compare that to the coil impedance on my car, and give you all a value that will work on an 05/06/07(?) as well.

Dont know if this helps, something I found going through vaca pics on 08 LGT

 

http://i596.photobucket.com/albums/tt49/underground000/08.png?t=1279375335

 

http://i596.photobucket.com/albums/tt49/underground000/Pressure.jpg?t=1279377851

It's not bad, but that's the info for the 4eat not the 5eat. Though, that said, I think the pinouts are similar. If you look at the 5eat in the service manual (and that other documentation I dug up) it just shows them going from the TCU to a "block" of the valve body. Unfortunately, not nearly the same level of detail as they give for the 4eat. Though that said, the info about the line pressure is interesting, as it's probably the same between them. I was thinking we needed to RAISE the current, but this info is showing the opposite.

Hum, if one puts a resistor in parallel with the coil, you'll get higher line pressure!

Just to be clear, are there set in stone downshift points, or does the TCU choose when to shift based on various data such as vehicle speed, load, what the G sensor is saying, etc.

Unsure on that, but if you look at some of the detialed information on the transmission, there are a few graphs of the shift points. They are not that detailed, but look very close to those found when they hacked the SVX's TCU. It's based on engine load and MPH, and there are some points that go to "0" on the throttle, so that would be the set in stone portion. Unlike a human driving a manual, the TCU is actually shifting based on MPH, so it would be set speed points. It changed maps has some shift logic incorporating the g-sensor, but I don't think it's a major impact on normal shifting.

I think the rev matching is done in the ECU, not the TCU. As in the TCU tells the ECU to do it, but the amount is probably in the ECU. You might want to check over on RomRaider to see if they can dismissible that portion of the ECU further for you.

Progress report: I'm designing a piggyback for the short term to act as a shift kit. It wont be able to change shift points, but it can speed them up and increase pressure. It can also keep that lockup from happening at WOT that killed a few transmissions. Right now I'm working on the pinout of the control wires to the valve body (not broken out in the service manual) and I'll post that when I have it finished.

only concerns i have at the time is being able to maintain the cruise control and cluster operation. The plan is to take the subaru crank triggor from subaru scan it with 50 $ walmart scanner scale it up so i can attach it to either the fly wheel or damper. With that the dash will have rpm signal. the dbw throttle boddy will be used and that contains the map and tps witch will be wired into the megasquirt.

the tranny will operate as normal. Then i will replace the tcu with a automation direct plc http://www.automationdirect.com/adc/Shopping/Catalog/Programmable_Controllers/CLICK_Series_PLCs_(Stackable_Micro_Brick)/PLC_Units/C0-00DD1-D

inputs will be shift buttons, torq lock up, auto/ manual mode , tps , 2wd /4wd comand.

 

The gauge cluster get's all of its information from the ECU/ABS computers via CAN. Remove ether of those, and it's not going to work. If you want to even try, you'll need to log the hell out of the CAN bus so you can later spoof the messages. There are no direct connections from the engine to the cluster except a few idiot lights.

 

Cruise control is 100% done in the ECU, and if you try and keep it in the system, you won’t have cruse. As soon as it realizes that it's no longer controlling an engine (or a TCU), you'll have a CEL and no cruse. Your Megasquirt will have to support this function, you you’ll have to run a mechanical throttle with an aftermarket vacuum cruse control.

 

DBW is the same way, it's all done in the ECU. There is no "map" in it, it's not stand alone and cannot operate in that manner. You'd have to program your Megasquirt to "output" the throttle position to the DBW throttle body based on what it reads in from the TPS. In this case, the OEM ECU might still TRY to keep running the throttle body if left in the system, but it won’t be happy.

 

On the 5EAT, if you go from the get-go with your PLC TCU replacement, that part of this might actually work. You probably won’t need a valve body mode ether if you slam the solenoids full open/close on shifts.

I have a stock valve body on my shelf. What do you need pictures of? I know I'm going to kick myself later if I tear it apart, so keep that in mind. Let me know.

I've never seen a good high res shot of it, so it's hard to tell. I think there is a box with a bunch of wires going into it on the bottom center. From the tech info, it calls that the memory box. You wouldn't even be taking the valve body apart to get pictures of the inside of that box.

Though if you want to take the entire thing apart, go for it! Detailed pics of the inside could help for mechanical mod potential. Particulary the chance of using a 350z shift kit on it.

I had noticed the mention in the manual of storing data in a memory inside the trans. but hadn't got around to posting about it. If you could figure out what is stored there, it might not be too difficult to hack it such that the TCU thinks it needs to shift quicker based on what it reads.

 

Another thought - Do the JDM or EDM versions of the LGT use a different TCU? Possibly one that shifts quicker / more firmly? I don't recall non-US/Canadian drivers complaining about the trans. I must admit though that I haven't done any type of searching to determine if this is more than just a notion on my part.

That's kind of what I was thinking. I have yet to figure out what the heck the controller used in the TCU is based on, so that makes it rather hard to start hacking it. If the memory chip in the valve body is "standard" enough for me to get a speck sheet on, we can at least take a look at it. Based on the description in the tech documentation of the 5EAT I dug up, they just use this for the "starting point" though and the TCU will learn around it.

On the JDM/EDM TCU, it might work. If I get the time, I'll try and plug this '05 TCU into my '06 to see if they lock the ECU year to the TCU one.

Any one have a trashed valve body they can take pictures of?

It has a fixed target address (the ECU's), I need to sweep the target addresses to find the tcu.

That said I have a program to try, so I'll keep you all updated. I took a shot at it last night and couldn't get it to talk to my cable though :/. May be driver related, I'm going to try my old XP laptop tonight.

Not yet, I'm having problems finding a program that I can use manually send commands via ssm to find it's address. Any .NET devs willing to wip me something up? I just need someth I can type hex commands in to send out my OpenPort.

I have come up with some some ideas for a piggyback, memory hack (it stores info in an EEPROM/Flash in the valve body) or hacking the valve presure regulating chip to rase the pressure.