utc_pyro

It's not bad, but that's the info for the 4eat not the 5eat. Though, that said, I think the pinouts are similar. If you look at the 5eat in the service manual (and that other documentation I dug up) it just shows them going from the TCU to a "block" of the valve body. Unfortunately, not nearly the same level of detail as they give for the 4eat. Though that said, the info about the line pressure is interesting, as it's probably the same between them. I was thinking we needed to RAISE the current, but this info is showing the opposite. Hum, if one puts a resistor in parallel with the coil, you'll get higher line pressure! Unsure on that, but if you look at some of the detialed information on the transmission, there are a few graphs of the shift points. They are not that detailed, but look very close to those found when they hacked the SVX's TCU. It's based on engine load and MPH, and there are some points that go to "0" on the throttle, so that would be the set in stone portion. Unlike a human driving a manual, the TCU is actually shifting based on MPH, so it would be set speed points. It changed maps has some shift logic incorporating the g-sensor, but I don't think it's a major impact on normal shifting.

I think the rev matching is done in the ECU, not the TCU. As in the TCU tells the ECU to do it, but the amount is probably in the ECU. You might want to check over on RomRaider to see if they can dismissible that portion of the ECU further for you. Progress report: I'm designing a piggyback for the short term to act as a shift kit. It wont be able to change shift points, but it can speed them up and increase pressure. It can also keep that lockup from happening at WOT that killed a few transmissions. Right now I'm working on the pinout of the control wires to the valve body (not broken out in the service manual) and I'll post that when I have it finished.

Ah, I didn't realize you were laving the stock ECU in to just handle the cluster and DBW. On making it think it's a manual, there is an ID pin, but it may be more complex then just changing it. The 5eat to 6MT conversion threads would have that info.

I've never seen a good high res shot of it, so it's hard to tell. I think there is a box with a bunch of wires going into it on the bottom center. From the tech info, it calls that the memory box. You wouldn't even be taking the valve body apart to get pictures of the inside of that box. Though if you want to take the entire thing apart, go for it! Detailed pics of the inside could help for mechanical mod potential. Particulary the chance of using a 350z shift kit on it.

That's kind of what I was thinking. I have yet to figure out what the heck the controller used in the TCU is based on, so that makes it rather hard to start hacking it. If the memory chip in the valve body is "standard" enough for me to get a speck sheet on, we can at least take a look at it. Based on the description in the tech documentation of the 5EAT I dug up, they just use this for the "starting point" though and the TCU will learn around it. On the JDM/EDM TCU, it might work. If I get the time, I'll try and plug this '05 TCU into my '06 to see if they lock the ECU year to the TCU one. Any one have a trashed valve body they can take pictures of?

It has a fixed target address (the ECU's), I need to sweep the target addresses to find the tcu. That said I have a program to try, so I'll keep you all updated. I took a shot at it last night and couldn't get it to talk to my cable though :/. May be driver related, I'm going to try my old XP laptop tonight.

Not yet, I'm having problems finding a program that I can use manually send commands via ssm to find it's address. Any .NET devs willing to wip me something up? I just need someth I can type hex commands in to send out my OpenPort. I have come up with some some ideas for a piggyback, memory hack (it stores info in an EEPROM/Flash in the valve body) or hacking the valve presure regulating chip to rase the pressure.

Not yet, just slowed down. I'm going to have a weak worth nothing to do after work soon, and I'm going to be spending most of that time sitting in my car hammering on my TCU to at least get logging support. For the "hacking" portion, I'm going to have to get friendly with the techs at my local dealer so I can intercept the flash being loaded onto the TCU. I'm still picking out a logic analyzer for that (suggestions welcome!).

Well, if some one has a contact there familiar with the SSM III tool, I have a few questions that could help us... It's a $3000+ piece of equipment, so I dont think they'll be lending it to us. That said, they could tell us if any updates are avalibel for ANY of the TCU's. If we can find one that has an update, I can get the equipment to "sniff" the flashing of one. That will give us the ROM and how to flash it.

J2534 Pass-thru Reprogramming CD-ROM I just looked up what's in it, and I don't see any TCU updates at the moment. What I was thinking of was just ECU updates (already cracked) NSFW found it to mostly match a part number on Digikey, but I'm starting to think it was just by chance. They do make a 144 pin version of the Spartin-XL, but the JTAG ports don't line up properly. If you can figure out what it is, or the two other ones next to it, let me know. The other 44 pin IC has it's own oscillator (~1/2 the frequency of the bigger one) and talks to the bigger between pin 20 and 36. I need to find the pinout of this thing and trace the K-Line and CAN interfaces... That might lead to ID'ing the parts.

I think I can see how the turn on this thing came about: some wanting it to run in sloppy non locked mode at high rpm, some wanting it sharp, locked at all times, and low rpm. I don't think this uses a FPGA, or at least not a Spartin XL. The pins don't match up quite right... I'm going to look into Hatachi MCU's to see if any happen to fit. Needs to be a 144pin package and have CAN bus support. It looks like the numbers ligning up was a fluke. I think going after this from the SSM side will help us more. If a rom can be pulled during a flash, that can be forwarded to the software guys at openecu, romraider, or a tuning house. Subaru has an update for the '05 5eat, I just need to buy the $75 cd to get it. edit: Picutes have NOTHING to do with this. For another user.

That's what I'm leaning toward right now, but I still need to figure out what those other IC's are. Here are the biggest hurtles for a comprlete rewrite: 1) The 5EAT is a quite advanved transmission, getting it as good as stock will be difficult with nothing more then the service manual documenting the mechanical side of it. 2) The center diff is controlled by the TCU, it's logic is not very well documented compared to the shifting logic. 3) The TCU talkes to the ECU and BIU via CAN, so all of those functions will need to be simulated. On our side though, we can use OpenCores for a working CAN bus module. 4) Any progress with talking to the TCU via SSM will be lost. 5) User level flashing of the TCU will be risky. That said, I'm sure I could program it to be one heck of a race transmission . Getting it to be civil around town is the hard part.

Eh, this may be harder then first thought.... being an FPGA, I can't find any good tools for taking the existing config and turning it back into VHDL/Veralog that I can work with. It might be possible to make get a gate level netlist, but that's going to be hard to figure out and modify. Second, I need to figure out what the chips to the top and left of thd FPGA are. One is the memory that feeds the thing it's config upon power up (I think), but I don't know about the other... This is all possible, but it may be WAYYYYY past what I can do alone. I think I'm going to back off this portion at the moment and try to probe it with SSM. Hopefully I won't kill my car doing a "port scan" on the thing... (read into the SSM protocal, I need to sweep the "address" untill I find the TCU)

NSFW, you have saved the day! My google skills failed and I was starting to think we would not get in. I just finished a grad course on VSLI and the Spartin 3, and the professor has some experiance with FPGA security. Maybe he can help on this... I wonder if there is a "digial" design in there or if they just implimented a processor + supporting hardware.

I got the test TCU in today, here is what I found with about an hour of looking: http://legacygt.com/forums/attachment.php?attachmentid=83858&d=1271995095 Figure 1. Outside http://legacygt.com/forums/attachment.php?attachmentid=83859&d=1271995095 Figure 2. Connector http://legacygt.com/forums/attachment.php?attachmentid=83860&d=1271995095 Figure 3. Warranties are for wusses Cracked the thing open, and this is the main board. It's just two layers from what I can tell, but it's extreamly dense. I dont have the skills to even to design something like this! Unfortunatally they coated it in goo making it rather hard to read the IC numbers. http://legacygt.com/forums/attachment.php?attachmentid=83862&d=1271995095 Figure 4. Board top http://legacygt.com/forums/attachment.php?attachmentid=83861&d=1271995095 Figure 5. Board bottom On the left side are the mosfets that drive the solenoids inside the valve body. There are seven that appear set up to handle PWM output, one that is a "digital" on or off only (lower left) and one that puts out an analog output. The analog (I think) one is a Inferon BTS716G, and based on the 4eat's diagrams, this would control the leaner solenoid used to regulate pressure. http://legacygt.com/forums/attachment.php?attachmentid=83863&d=1271995095 Figure 6. Output section Now this is our main target: The controller. Unfortunately we have a small (Er, ok, BIG) problem. http://legacygt.com/forums/attachment.php?attachmentid=83864&d=1271995095 Figure 7. WTF is this thing?! I cant figure out what on earth they are using controller wise. I can't even find a referance to a "uJ" that makes anything.... Maybe Hitachi is using an ASIC for this thing? Any help would be apreciated here.... BIG TIME. I also cant figure out what the IC on the right does. It has it's own oscillator, but it does not appear to have many lines going to the main controller. On an good note, notice what's right above the "WTF" chip are what appear to be programing ports! http://legacygt.com/forums/attachment.php?attachmentid=83866&d=1271995095 Figure 8. Top of ports http://legacygt.com/forums/attachment.php?attachmentid=83865&d=1271995095 Figure 9. Bottom of ports But, again, this gets back to I need to know what the heck this thing is and get a Datasheet before I can get into it... Time to sweep SSM I guess. Edit: Doh.... Ok, progress on the controller. uJ = Unisia Jecs Unisia Jecs = Hitachi Automotive Products, Ltd. See here: http://www.romraider.com/forum/viewtopic.php?f=3&t=1139&hilit=hitachi or this picture here (from a OLD legacy gt): http://i18.photobucket.com/albums/b141/PandaImpreza/IMG_1045.jpg Note the icon in the upper left of the lable? It's the same between them! Now take a look at this thread, there is an ECU with a very similar controller: http://www.romraider.com/forum/viewtopic.php?f=14&t=3740&p=37081&hilit=hitachi#p37081