5EAT TCU Reverse Engineering

[utc_pyro]

BIU? Hmm. Can we scan the CAN to see what commands it sends, and then send our own instead? :-)

 

I'm going to try that as on of my embeded systems class projects, but we'll see what happens.... I'm working to get these romradier deffs for the 5EAT working right now.

 

<< "9;1;0;1;00004F;;Turbine Revolution Speed;rpm;*32;0"

<< "9;2;0;1;00004E;;Throttle Sensor Voltage;V;/45;2"

<< "9;3;0;1;00004D;;Transfer Duty Ratio;%;/2;1"

<< "9;4;0;1;00004C;;Lock Up Duty Ratio;%;/2;1"

<< "9;5;0;1;00004B;;Line Pressure Duty Ratio;%;/2;1"

<< "9;6;1;1;00004A;;Gear Position;gear;+1;0"

<< "9;7;0;1;000049;;ATF Temperature;°C;0=-60,1=-60,2=-51,3=-45,4=-40,5=-37,6=-34,7=-31,8=-29,9=-27,10=-25,11=-23,12=-22,13=-20,14=-19,15=-17,16=-16,17=-15,18=-14,19=-13,20=-12,21=-10,22=-9,23=-9,24=-8,25=-7,26=-6,27=-5,28=-4,29=-3,30=-2,31=-2,32=-1,33=0,34=1,35=1,36=2,37=3,38=3,39=4,40=5,41=5,42=6,43=7,44=7,45=8,46=8,47=9,48=10,49=10,50=11,51=11,52=12,53=12,54=13,55=13,56=14,57=15,58=15,59=16,60=16,61=17,62=17,63=18,64=18,65=19,66=19,67=20,68=20,69=21,70=21,71=22,72=22,73=23,74=23,75=23,76=24,77=24,78=25,79=25,80=26,81=26,82=27,83=27,84=28,85=28,86=29,87=29,88=29,89=30,90=30,91=31,92=31,93=32,94=32,95=33,96=33,97=33,98=34,99=34,100=35,101=35,102=36,103=36,104=37,105=37,106=37,107=38,108=38,109=39,110=39,111=40,112=40,113=41,114=41,115=41,116=42,117=42,118=43,119=43,120=44,121=44,122=45,123=45,124=45,125=46,126=46,127=47,128=47,129=48,130=48,131=49,132=49,133=50,134=50,135=50,136=51,137=51,138=52,139=52,140=53,141=53,142=54,143=54,144=55,145=55,146=56,147=56,148=57,149=57,150=58,151=58,152=59,153=59,154=60,155=60,156=61,157=61,158=62,159=62,160=63,161=63,162=64,163=65,164=65,165=66,166=66,167=67,168=67,169=68,170=68,171=69,172=70,173=70,174=71,175=71,176=72,177=73,178=73,179=74,180=75,181=75,182=76,183=77,184=77,185=78,186=79,187=79,188=80,189=81,190=81,191=82,192=83,193=84,194=84,195=85,196=86,197=87,198=88,199=88,200=89,201=90,202=91,203=92,204=93,205=94,206=95,207=96,208=97,209=98,210=99,211=100,212=101,213=102,214=103,215=104,216=105,217=107,218=108,219=109,220=110,221=112,222=113,223=115,224=116,225=118,226=119,227=121,228=123,229=125,230=127,231=129,232=131,233=133,234=135,235=138,236=140,237=143,238=146,239=149,240=152,241=156,242=159,243=164,244=168,245=173,246=179,247=186,248=193,249=202,250=212,251=225,252=241,253=264,254=300,255=373;0"

<< "9;8;0;1;000048;;Front Wheel Speed;km/h;*1;0"

<< "10;1;0;1;000057;;Low Clutch Duty;%;/2;1"

<< "10;2;0;1;000056;;ATF Temperature;°C;-50;0"

<< "10;3;0;1;000055;;Lateral G Sensor Voltage;V;/50;2"

<< "10;4;1;0;000054;;Air/Fuel Sensor #2 Heater Current;A;/10;1"

<< "10;5;1;0;000053;;Air/Fuel Sensor #1 Heater Current;A;/10;1"

<< "10;6;0;1;000052;;Manifold Pressure Sensor Voltage;V;/50;2"

<< "10;7;0;1;000051;;Rear Wheel Speed;km/h;*1;0"

<< "10;8;0;1;000050;;Brake Clutch Duty Ratio;%;/2;1"

<< "11;1;0;1;00005F;;Center Differential Indicate Current;A;/32;2"

<< "11;2;0;1;00005E;;Center Differential Real Current;A;/32;2"

<< "11;3;0;1;00005D;;AT Turbine Speed 2;rpm;*32;0"

<< "11;4;0;1;00005C;;AT Turbine Speed 1;rpm;*32;0"

<< "11;5;0;1;00005B;;Voltage Center Differential Switch;V;/51;2"

<< "11;6;0;1;00005A;;ATF Temperature 2;°C;-50;0"

<< "11;7;0;1;000059;;Load & Reverse Brake (L&R B) Duty;%;/2;1"

<< "11;8;0;1;000058;;High Clutch Duty;%;/2;1"

 

I'm working on converting that to XML. I cant figure otu what a few of his varibles are yet though, as I have not found the function that calls the definitions. My roomate has visual studios on his computer, I may try and load it into that.

Edited September 9, 2010 by utc_pyro

[subarutech77]

I'm going to try that as on of my embeded systems class projects, but we'll see what happens.... I'm working to get these romradier deffs for the 5EAT working right now.

 

 

 

I'm working on converting that to XML

 

 

Very cool, were you able to find the init command to talk to the TCM then?

 

I have a vag-com cable on the way, but at this rate it might be ported over to RR before we know it. From the screenshots I see, it looks like freessm writes the changes to RAM or more like a realtime map like Cobb can to the ECU, is that right?

 

I think I can get the .pak file for the TCM update, would that be any use to anyone? The rom has to be in there somewhere, right?

[subarutech77]

BIU? Hmm. Can we scan the CAN to see what commands it sends, and then send our own instead? :-)

 

Easier said than done, I'm afraid...

 

would something like this work to scan the can lines?

 

http://intrepidcs.com/osc_store/product_info.php/cPath/37/products_id/130?gclid=CLWd-LSj16MCFRD75wodUVWVuA

Edited September 9, 2010 by subarutech77

[dschultz]

If it can decipher the data and the upper layer protocols then maybe. I have a CAN bus analyzer but no TCU.

As for the .pak file. It's of no use unless it can be unpacked. Basically the only way is to capture the data as it is transferred while being written to the TCU.

[dschultz]

I'm working to get these romradier deffs for the 5EAT working right now.

Are you going to build a custom RR Logger app with the TCU as the destination byte in the SSM read command?

Edited September 10, 2010 by dschultz

[utc_pyro]

Are you going to build a custom RR Logger app with the TCU as the destination byte in the SSM read command (0x40 right)?

 

I think the data we can log is requested from the ECU from what I can tell in FreeSSM. I'm still trying to trace were the definitions are called through his code to see how the data string is used. Other commands (like setting the pressure) look like they talk direct to the TCU. I'm going to be putting some time in this weekend to try and get it going. This is a good C refresher any way.

 

Were did the get the 0x40 from BTW? I've not seen any one talk about it before....

 

Looking at his definition, they read something like this:

 

<< "9;5;0;1;00004B;;Line Pressure Duty Ratio;%;/2;1"

 

Translate those varibles into the RomRaider XML names....

 

<< "ecubyteindex 9offset by -7?);ecubit (offset by -1?);?;?;address;?;name;units;expr;?"

 

I dont know what the "?" are yet, but we can make some guesses.

 

If it does request the inf fromt he TCU directally (I dont think so, but key word is THINK) the first two "?"'s would be switches to change what it reads from. In his SSM commands file, he has a switch that changes the destination address to the TCU, but again I have not fully tranced how this is set. i've found were soem commands do it (like the ones to reset the TCu memory), but not on the "logger" yet.

 

Also, just looking at the above code snippet, the definitons may not be dead on scaling wise... I need to look into that. I have my VagCOM cable now, so I can see what it's doing tonight.

 

Anyone want to try it now?

 

               <parameter id="P306" name="Beta - Front Wheel Speed" desc="" ecubyteindex="16" ecubit="7">
                   <address>0x000048</address>
                   <conversions>
                       <conversion units="km/h" expr="x" format="0" />
                   </conversions>
               </parameter>
               <parameter id="P307" name="Beta - ATF Temperature" desc="" ecubyteindex="16" ecubit="6">
                   <address>0x000049</address>
                   <conversions>
                       <conversion units="raw" expr="x" format="0" />
                   </conversions>
               </parameter>
               <parameter id="P308" name="Beta - Gear Position" desc="" ecubyteindex="16" ecubit="5">
                   <address>0x00004A</address>
                   <conversions>
                       <conversion units="gear" expr="x+1" format="0" />
                   </conversions>
               </parameter>
               <parameter id="P309" name="Beta - Line Pressure Duty Ratio" desc="" ecubyteindex="16" ecubit="4">
                   <address>0x00004B</address>
                   <conversions>
                       <conversion units="%" expr="x/2" format="0" />
                   </conversions>
               </parameter>
               <parameter id="P310" name="Beta - Lock Up Duty Ratio" desc="" ecubyteindex="16" ecubit="3">
                   <address>0x00004C</address>
                   <conversions>
                       <conversion units="%" expr="x/2" format="0" />
                   </conversions>
               </parameter>
               <parameter id="P311" name="Beta - Transfer Duty Ratio" desc="" ecubyteindex="16" ecubit="2">
                   <address>0x00004D</address>
                   <conversions>
                       <conversion units="%" expr="x/2" format="0" />
                   </conversions>
               </parameter>
               <parameter id="P312" name="Beta - Throttle Sensor Power" desc="" ecubyteindex="16" ecubit="1">
                   <address>0x00004E</address>
                   <conversions>
                       <conversion units="V" expr="x/45" format="0" />
                   </conversions>
               </parameter>
               <parameter id="P313" name="Beta - Turbine Revolution Speed" desc="" ecubyteindex="16" ecubit="0">
                   <address>0x00004f</address>
                   <conversions>
                       <conversion units="rpm" expr="x*32" format="0" />
                   </conversions>
               </parameter>

 

That's based on NSFW's beta defs and the freessm defs.

Edited September 10, 2010 by utc_pyro

[utc_pyro]

Looks like I'm re-inventing the wheel.....

 

http://subdiesel.wordpress.com/2010/08/23/logger-definition-formats/

 

Looks like he drives a legacy though

 

http://translate.google.com/translate?hl=en&sl=de&u=http://www.motor-talk.de/forum/subaru-diagnose-software-t2104152.html&ei=JFmKTMvZOoWE8wT88LT_BQ&sa=X&oi=translate&ct=result&resnum=8&ved=0CDIQ7gEwBzgK&prev=/search%3Fq%3Dfreessm%2Bsubaru%26start%3D10%26hl%3Den%26safe%3Dactive%26sa%3DN

Edited September 10, 2010 by utc_pyro

[hadvw]

Well, the translation isn't too bad, aside from a few words the original author misspelled, and a couple that I'm not 100% sure of what they mean (my german is based on my childhood, and is missing some technical terms).

 

These days, most germans speak fluent English, so you probably won't have any issues, but I'd be willing to help translate if there's a need..

 

I'd offer to get involved (I'm a software dev), but I'm already 2 days behind a major release at work, and have another high priority project coming up after that. I don't know how far my wife would drop-kick me if I told her I committed to helping with more software, after already not spending enough time with her and my 1 and 3 year olds..

 

On the other hand, I would be willing to make a small donation if someone else wants to get involved and needs a VAG COM cable or such..

[dschultz]

Were did the get the 0x40 from BTW? I've not seen any one talk about it before....

 

In his SSM commands file, he has a switch that changes the destination address to the TCU, but again I have not fully tranced how this is set. i've found were some commands do it (like the ones to reset the TCU memory), but not on the "logger" yet.

Oops, I think that's the BIU.

[dschultz]

I think the data we can log is requested from the ECU from what I can tell in FreeSSM. I'm still trying to trace were the definitions are called through his code to see how the data string is used.

Well if you query the ECU for those values they will return FF (255) as far as I can tell from this lookup table from a 2010 Legacy AT

ROM:0005EF8C 00 05 5F 84 PtrSsmGetAFSensor2:.data.l loc_55F84    ; 0x000047
ROM:0005EF90 00 05 59 CC                 .data.l SsmGetUnsupported ; 0x000048
ROM:0005EF94 00 05 59 CC                 .data.l SsmGetUnsupported ; 0x000049
ROM:0005EF98 00 05 59 CC PtrSsmGetGearPosition:.data.l SsmGetUnsupported ; 0x00004A
ROM:0005EF9C 00 05 59 CC                 .data.l SsmGetUnsupported ; 0x00004B
ROM:0005EFA0 00 05 59 CC                 .data.l SsmGetUnsupported ; 0x00004C
ROM:0005EFA4 00 05 59 CC                 .data.l SsmGetUnsupported ; 0x00004D
ROM:0005EFA8 00 05 59 CC                 .data.l SsmGetUnsupported ; 0x00004E
ROM:0005EFAC 00 05 59 CC                 .data.l SsmGetUnsupported ; 0x00004F
ROM:0005EFB0 00 05 59 CC                 .data.l SsmGetUnsupported
ROM:0005EFB4 00 05 59 CC                 .data.l SsmGetUnsupported
ROM:0005EFB8 00 05 59 CC                 .data.l SsmGetUnsupported
ROM:0005EFBC 00 05 59 CC PtrSsmGetAFSensor1HeaterCurrent:.data.l SsmGetUnsupported ; 0x000053

[subarutech77]

Anyone want to try it now?

 

               <parameter id="P306" name="Beta - Front Wheel Speed" desc="" ecubyteindex="16" ecubit="7">
                   <address>0x000048</address>
                   <conversions>
                       <conversion units="km/h" expr="x" format="0" />
                   </conversions>
               </parameter>
               <parameter id="P307" name="Beta - ATF Temperature" desc="" ecubyteindex="16" ecubit="6">
                   <address>0x000049</address>
                   <conversions>
                       <conversion units="raw" expr="x" format="0" />
                   </conversions>
               </parameter>
               <parameter id="P308" name="Beta - Gear Position" desc="" ecubyteindex="16" ecubit="5">
                   <address>0x00004A</address>
                   <conversions>
                       <conversion units="gear" expr="x+1" format="0" />
                   </conversions>
               </parameter>
               <parameter id="P309" name="Beta - Line Pressure Duty Ratio" desc="" ecubyteindex="16" ecubit="4">
                   <address>0x00004B</address>
                   <conversions>
                       <conversion units="%" expr="x/2" format="0" />
                   </conversions>
               </parameter>
               <parameter id="P310" name="Beta - Lock Up Duty Ratio" desc="" ecubyteindex="16" ecubit="3">
                   <address>0x00004C</address>
                   <conversions>
                       <conversion units="%" expr="x/2" format="0" />
                   </conversions>
               </parameter>
               <parameter id="P311" name="Beta - Transfer Duty Ratio" desc="" ecubyteindex="16" ecubit="2">
                   <address>0x00004D</address>
                   <conversions>
                       <conversion units="%" expr="x/2" format="0" />
                   </conversions>
               </parameter>
               <parameter id="P312" name="Beta - Throttle Sensor Power" desc="" ecubyteindex="16" ecubit="1">
                   <address>0x00004E</address>
                   <conversions>
                       <conversion units="V" expr="x/45" format="0" />
                   </conversions>
               </parameter>
               <parameter id="P313" name="Beta - Turbine Revolution Speed" desc="" ecubyteindex="16" ecubit="0">
                   <address>0x00004f</address>
                   <conversions>
                       <conversion units="rpm" expr="x*32" format="0" />
                   </conversions>
               </parameter>

That's based on NSFW's beta defs and the freessm defs.

 

I also pasted those values into the RR logger def .xml file, and they do show up in the table until the ECM connects then they are no longer there.

 

But, I did get my Vag-com cable in and can log my TCM in either vehicle, however I cannot adjust anything for my 4eat- bummer

 

I can reset the TCM and see live data, also with my 5eat, I am able to see live data and have the one adjustment that KYLegacy can get as well, the AWD correction adjustment.

 

I did try to register at beliOS to be able to post in their forum, but never received a confirmation email, and from about 20min ago, it seems like the site is down

 

Would the ROMid have anything to do with connecting to the TCM??

[utc_pyro]

It must be a direct to TCU thing as Dschults stated... that kills RR support unless a Java dev wants to hack it in. I don't do well with Java....

 

What can you get to on 0x40?

[dschultz]

I've found nothing but I haven't finished scanning all the address and commands yet. I'm about 1/2 done.

 

Modifying RR won't be hard, I don't think. I've been hacking at it to learn how it's put together. That's how I made a scanner out of it (and added the road Dyno tab). What it comes down to is time, or the lack of ;-)

[NesCar]

Hi there!

I've got lots of experience in SSM2 (SSM for short as there are older SSM protocols too). I don't own a TCU model though.

I think to access the TCU, you'll just have to swap SSM destination address 0x10 (ECU) with 0x18 (seems standard for TCU). Everything else exactly or very similar to ECU stuff - the init, reading/writing addresses etc.

Makes sense to share most code, that's what FreeSSM appears to do. AFAIK it does everything using SSM, like dealer software or 3rd party diagnostic apps would do. No ROM flashing or what not!

AFAIK ECU and TCU are the only control modules speaking SSM. Other control modules speak protocols more difficult than SSM.

The main problem lies in definitions, what addresses to read (and write to make actions, adjustments, ...) and how to interprete. The control modules themselves don't provide any help except SSM-Init-Info. All apps need their own sort of database.

 

Here's some SSM-Init payload data I got from somewhere. According to

http://subdiesel.wordpress.com/2010/09/12/system-names-by-ssmid/

it's from an E-5AT:

[color=DarkRed]A6 10 22[/color] [color=Purple]91 E0 20 74 00[/color] 01 00 80 04 00 00 00 00 A1 46 2C 00 08 00 00 00 00 00 00 00 DE 06 00 0B 29 C0 04 7E 01 1E 00 3E 00 00 00 00 00 00 80 A2 00 00 FE FE 00 00 00 00

[b3lha]

Hi, I am very interested in this thread.

 

A couple of years ago I cracked the SVX 4EAT TCU. Some of the details about how it works can be found on my website and there's more buried in various threads on the SVX World Network. I expect some of the control algorithms I've reverse-engineered will help with understanding the 5EAT. Most likely they used the 4EAT software as a starting point for 5EAT development.

 

I have done custom remapping on SVX TCUs for various people and it's certainly possible to improve upon the factory calibrations. IMHO it's much better to remap properly in software than try to frig the computer's inputs and outputs with resistors or other circuitry.

 

I not in a position to help with your project, other than to offer words of encouragement. But I'm very interested and will be following your progress. Keep up the good work.

 

Phil Skuse

http://www.alcyone.org.uk/ssm

[Leonardo]

I love where this thread is going!!

[seabass07]

Me too! As soon as I get my cable and get familiar with the available software, I'll do what i can to help. Unfortunately, my development experience is with java and python and is somewhat limited.

[utc_pyro]

I've found nothing but I haven't finished scanning all the address and commands yet. I'm about 1/2 done.

 

A generous dev gave me a tool to rapidly scan SSMII a few months back. It just never worked well with my OpenPort 2.0. Just got my VAG-COM cable a few days ago, so I'll do a complete scan of it.

 

You don’t think it's the airbag computer do you? I have this strange fear of doing a sweep, hitting a command that’s mapped to “Fire” on the airbag computer. The video of Mazda firing off the airbags in those cars from the capsized ships a few years ago keeps flashing through my head…

 

Hi there!

I've got lots of experience in SSM2 (SSM for short as there are older SSM protocols too). I don't own a TCU model though.

I think to access the TCU, you'll just have to swap SSM destination address 0x10 (ECU) with 0x18 (seems standard for TCU). Everything else exactly or very similar to ECU stuff - the init, reading/writing addresses etc.

Makes sense to share most code, that's what FreeSSM appears to do. AFAIK it does everything using SSM, like dealer software or 3rd party diagnostic apps would do. No ROM flashing or what not!

AFAIK ECU and TCU are the only control modules speaking SSM. Other control modules speak protocols more difficult than SSM.

The main problem lies in definitions, what addresses to read (and write to make actions, adjustments, ...) and how to interprete. The control modules themselves don't provide any help except SSM-Init-Info. All apps need their own sort of database.

 

Here's some SSM-Init payload data I got from somewhere. According to

http://subdiesel.wordpress.com/2010/09/12/system-names-by-ssmid/

it's from an E-5AT:

[color=darkred][font=Verdana]A6 10 22[/font][/color][color=purple][font=Verdana]91 E0 20 74 00[/font][/color][color=black][font=Verdana] 01 00 80 04 00 00 00 00 A1 46 2C 00 08 00 00 00 00 00 00 00 DE 06 00 0B 29 C0 04 7E 01 1E 00 3E 00 00 00 00 00 00 80 A2 00 00 FE FE 00 00 00 00[/font][/color]

 

NesCar, 0x18 matches what some scans over on RR found. Do you know where the definitions used in FreeSSM were derived from? There is a TON of great info in the source code that appears well advance of anything but the SSMIII tool.

 

Hi, I am very interested in this thread.

 

A couple of years ago I cracked the SVX 4EAT TCU. Some of the details about how it works can be found on my website and there's more buried in various threads on the SVX World Network. I expect some of the control algorithms I've reverse-engineered will help with understanding the 5EAT. Most likely they used the 4EAT software as a starting point for 5EAT development.

 

I have done custom remapping on SVX TCUs for various people and it's certainly possible to improve upon the factory calibrations. IMHO it's much better to remap properly in software than try to frig the computer's inputs and outputs with resistors or other circuitry.

 

I not in a position to help with your project, other than to offer words of encouragement. But I'm very interested and will be following your progress. Keep up the good work.

 

Phil Skuse

http://www.alcyone.org.uk/ssm [/quote]

 

Wow, the ledged of TCU hackin. Your page has a TON of great info on it, and if you look at the documents for the 5EAT the shift maps look quite similar to the ones you found. They don’t go into much detail in that documentation as it is just ment for people fixing them, but the shape is the same.

 

The issues we’re facing for re-mapping are still early: What is the CPU? What type of co-processor/flash memory is that attached to it? What standard (if any) are those test points at the top of the board?

 

Unlike the ECU and the old TCU’s, Hatachi (or Urasia Jsecs) used a proprietary chip of some sort. It may be a rebranded FPGA, it may be an ASIC, or it might be as simple as an off-the-shelf Hatachi microcontroller with a different label

[ClimberDHexMods]

I was reading through the 5AT Manual again, specifically the part about line pressure:

 

It appears the input variables to how the TCU controls line pressure are (only):

Per page 5AT-40:

RPM

Vehicle Speed

Oil Temp (of ATF)

Input Torque

 

The really sweet one? Input Torque

 

This means if you want to tune your ECU to give more line pressure, then scale up your requested torque map to something really high like 400 or 500. Reason being that when people increase their HP by 50%, they don't scale up their requested torque map by 50%. Apparently they should!!! So when you give your car say 80% throttle, instead of the ECU telling the TCU you are trying to make 200tq, it will say 300tq oh crap up the line pressure!!!

 

The catch is, there is a ceiling to line pressure. So add a resistor?

Not quite. It is possible the TCU can learn its way around the resistor. SO a WOT activated relay to resistor MAY or MAY NOT trick the TCU. It's hard to say. More RTFM to come. In the ECU logic, there are learning ranges. If the resistor is outside of the line pressure learning % range, assuming there is even such a map, then it would definitely work!

 

In the mean time, up your Requested Torque Map!!! It is only a relative map to the MT guys, but apparently quite literal to the 5eat!!!

[ClimberDHexMods]

It also looks like one could interfere with the resistance of the temp sensor outputs in the transmission, since they will directly increase the line pressure, the colder they read.

 

There is also a lockup solenoid that is controlled by a REALLY sophisticated map and memory. So you could easily give it pull or no power to do a manual lockup. Not sure what negative ramifications (if any) the TCU would or could produce from it detecting abnormal activity.

 

Transfer solenoid might be fun to play with for AWD lockup switch... might be better for brake launching. Maybe...

[LGTONCOKE]

I love where this thread is going!!

 

 

Me and you both buddy. I need a way to control this beast of a 5EAT I Just got built.

[underground000]

It also looks like one could interfere with the resistance of the temp sensor outputs in the transmission, since they will directly increase the line pressure, the colder they read.

 

You cant just adjust the temp sensor, you will have to adjust lockup also. If you make it read really cold the car will never go into lock up

[frank_ster]

hey guys! keep up the good work! For now i am going to be using the megashift from megasquirt to control my tranny. its about 250$

 

what i am thinking is it has can comunication also, and maybe it could be made to talk to the ecm making it think its the tcm. or in my case disconnect the subaru's tcm ability to do anything to the tranny let the mega shift do that and just disable the p0700 code. only thing left would be the sport light flashing.

[underground000]

Oct bump!!

 

I kind of forgot about the resistor mod, Ill check and see if my local audio shop has one for cheap and may try it out.

 

A nabisco guy with 4eat said he was having cel with the ipt resistor (he had full ipt trans built) so ipt removed it and he said that made the most difference (that he can feel)

[hadvw]

hey guys! keep up the good work! For now i am going to be using the megashift from megasquirt to control my tranny. its about 250$

 

what i am thinking is it has can comunication also, and maybe it could be made to talk to the ecm making it think its the tcm. or in my case disconnect the subaru's tcm ability to do anything to the tranny let the mega shift do that and just disable the p0700 code. only thing left would be the sport light flashing.

 

Please keep us updated! I wouldn't mind paying $250 to get total control of the 5EAT! I would LOVE faster shifting...