Jump to content
HybridZ
stupid_fast

re-mapping and live tuning L28ET 1982/83 S130 ECCS

Recommended Posts

Posted (edited)

Edit,
see posts further down for full details on modifying 1982/83 ECCS for re-mapping and live tuning. 

 

I am setting up a public google drive share with all related documents. 

 

Original post;

Thought someone here might get a kick out of this. 


I just dumped the ROM chips from my 1982 L28ET Manual & Automatic ECCS ECUs.
The only data I was able to identify was the timing and fuel maps.

The Ignition and Fueling map were identical between Auto and Manual ECUs.  There were a few other bits of data that were different but I have not identified what they are.

 

I've attached the .bin file to this post if anyone wants to have a look. 
1982 Manual Transmission ECU A18-601-042 2603 
1982 Automatic Transmission ECU A18-602-043 2111 
 

 

Here's some information I've learned about each component while figuring out how to read the ROMs.

The 1982 ECCS ECU; (note, 1982 and 1983 ECCS ECM's are interchangeable) 
Hitachi HD46802P Motorola 6802 CPU varient

Motorola 6800 series was fairly common in the late 70's and 80s, disassembles are available although I have not had luck interpreting the code. 

6800-series disassembler DASMx, http://myweb.tiscali.co.uk/pclare/DASMx/

 

Hitachi HD46506 IO controller

I haven't been able to find any information about this chip other than it is in fact an IO controller. 


1K-byte 2708-type ROM 

1024-word x 8-bits 

Hitachi HN25089 DIP-24

Contains ignition&fuel map data similar to the design of the dual-chip Z31 & R31 ECCS units, the data is redundant and also contained in the main 8K-byte chip. 

For more information, see 'The R31 Complication' at  https://wiki.r31skylineclub.com/index.php/ECU_Chipping 

This 1K ROM can be removed, and the ECU will function with the single 8K ROM as long as the IC-3 HD47LS20P quad-NAND chip is moved from the daughter board to the main board. 


8k-byte 2364-type ROM

8192-word x 8-bits

Hitachi HN48364P DIP-24

Contains all microcode, fuel and ignition maps are on the last 1K of address space. 

I was able to rewire the 2364 ROM to read as a 2764-type ROM on a TL866 II+ programmer.

The adapter diagrams were found on Commedore 64 forums, they also use a DIP-24 2364-type ROM.
I have a 28C256 ROM functioning as a replacement with a C64 2364 adapter from Retro Innovations. 

 

Addresses identified so far;

1C00 to 1CFF - ignition timing map

1D00 to 1DFF - fueling map

1B80 to 1BFF - DWORD RPM scales 12.5 * X

 

Ideally I'd like to identify the fueling and ignition RPM scales as well as the rev limiter, but unfortunately I'm currently beyond my expertise messing with this system. 

 

I'm still waiting for some new EEPROMs to arrive to test altering the ignition map.

Attached to this post you'll find two dumps of 8KB bin files from the Manual and Automatic 1982 ECCS ECU's, as well as some representations of the ignition and fueling maps in LiveEdit as well as RomScan utilities. 
Be aware the data is missing RPM and load scales, after testing with the Ostrich realtime address tracing it seems to be similar to early Z31 going in 16 steps from 400RPM to 6000RPM. 
 

L28ET_timing_map_1982.PNG

 

romscan_ZXT_82MT.PNG

ROMSCAN_FUELMAP_ZXT_82MT.PNG

 

1982MT_S130_A18-601-042.BIN

1982AT_S130_A18-602-043.BIN

Edited by stupid_fast

Share this post


Link to post
Share on other sites
Posted (edited)

Here it is, the moment nobody has been waiting for.

Please note this only applies to 82/83 ECU's, I don't know if the 81's are different all I know is they have different injectors. 

Its extremely easy to chip a ZX ecu.

The three ribbon cables from the mainboard to the daughterboard for the dual ROM's need to be removed.  F/C-A, F/C-B, and the 3-pin for IC-3.

The ribbon cable labeled 'MAIN' is for additional logical circuitry and should not be touched.


IC-3 HD47LS20P quad NAND chip is the logic for the memory bus. 

This chip needs to be moved from the IC-3 spot on the daughterboard to the IC-3 spot on the mainboard next to the 6802 CPU.

 

With the IC-4 spot on the mainboard free of the ribbon cables, a socket or rom adapter can be soldered in place.

There are readily available pre-assembled Commedore 64 2364-type rom adapters so that newer 28-pin EEPROM's can be used.  I used a 28c256.
 

The IC-4 2364 chip on the daughterboard contains all microcode and map data needed to flash a new ROM.

The IC-5 2708 chip is no longer needed. 

If you already have the BIN's, the IC-4 and IC-5 ROM's on the daughterboard can be left in place, they are no longer used.

 

 

I'll clean up this post a bit later once I do more testing, but all the basic information is here now. 
 

DSC_0935.JPG

DSC_0938.JPG

DSC_1006.JPG

DSC_1035.JPG

DSC_1033.JPG

Edited by stupid_fast

Share this post


Link to post
Share on other sites

Well, I did want to adjust the fuel and timing maps a bit to get rid of a few drive-ability issues since I'm not running a stock block.


Also wanted to pull some timing before turning the boost up again.  

I also have an 84T ECU I've been scavenging components from it, I'll probably dump the ROM at some point as well. 

  • Thanks 1

Share this post


Link to post
Share on other sites

Quick update,

I've successfully changed the fueling map and started tuning it for my specific engine.

I'll report back with my experience once its further along.  Its far from an ideal tuning solution without a real time rom emulator like the Moates Ostrich 2.0. 

Share this post


Link to post
Share on other sites

Well done! From a glance of that first tabulated timing map, looks like the RPM axis is vertical and the load axis is horizontal, if your testing hasn't already showed that. Looking forward to seeing how far you get!

Share this post


Link to post
Share on other sites
Posted (edited)

After a few times around the block playing with the fuel map I gave up and ordered an Ostrich 2.0 for real-time tuning and address tracing, I should be able to identify the RPM scale that way.   

Probably going to end up going standalone in the future with something like speeduino, just having fun playing with the stock setup and seeing what it can do. 

 

Leon, you're right that the Y axis is RPM, X axis is load which is the same as the Z31 ecus.  Unfortunately it doesn't seem the early ECCS has defined RPM and TP scales like the later units. 

 

I'm using LiveEdit with custom config currently to modify the maps, but I'm creating a config file for TunerPro RT which supports the Ostrich emulator. 

Since my AFM calibration is thrown way off from factory and my motor is not standard, any fueling or timing maps I run will not be usable on another L28ET.

 

 

Edit,

While creating the config for Tunerpro I found a 8x8 table in the rom.
Not a clue what its for, but its interesting. 

 

 

7EF0-7F2F.PNG

Edited by stupid_fast

Share this post


Link to post
Share on other sites

I'm surprised you'll be able to see the maps being used in real time with such an old ECU. I've only played with newer stuff and most of those don't seem to support it. Them again, I haven't gone as DIY as you either.

 

Are you able to see the hex code for the entire ROM? It'll take some manual labor but you may get lucky and find the RPM and load scales near the address of the maps you've found. Looks like a fun project!

Share this post


Link to post
Share on other sites
Posted (edited)

You can dig in yourself if you want, the ROM bin's are attached to the top post. 

I've been using the address identification from the newer Z31 units as a reference, there is nothing in the hex data on the S130 units similar to the RPM scales on the Z31 units. 


Romscan is a neat tool to quickly identify 2d lines and 3d maps, I'm using HxD for the raw hex view.

In the middle of constructing an excel sheet with the addresses for my 32k roms. ( the data needs to be at the end of the file for the way the rom adapter is setup)

The real time on the ostrich unit is simply address hits, since its a rom emulator it can log which addresses on the map were last accessed in memory. 

Its crude, but better than nothing.

Also keep in mind this is the same 6802 processor as used in the 84-86 Z31 ECUs.  The main difference I can see is they use a newer IO controller and they're configured for a 28-pin rom. They can access an extra 1K of memory. 
On the 84 ECU I took apart, the 8K rom contains only code, and the 1KB rom contains only map data.  This is different from the S130 ECCS configuration.

 

 

 

edit, well it seems I can't export the excel file in anything readable.  I'll post a plain text list of interesting unidentified addresses in the map space for the S130 eccs. 

 

edit 2,

Here's the partially defined address space as I currently have in my notes.

DWORD = 16-bit values

 

Address                      note
0x1B00 to 0x1B0F    data, unknown

0x1B10 to 0x1B1F    data, unknown
0x1B20 to 0x1B27    data, unknown
0x1B28 to 0x1B2F    DWORD 4x1 
0x1B30 to 0x1B4F    Temp Sensor 16x1 (shared with late Z31 maps)
0x1B50 to 0x1B5F    line, unkown (shared with late Z31 maps)
0x1B60 to 0x1B6F    line, unknown
0x1B70 to 0x1B7F    line, unknown
0x1B80 to 0x1BFF    scales? DWORD 16x4
0x1C00 to 0x1CFF    Timing table 16x16
0x1D00 to 0x1DFF    Fuel table 16x16
0x1E00 to 0x1E0F    flat, unknown
0x1E10 to 0x1E1F    line, unknown
0x1E20 to 0x1E2F    line, unknown
0x1E30 to 0x1E3F    line, unknown
0x1E40 to 0x1E4F    line, unknown
0x1E50 to 0x1E5F    line, unknown
0x1E60 to 0x1E6F    line, unknown
0x1E70 to 0x1E7F    line, unknown
0x1E80 to 0x1E8F    line, unknown
0x1E90 to 0x1E9F    line, unknown
0x1EA0 to 0x1EAF    line, unknown
0x1EB0 to 0x1EBF    data, unknown
0x1EC0 to 0x1ECF    data, unknown
0x1ED0 to 0x1EDF    flat, unknown
0x1EE0 to 0x1EEF    flat, unknown
0x1EF0 to 0x1F2F    unknown table 8x8
0x1F30 to 0x1F3F    line, unknown DWORD
0x1F40 to 0x1F4F    data, unknown
0x1F50 to 0x1F5F    data, unknown
0x1F60 to 0x1F6F    data, unknown
0x1F70 to 0x1F7F    data, unknown
0x1F80 to 0x1F8F    data, unknown
0x1F90 to 0x1F9F    data, unknown
0x1FA0 to 0x1FAF    data, unknown
0x1FB0 to 0x1FBF    line, unknown
0x1FC0 to 1x1FCF    line, unknown DWORD
0x1FD0 to 0x1FDF    ?
0x1FE0 to 0x1FEF     line, unknown
0x1FF0 to 0x1FFF    data, unknown 

Edited by stupid_fast

Share this post


Link to post
Share on other sites
Posted (edited)

@Leon I'm wrong!  I just pulled apart my S130 1983 N/A A11-652 805 and its JECS with a Motorola 6801 and a Hitachi HN25089LGJ ROM!

 

I thought ZX EFI was L-jetronic, I guess I'm mistaken. 

Currently going off the assumption they switched to JECS around 1979 or 80, the Motorola 6801 microprocessor was released around 1977-78. 

 

Maybe early 76~78 EFI was L-jet, you'd have to pull apart your ECU to confirm.

In short- a JECS ECU with a digital ROM can be modified, L-jet is analog and I'm not sure how to go about modifying those. 

If you do have a digital ECU, the ROM will need the pins identified and remapped to read as a newer style ROM compatible with whatever EEPROM programmer/reader you go with.  I used a TL866+ cause they're cheap. 

Additionally, I'm not certain any of this is worthwhile.  I'm having fun playing with tuning mine, but its quite possible that anything beyond stock is not reasonable with these old units. 

The AFM is a terrible measure of fuel flow, and any modern ECU with a map sensor will run circles around it for tuning ability. 
After getting the programmer $60, roms and misc supplies $50, spare ECUs to test $100, Ostrich 2.0 for real-time tuning $200, Tunerpro RT(donationware) $40,  I'm already in the ballpark of setting up a Microsquirt module.

 

edit, it seems this system is L-jet.  Seems everything I've learned previously about these systems keeps turning out to be wrong. 

I don't know how the older 76-78 systems work, you need to open up your ECU to find out. 
https://en.wikipedia.org/wiki/JECS

A11-652805.JPG

Edited by stupid_fast

Share this post


Link to post
Share on other sites

Additionally, here's the Ostrich 2.0 installed on my S130-turbo JECS unit.

Have to get some data logging working on Tunerpro, or get someone to drive my car while I play with the tune. 

Still to be determined if this is worthwhile to get driveability back on a mild hopped up motor. 

DSC_1153.JPG

Share this post


Link to post
Share on other sites

Good to know! I don't have any EFI Z-cars but it's cool to see somebody playing with it at this level. I'm in the SF Bay Area as well (Burlingame), I'd love to check out what you're doing sometime.

Share this post


Link to post
Share on other sites
Posted (edited)

Found the RPM scales, RPM fuel cut, and maybe the idle/cold start timing map. 

 

I'll post up the excel sheet when I'm done with it. 

 

RPM scales are 16x1 DWORD  12.5*X
7B80 to 7B9F - Unknown

800 1200 1600 2000 2400 2800 3200 3600 4000 4200 4400 4600 4800 5200 6000 6400

7BA0 to 7BBF - Fuel Scale

400 500 800 1200 1600 2000 2400 2800 3200 3600 4000 4400 4800 5200 5600 6000

7BC0 to 7BDF - Timing Scale

800 1000 1200 1400 1600 1800 2000 2200 2400 2800 3200 3600 4000 4800 5600 6400

7BE0 to 7BFF - Unknown

800 1000 1200 1400 1600 2000 2400 2800 3200 3600 4000 4400 4800 5200 5600 6000

 

Fuel cut DWORD

0x7F50

Decimal: 520
12.5*X=6500

Successfully tested fuel cut at 2000rpm. 

 

 

@leon I go to the track pretty often, I'll be at Thunderhill on sept 23 if you want a ride along.  

 

Edited by stupid_fast

Share this post


Link to post
Share on other sites
Posted (edited)

If you're ever passing through Vacaville you can HAVE my old ECUs....

 

Keep up the neat work. Might not be applicable to most as aftermarket EFI is getting cheaper and cheaper, but it certainly fuels the learning/research data which ends up helping you and others that follow along, regardless of solution chosen. Before I scored a good deal on MS3X I was strongly considering ordering a RusEFI kit...

Edited by Gollum

Share this post


Link to post
Share on other sites
1 hour ago, Gollum said:

Before I scored a good deal on MS3X I was strongly considering ordering a RusEFI kit...

 

I have one I've been working on casually for the past year or so for my Honda (maybe it's been 2?). It's still not in the car very often (though it has started and driven). The assembly process is not for everyone and I (as well as everyone else on the forum) strongly recommend a preassembled unit. It's great hardware, and it's awesome being able to request features and get them a week later with personal support, but it's still a bit behind MS3 in the software department.

Share this post


Link to post
Share on other sites

Well, MS software might be more mature, but it's also quite stagnate. I was hoping that the open nature of RusEFI might help it gain ground quicker, and it looks like the project is doing pretty well, but it's not like the software(only) industry. There still needs to be buyers to get growth to happen to accelerate maturity.

 

But yeah, kit or pre-assembled, it's still a great deal to get into what looks like a great community.

 

 

But then alternatively, there's great propriety platforms that are very affordable these days. EMU Black comes to mind...

Share this post


Link to post
Share on other sites
Posted (edited)
On 8/17/2018 at 10:43 AM, Gollum said:

If you're ever passing through Vacaville you can HAVE my old ECUs....

 

Keep up the neat work. Might not be applicable to most as aftermarket EFI is getting cheaper and cheaper, but it certainly fuels the learning/research data which ends up helping you and others that follow along, regardless of solution chosen. Before I scored a good deal on MS3X I was strongly considering ordering a RusEFI kit...

Hey Nathan!  Its been a while! 
Last time I met you I had just gotten the turbo motor running.

 

This system is definitely very far from ideal and not much cheaper to setup than megasquirt or Z31 with Nistune.  

After a few tuning sessions I've been able to get the AFR's closer to what I want to see, but the analog AFM as a load measure is terrible compared to a modern system with a MAP sensor.

Increased fuel cut to 6700 and fuel scales to 6500, seems to keep pulling strong up there.

 

Megasquirt as you say seems like its stagnated, probably because its 'good enough' for most applications. 

I've been leaning towards trying Speeduino for my next step up, or even DIYEFI with the freescale board.

Mainly did this modification because I was wondering why nobody else had done it before.   Once I started learning a little bit about 8-bit ROM chips it quickly spiraled into what you see in this thread.  It ended up being fairly simple to do, just required lots of research, studying datasheets, interpreting hex data and testing changes. 


Not sure if I need any more ECU's, but I'll keep it in mind! I could use a factory calibrated AFM or two to check how far off my settings are. 

 

 

On another note my o2 correction isn't working like it used to anymore... might've toasted the o2 sensor or broke something.  



Update;

I've setup a public google drive with the related files to this project.
The ROM Address spreadsheet is probably the most interesting file.  It only includes a partial translation for the map portion of the ecu ROM, I have made no progress in disassembling the microcode. 
Any addresses highlighted in green I have tested and verified as correct, all other comments are speculation and unverified. 

https://drive.google.com/open?id=1mRNbCs317YusVA-wutB3DW7AYV1MVt2l

Edited by stupid_fast

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×