Jump to content
HybridZ
stupid_fast

ROM bins for L28ET 1982 ECCS

Recommended Posts

Posted (edited)

 

Thought someone here might get a kick out of this. 


I just dumped the ROM chips from my 1982 L28ET Manual & Automatic ECCS ECUs.
The only data I was able to identify was the timing and fuel maps.

The Ignition and Fueling map were identical between Auto and Manual ECUs.  There were a few other bits of data that were different but I have not identified what they are.

 

I've attached the .bin file to this post if anyone wants to have a look. 
1982 Manual Transmission ECU A18-601-042 2603 
1982 Automatic Transmission ECU A18-602-043 2111 
 

 

Here's some information I've learned about each component while figuring out how to read the ROMs.

The 1982 ECCS ECU; (note, 1982 and 1983 ECCS ECM's are interchangeable) 
Hitachi HD46802P Motorola 6802 CPU varient

Motorola 6800 series was fairly common in the late 70's and 80s, disassembles are available although I have not had luck interpreting the code. 

6800-series disassembler DASMx, http://myweb.tiscali.co.uk/pclare/DASMx/

 

Hitachi HD46506 IO controller

I haven't been able to find any information about this chip other than it is in fact an IO controller. 


1K-byte 2708-type ROM 

1024-word x 8-bits 

Hitachi HN25089 DIP-24

Contains ignition&fuel map data similar to the design of the dual-chip Z31 & R31 ECCS units, the data is redundant and also contained in the main 8K-byte chip. 

For more information, see 'The R31 Complication' at  https://wiki.r31skylineclub.com/index.php/ECU_Chipping 

This 1K ROM can be removed, and the ECU will function with the single 8K ROM as long as the IC-3 HD47LS20P quad-NAND chip is moved from the daughter board to the main board. 


8k-byte 2364-type ROM

8192-word x 8-bits

Hitachi HN48364P DIP-24

Contains all microcode, fuel and ignition maps are on the last 1K of address space. 

I was able to rewire the 2364 ROM to read as a 2764-type ROM on a TL866 II+ programmer.

The adapter diagrams were found on Commedore 64 forums, they also use a DIP-24 2364-type ROM.
I have a 28C256 ROM functioning as a replacement with a C64 2364 adapter from Retro Innovations. 

 

Addresses identified so far;

1C00 to 1CFF - ignition timing map

1D00 to 1DFF - fueling map

1B80 to 1BFF - DWORD scale of some sort

 

Ideally I'd like to identify the fueling and ignition RPM scales as well as the rev limiter, but unfortunately I'm currently beyond my expertise messing with this system. 

 

I'm still waiting for some new EEPROMs to arrive to test altering the ignition map.

Attached to this post you'll find two dumps of 8KB bin files from the Manual and Automatic 1982 ECCS ECU's, as well as some representations of the ignition and fueling maps in LiveEdit as well as RomScan utilities. 
Be aware the data is missing RPM and load scales, after testing with the Ostrich realtime address tracing it seems to be similar to early Z31 going in 16 steps from 400RPM to 5600RPM. 
 

L28ET_timing_map_1982.PNG

 

romscan_ZXT_82MT.PNG

ROMSCAN_FUELMAP_ZXT_82MT.PNG

 

1982MT_S130_A18-601-042.BIN

1982AT_S130_A18-602-043.BIN

Edited by stupid_fast

Share this post


Link to post
Share on other sites
Posted (edited)

Here it is, the moment nobody has been waiting for.

Please note this only applies to 82/83 ECU's, I don't know if the 81's are different all I know is they have different injectors. 

Its extremely easy to chip a ZX ecu.

The three ribbon cables from the mainboard to the daughterboard for the dual ROM's need to be removed.  F/C-A, F/C-B, and the 3-pin for IC-3.

The ribbon cable labeled 'MAIN' is for additional logical circuitry and should not be touched.


IC-3 HD47LS20P quad NAND chip is the logic for the memory bus. 

This chip needs to be moved from the IC-3 spot on the daughterboard to the IC-3 spot on the mainboard next to the 6802 CPU.

 

With the IC-4 spot on the mainboard free of the ribbon cables, a socket or rom adapter can be soldered in place.

There are readily available pre-assembled Commedore 64 2364-type rom adapters so that newer 28-pin EEPROM's can be used.  I used a 28c256.
 

The IC-4 2364 chip on the daughterboard contains all microcode and map data needed to flash a new ROM.

The IC-5 2708 chip is no longer needed. 

If you already have the BIN's, the IC-4 and IC-5 ROM's on the daughterboard can be left in place, they are no longer used.

 

 

I'll clean up this post a bit later once I do more testing, but all the basic information is here now. 
 

DSC_0935.JPG

DSC_0938.JPG

DSC_1006.JPG

DSC_1035.JPG

DSC_1033.JPG

Edited by stupid_fast

Share this post


Link to post
Share on other sites

Well, I did want to adjust the fuel and timing maps a bit to get rid of a few drive-ability issues since I'm not running a stock block.


Also wanted to pull some timing before turning the boost up again.  

I also have an 84T ECU I've been scavenging components from it, I'll probably dump the ROM at some point as well. 

  • Thanks 1

Share this post


Link to post
Share on other sites

Quick update,

I've successfully changed the fueling map and started tuning it for my specific engine.

I'll report back with my experience once its further along.  Its far from an ideal tuning solution without a real time rom emulator like the Moates Ostrich 2.0. 

Share this post


Link to post
Share on other sites

Well done! From a glance of that first tabulated timing map, looks like the RPM axis is vertical and the load axis is horizontal, if your testing hasn't already showed that. Looking forward to seeing how far you get!

Share this post


Link to post
Share on other sites

After a few times around the block playing with the fuel map I gave up and ordered an Ostrich 2.0 for real-time tuning and address tracing, I should be able to identify the RPM scale that way.   

Probably going to end up going standalone in the future with something like speeduino, just having fun playing with the stock setup and seeing what it can do. 

 

Leon, you're right that the Y axis is RPM, X axis is load which is the same as the Z31 ecus.  Unfortunately it doesn't seem the early ECCS has defined RPM and TP scales like the later units. 

 

I'm using LiveEdit with custom config currently to modify the maps, but I'm creating a config file for TunerPro RT which supports the Ostrich emulator. 

Since my AFM calibration is thrown way off from factory and my motor is not standard, any fueling or timing maps I run will not be usable on another L28ET.

 

 

Edit,

While creating the config for Tunerpro I found a 8x8 table in the rom.
Not a clue what its for, but its interesting. 

 

 

7EF0-7F2F.PNG

Edited by stupid_fast

Share this post


Link to post
Share on other sites

I'm surprised you'll be able to see the maps being used in real time with such an old ECU. I've only played with newer stuff and most of those don't seem to support it. Them again, I haven't gone as DIY as you either.

 

Are you able to see the hex code for the entire ROM? It'll take some manual labor but you may get lucky and find the RPM and load scales near the address of the maps you've found. Looks like a fun project!

Share this post


Link to post
Share on other sites

You can dig in yourself if you want, the ROM bin's are attached to the top post. 

I've been using the address identification from the newer Z31 units as a reference, there is nothing in the hex data on the S130 units similar to the RPM scales on the Z31 units. 


Romscan is a neat tool to quickly identify 2d lines and 3d maps, I'm using HxD for the raw hex view.

In the middle of constructing an excel sheet with the addresses for my 32k roms. ( the data needs to be at the end of the file for the way the rom adapter is setup)

The real time on the ostrich unit is simply address hits, since its a rom emulator it can log which addresses on the map were last accessed in memory. 

Its crude, but better than nothing.

Also keep in mind this is the same 6802 processor as used in the 84-86 Z31 ECUs.  The main difference I can see is they use a newer IO controller and they're configured for a 28-pin rom. They can access an extra 1K of memory. 
On the 84 ECU I took apart, the 8K rom contains only code, and the 1KB rom contains only map data.  This is different from the S130 ECCS configuration.

 

 

 

edit, well it seems I can't export the excel file in anything readable.  I'll post a plain text list of interesting unidentified addresses in the map space for the S130 eccs. 

 

edit 2,

Here's the partially defined address space as I currently have in my notes.

DWORD = 16-bit values

 

Address                      note
0x1B00 to 0x1B0F    data, unknown

0x1B10 to 0x1B1F    data, unknown
0x1B20 to 0x1B27    data, unknown
0x1B28 to 0x1B2F    DWORD 4x1 
0x1B30 to 0x1B4F    Temp Sensor 16x1 (shared with late Z31 maps)
0x1B50 to 0x1B5F    line, unkown (shared with late Z31 maps)
0x1B60 to 0x1B6F    line, unknown
0x1B70 to 0x1B7F    line, unknown
0x1B80 to 0x1BFF    scales? DWORD 16x4
0x1C00 to 0x1CFF    Timing table 16x16
0x1D00 to 0x1DFF    Fuel table 16x16
0x1E00 to 0x1E0F    flat, unknown
0x1E10 to 0x1E1F    line, unknown
0x1E20 to 0x1E2F    line, unknown
0x1E30 to 0x1E3F    line, unknown
0x1E40 to 0x1E4F    line, unknown
0x1E50 to 0x1E5F    line, unknown
0x1E60 to 0x1E6F    line, unknown
0x1E70 to 0x1E7F    line, unknown
0x1E80 to 0x1E8F    line, unknown
0x1E90 to 0x1E9F    line, unknown
0x1EA0 to 0x1EAF    line, unknown
0x1EB0 to 0x1EBF    data, unknown
0x1EC0 to 0x1ECF    data, unknown
0x1ED0 to 0x1EDF    flat, unknown
0x1EE0 to 0x1EEF    flat, unknown
0x1EF0 to 0x1F2F    unknown table 8x8
0x1F30 to 0x1F3F    line, unknown DWORD
0x1F40 to 0x1F4F    data, unknown
0x1F50 to 0x1F5F    data, unknown
0x1F60 to 0x1F6F    data, unknown
0x1F70 to 0x1F7F    data, unknown
0x1F80 to 0x1F8F    data, unknown
0x1F90 to 0x1F9F    data, unknown
0x1FA0 to 0x1FAF    data, unknown
0x1FB0 to 0x1FBF    line, unknown
0x1FC0 to 1x1FCF    line, unknown DWORD
0x1FD0 to 0x1FDF    ?
0x1FE0 to 0x1FEF     line, unknown
0x1FF0 to 0x1FFF    data, unknown 

Edited by stupid_fast

Share this post


Link to post
Share on other sites

@Leon I'm wrong!  I just pulled apart my S130 1983 N/A A11-652 805 and its JECS with a Motorola 6801 and a Hitachi HN25089LGJ ROM!

 

I thought ZX EFI was L-jetronic, I guess I'm mistaken. 

Currently going off the assumption they switched to JECS around 1979 or 80, the Motorola 6801 microprocessor was released around 1977-78. 

 

Maybe early 76~78 EFI was L-jet, you'd have to pull apart your ECU to confirm.

In short- a JECS ECU with a digital ROM can be modified, L-jet is analog and I'm not sure how to go about modifying those. 

If you do have a digital ECU, the ROM will need the pins identified and remapped to read as a newer style ROM compatible with whatever EEPROM programmer/reader you go with.  I used a TL866+ cause they're cheap. 

Additionally, I'm not certain any of this is worthwhile.  I'm having fun playing with tuning mine, but its quite possible that anything beyond stock is not reasonable with these old units. 

The AFM is a terrible measure of fuel flow, and any modern ECU with a map sensor will run circles around it for tuning ability. 
After getting the programmer $60, roms and misc supplies $50, spare ECUs to test $100, Ostrich 2.0 for real-time tuning $200, Tunerpro RT(donationware) $40,  I'm already in the ballpark of setting up a Microsquirt module.

 

edit, it seems this system is L-jet.  Seems everything I've learned previously about these systems keeps turning out to be wrong. 

I don't know how the older 76-78 systems work, you need to open up your ECU to find out. 
https://en.wikipedia.org/wiki/JECS

A11-652805.JPG

Edited by stupid_fast

Share this post


Link to post
Share on other sites

Additionally, here's the Ostrich 2.0 installed on my S130-turbo JECS unit.

Have to get some data logging working on Tunerpro, or get someone to drive my car while I play with the tune. 

Still to be determined if this is worthwhile to get driveability back on a mild hopped up motor. 

DSC_1153.JPG

Share this post


Link to post
Share on other sites

Found the fuel maps, rev limiter, and maybe the idle/cold start timing map. 

 

Fuel cut happens at 6500RPM (12.5 * 520)

 

I'll post up the excel sheet when I'm done with it. 

 

RPM scales are DWORD  12.5*X
7B80 to 7B9F ignition ? 

800 1200 1600 2000 2400 2800 3200 3600 4000 4200 4400 4600 4800 5200 6000 6400

7BA0 to 7BBF fuel ? 

400 500 800 1200 1600 2000 2400 2800 3200 3600 4000 4400 4800 5200 5600 6000

7BC0 to 7BDF

800 1000 1200 1400 1600 1800 2000 2200 2400 2800 3200 3600 4000 4800 5600 6400

7BE0 to 7BFF

800 1000 1200 1400 1600 2000 2400 2800 3200 3600 4000 4400 4800 5200 5600 6000

 

 

0x7F50 DWORD

Decimal: 520
12.5*X=6500

Successfully tested fuel cut at 2000rpm. 

 

Edited by stupid_fast

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×