2GR-FE ECU Tools and Techniques - MR2 Owners Club Message Board
 16Likes
Reply
 
LinkBack Thread Tools
post #1 of 193 (permalink) Old October 14th, 2017, 03:34 Thread Starter
Registered User
 
Join Date: Feb 2016
Location: Maui, HI
Posts: 1,234
OldTrader Rating: (0)
2GR-FE ECU Tools and Techniques

This is a thread for gathering information on working with the ECU, i.e. editing its contents. It is not a tuning thread per se although this information could be useful to anyone who wishes to tune their car. Emphatically, this is NOT a thread on EFI or general theory of operation of a modern ECU. Rather the intention is to help people of different backgrounds to come up to speed on the hardware and software aspects of our specific ECU, just as I am trying to do. There is momentum gathering about this as more tools are becoming available and more information is being published. I'd like to acknowledge the work that Marc (Gouky) has been doing with this. All of us driving 2GR-swapped MR2's owe him a huge debt. Part of the intention with this thread is to give him some support in what he's been doing mostly single-handed so far. Some time ago Marc planted the idea of getting people to share information and collaborate on the ECU. Maybe this thread will give a push in that direction. Personally I have zero background or training in firmware, embedded systems, or electrical engineering. I am definitely not an authority on the subject. Every day of working with this I am reminded that the little knowledge I have is incomplete and inaccurate. I'm approaching this as a challenge and a learning opportunity. I'd like to invite anyone else who has information or knowledge in this area to join in contributing to the thread and help to make it more useful. If you know something, please make corrections and suggestions. How is this different from the other threads already here? This thread will have a focus on hands-on tools and techniques and how to use them. This thread will also attempt to catalogue information more systematically, as compared to the progress reports that are given elsewhere.

I'll use this first post as an index/table of contents for the topics that will come later in the thread. The index and the topics will evolve and develop over time. Here's a proposed TOC that might or might not be followed. These topics might not necessarily be addressed in the order listed:

1. Architecture
2. Communication protocols
3. Tools
4. The calibration file
5. Maps
monkeyra likes this.
merryfrankster is offline  
Sponsored Links
Advertisement
 
post #2 of 193 (permalink) Old October 14th, 2017, 03:35 Thread Starter
Registered User
 
Join Date: Feb 2016
Location: Maui, HI
Posts: 1,234
OldTrader Rating: (0)
Placeholder
merryfrankster is offline  
post #3 of 193 (permalink) Old October 14th, 2017, 03:35 Thread Starter
Registered User
 
Join Date: Feb 2016
Location: Maui, HI
Posts: 1,234
OldTrader Rating: (0)
Place holder
merryfrankster is offline  
Sponsored Links
Advertisement
 
post #4 of 193 (permalink) Old October 14th, 2017, 03:36 Thread Starter
Registered User
 
Join Date: Feb 2016
Location: Maui, HI
Posts: 1,234
OldTrader Rating: (0)
This section is for tools available to work with the ECU. I'll be filling it in as we go along.

1. Tactrix Openport 2.0



This tool allows communication between the laptop and the ECU through the OBD2 port. It is of interest because it is the suggested tool for use with I0tech software which can be used for editing the ECU's binary files. I'll add more info about I0tech as it becomes available. Tactrix Openport requires use of software to manage the communication. The suggested software for communicating with Toyota ECU's is PCMFlash.

-------------------

2. Toyota/Lexus ECU Flasher



This tool supports reading and writing to the ECU. Reading the bin file is done through the JTAG port on the ECu's circuit board. Writing can be done either through this same port or through the OBD2 port. This tool has dropped steadily in price now $750 which is not much more than Tactrix plus software. See Marc's user notes on this tool in Post #8 below.

--------------------

3. Elmscan Toyota

Runs on your Android phone or tablet. Download from the Google Play store. This diagnostic tool gives access to the proprietary Mode 21 PID's, which are generally not available in consumer-class scantools and software (like Torque). For the price this is amazing. I wrote some notes about it here. I recommend this very highly. No brainer.

---------------------------

4. Torque Pro.
This is possibly the gold standard of consumer-class OBD2 scantool and logging software. Runs on Android. It is severely limited and inaccurate but it serves its purpose for most people. You do not use this for any serious application but for driving around and keeping an eye on engine parameters it does fine. Elsewhere on this forum I've dug deeply into why this tool is not to be trusted blindly.

---------
5. Techstream
This is a Toyota proprietary tool. With this tool you can perform all Toyota-approved functions for modifying the ECU, including flashing new binaries, editing vehicle settings (like whether your doors ding or whatever), programming keys to the immobilizer, running diagnostic tests, et cetera. For most people this tool is available only in various hacked/cloned versions offered on eBay by Chinese sellers in complete violation of US copyright law. If you work at a Toyota dealer you have access to a licensed version. I have nothing else informative to say about this.

Last edited by merryfrankster; August 2nd, 2018 at 19:43.
merryfrankster is offline  
post #5 of 193 (permalink) Old October 14th, 2017, 03:37 Thread Starter
Registered User
 
Join Date: Feb 2016
Location: Maui, HI
Posts: 1,234
OldTrader Rating: (0)
The calibration file is a proprietary file format that Toyota uses to upload data into the ECU with the Techstream Calibration Update Wizard (CUW).

Detailed information about the calibration file is in this 2014 whitepaper titled "Adventures in Automotive Networks and Control Units" starting on Page 75. The authors also provide a set of tools for manipulating the calibration file that can be viewed here or downloaded here in zip format.

Toyota calibration files are of interest because they can be easily obtained for example from Toyota's Technical Information System (TIS) and used for study. A calibration file contains all of the maps that are used for tuning the ECU. The calibration file is a good way to get hold of the original maps without opening the ECU. The maps can be edited then flashed back into the ECU through the Data Link Connector (DLC) aka the OBD2 port - again without opening the ECU. This will be covered in detail.

As noted in the whitepaper, calibration files are encoded in a standard format called Motorola S-Record. This is to facilitate transfer of data. The encoding makes the file appear as gibberish if viewed directly in a normal calibration file editor like WinOLS. Here is what a calibration file looks like in WinOLS.



This was a sample calibration file that Marc shared a few years ago [1]. The header is recognizable but nothing else is recognized as a map because it is in encoded S-record format. You can see how all the records follow a pattern starting with the letter "S."

Also as noted in the whitepaper, the file header includes a key for the file (TargetData) that is used by the Calibration Update Wizard to enable flashing. If it were possible to hack this password then in theory it would be possible to upload modified non-original Toyota calibration files into the ECU with Techstream. I don't know if this can be done. However I will cover other tools needed for flashing the maps back into the ECU successfully.

In order to look at the contents of the calibration file it's necessary to use S-record decoding tools. For example Srecordizer is a visual editor that decodes and edits S-record encoded files.



The limitation is you'd have to know exactly what to edit.

Other s-record decoding tools, for example Srecord, run under Windows XP. (If you don't have Windows XP you get Oracle VirtualBox and install an XP disk image as a virtual machine on your system). Then you can run Srecord from the command line to convert the S-record encoded file to an un-encoded binary file. For example the following command converted the file name test.cuw to a binary format with the output going to test.bin, with some errors reported on the first 34 lines of the file, which make up the header.



Next we try to view the binary file.

[To Be Continued]

Last edited by merryfrankster; June 27th, 2018 at 02:39.
merryfrankster is offline  
post #6 of 193 (permalink) Old October 14th, 2017, 03:38 Thread Starter
Registered User
 
Join Date: Feb 2016
Location: Maui, HI
Posts: 1,234
OldTrader Rating: (0)
This is a rundown of maps that are known to me. I will add any contributions from others. At this point all the credit for finding and documenting these maps goes to Marc. My renderings are based on the 4G00 Rav4 ECU binary linked in Post #9.

1. Accelerator Pedal Map and Torque Demand Maps.
The ECU uses these to determine the throttle opening in response to the pedal position and load. It takes the pedal position at a given load and applies a transformation. In linear algebra this is known as a convolution. [PS. Convolutions like this are useful for making calculations in the curved and non-uniformly stretched geometry of space-time. So you could say that our ECU's operation is based in part on Einstein's General Theory of Relativity.]



2. VVTi Intake and Exhaust Maps.
These set the target for the cam advance angle based on load and rpm. The advance angle is PID controlled with feedback from the cam sensors with the OCV duty cycle as the driver.



3. Fuel Map.
This is Marc's rendering of the map. Even with this input I have not been able to find this map in WinOLS. This is a perfect illustration of how WinOLS can miss significant maps.


Last edited by merryfrankster; August 2nd, 2018 at 21:24.
merryfrankster is offline  
post #7 of 193 (permalink) Old October 14th, 2017, 04:16
Registered User
 
Join Date: Apr 2006
Location: London, UK
Age: 40
Posts: 235
OldTrader Rating: (0)
Great idea, it's something I'd like to get involved with, as much as for my own knowledge gain as well as possibly help us all.

Sent from my SM-G930F using Tapatalk
monkeyra is offline  
post #8 of 193 (permalink) Old October 14th, 2017, 07:33
Gold Level
 
Join Date: Sep 2005
Location: Fort Wayne, IN
Age: 38
Posts: 3,502
OldTrader Rating: (14)
I haven't found a cheap tool yet, but when they dropped the price of this from $1050 to $800 i purchased one because my setup here was a complicated disaster for programming these and it works great: http://ecutools.eu/chip-tuning/toyota-lexus-flasher/

all the tune editing I'm still doing by hand with a hex editor. there are a few tools advertised out there now and frankly they are all crap. I've purchased a few of them to see if they can make my job easier and they are all developed in eastern europe and the focus there is diesel engines so they seem to be off on several things on these gas engines and i also don't think they've ever actually seen a 2GR-FE. this includes the bitedit tool advertised on the same site.

The flasher tool also integrates the checksum algorithm so it's everything you need to get files off and back on the ECU, also all the ECUs i've sold still have the JTAG port soldered on so it's easy if you go that way.

I'm still using a custom home made programmer for the immobilizer stuff because i'm using a low voltage programming mode to avoid powering up the rest of the ECU without needing to desolder that chip. I'm sure something off the shelf would work but i'm happy with my setup and haven't looked further.
Gouky is offline  
post #9 of 193 (permalink) Old October 14th, 2017, 07:34
Gold Level
 
Join Date: Sep 2005
Location: Fort Wayne, IN
Age: 38
Posts: 3,502
OldTrader Rating: (14)
Frank, you want to convert the srecord to a binary before putting it in winOLS. winOLS is actually a tool that helps me a fair bit but it also misses quite a bit.

*edit* here's a bin file for the "42G00" ECU so you can poke around: http://frankensteinmotorworks.com/2G...20original.bin

Last edited by Gouky; October 14th, 2017 at 07:37.
Gouky is offline  
post #10 of 193 (permalink) Old October 14th, 2017, 08:07 Thread Starter
Registered User
 
Join Date: Feb 2016
Location: Maui, HI
Posts: 1,234
OldTrader Rating: (0)
Quote:
Originally Posted by Gouky View Post
Frank, you want to convert the srecord to a binary before putting it in winOLS. winOLS is actually a tool that helps me a fair bit but it also misses quite a bit.

*edit* here's a bin file for the "42G00" ECU so you can poke around: http://frankensteinmotorworks.com/2G...20original.bin
He he I was just adding this bit. See above.
merryfrankster is offline  
post #11 of 193 (permalink) Old October 14th, 2017, 21:48 Thread Starter
Registered User
 
Join Date: Feb 2016
Location: Maui, HI
Posts: 1,234
OldTrader Rating: (0)
Quote:
Originally Posted by Gouky View Post
Frank, you want to convert the srecord to a binary before putting it in winOLS. winOLS is actually a tool that helps me a fair bit but it also misses quite a bit.

*edit* here's a bin file for the "42G00" ECU so you can poke around: http://frankensteinmotorworks.com/2G...20original.bin
Ok cool so previously you gave some clues about the vvti tables:



So I went poking for something of the same dimension 13x20 in this file.

I find some candidates and I apply transformations to the axis units, 50 to RPM and 0.625 to load, and voila, provided I can get the right transformation for the z-axis, which will take me some thought because I am brain dead today from staying up nearly all night playing with this stuff.



So this is kind of a Rosetta Stone because it tells me what scale factors to apply everywhere for RPM and for Load and what values to look for in the table axes to indicate those variables.

If I were starting from scratch and trying to decode this ab initio without getting a push [ok let's call it a powerful shove] from you in the right direction I'd be tearing my hair out and wishing I were smarter.

So I'll be continuing with the more systematic exposition up above but I thought this would be an interesting detour right here.

PS. I'm working with a free demo version of WinOLS so I would have to use another hex editor like for example Hex Editor Neo to go back in and edit the values and save them with CRC or checksum. But the exciting thing is that I haven't spent a penny and already I'm looking at maps.

PPS. I'm aware this might not be the vvti tables. Looking at the pattern it's more like a spark advance but with the wrong transformation.

Last edited by merryfrankster; June 27th, 2018 at 02:34.
merryfrankster is offline  
post #12 of 193 (permalink) Old October 14th, 2017, 22:12
Gold Level
 
Join Date: Sep 2005
Location: Fort Wayne, IN
Age: 38
Posts: 3,502
OldTrader Rating: (14)
yeah, i just use the free winOLS also just to find addresses. i use hex workshop to do the edits manually.

keep in mind many of the tables it finds aren't actually tables. it's also missing some tables that do exist but winOLS does find the vvti tables and the timing tables.

I'm actually not sure what table you're looking at there. it does certainly look like an RPM vs load table but that's an odd pattern inside of it.
Gouky is offline  
post #13 of 193 (permalink) Old October 15th, 2017, 05:39
Registered User
 
Join Date: Jan 2016
Posts: 30
OldTrader Rating: (0)
Hey Gouky,

Have you seen anything whilst investigating these ECU ROMs which might explain the weird 6th gear safe-mode that I get ?
I know these are just tables of data as opposed to the algorithms that are in use so we might not have the complete picture to work it out.

Gavs
gavsdavs is offline  
post #14 of 193 (permalink) Old October 15th, 2017, 06:53 Thread Starter
Registered User
 
Join Date: Feb 2016
Location: Maui, HI
Posts: 1,234
OldTrader Rating: (0)
Gavin, Did you see the safe mode related discussion in "ECU has been hacked..." thread in connection to Aurion ECU? How did you wire PRNDL on your ECU. Your question is interesting and important, but it is off-topic for this thread.
merryfrankster is offline  
post #15 of 193 (permalink) Old October 15th, 2017, 11:26
Registered User
 
Join Date: Jan 2016
Posts: 30
OldTrader Rating: (0)
Quote:
Originally Posted by merryfrankster View Post
Gavin, Did you see the safe mode related discussion in "ECU has been hacked..." thread in connection to Aurion ECU?
I will go have a look, cheers.
gavsdavs is offline  
post #16 of 193 (permalink) Old October 15th, 2017, 11:37
Gold Level
 
Join Date: Sep 2005
Location: Fort Wayne, IN
Age: 38
Posts: 3,502
OldTrader Rating: (14)
Frank,

If you want to find the VVT-I tables in that map look at 0x00FB45 for the exhaust and 0x00F6CA for the intake.

the addresses i'm giving you are actually a little bit in the table so your addresses will be a bit earlier in winOLS but it should get you really close.
Gouky is offline  
post #17 of 193 (permalink) Old October 15th, 2017, 15:38 Thread Starter
Registered User
 
Join Date: Feb 2016
Location: Maui, HI
Posts: 1,234
OldTrader Rating: (0)
Quote:
Originally Posted by Gouky View Post
Frank,

If you want to find the VVT-I tables in that map look at 0x00FB45 for the exhaust and 0x00F6CA for the intake.

the addresses i'm giving you are actually a little bit in the table so your addresses will be a bit earlier in winOLS but it should get you really close.
Marc, thanks for your help and support with this. I did get a bunch of tables tagged yesterday. I see what you mean about WinOLS finding some things but not finding others and this is also mentioned in the WinOLS tutorials. Interestingly WinOLS did automatically tag the vvti exhaust map but it did not tag the vvti intake map. For anyone interested, there's a tremendous series of video tutorials on using WinOLS available free on youtube. It does have some outlandish "continental" nomenclature and it is oriented to Volkswagen/Audi (VAG) Ecus but most of what's covered does also apply to Nippon Denso.

So what I was thinking of doing as I get the main maps identified and figured out is to produce a listing or specification of maps or map candidates with address, dimensions, and scaling factors. I'm not quite there and there are some things that are baffling me like perchance did you slip an 8000 RPM rev limit into this file? LOL. There is one table which unlike all the others has 8000 as the maximum on the rpm axis. Also some tables go to 6400, which is what I expected, others go to 6200, others go to some other number. This will take me some time to figure out.... There is one thing I will not "address" and that is the immobilizer, for a few reasons, the main ones being a. it is way above my pay grade so I don't think I could present anything useful there, even if I wanted to, and b. unlike the other info it is not accessible with publicly available tools and techniques so I don't have access to it anyway and that's fine.

Then there are also the other sections of the TOC on architecture, tools, com, to complete so I have enough to keep me busy for a while.
monkeyra likes this.
merryfrankster is offline  
post #18 of 193 (permalink) Old October 15th, 2017, 15:59
Gold Level
 
Join Date: Sep 2005
Location: Fort Wayne, IN
Age: 38
Posts: 3,502
OldTrader Rating: (14)
That file is 100% stock and the rev limit is 6400RPM. the rev limiter is really frekin' hard to find until you know a few things:
1) the rev limiter is stored in units of 1.28RPM for reasons of i don't know why.
2) the rev limiter is actually a cut and restore RPM that are right next to each other.
3) the cut and restore RPM in these stock tunes are always the same number it seems
4) the data format in this file is all little-endian.

I'll tell you what the address is of the rev limiter but i'm curious if you can find it with that information first.
Gouky is offline  
post #19 of 193 (permalink) Old October 15th, 2017, 17:26
Gold Level
 
Join Date: Sep 2005
Location: Fort Wayne, IN
Age: 38
Posts: 3,502
OldTrader Rating: (14)
Oh, also the comment about the table you found that goes to 8000 RPM, it's likely not actually RPM on that axis. most of the tables that have RPM all end at 6200 or 6400
Gouky is offline  
post #20 of 193 (permalink) Old October 15th, 2017, 19:19 Thread Starter
Registered User
 
Join Date: Feb 2016
Location: Maui, HI
Posts: 1,234
OldTrader Rating: (0)
I'm getting there slowly but surely and I stumbled upon something useful which is the "table storage format." This is important because if you follow the winOLS tutorial the Bosch VAG format is explained there but the Nippon Denso format is different and it actually makes sense if you've ever watched a Japanese student doing math or taking notes in math class.

Taking the vvti exhaust angle map as an example:



This is viewed in 8-bit decimal. The table is highlighted in blue. The outlines in light blue on the top and to the right are the x-y axis values. The dark blue square is the z-axis values. The dimension of the table 10x18 is in the upper right hand corner right above the table.

So.... if this holds generally which no reason why it shouldn't this should be useful for chasing down and confirming other tables.

Ok so there are other things where gaps in my knowledge leave me perplexed and where in Arthur C. Clarke parlance I assume you relied on divine inspiration or magic like how and why in the heck did you map 11010 to 95% as you did in the Torque Demand and Driver's Wish combo. LOL.

PS> Practical note for anyone wondering: you don't have to squint, you right click on the image and select "View Image" from the drop-down menu to get it at full-size.

Last edited by merryfrankster; June 27th, 2018 at 02:36.
merryfrankster is offline  
Reply

Quick Reply
Message:
Options

Register Now



In order to be able to post messages on the MR2 Owners Club Message Board forums, you must first register.
Please enter your desired user name, your email address and other required details in the form below.

User Name:
Password
Please enter a password for your user account. Note that passwords are case-sensitive.

Password:


Confirm Password:
Email Address
Please enter a valid email address for yourself.

Email Address:
OR

Log-in











Currently Active Users Viewing This Thread: (0 members)
 
Thread Tools
Show Printable Version Show Printable Version
Email this Page Email this Page



Posting Rules  
You may post new threads
You may post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

 
For the best viewing experience please update your browser to Google Chrome