Legnum VR-4 Def File

[BarryC]

ok guys my mate has a VR-4 and asked me to tune it up for him,
I was able to pull the rom from it AFAIK its a H8 based ecu,
I have tried and tried to look for the fuel and timing maps and the boost limit table but cannot find anything,
could someone please help me out here,
all I need are the high octane fuel and timing tables,
and the boost limit table if possible,
many thanks
or if someone wants to show me what to look for in the rom I might be able to hunt it down myself
cheers

[merlin]

Hi Barry, found:
hi and lo octane ignition maps.
4 fuel maps.

Need clues to help find:
rev limit
speed limit
inj size
idle speed
boost cut

Any empirical info or FSM info you can provide on these items will help in finding them.


Edit:
found -
2 more timing maps
what looks like an EGR fuel overlay map
possible rev limit

[evonut270]

have a look at these.

[merlin]

ok, here is what I have sofar.
I think we need some code dissassembly to find the boost cut though.

[evonut270]

ok, here is what I have sofar.
I think we need some code dissassembly to find the boost cut though.
boost cut seems to be address FDD if my reading of tunerpro is correct.

[merlin]

Hi evonut, quick questions.
Does the Legnum tt have the re-flash port next to the OBD-II connector?

I started with TunerPro as I thought it was an EPROM type ECU.
But if its a flashy type, then I will convert my xdf to xml/EcuFlash tonight.
Maybe tomorrow night, TopGear night tonight.

Is boostcut a single 8 bit value, or a table as per the evos?

[evonut270]

Hi evonut, quick questions.
Does the Legnum tt have the re-flash port next to the OBD-II connector?

I started with TunerPro as I thought it was an EPROM type ECU.
But if its a flashy type, then I will convert my xdf to xml/EcuFlash tonight.
Maybe tomorrow night, TopGear night tonight.

Is boostcut a single 8 bit value, or a table as per the evos?i have no idea mate but i would think as it uses the same processor as the e5+6 you will need to convert to xml from xdf

[Cossie1]

It does have the reflash connector, as I dumped the rom out of a 96 model a few weeks back.

Again I couldn't find any tables for it either.

[merlin]

Started converting to EcuFlash/xml last night.
Items done are:
4x FUEL maps, 2x hi octane, 2x lo octane.
4x IGNITION maps, as above.
2x cat warmup retard ignition maps.
load and rpm scaling for all the above.

Reasonably confident about:
Rev Limit.
Speed Limit.
Injector Latency.

Have found a bunch of other maps, not had time to look closly at them to try and identify the purpose.
As I am not doing disassembly, some of it is guesswork.
But I can say that the data more closely resembles evo 7-9 type date than early evo 1-3.
Unfortunately, no data variables are stored in locations matching any evo/def file I have and the rom size is different to at 128k bytes.

Cossie1, when you read the hex from the '96, was that using EcuFlash?
In which case what did you select as the ecu/vechicle type when connecting?
And, was it a 1.3 cable or openport2 cable to do the read.
I understand we need the openport2 to do re-flash though, mine should arrive this weekend. Hopefully.

evonut, do you want me to post the xml as is or wait a bit?

[Cossie1]

I read it as evo 5/6 and used the OP 1.3 cable.

The roms are similar to the Evo 5/6 and uses the same processor, but no address's seem to match from the xml's I made up for the 5/6

[merlin]

Results so far, everything with a * prefix is dodgy/wip.

EDIT 1: Added periphery+mut+ecuID+ascii scaling. All turbo stuff is wrong/work-in-progress.

EDIT 2: Files have been updated in post on page 5, 28th July.

[evonut270]

good work chap :smile:

[Mitsiman]

Could somoene please have a look at the Legnum File I have here. I downloaded it off a vehicle, but was unable to read it using the defiition files which you have already created. Been reading through these forums and am very impressed with the information and knowledge out there. New to ECU reflashing but learning very very fast.

[acamus]

ROMID = 23810004
ECU Family = EM2428
SCC = E7E1

modify one of the files eg. EM2004 to EM2428 and you shall have what you wanted

[Mitsiman]

Thanks for the feedback but I don't know how to modify those files. I have started studying up on XML software and programming. Is there any chance someone could do this for me?

[kc427]

Results so far, everything with a * prefix is dodgy/wip.

EDIT 1: Added periphery+mut+ecuID+ascii scaling. All turbo stuff is wrong/work-in-progress.

Merlin,

Any idea how to do the Mut 2byte mod for the VR4? :p

[kc427]

Thanks for the feedback but I don't know how to modify those files. I have started studying up on XML software and programming. Is there any chance someone could do this for me?

you can do it by yourself, and it's very simple, download, eg, vr4_MD340289.xml, open it with notepad, replace "EM2005" to your ECU Family, "EM2428", then save as another filename, with extension .xml, and place into the same folder with "vr4base1.xml", and you can able to open the ROM in ECUFlash.

[Mitsiman]

Thanks guy's worked a treat. Now I can start tuning these vehicles

[Mitsiman]

Just another question - the boost desired engine load maps in the definition files I altered are not in the correct rpm scaling, they start at 4000,500, 6000, 7000, then 24000, 2435, then 35, 0, 125, 250 etc.

Is this a case if Just need to change the scaling or is it a defiition file issue?

[evonut270]

Just another question - the boost desired engine load maps in the definition files I altered are not in the correct rpm scaling, they start at 4000,500, 6000, 7000, then 24000, 2435, then 35, 0, 125, 250 etc.

Is this a case if Just need to change the scaling or is it a defiition file issue?sounds like the rpm axis adderess is wrong.

[Mitsiman]

Thats what I was thinking - a variation in the defiition file. Can someone take a look at this for me and tell me what to change?

[evonut270]

Thats what I was thinking - a variation in the defiition file. Can someone take a look at this for me and tell me what to change?iv had a little play with the addresses this the best i could find.

[kc427]

Just another question - the boost desired engine load maps in the definition files I altered are not in the correct rpm scaling, they start at 4000,500, 6000, 7000, then 24000, 2435, then 35, 0, 125, 250 etc.

Is this a case if Just need to change the scaling or is it a defiition file issue?

Are you using the vr4base1.xml from post#11? If you are using this, the RPM scaling for boost desired engine load should be OK. At least, I can see the RPM in scale correctly.:blink:

[kc427]

iv had a little play with the addresses this the best i could find.

You have changed the "*Boost Cut Load Limit" to address "11d1b", compared to the old one, it looks "better" than original address at "12228".... thanks a lot :tt1:

[RichardB]

Dave (MitsiMan) youve got to remember there are quite a few different ECU's for the VR4. At least 4 that I know of (pre and post 1997 for both auto and manual) and knowing mitsi the code will be different on each one.

[evonut270]

You have changed the "*Boost Cut Load Limit" to address "11d1b", compared to the old one, it looks "better" than original address at "12228".... thanks a lot :tt1:yes i changed it as i searched through alot of address code and couldnt find anything close.

[Mitsiman]

I was using the same VR4 base yes. I did as someone said, copied the definiton file, changed the EM number and saved it as a new defiition file.

I will try these new changes and see if they are better. Thanks.

[kc427]

yes i changed it as i searched through alot of address code and couldnt find anything close.

cool....btw, do you know the address for the 2 Byte Mod, I guess it would be more useful if using if with EvoScan to log the engine load regarding the fuel/ignition map:p

[kc427]

Dave (MitsiMan) youve got to remember there are quite a few different ECU's for the VR4. At least 4 that I know of (pre and post 1997 for both auto and manual) and knowing mitsi the code will be different on each one.

yes, there are few different ECU for the VR4, ie, Galant, Legnum, pre 97, post 97, etc, but as far as I know, the map addresses are the same for EM200 and EM2005, the only differences are the values, and also the ID. Note, I have seen the code segment are different on the 2001/2002 VR4. :bored:

[kc427]

I was using the same VR4 base yes. I did as someone said, copied the definiton file, changed the EM number and saved it as a new defiition file.

I will try these new changes and see if they are better. Thanks.

oh.... I see what you mean..... I just open your .hex file, and see the RPM is strange.....even the fuel map, those RPM scaling are strange too....:blink:

[Mitsiman]

I am glad I am not going crazy. So what we need is to get all the address mapped of the rom file that I posted on the forum. If someone wants to go through and do that for me I am willing to compensate them for the time :)

[kc427]

I am glad I am not going crazy. So what we need is to get all the address mapped of the rom file that I posted on the forum. If someone wants to go through and do that for me I am willing to compensate them for the time :)

Here you go..... I made a xml for your rom, ROM ID: 23810004 :tt2: It should work. NOTE: Delete your old EM2428 xml, and just add this "vr4_23810004.xml" into the folder.

[Mitsiman]

thanks will give it a go and let you know

[Mitsiman]

You have done a fantastic job, more maps and everything is looking good.

Some general questions about these now - more about tuning than anything else. Maybe someone can provide more information on this.

Ignition Maps
The vehicle has four ignition maps, 2 hi octane and 2 low octane maps. The two hi octane maps are identical, as are the two low octane maps. Does this mean when tuning, we should make the same changes to both maps? How does teh ecu definine whic map to use

Fuel Maps
Same situation two hi and two lo octane, again same maps

Boost Desired Engine Load - we have four maps named A, B, C & D

Maps A & B are identical
Map C has hgher boost numbers
Map D has even higher ones again

Once again how does the ecu decide which map to use?

There is also two wastegate duty cycle maps marked A & B. Both currently set to zero, any ideas how these related to desired engine load maps?

I realise that most of this is just playtime on the dyno to work it out but any headers in advance would be great

[kc427]

You have done a fantastic job, more maps and everything is looking good.

Some general questions about these now - more about tuning than anything else. Maybe someone can provide more information on this.

Ignition Maps
The vehicle has four ignition maps, 2 hi octane and 2 low octane maps. The two hi octane maps are identical, as are the two low octane maps. Does this mean when tuning, we should make the same changes to both maps? How does teh ecu definine whic map to use

Fuel Maps
Same situation two hi and two lo octane, again same maps

Boost Desired Engine Load - we have four maps named A, B, C & D

Maps A & B are identical
Map C has hgher boost numbers
Map D has even higher ones again

Once again how does the ecu decide which map to use?

There is also two wastegate duty cycle maps marked A & B. Both currently set to zero, any ideas how these related to desired engine load maps?

I realise that most of this is just playtime on the dyno to work it out but any headers in advance would be great


I am not familiar of these technical things, but you can find your answer here:

http://www.geekmapped.com/forums/showthread.php?t=51

:)

[evonut270]

You have done a fantastic job, more maps and everything is looking good.

Some general questions about these now - more about tuning than anything else. Maybe someone can provide more information on this.

Ignition Maps
The vehicle has four ignition maps, 2 hi octane and 2 low octane maps. The two hi octane maps are identical, as are the two low octane maps. Does this mean when tuning, we should make the same changes to both maps? How does teh ecu definine whic map to use

Fuel Maps
Same situation two hi and two lo octane, again same maps

Boost Desired Engine Load - we have four maps named A, B, C & D

Maps A & B are identical
Map C has hgher boost numbers
Map D has even higher ones again

Once again how does the ecu decide which map to use?

There is also two wastegate duty cycle maps marked A & B. Both currently set to zero, any ideas how these related to desired engine load maps?

I realise that most of this is just playtime on the dyno to work it out but any headers in advance would be greati didnt bother with the addresses on on map c+d of the boost desired engine load purely because its doubt full they will be used. the wastegate duty maps have been fixed.

[evonut270]

You have done a fantastic job, more maps and everything is looking good.

Some general questions about these now - more about tuning than anything else. Maybe someone can provide more information on this.

Ignition Maps
The vehicle has four ignition maps, 2 hi octane and 2 low octane maps. The two hi octane maps are identical, as are the two low octane maps. Does this mean when tuning, we should make the same changes to both maps? How does teh ecu definine whic map to use

Fuel Maps
Same situation two hi and two lo octane, again same maps

Boost Desired Engine Load - we have four maps named A, B, C & D

Maps A & B are identical
Map C has hgher boost numbers
Map D has even higher ones again

Once again how does the ecu decide which map to use?

There is also two wastegate duty cycle maps marked A & B. Both currently set to zero, any ideas how these related to desired engine load maps?

I realise that most of this is just playtime on the dyno to work it out but any headers in advance would be greatwhich rom do you have?please post it or is it the one already on here?

[evonut270]

heres what i have so far.

[Mitsiman]

so these are all updated files then, all of them, meaning its worthwhile downloading them and replacing all previous versions I have? This has been a great thread guy's

[kc427]

Nice, I have successfully flashed the VR4 ECU !!!

[evonut270]

Nice, I have successfully flashed the VR4 ECU !!!did it work ok?

[kc427]

did it work ok?

Yes, I have set the RPM limit, and then cut at 3000 rpm :tt2:

Also, I change the ignition timing at the low rpm and below 0 bar boost area, and I can feel the difference:tt1:

[evonut270]

Yes, I have set the RPM limit, and then cut at 3000 rpm :tt2:

Also, I change the ignition timing at the low rpm and below 0 bar boost area, and I can feel the difference:tt1:
thats excellent mate.:smile:

[kc427]

Guys, I have found the 2byte RPM and I tested it with EvoScan. You can use it with need. But personally, I don't need, as the 2byte RPM is almost exactly the same is the normal RPM, so, no need to waste 1 byte to log from the slow MUT port.:rolleyes:

20030011

2byte RPM
MUT 02 = F0A8
MUT 03 = F0A9

[blackvr]

Guys, I pulled a rom from a Jspec 2001 (?) tiptronic VR4 Legnum today, and tried using your good work in developing xml files for the Legnum.

I have got a copy of that rom enclosed in this reply.

A lot lines up... but the axis are out for the ignition tables and most of the boost and wastegate tables. Evonut270, would you be able to take a look and see what you reckon. Or suggest what xml file I should be using, or what needs to be renamed ?

Has anyone used the wastegate tables successfully ? It would be nice to use these instead of wiring up a expensive EBC.

Cheers... keep up the good work ! Mike

[evonut270]

Guys, I pulled a rom from a Jspec 2001 (?) tiptronic VR4 Legnum today, and tried using your good work in developing xml files for the Legnum.

I have got a copy of that rom enclosed in this reply.

A lot lines up... but the axis are out for the ignition tables and most of the boost and wastegate tables. Evonut270, would you be able to take a look and see what you reckon. Or suggest what xml file I should be using, or what needs to be renamed ?

Has anyone used the wastegate tables successfully ? It would be nice to use these instead of wiring up a expensive EBC.

Cheers... keep up the good work ! Mikeill take a look and see what i can find.if you want to use the wastegate tables its probably best buying a 3 port solenoid the stock one probably wont be up to much.

[AderC]

I'd just noticed this same issue. The "Boost Cut Load Limit" and "Boost Desired Engine Load - A" tables both have the same address (12228).

A thanks from me too for the work done on this so far (and in the future)

[Mitsiman]

http://www.ozvr4.com/forums/showpost.php?p=99220&postcount=127

http://www.ozvr4.com/forums/showpost.php?p=99221&postcount=128

Check the above two links. The definitions files have had some more editing done to them, more official names and is what a lot more of us are using now. They seem to be working correctly so far.

[AderC]

Those were the files I was using. There's a definite clash between the BCLL and BDEL-A tables (both address 12228)

aDe

[merlin]

ok, back onto vr4 and legnums, after an absense of six months.

Have upgraded some definition files, and stripped out some wrong bits to save confusion.
I am not sure the MUT table is correct!
Have added an ability to add the tuners id and/or rom id info.

[merlin]

Has anyone that has had a wide-band O2 on these seen any evidence the ROM has LEAN SPOOL?

Diddnt want to spend time looking for something that is not there.
Does the evo5/6 have LEAN SPOOL?

I will look for the IDLE STEPPER 3D map though.

[merlin]

edit: added an update for the 23810004 rom.

[Cossie1]

Evo 5/6 does have lean spool

[merlin]

I was able to read a clients vr4 rom the other day, using the 1.3 cable, but was not able to get the OpenPort2 cable to work.
It would not work on my 9 either.
Using V1.40 EcuFLASH.
Should I be using V1.41?
Did the usual un-install ecuflash/tactrix drivers/stripped the registry/reinstalled ecuflash etc.
The 1.3 cable connected to my 9, but the openport2 cable refused.
Any clues please?
Hoping to be able to return to the vr4 on saturday.

[merlin]

Had a good long look for vr4 lean spool tables last night, no luck.
Cossie1, does the 5/6 lean spool ARF table have the same values as the evo 7?

[Cossie1]

Had a good long look for vr4 lean spool tables last night, no luck.
Cossie1, does the 5/6 lean spool ARF table have the same values as the evo 7?

They do have the same values

[kc427]

I was able to read a clients vr4 rom the other day, using the 1.3 cable, but was not able to get the OpenPort2 cable to work.
It would not work on my 9 either.
Using V1.40 EcuFLASH.
Should I be using V1.41?
Did the usual un-install ecuflash/tactrix drivers/stripped the registry/reinstalled ecuflash etc.
The 1.3 cable connected to my 9, but the openport2 cable refused.
Any clues please?
Hoping to be able to return to the vr4 on saturday.

There is a new version, v1.42, maybe you can try that:smile:

[merlin]

d'oh, downloaded V1.42 and it connected to my IX no worries.
Will hopefully get a chance to tune the vr4 on saturday.

[n-j]

tried to connect to six vr4's so far and not a single one connects , should have a facelift manual to play with soon though

[merlin]

n-j, check the ECU connector for wires on pin #56 and #79.
Apparently some wireing harness are missing the diagnostics wireing.

kc427, did you try logging 2byte load on F041, F040 ?

Had another good look into the rom today, could not find egr timing adders, lean spool or the 3D idle stepper-motor map.

Found two tables that might be the octane update and knock load threshold.
I dont think I have any chance of finding the 3 knock multipliers, so have stopped searching.

[kc427]

n-j, check the ECU connector for wires on pin #56 and #79.
Apparently some wireing harness are missing the diagnostics wireing.

kc427, did you try logging 2byte load on F041, F040 ?

Had another good look into the rom today, could not find egr timing adders, lean spool or the 3D idle stepper-motor map.

Found two tables that might be the octane update and knock load threshold.
I dont think I have any chance of finding the 3 knock multipliers, so have stopped searching.

The 2byte load on F041, F040 ? How can you find that? I could only find the address, F008, F009. but they are not correct. How can you find that 2byte load? I have been searching for long long time from different forum, and trying to find the 2byte load, but still couldn't find any.

[n-j]

Thanks Merlin , not seen any reports of them having missing ecu lines

The cars I have treid all work with evoscan with a vagcom cable but not the OP2 cable

[merlin]

kc427, sorry for misleading you there on the mut issue.
I realised later my mistake. No, I dont know the correct address.
Am I right in assuming it has to be one of the address pairs, seen in the mut table, and then placed in mut location 00, 01?

[kc427]

kc427, sorry for misleading you there on the mut issue.
I realised later my mistake. No, I dont know the correct address.
Am I right in assuming it has to be one of the address pairs, seen in the mut table, and then placed in mut location 00, 01?

yes, once you know the address pair of 2byte load, simply put into the MUT table 00 and 01. I found the 2byte RPM, and logged the 2byte RPM is same as normal RPM from the EvoScan, so I am pretty sure the 2byte RPM is correct. But, the 2byte load, I still cannot figure out how to find that.

Have you seen the post in Evo forum, they talked about how to find the 2byte load, but I follow the guide at there, even their example Evo ROM, I still couldn't find out the address pair as they found. There must be some tricks or, maybe I misunderstand their meaning, because my mother language is not English.... >.<

Have a look in this link, and see you can find the 2byte load from their example:

http://forums.evolutionm.net/ecuflash/303050-ida-pro-tutorial-request.html

[merlin]

kc427, I had a read thru the link/tutorial. Pheww!
However, I may have got something.

Working it out thru the 20030013 rom, I got F0A8 F0A9 for ram 2byte, like u did. Great!

Then, I got F008 F009 for 2byte load.
Did you try those ram addresses or something else?

[kc427]

kc427, I had a read thru the link/tutorial. Pheww!
However, I may have got something.

Working it out thru the 20030013 rom, I got F0A8 F0A9 for ram 2byte, like u did. Great!

Then, I got F008 F009 for 2byte load.
Did you try those ram addresses or something else?

I tried F008 F009 for 2byte load, and then after logged with EvoScan, it was not the load, so I am pretty sure the F008 and F009 are not correct....and I asked this question in Evo Forum, and no one answered..... :unsure: So, right now, I am stucked at this 2byte load, without this, I can't tune the fuel and ignition.

[merlin]

oh, crap!I dont know, we must have done something wrong.
Maybe we used the wrong load scale table.

On another note, I sucessfully re-flashed and tuned a vr4 vspec 2000 manual, rom code 20030013. Note that previously posted boost cut address's are wrong.
The tuned vr4 is now running 17-18psi, with boost cut set to 210%.
No knock, speed limit altered, cat warmup ignition tables zero'ed off.

This car has a clutch switch, which was dissconnected. I think I may have found 2 stationary rev limiters, clutch in and clutch out.
This will have to wait untill the next round of tuning to proove.

This was done with ecuflash v1.42, and there were some connectivity issues.
Things started out alright, but after a couple of flashes, started to throw some errors.
Then refused to connect at all.
Had to use another laptop to proceed (I took 3 laptops with me).
At one stage, the tactrix openport2 cable installer demanded / expected to have xp service pack 3 installed to prevent usb problems.

I seems that if you try to run evoscan and ecuflash on the one pc equals trouble.

[AderC]

I've got these defs for the Open Loop Load Limit tables. Have tried them by upping a few afr cells to 15 and lowering the OLLL to 45%. Logging in evoscan shows the AFRMap values hitting 15 as expected.

<table name="*Open Loop Load 1" category="Fuel" address="114C6" type="2D" scaling="Load8">
<table name="RPM" address="2d232" type="Y Axis" elements="9" scaling="RPM"/>
</table>

<table name="*Open Loop Load 2" category="Fuel" address="114D6" type="2D" scaling="Load8">
<table name="RPM" address="2d232" type="Y Axis" elements="9" scaling="RPM"/>
</table>

[merlin]

good find there, but...

how did you find them?

[AderC]

Adapted 'em from the ecuEdit XML files that the Russians were using so I can't take credit for actually finding them. I'm not 100% sure about the RPM scaling, but the load limit values are correct.

[kc427]

I've got these defs for the Open Loop Load Limit tables. Have tried them by upping a few afr cells to 15 and lowering the OLLL to 45%. Logging in evoscan shows the AFRMap values hitting 15 as expected.

<table name="*Open Loop Load 1" category="Fuel" address="114C6" type="2D" scaling="Load8">
<table name="RPM" address="2d232" type="Y Axis" elements="9" scaling="RPM"/>
</table>

<table name="*Open Loop Load 2" category="Fuel" address="114D6" type="2D" scaling="Load8">
<table name="RPM" address="2d232" type="Y Axis" elements="9" scaling="RPM"/>
</table>



Great, then we can add this into the xml too.... :p

btw, do you have any idea about the 2 byte load?

[kc427]

oh, crap!I dont know, we must have done something wrong.
Maybe we used the wrong load scale table.

On another note, I sucessfully re-flashed and tuned a vr4 vspec 2000 manual, rom code 20030013. Note that previously posted boost cut address's are wrong.
The tuned vr4 is now running 17-18psi, with boost cut set to 210%.
No knock, speed limit altered, cat warmup ignition tables zero'ed off.

This car has a clutch switch, which was dissconnected. I think I may have found 2 stationary rev limiters, clutch in and clutch out.
This will have to wait untill the next round of tuning to proove.

This was done with ecuflash v1.42, and there were some connectivity issues.
Things started out alright, but after a couple of flashes, started to throw some errors.
Then refused to connect at all.
Had to use another laptop to proceed (I took 3 laptops with me).
At one stage, the tactrix openport2 cable installer demanded / expected to have xp service pack 3 installed to prevent usb problems.

I seems that if you try to run evoscan and ecuflash on the one pc equals trouble.

But, would 17-18psi too high for the engine? I guess the safe limit would be something like 1 bar or 14.7psi.

Is it ok using the 1.42? If not, try the 1.41, as I used it to flash my ECU.

[merlin]

kc, Im using v1.42 now.
The tuned vr4 had a large intercooler, so the boost temps were ok at the higher boost pressures.

[AderC]

Great, then we can add this into the xml too.... :p

btw, do you have any idea about the 2 byte load?

No - scratching my head trying to find the 2 byte load too...

BTW have you seen this how-to for the H8/500 on aktivematrix:

http://www.aktivematrix.com/forum/viewtopic.php?t=474

I've now got lots of pretty coloured code to look at. Just wish it was VB! :eek:

[kc427]

No - scratching my head trying to find the 2 byte load too...

BTW have you seen this how-to for the H8/500 on aktivematrix:

http://www.aktivematrix.com/forum/viewtopic.php?t=474

I've now got lots of pretty coloured code to look at. Just wish it was VB! :eek:

Yes, I did follow that post and tried to see it in assemble, but, don't know what to find......haha

[AderC]

Got the 2 byte load chaps! Graph of ECULoad and 2 byte load from Evoscan below:

http://www.clubvr4.com/forum/uploaded/1988/1247924897.jpg

As you can see the 2 byte load is a slightly different value and isn't clipped at 160 like the ECULoad is.

Found it in the following bit of code in the high octane fuel map table header (actual address is 110a3 but is offset to 210a3 in IDA Pro when RAM is loaded as the 0000-FFFF addresses):

ROM:000210A3 shll.w r0
ROM:000210A5 shll.w r0
ROM:000210A7 mov:g.w r0, @word_F0DA:16
ROM:000210AB mov:g.w @word_F0DA:16, r0
ROM:000210AF mov:g.w r0, @word_F0D2:16
ROM:000210B3 mov:g.w @word_F0DA:16, r0
ROM:000210B7 mov:g.w r0, @word_F0D8:16
ROM:000210BB prts

I tried addresses F0DA, F0D8 and F0D2 - both the F0D2/F0D3 and F0D8/F0D9 combinations seem to give the value which would appear to be the 2-byte load!

aDe

[AderC]

On another note, I sucessfully re-flashed and tuned a vr4 vspec 2000 manual, rom code 20030013. Note that previously posted boost cut address's are wrong.

Merlin - have you got the correct boost cut addresses?

aDe

[merlin]

AderC, great job on the 2-byte.
For boost cut, try 1153c
For boost cut delay, try 10378
For rev limit stationary #1, try 10341
For rev limit stationary #2, try 10343

[AderC]

Cheers Merlin. I've posted on clubvr4 that the evoscan calc for 2 byte load seems to be wrong for the VR-4. I would have thought that below loads of 160, the ecuload and 2byte load should give similar values, but in reality 2byte is consistently 1.4 times ecuload. Changing the evoscan formula for the 2byte load from (0.3125 * x) to (0.2326 * x) gives 2 byte values closer to the ecuload:

http://www.clubvr4.com/forum/uploaded/1988/1248002427.jpg

[merlin]

Thanks for that new evoscan formula.
Any ideas as to why its different to evo?

[kc427]

AderC, I read from EVO forum, and most of them saying that the most accurate one is 2byte load, and then, Load Calculated(ReqID:29) is more accurate than ECULoad(ReqID:1C). So, why not doing the conversion from EvoScan's "Load Calculated"? Any advantage?

Merlin, is it because of the injector scaling size? Because the EvoScan's "LoadCalculated" takes the injector scaling as one of the parameter. I don't know, I just guess it.

[AderC]

I think it's simpler than that. Evo's run higher boost therefore mapped for higher load (Evo5 GSR for example is mapped up to 260 load compared to VR-4's 200). The ECU sees a value "x" which for the Evo at 260 load would be (260/0.3125) = 832 according to evoscan formula. I would assume that when our ECU sees a value of 832, this represents 200 load. 200/832 = 0.2404, which isn't far off the observed scaling factor of 0.2326 in my logs.

I did try logging the Load Calculated too for comparison, but it only returned zero values. I need to look into why evoscan didn't log this properly.

[merlin]

kc, regarding inj formula, maybe, but the % error seems to be different.
I do have a bit of a mental issue with the evo/ecuflash injector scaling formula, 29241/x.
29241 translated to hex does not appear in my evo9 rom at all, which seems odd.
However, the old DSM scaling formula, 31920/x yeilds inj scaling values which seem to match the real world, ie what the injectors are typically rated to flow.
And, the value 31920 does appear in my evo9 rom, several times.
As a consequence, I routinely include in any new ECU def xml I work on a DSM version of injector scaling.
Thats how I found the inj scaling for the VR4 for example.
Having played with the VR4s a bit now, I get the strong feeling that the load values of VR4 and EVO are the same air-flow. Or at least I have no evidence to think otherwise.

[merlin]

Here is a link to the VR4 & LEGNUM Tuning Guide I have posted.

http://ozvr4.com/forums/showthread.php?t=6650

[kc427]

Here is a link to the VR4 & LEGNUM Tuning Guide I have posted.

http://ozvr4.com/forums/showthread.php?t=6650

that's very good.... :tt1::tt1:

[AderC]

What KC427 said! :thumbup1:

[kc427]

Guys, I found something strange from the xml definition, and would like to discuss with you. Sorry, it's about the injector thing again. I suspect the "Injector Size Scaling" is not correct in VR4 xml.

OK, here is the detail. I looked at EVO5_GSR rom, and used the IDA to see the assembly code. From EVO5 xml, if the "Injector Size Scaling" address(0x0806) is correct, I searched the whole rom, and most suitable place about the code is below:
http://i67.photobucket.com/albums/h286/kcheng8888/2009-07-23/EVO5.jpg
and you can see "mulxu.w" is multiple arithmetic.


Again, from VR4 xml, the address is 0x0318, and only 1 place in the code has this:
http://i67.photobucket.com/albums/h286/kcheng8888/2009-07-23/VR4_0x0318.jpg
But you see, "cmp" is comparing, not arithmetic function, so it is very strange.

Then, I search the whole VR4 rom, and most similar code is:
http://i67.photobucket.com/albums/h286/kcheng8888/2009-07-23/VR4_0x0306.jpg
Now, you can see, the structure is very similar to EVO5 rom. So, if the address for EVO5 is correct, then, similarly, the "Injector Size Scaling" should be address 0x0306.

OK, assume the address is 0x0306, and from the rom, the value is 0x0050, which is 80 in dec, and if 31920/80, which is 399, and quite close to the 390cc injector.

Any comment? :rolleyes:

[merlin]

Well I'm confused, just looked at the hex for a evo5 GSR, and at address 0806 I find 0036.........
and
all the evo5 xml files I have say inj is at 0806
confused and puzzled now.

edit:
looked at this again, I still think the correct address is 10306.

[kc427]

Well I'm confused, just looked at the hex for a evo5 GSR, and at address 0806 I find 0036.........
and
all the evo5 xml files I have say inj is at 0806
confused and puzzled now.

edit:
looked at this again, I still think the correct address is 10306.

What happen if just change the value in 10306? Any intermediate changes we can notice? Eg, rough idle, or running very rich, or.... etc....?

[merlin]

Suggest change the value by 10% and check if fuel trims change by 10%.
That ought to prove it one way or the other.

[kc427]

Suggest change the value by 10% and check if fuel trims change by 10%.
That ought to prove it one way or the other.

You mean fuel trims when in idle?

[merlin]

^thats right

[kc427]

^thats right

Good, I am willing to test on that, should I increase the value in 10306 or decrease by about 10%?

[merlin]

your choice, either way it should still start and run

[MattS00]

Got the 2 byte load chaps! Graph of ECULoad and 2 byte load from Evoscan below:

http://www.clubvr4.com/forum/uploaded/1988/1247924897.jpg

As you can see the 2 byte load is a slightly different value and isn't clipped at 160 like the ECULoad is.

Found it in the following bit of code in the high octane fuel map table header (actual address is 110a3 but is offset to 210a3 in IDA Pro when RAM is loaded as the 0000-FFFF addresses):

ROM:000210A3 shll.w r0
ROM:000210A5 shll.w r0
ROM:000210A7 mov:g.w r0, @word_F0DA:16
ROM:000210AB mov:g.w @word_F0DA:16, r0
ROM:000210AF mov:g.w r0, @word_F0D2:16
ROM:000210B3 mov:g.w @word_F0DA:16, r0
ROM:000210B7 mov:g.w r0, @word_F0D8:16
ROM:000210BB prts

I tried addresses F0DA, F0D8 and F0D2 - both the F0D2/F0D3 and F0D8/F0D9 combinations seem to give the value which would appear to be the 2-byte load!

aDe

I wonder if there is raw load, temp corrected, baro corrected, or temp and baro corrected load.

A little more info below.

http://evoecu.logic.net/wiki/96530006

[kc427]

your choice, either way it should still start and run

I have tried it, changing the value in 0x10306 from 0x50 to 0x48(from 399cc to 443cc), unfortunately, all the fuel trims are the same, no changes. Either the Req ID is differently config in VR4 or the address 0x10306 is not for injector size scaling. Below is the excel log:

Original value, 0x50:
http://i67.photobucket.com/albums/h286/kcheng8888/2009-07-25/0x0306_0x50.jpg


Changed to 0x48:
http://i67.photobucket.com/albums/h286/kcheng8888/2009-07-25/0x0306_0x48.jpg

[AderC]

I wonder if there is raw load, temp corrected, baro corrected, or temp and baro corrected load.

A little more info below.

http://evoecu.logic.net/wiki/96530006

Looking at the link you could well be right on that. I wondered why F0D2/F0D3 and F0D8/F0D9 gave similar values. Looks like it's worth trying F0D4/5 and 6/7 combinations too to see what values they give.

[merlin]

Ok kc, I will have another look for it again today and get back to you.
I remember finding a couple of other possibles.

[merlin]

kc, I note there is no log of STFT, which would show the effect immediately.
So, how long had the engine been idling before you logged the above session?
The trims you logged will only change after a minimum time period, about 16 minutes from memory.

[kc427]

kc, I note there is no log of STFT, which would show the effect immediately.
So, how long had the engine been idling before you logged the above session?
The trims you logged will only change after a minimum time period, about 16 minutes from memory.

oh, I just logged it for about 1-2 minutes, as I saw those fuel trims are the same, so, I stopped the log.

BTW, when logging by the EvoScan, I update the "Injector Scaling" to "390", and the function for
Injector Pulse Width = 0.256*x
Injector Duty Cycle = [InjPulseWidth]*31.25*x/1200

Do you think those numbers are correct for us? I mean, for EVO, using 4 injectors, and the functions are correct. But, we have 6 injectors, shall we make some adjustment to those numbers? I guess these numbers are simplified by some complex functions, do you know where to find the information about the formulas?

[evo_gerard]

hey guys i'm tryin to follow this tread, can u direct me to the most recent/accurate base xml and definitions. i want to make sure that i'm using the correct defs to read/flash the vr4.

[kc427]

I have logged the 3 different load in 4th gear yesterday. But I have a question about that. I used 0.2326*x for the 2byteload.

All 3 different load curves are the same below 100%, but after 100%, they all different. Does anyone know why?

[kapralchik]

hey guys, the help is necessary
Somebody knows 2-byte MAF address?
20030010 em2005

[rich]

Hello,

I recently pulled the attached rom from a 1996 Galant VR4 but the xml definitions in this thread don't seem to line up. the rom has a internal identifier of EM0005 could someone see if they can make sense of it?

Cheers,

Rich.

[kc427]

Hello,

I recently pulled the attached rom from a 1996 Galant VR4 but the xml definitions in this thread don't seem to line up. the rom has a internal identifier of EM0005 could someone see if they can make sense of it?

Cheers,

Rich.


Your VR4 is 1996? What is your ECU number? As far as I know, 1996 uses ECU with 7201 CPU, which is not flashable using EcuFlash, and it maybe the reason why it looks differently from 7202 CPU rom.

[rich]

Your VR4 is 1996? What is your ECU number? As far as I know, 1996 uses ECU with 7201 CPU, which is not flashable using EcuFlash, and it maybe the reason why it looks differently from 7202 CPU rom.

yep it's a 1996, MD340289 metal cased pfl ecu with 7201 processor. As you say it's not flashable via ecuflash - I have a different approach. I think you've seen my thread on club VR4's forums.

[kc427]

yep it's a 1996, MD340289 metal cased pfl ecu with 7201 processor. As you say it's not flashable via ecuflash - I have a different approach. I think you've seen my thread on club VR4's forums.

oh, I am sorry... but what name you use in clubvr4?

[n-j]

we have now proved that this reprograming method works and have used a re-flashed rom to start and test the car .

Has anyone got the map's worked out for the 7201 image yet ?

Rich is Kinkyafro on cvr4 (I'm nutter_john)

[n-j]

7201 is now known , see cvr4

[theboss]

For boost cut, try 1153c

Is this correct address? Updated xml files?

[VR4S]

Has anyone update the vr-4 def file with stationary speed limit ? Is it possible like the evo 6 ?

[CrAzYnSaNe]

Great work here guys :)
Keep it up.. I'm trying to keep up :/

[Wrecked]

I tried to pull the definition from a 2001 VR4 tonight without success. I tried with an openport 2.0 cable and ecuflash 1.42. It didn't work using Evo 5-6, Evo 6.5 or Evo 7-8. Any ideas what might be wrong?

It logs with EvoScan so the only other thing I can think is that the wire in the white plug is somehow disconnected.

Thanks.

[Mitsiman]

Would it be possible to get the latest updated files on this? I have some more vehicles to tune. I would be happy to do some testing at the same time on any addresses etc and provide some feedback on them as well. I don't mind spending an hour or so on the dyno testing maps to see where they work and don't work as such

[Shtiv]

Wrecked, a 2001 model would have a 7203 ecu, which means you need to use the beta version 1.43 of ecuflash. also the read file needs to have an fa instead of the f for the memmodel. Read file code like this:

- <rom>
- <romid>
<xmlid>read_EM2004</xmlid>
<make>Mitsubishi</make>
<market>JDM</market>
<model>Galant</model>
<submodel>VR4</submodel>
<year>1998</year>
<flashmethod>mitsukernel</flashmethod>
<memmodel>H8539FA</memmodel>
</romid>
</rom>

write file code like this:
- <rom>
- <romid>
<xmlid>EM2004</xmlid>
<internalidaddress>2fefa</internalidaddress>
<internalidstring>EM2004</internalidstring>
<caseid>MD340288</caseid>
<make>Mitsubishi</make>
<market>JDM</market>
<model>Galant</model>
<submodel>VR4</submodel>
<transmission>Manual/Automatic</transmission>
<year>1998</year>
<flashmethod>mitsukernel</flashmethod>
<memmodel>H8539FA</memmodel>
</romid>
<include>vr4base7203</include>
</rom>

Mitsiman, a few of us are trying hard to work on disassembly of these now, but most of us are learning (and i am behind the others - haha) so we are getting there but probably a couple of months away I suspect.

[Mitsiman]

I am working with the guys on the Clubvr4 forums as well to help sort out the def codes for these vehicles. I will do what I can to aid in this development.

[stunt]

Guys, is there Launch Control and NLTS options available for vr4 ?

[stunt]

anybody ?

[nick.jpn]

Hi dear geeks!
My MMC Galant-VR4 JDM has ECU with H8539F (id:20030011) plastic case, rom very similar to 5/6 evo. My question is: it has ALS as evo 5/6 ? And there is a possibility to make it on with alternative maps for launch ? That was like here http://www.youtube.com/watch?v=n5eLHAFp_YQ

[Mitsiman]

http://www.evoscan.com/roms/mitsubishi/index.php

Check the above link - there are some updated roms and xml's that I have been working on for the VR4 galants.

Do we have known 2 byte addresses recorded anywhere? If so let me know what htye are and I can test them and also update that database.

[nick.jpn]

http://www.evoscan.com/roms/mitsubishi/index.php

Check the above link - there are some updated roms and xml's that I have been working on for the VR4 galants.

Do we have known 2 byte addresses recorded anywhere? If so let me know what htye are and I can test them and also update that database.
It is a stock ROM's ?

[stunt]

Guys, is there Launch Control and NLTS options available for vr4 ?

[Mitsiman]

The roms I uploaded are stock roms yes.

[nick.jpn]

Guys, is there Launch Control and NLTS options available for vr4 ?
Launch - yes (released on stock RPM limit), NLTS - i'm not seen it for VR-4...

[Ganabi]

Hi Guys

Anyone know Stationary RPM Limit correct address for Galant VR4 manual, EM2004

Thanks in advance for your help

Regards,

[nick.jpn]

Hi Guys
Anyone know Stationary RPM Limit correct address for Galant VR4 manual, EM2004

Here 0x358
format - toexpr="x*31.25" frexpr="x/31.25"

[Ganabi]

can you tell me if its correct scalling and table for Stationary Rev Limit:

<scaling name="RPMStatLimit" units="units" toexpr="x*31.25" frexpr="x/31.25" format="%.0f" min="0" max="9000" inc="31.25" storagetype="uint16" endian="big"/>

<table name="Stationary Rev Limit" category="Limits" address="0x358" level="1" type="1D" scaling="RPMStatLimit"/>


If not, can you please post your version so that I can correct mine

Thanks in advance for your help

[nick.jpn]

Yeah, i'ts correct

[Ganabi]

Its not correct mate, ecuflash is not accepting 0x358

[Mitsiman]

I have just updated the following link with new updated definition files for the VR4 galants.

Combination of various sources, this forum, ClubVR4, Acamus (Great help, cannot thank him enough), Steve Knight Racing in South Australia.

I tested all the boost, fuel and ignition maps, boost limiter etc and they all worked perfectly.

I would say at this moment these are probably now the most complete and accurate definition files available for the Galant VR4 vehicles.

http://www.evoscan.com/roms/mitsubishi/index.php

[BCX]

Hi All,

I'm new to the ECU disassembly scene. I've got an 8th gen Galant VR4... and have been poking around my ROM.

Looking at Address 2D3EE, seems to be address locations various maps? (repeated heaps - 32bit addresses)

Some point to what looks to be the headers of the 4 Fuel Map tables... but there some that i dont think have been defined, and/or the vr4 def file i'm working from hasn't got them defined.

Any thoughts?

Cheers,
Bill