Hi all. Not trying to make my first post particularly controversial... does anyone have any information about what locations do what in the Z32 EPROM? I recently had the chance to dump out a couple of non-standard chips, one of which has 3 selectable maps. If it's likely to be a help to the 300 community I'd like to propose posting these dumps somewhere for all to examine, maybe building up a database to see who's doing what in their "performance" mapping. If anyone's worried about piracy, I can list these in a format that can't be directly imported into an EPROM programmer. I s'pose, technically, anyone making a new map is infringing Nissan's copyright anyway by starting with the original ROM contents.

 

So... thoughts?

Contact AshZ from twinturbo.net. He is a fab-whore, programer-supreme and has a PC integrated into his Z. You can contact him via his website I think, http://www.ashleypowers.com

 

Hope that helps.

Wow! The guy is completely bonkers! Top site tho. Thanks for the tip.

...he could only offer limited advice because he makes money from custom mapping. I s'pose it's fair - he's gone to a lot of effort to disassemble the ROM contents.

 

Any other techie guru's around?

That might help you

 

http://www.925style.com/edittool_vb.html

 

Zee you

51x Send me a mail mate, have some stuff you might be interested in.

chris.carter@orange.net

H,

 

The software that link points to looks promising. But, unless I'm just not waiting long enough, they haven't sent a username and password for the download. Now I'm worried it's a hoax and I'm gonna get a ton of spam. Have you had any better luck with it?

Originally posted by 51x

H,

 

The software that link points to looks promising. But, unless I'm just not waiting long enough, they haven't sent a username and password for the download. Now I'm worried it's a hoax and I'm gonna get a ton of spam. Have you had any better luck with it?

 

Yeah, I got it, no spamming at all

The owner had to put the login+pass because some guys on e-bay was (were) reselling it, while it's a free software !!

 

Zee you

 

Henri

I got a username and password within a minute of sending. havent installed the application yet thou.

 

Si.

OK. I've got it now (cheers guys). I got it sent to a different account. Something weird going on there, but never mind. So... it does look pretty good! It even has a compare mode and 3D editing! This is what I was after. The English translation is fairly entertaining too. Not sure it likes Win2K too much, but I can probably dig up a Win95 machine from somewhere.

 

Cheers for the link H. I'm off to play with some numbers :D

Well, I'm gonna tell you anyway ;)

 

There's a nice mailing list at: http://www.diy-efi.org - lots of interesting stuff. If you do a search for 300zx or Z32 you'll find there's been some discussion about the Z32 EPROM.

 

From diy-efi I find the main processor in the ECU is a Hitachi 6303, which is an 8-bit Motorola 68xx derivative with some extra functionality, in particular: multiply and divide instructions. They also mention a suitable disassembler: DASMx 1.3 which can handle 6303 disassembly (among other things).

 

From much fiddling around with ROM Editor (cheers Henri), then later simply looking at the Z32 ADR file (doh!) I made a list of what addresses in the ROM relate to what maps and other settings. There still seems to be some large data areas in the ROM that the editor doesn't address. I don't have a clue what these are for (does it matter?).

 

Next, I mess around with the disassembler. From the address list, I make a rough SYM file so the disassembler can code-thread it's way through the ROM and sort out what's code and what's data. The SYM is based on the MOT 6803 (mainly for the hardware entry points), but the disassembly seems to look OK with ROM Editor based labels for the data sections.

 

Then I try looking at some ROM dump disassembly in more detail. Specifically, I'm comparing an SE chip to 3 switchable pages from a MINE'S ECU - it has the potential for 4 pages, but the 3rd and 4th are the same. And so... a few (possibly) interesting points:

 

.the "useful" data section of the ROM is the last 4 Kbytes (of 32K). There's some small data entries embedded below that, but mainly it's code (or reserved for code).

 

.the 1st MINE'S map has the speed limit set to 184 kph (114 mph). This makes me think it's based on original Jap contents. The 2nd and 3rd are set to 510 kph (317 mph) - a bit ambitious maybe ;). SE set theirs to 476 kph (296 mph).

 

.all the MINE'S maps have a rev limit of 7000 rpm. SE's is set to 7400.

 

.MINE'S do something rather strange with their low-octane ignition time map - there's a big peek at 800 rpm for some reason. Maybe it's a hangover from the original (Jap?) contents? It's not in the SE ROM.

 

.all the maps have 16 programmable rpm thresholds. All are set at 400 to 6400 in 400 rpm steps. They don't /have/ to be tho. Theoretically, you could concentrate more detail around a certain rpm range by closing down the thresholds. There's actually two of these threshold tables, although ROM Editor only accesses one of them.

 

.In the SE ROM the first 3 fuel maps (low, reg, high: F000-F2FF) are identical. In the MINE'S ROM these are each different. The 4th (FD00-FDFF) in the SE ROM is different to the first 3 maps. I don't fully understand why the ECU would have different fuel octane maps, but maybe the ECU attempts to select an appropriate map (or pair of maps, including the timing map) based on knock-sensing. How would it know the fuel octane rating otherwise?

 

.Most surprising to me: the *code* in the MINE'S and SE ROM is different. The MINE'S pages all have identical code, but relative to the SE ROM they have stuff missing (1st free byte in MINE'S: DBFA; SE: DCE6 - just after the SWI and NMI entry points). It's a bummer really, cos it means you can't switch pages between MINE'S and SE on the fly without running the risk of crashing the processor. I s'pose it's only a matter of doing a cut'n'paste with the code from one ROM and the data from the other. But still, I'd like to know why they're different.

 

 

And that's about it for the moment. There's still a lot I'd like to know, particularly about all the (non-map) stuff ROM Editor can edit. If anyone's willing to host it, I'd happily share my address list, the disassembler, my SYM file and the ROM Editor (although it's probably best just to post a link to the main host). I was also thinking of doing a: "how to make a 2 page switchable ROM" based around a 27C512... and a switch. It's /real/ tricky stuff (not). I bought some the other day cos they're actually cheaper than blank 27C256's (wot the ECU has already got), and they're pin-compatible. Might be nice to have a "conservative" map built in (with speed limit set to 70 mph and rev limit set to 4000 rpm) for those times you /have/ to leave your motor with the missus - and a second key like Corvettes used to have ;).

 

 

Anyone still awake?

Yup !

 

One of the tricks they use is to offset the maps, don't ask me how though.

 

Also there are several different SE maps, plus the true custom stuff obviously. Do you know which one you have ?

Offset the maps?

 

I think it was marked: SE_Z32A.470. I don't have it here to check unfortunately. It's for a UK spec auto - maybe that's what the "A" is for?

 

Looking forward to my custom map... and getting my car back in a few months :(

That's really interesting stuff. I expect the code differences are indeed for different models.

 

Not sure if SE continue to use the same naming convention but, if so, I believe that the one you have will be for an auto which achieved 470 bhp on the rolling road.

 

Dave

Dunno if it was as much as 470 bhp Dave. I should've asked Pete this morning - I dropped in to give him the nod (wink and gun). I'm still feeling a bit sick about parting with all that cash. It'll be worth it tho (repeated over and over in my head).

Am i correct in saying the SE unit is a derivative of the JWT unit?

And if mines have a 7000rpm revlimit then they forgot to put it on my unit lol because ive been on the far side of 8k already (accidently lol)

Originally posted by 300z

Am i correct in saying the SE unit is a derivative of the JWT unit?

And if mines have a 7000rpm revlimit then they forgot to put it on my unit lol because ive been on the far side of 8k already (accidently lol)

 

No Warren, the SE is from scratch. Well, my one was anyway as I was there when it was done.

I'm pretty sure SE wouldn't have knocked-off the JWT chip. But I haven't seen the JWT contents yet. I know Pete's put in a lot of work to make a good map - lots of testing on rolling roads, and real ones. I'd heard the JWT maps are more conservative to comply with US emissions. But maybe that's a rumour. In both cases, it's only the EPROM that's different - the ECU is the standard unit with a socket fitted. But you know this already and you totally know how to suck eggs (sorry).

 

I've no idea how old this MINE'S thing is. It's probably not their current VX-ROM - I dunno if that's what you've got. Let me have a look at the contents and I'll see what your limit should be ;)

 

I'd heard it's possible to fling an engine above it's rev limit by, say, missing a gear on hard accelleration. It's all momentum and stuff, right?

how did you get the mines info then as having spoken to the dealers here andin Japan if you open the ecu in any form or another you damage them?

just interested to know your means?

And what does suck eggs mean? I asked a question because from when i was at the SE open day - i was under that very impression , just as im sure everyone else who was there were aswell?

Hmmm

Originally posted by 300z

Am i correct in saying the SE unit is a derivative of the JWT unit?

And if mines have a 7000rpm revlimit then they forgot to put it on my unit lol because ive been on the far side of 8k already (accidently lol)

 

Nope, definitely not. The SE chip is based on a late model Nissan map, I think Pete said it was something like a '94.

 

And for the mysterious 51x:

By offsetting the maps I mean that sometimes the parameters that are changed in the engine would take the map off the edge of the data space available. So what they do is offset the map such that, for example the area that would cover the rev range between 500 and 1500 is not used and the whole lot is shifted up to enable mode detail in the 6500-8000 range. Not a good example, but I guess you get the idea.

 

Also, was just thinking about this earlier today whilst seeing a Boxter disappear in my mirrors at an indicated 165 (!) - what is the purpose of the high and low octane maps ? Could the low octane one be used after knock has been detected, as a safeguard to prevent engine damage ?

OK, it's not an insult. It comes from the expression: "teaching your granny to suck eggs", ie. telling someone all about something who could probably write a book on it already. No offense intended.

 

Ignorance being bliss (another cr*ppy expression), I hadn't heard I could bust the ECU by opening it... so I just opened it! The original EPROM was removed and a little adapter was soldered in place with a 27C1001 (1 Mbit EPROM) sat in a socket. I popped it out, stuck it in my home-made EPROM reader and dumped the contents. The 1001 being 4 times the size of a 256, I assumed they'd made 4 pages. There's some small IC's on the adapter board (with the numbers rubbed off) that handle the page selection. I'm told there should've been an extra box that you use to select the page with - it connects via 3 wires to the adapter board. I didn't have this tho.

 

I've connected it all up since and the ECU is still working fine - on the one page I could run it without the selector.

 

I've not done anything spectacular (apart from the EPROM reader - which is f'kin spectacular! :D ). I don't have a mate at MINE'S or anything like that.

Originally posted by 51x

OK, it's not an insult. It comes from the expression: "teaching your granny to suck eggs", ie. telling someone all about something who could probably write a book on it already. No offense intended.

 

Ignorance being bliss (another cr*ppy expression), I hadn't heard I could bust the ECU by opening it... so I just opened it! The original EPROM was removed and a little adapter was soldered in place with a 27C1001 (1 Mbit EPROM) sat in a socket. I popped it out, stuck it in my home-made EPROM reader and dumped the contents. The 1001 being 4 times the size of a 256, I assumed they'd made 4 pages. There's some small IC's on the adapter board (with the numbers rubbed off) that handle the page selection. I'm told there should've been an extra box that you use to select the page with - it connects via 3 wires to the adapter board. I didn't have this tho.

 

I've connected it all up since and the ECU is still working fine - on the one page I could run it without the selector.

 

I've not done anything spectacular (apart from the EPROM reader - which is f'kin spectacular! :D ). I don't have a mate at MINE'S or anything like that.

he he none taken lol, im a bit in the dark with most expressions in English lol.

 

 

Well thats interesting to hear lol, cool bananas on the mines thing.I guess they just tell everyone that lol.

By the way this is all very interesting.

300z: Phew! Desperately trying not to p*ss anyone off - I've already been banned from here once... for saying *nothing* (I think)! Now I'm sure I'm gonna get banned for boring everyone into a coma. Oh, and there's no need to take the p*ss, saying this stuff is interesting! :P Cool bananas?! LOL!

 

AndyP: Nothing mysterious... I'm a bloke with a car that jerks off over tables of hex numbers.

 

I totally get what you mean about offsetting maps now. Sorry, my brain fell out and rolled under the bed. It's actually quite easy to do with the Z32 ECU data cos each map is only a 16 by 16 table of 8-bit numbers (256 bytes), and the RPM thresholds are defined in a seperate 16-byte list. In your example (not that bad at all) you'd simply lop a couple of lines off the start of the table (32 bytes) then add your new data (32 bytes) at the end of the table. Then you remove the 1st two bytes in the RPM threshold list and tack the two new upper limits on the end. Job done. It has the effect of appearing to move the 3D graph toward you (in ROM Editor) in the rev-range scale and adding new data. But in reality, you're actually shifting the mapping window (away from you). Relativity... hmm.

 

165? Oops ;) That's kinda what I was thinking about the octane maps. But to add to the confusion (there must be someone who knows about this!) there's actually 3 fuel maps (lo, mid, hi). I did have a brief word with Pete about this in the morning. As far as he's concerned, "safety boost" is not present in UK spec cars - the ECU *can't* control the boost level. But it can (obviously) retard the timing, and that is somehow triggered by the knock sensor. It came up cos I'm kinda thinking maybe my sensor's f'k'd and worth changing when he does all the other work. Maybe there's some clever(?) way the ECU could do it, but it's probably simpler to switch down to a safer map (with retarded timing) and see if the knocks are still present. If they are, switch down to an even safer one. I really dunno. I'm making a big guess.

 

Anyway Mr AndyP, did you wanna host my crud on your site? As if I hadn't already put enough text in this thread, this is the address list with ROM Editor's labels:

 

 

Breakdown of the Z32 EPROM addresses, from accesses made by ROM EDITOR 1.98.48

------------------------------------------------------------------------------

 

Note: these are addresses relative to the start of the EPROM (at 0000). The HD6303 processor sees the EPROM start at address: 8000 - the upper 32 Kbytes of the 64 Kbyte address space. So in disassembly, the following addresses will be found at F000 onwards. The low 32 Kbytes has hardware registers (and RAM? - dunno how much) mapped to it.

 

 

7000-70FF *: Low octane fuel map {8bit ON, 7bit ON}

7100-71FF *: High octane fuel map (more than gear position 4) {8bit ON, 7bit ON}

(7200-720F: Acceleration increase volume (?!) ...and also...)

7200-72FF *: Regular fuel map (more than gear position 4) {8bit ON, 7bit ON}

 

 

7800-78FF *: High octane ignition time (also High-octane ignition time map (more than gear position 4)) {8bit ON, 7bit OFF}

 

7940-795F: Idol stabilization control MAX [all 0]

7960-796F: TP Limit

 

79E3-79EB: Knock limit

 

7A70-7AAF #: VQ map [a nice smooth curve from 48 to 65535]

 

7AF0-7AFF: Boost

 

7B00-7B0F: Fuel RPM thresholds (lowest to highest) - steps of 50 RPM [400 - 6400 in 400 RPM steps]

7B10-7B1F: Another set of RPM thresholds (not accessed by ROM EDITOR)

7B20-7B2F: Ignition time RPM thresholds (lowest to highest) - steps of 50 RPM [400 - 6400 in 400 RPM steps]

7B30-7B4F: Water temperature conversion table

 

7C00-7CFF *: Low octane ignition time {8bit ON, 7bit OFF}

7D00-7DFF *: High octane fuel map {8bit ON, 7bit ON}

 

7E80-7E8F: TTP MIN

7E90-7E9F: TTP MAX

 

7F2B-7F2C: K required number (hi-byte, low-byte) [0120]

 

7F88: Void blast-off time [4B]

 

7F91: Feedback control [64]

 

7FA5: Speed limit - steps of 2 KPH [EE = 476 KPH]

7FB4: RPM limit - steps of 50 RPM [94 = 7400]

 

 

# = 2D map

* = 3D map: load-min: xxx0 to load-max: xxxF; RPM min: xx0x to RPM max: xxFx

{} = use these settings in ROM EDITOR's 3D edit mode

[] = typical settings

= ROM EDITOR tab identification

I'd be happy to host stuff that does not violate other peoples intellectual property or copyright, generally my site is just an index or directory so I don't have to worry about that, but I'd be happy to discuss it in more detail if you're interested.