I haven't posted here in years! Recently, I have made major leaps and bounds with decoding the Legend's ECU. To sum it up, I've got a full commented dis-assembly with the master program stack and "engine running" stack identified and quite a few of the many programs identified. I started by reverse engineering the A/D, check engine light and limp mode routines. From there I was able to find the variables for the high and low limits of all of the sensors, the substitute values for when a sensor fails and most importantly, the location of all of the major sensor values in RAM. I was able to write a primitive program that hijacks the serial port and logs those values one at a time in raw hex. I've also identified just about all of the program switches and have the ability to turn off various sensors and their associated CEL's - Knock, EGR, Oxygen (OPEN LOOP!), Fuel Injector and Barometric Pressure sensors.
Hardware & software wise, I'm running a Moates Ostrich emulator with a trace feature. I use this in conjunction with TunerPro RT program by Mark Mansur and a custom definition file I've brewed. This allows real time tuning and modification and pseudo datalogging with the trace feature activated. I've got hand drawn schematics of the A/D converters, and hybrid ROM setup, datasheets (and programming manual for the MCU) for most of the ICs on the board and a good idea of what they do. I also have a kick ass custom made engine simulator set up on my bench for more invasive testing. This is my favorite hobby and I probably wont stop until I know what every byte in the RAM and ROM does in this ECU .
What I've learned with the Legend's ECU directly ports to the 90-93 NSX's ECU, as they are set up almost identically. The ignition, fuel and other maps as well as the variables and most importantly, the sensor values, are in the same locations in ROM & RAM. These engine computers could be considered sisters (I need more information about the drive by wire ECUs). For instance, there are a handful of Legend owners that use the NSX specific EMS as a plug and play system - I think 3 wires have to be swapped around in order to make it work.
These Panasonic made ECUs were way ahead of their time and I admire everything about them. From the near military grade construction to the elaborate hybrid memory setup to the lengths that were taken for proper ground shielding. Even the assembly language used to code is eloquent. There are 6 individual coil pack and fuel injector drivers, individual banked feedback oxygen and knock sensors, and provisions for communicating with the traction control and auto transmission for torque reduction. Many features aftermarket computers lack. They used a top of the line Hitachi h8 16bit RISC processor and in the early 90's this single chip alone cost upwards of $500.00. The descendants of these processors are still used today.
My primary goal with this ecu is to have some or all of the features of an aftermarket engine management system with no piggyback controls or external modifications. I'd like to follow in the footsteps of the grassroots movement a few years ago to reverse engineer the OBD1 civic & integra ECUs (www.pgmfi.org). They have proven without a doubt that the stock engine computer can be tuned for any setup. Although those ECUs use a completely different processor and manufacturer, the same general idea applies.
The main items on the agenda are:
1. Tune in high resolution for boost.
2. Complete realtime datalogging with integration into tunerpro.
3. Retained function of the traction control and automatic transmission.
4. Use a modified PWM output as a boost controller.
5. To have it pass emissions.
6. Add sensors such as EGT and wideband o2 to be datalogged.
My current problem is time. I started this project years ago when I had a lot more of it. I now own & operate a full service Acura Legend specialty shop in Bristol, CT. Now that the shop has picked up I don't have as much time as I used to. It's the worst catch 22. Lately it seems this is universal to life in general - when I had the time I didn't have the knowledge and now that I have the knowledge I don't have the time. I have been staying up sometimes until 4 in the morning playing with this ECU which hasn't made me too popular with my girlfriend. I've determined that I'm addicted to it!
I have thousand of hours invested into this project, I've taught myself how to read assembly and learned quite a bit about embedded systems in the process. I need some help from the members on this forum. One of the major cornerstones to a successful reverse engineering project is the ability to compare and contrast. I need dumps of the stock 27C256 chip from year to year, and most importantly from region to region - European and Japanese at the least. I need a working stock NSX ECU that I can hook up to my engine simulator to do tests on. I also need a broken NSX ECU that I could render even more useless to do an MCU dump on. I would like to examine the ECUs used on the drive by wire setup on the (94+?) NSX's - it would be nice at the very least to see a high resolution photo of the inside of it. I need to know if there are any old school ASM programmers on here that might be willing to help with some of the coding. Basically I'd like to start a network with you guys and go from there.
Please let me know if you are interested and what you can do to help.
Cheers!
-Matt
Hardware & software wise, I'm running a Moates Ostrich emulator with a trace feature. I use this in conjunction with TunerPro RT program by Mark Mansur and a custom definition file I've brewed. This allows real time tuning and modification and pseudo datalogging with the trace feature activated. I've got hand drawn schematics of the A/D converters, and hybrid ROM setup, datasheets (and programming manual for the MCU) for most of the ICs on the board and a good idea of what they do. I also have a kick ass custom made engine simulator set up on my bench for more invasive testing. This is my favorite hobby and I probably wont stop until I know what every byte in the RAM and ROM does in this ECU .
What I've learned with the Legend's ECU directly ports to the 90-93 NSX's ECU, as they are set up almost identically. The ignition, fuel and other maps as well as the variables and most importantly, the sensor values, are in the same locations in ROM & RAM. These engine computers could be considered sisters (I need more information about the drive by wire ECUs). For instance, there are a handful of Legend owners that use the NSX specific EMS as a plug and play system - I think 3 wires have to be swapped around in order to make it work.
These Panasonic made ECUs were way ahead of their time and I admire everything about them. From the near military grade construction to the elaborate hybrid memory setup to the lengths that were taken for proper ground shielding. Even the assembly language used to code is eloquent. There are 6 individual coil pack and fuel injector drivers, individual banked feedback oxygen and knock sensors, and provisions for communicating with the traction control and auto transmission for torque reduction. Many features aftermarket computers lack. They used a top of the line Hitachi h8 16bit RISC processor and in the early 90's this single chip alone cost upwards of $500.00. The descendants of these processors are still used today.
My primary goal with this ecu is to have some or all of the features of an aftermarket engine management system with no piggyback controls or external modifications. I'd like to follow in the footsteps of the grassroots movement a few years ago to reverse engineer the OBD1 civic & integra ECUs (www.pgmfi.org). They have proven without a doubt that the stock engine computer can be tuned for any setup. Although those ECUs use a completely different processor and manufacturer, the same general idea applies.
The main items on the agenda are:
1. Tune in high resolution for boost.
2. Complete realtime datalogging with integration into tunerpro.
3. Retained function of the traction control and automatic transmission.
4. Use a modified PWM output as a boost controller.
5. To have it pass emissions.
6. Add sensors such as EGT and wideband o2 to be datalogged.
My current problem is time. I started this project years ago when I had a lot more of it. I now own & operate a full service Acura Legend specialty shop in Bristol, CT. Now that the shop has picked up I don't have as much time as I used to. It's the worst catch 22. Lately it seems this is universal to life in general - when I had the time I didn't have the knowledge and now that I have the knowledge I don't have the time. I have been staying up sometimes until 4 in the morning playing with this ECU which hasn't made me too popular with my girlfriend. I've determined that I'm addicted to it!
I have thousand of hours invested into this project, I've taught myself how to read assembly and learned quite a bit about embedded systems in the process. I need some help from the members on this forum. One of the major cornerstones to a successful reverse engineering project is the ability to compare and contrast. I need dumps of the stock 27C256 chip from year to year, and most importantly from region to region - European and Japanese at the least. I need a working stock NSX ECU that I can hook up to my engine simulator to do tests on. I also need a broken NSX ECU that I could render even more useless to do an MCU dump on. I would like to examine the ECUs used on the drive by wire setup on the (94+?) NSX's - it would be nice at the very least to see a high resolution photo of the inside of it. I need to know if there are any old school ASM programmers on here that might be willing to help with some of the coding. Basically I'd like to start a network with you guys and go from there.
Please let me know if you are interested and what you can do to help.
Cheers!
-Matt
Last edited: