RomRaider

[*]Hi Guys,

I have a 2009 WRX running a 2011 AUD WRX AZ1G900C version of AijiiMod's flex fuel patch.

I am trying to re-purpose an OEM fuel pump control module common among a variety of high powered cars - part number 7W83-9D372-AA. Used in various Aston Martin/Ford/Volvo/Jaguar/Range Rover models. The fuel pump controller is inexpensive, apparently reliable and readily available second hand. It is supposedly good for 20 amps of current draw from the fuel pump.

I have considered alternative ideas such as a fast switching SSR such as the Power-IO 75A model and running that from the output of the stock Subaru FPCM, but that seems overkill in terms of cost and adds another point of potential unreliability to the system. reference thread: https://www.romraider.com/forum/viewtop ... 5&start=30.

I believe the PWM signal from the Jaguar ECU to the FPCM is about 100Hz, I'm not sure at what voltage. I have the Subaru FP pulse-width ECU address: C00A8 and can modify that to suit this fuel pump controller. https://www.romraider.com/forum/viewtop ... 5&start=30

The issue is that the Jaguar FPCM doesn't have a 1:1 pulse-width input:output translation, it's 1:2 outputting full duty cycle at 50% pulse-width input, and anything over 50% it actually cuts power to the fuel pump. So I'd like to modify the relevant ECU code to only run the fuel pump at 50% max duty cycle from the Subaru ECU which will drive the Jaguar FPCM at 100% duty cycle. This includes running the car but priming the pump and running the pump at 100% when the car is warming up as well.

I am an absolute rookie with IDA and code but have spent many days trying to work it out for myself (reading every single IDA thread I can find here) to no avail.

I know that NSFW has mentioned here: viewtopic.php?f=34&t=6356 that there are two functions which govern fuel pump duty cycle for the 06 wrx, one is the logic which switches between low/med/max duty cycle and the other is the function which switches the fuel pump duty cycle to 100% and I am hoping the latter is the fuel pump priming/warm-up code and that logic would be similar for my AZ1G900C based rom.

I have been scratching around in IDA and think that...
the low setting FPDC address is: 000438BC
the medium setting FPDC address is: 000438C0
the high setting FPDC address (when the car is warmed up) is: 000438B0

But I have no idea of where the other priming and warm-up 100% FPDC address locations are.

If anyone has the know-how in tracking down all 100% fuel pump duty cycle addresses for my AZ1G900C rom I would be very grateful.

Thanks for your time,
Nick

p.s. I've attached my ECUFlash xml file which I have uncovered many additional tables, hopefully it helps someone out

I think I found something of interest - sub_436B2 looks like it determines whether the FPDC is low/med/high



I am struggling finding the logic that governs the startup and priming function still, if anyone could give me a pointer I'd really appreciate it

If I haven't messed it up, I think this is the location for SsmGet_Fuel_Pump_Duty_P47:



Thanks a lot,
Nick

For anyone that is interested it was actually address 438B0 which controls the priming and startup FPDC value. I was testing the reduced max setting without lowering my low and medium settings which I think made the max default to 100%. When the settings made sense to the ECU then the 100% value is used to prime.

Next steps I will install and test the Jaguar FPDC and test the voltage drop vs stock in usage with my DW300

Sorry - only saw this now - I was going to say - the 3 values will be found in the same routine - from all the roms I've seen it's a float value of 100, usually very near to the low and medium duty values.

Legend, thanks td-d.

Hi Oren,

I've been testing the ECU fuel pump controller signal (green wire, pin B136 on ECU) duty cycles via scope to make sure the tables are changing the duty cycles as expected, before I install the Jaguar fuel pump on the '09 WRX - running AZ1G900C.

The Jaguar FPC utilises a 100hz PWM signal - interpolating a signal of 0-50% duty as 0-100% fuel pump voltage, anything over 50% cuts the fuel pump entirely.

Anyway, the address I thought was the value relating to the 'high duty cycle value' - 000438B0 - seems to also be a multiplier for the Low/Medium values - i.e. if I set the high duty cycle value to 50% and the low DC value is set to 15%, the measured ECU signal when the low state is being commanded measures 30% DC.

If the high duty cycle is left at 100%, low DC is 30% and the low state is being commanded the scope will see 30% DC.

I can work with this, the thing I am unable to hunt down is where the ECU code is for the priming and startup routine in relation to the fuel pump commanded duty cycle - which remains at 100% duty cycle regardless of what is set at 000438B0.

EDIT - there's a multiplier in the code (ROM:0000805C Maybe_Fuel_Pump_Duty_Multiplier:.data.l h'47800000) which seems to work as a multiplier of the final commanded duty cycle; if you leave the 'high' duty cycle setting as it is at 100(%) then the final PWM output for all states will be halved - which is exactly what the Jag fuel pump wants to see.

Because the PWM input of the jag is high by default (opposite of Subaru FPC) you need a simple signal inverter made with a handful of transistors/resistors, see image below.



The result is that you now have a FPC that can handle 20A all day and is actually variable / tuneable; the stock subaru FPC limits the outputs to ~ 0,58,73,100% duty (i.e. it doesn’t matter if you have 66.6666% or 80% duty cycle you will still get the 73% duty output, I’ve tested the output on a scope)

Hope this helps someone out there!

Can someone please help me find this 'Multiplier' address in the A2ZJE11J Rom (06 STI). I've blindly gone forward and wired up two of these Fuel Pump Controllers (lift and surge tank), but now haven't the right scaled Duty cycle to send it.
Willing to pay a bounty if someone can help Thanks!

Stok rom upload

Thx cortin, shoot me a PM when you've had a chance to take a look.
I've spent a few days writing an Arduino program to half the duty cycle, but it's fairly choppy and I don't trust it. Would much rather connect straight to the ECU.

Multiplier Value referred to above is: B30C

Fuel Pump Duty 'High' Address is: 34D78

Additionally:

You guys are a god send! As I sit here trying to fine tune my ISR on the Arduino, I'll go try this instead.
Thanks so much, Lorax, let me know if you want anything for your time.

EDIT: Had to use different scaling to get the tables to match what AccessTuner shows.


Still looking for this 'Multiplier' that No-tates found. I looked in his ROM at that address, and it's value is 65,536 rawecuvalue. I think he mentioned as well that this is different than the 100% Max Duty, and has a different effect.

Also:

See above amended post. My bad, I gave you 100% max duty, not the multiplier.

I'd still be sunk without your help. Can finally test drive my car.
Many thanks.

No troubles, let us know how it goes!