RomRaider

Here's the results so far. I tried two times - so I could get two different screenshots.

Log attached aswell.

TCU ID - 99AE203000

Used FastECU_34_short

Thanks. Looks like it is talking CAN ok, but the responses got out of sync with the commands. I'll post up another version with different delay timing.

@riksk & @AJ08H65EAT - there is an updated FastECU_34_short.exe in the repo to try. Thanks!

iso15765 ROM dumping is basically working (just need to iron out decryption). Which means that ROM upload & flashing is close. The first thing to try will be flashing an unchanged ROM.

I'm assuming the first things to tune are the gear shifting tables, so I'm starting to think about how to extract that data from the ROM, enable changes and fix ROM checksums.

Attaching the log from that version. I got a different TCUID from that reply now?

Thanks for the update - another log file attached to investigate. On the topic of tuning, the factory lock-up control is exceptionally slippy - seems to extend over a number of seconds - which per FSM is 'Smooth control - In lock-up clutch engagement, gradually changes pressure to provide smooth engagement.' I would say the gradual is about 5 or 10 times slower than it should be. Not sure how hard it is to locate those tables.

Thanks all.

@riksk - I'm changing the IDs to match the ECU approach (ECU IDs and CAL IDs). This will be changed in the next version. CAN comms is now working correctly with your ROM, but security access is failing probably because you have different encryption words. Can you try again but this time use the select button to select the Kline approach. This will attempt a ROM dump. This works for some TCUs and is locked down for other TCUs.

@AJ08H65EAT - it looks like everything is working based on the log. Could you please post up the default.bin file so I can check that the decryption is working.

Thanks!

Sorry, forgot that part. Just sent via PM

No worries. There's a new version in the repo to try.

The other fun aspect to this is manipulating the tables. The TCU uses a different table format, so it doesn't automatically work with RR editor. So, instead the TCU tables need to be reconstructed in ECU format in a temporary bin file, which can then be manipulated in RR. Here's my first attempt at that as a preview. Plenty of headaches getting this to work, but finally got something workable...

What's the differences in table format? Should be easy to fix to work straight in FastECU and why not in RomRaider too.

If the tables are so different I guess changes would be necessary software-side

Thanks to RR Open Source, it's do-able.

I don't think my coding skills are up to editing RR. And I figured if I got it working in an unedited RR it would then also work in FastECU.

But I'd be more than happy for someone to do the required coding! Although it would be good to fix the FastECU crashes first.

Summary of Table differences...

ECU
- tables have a table header with number of items, data type, pointers to table data. This makes the table data 'clean' (not mixed with other data)

TCU
- no table header, only a pointer to the start of the data
- some tables have the number of elements at the start of the data. Other tables are terminated with 0xffff to signify end of data
- arrangement of data varies. 2D table data is generally intermixed (ie) x1, y1, x2, y2 and so on. 3D table data is generally split into the columns (ie) d11, d12, d13, d21, d22, d23, d31, d32, d33 where dxy means data item y in column x.

@riksk - did you have a go with the KLine version? I'm trying to see if we can access a broader range of TCUs, which will hopefully make all this effort applicable to more folks.

If you managed to edit the bin file to work with RR, that's one hard approach. Editing the software would be easier imo, haha.

Here's the log file from using Kline. It dumps just ffff's.

I will try to get few crashpoint fixed tonight so you can add them to test codes. Also need to check few other things after that with ECU on bench. Can you send me TCU ROM you are using and point few table locations/format so I can test some table parsing code after that?

Hi @MiikaS, sounds great.

I have been using ACD1A06000 from page 3(?) of this thread.

The shift table pointers start at 0x180e8. The first lot of data is at 0x0001683c. The data is structured as words (uint16) in pairs of x, y. x is the Vehicle Speed in km/hr. y is the Accelerator Pedal Angle in % where 0xff = 100%. The data is terminated by 0xffff.

Doing each table as a 2D table is a start. Ideally the software would construct a chart like this...



Thanks @riksk - looks like your ROM won't expose your encryption words, maybe like @ajayel. @ajayel is trying one possible alternative approach. Let me think about other techniques...

I want to change 5h gear to 3rd gear downshift and lockup durations.

On this table, I think there is something missing because when the load changes, transmission behavior also changes indepentent from speed. (I think)

On ECU, If you change the cl fueling compensation table, transmission behavior also change.

All related each other and tuning will be much complicated than changing some parameters.