|
RomRaider
Documentation
Community
Developers
|
| Author |
Message |
|
rimwall
|
Post subject: Re: 5EAT TCM JECS ROM Image  Posted: Fri Oct 27, 2023 1:44 am |
|
 |
| Experienced |
Joined: Fri Aug 21, 2020 6:05 am
Posts: 315
|
|
As an update, the current focus is on possible levers to increase shifting times. It looks like there are tables with a number of steps for each gear shift (eg: 4th to 5th, 3rd to 4th) and each direction (brake or clutch engaging or disengaging). Pressure is changed based on the number of steps (the less steps, the faster the change). There is a huge amount of complexity how the pressure is controlled through the various states from fully disengaged to engaged or vice versa (each brake / clutch can be in any one of ~70 states). I guess it's not surprising given that engaging and disengaging the brakes and clutches is the core function of the TCM. In any case, it's gradually unravelling with help from @ajayel's logging data.
|
|
| Top |
|
 |
|
V6er
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Fri Oct 27, 2023 5:30 pm |
|
|
| Newbie |
Joined: Wed Oct 16, 2019 2:25 pm
Posts: 53
|
you ment DEcrease shifting times, right?  ) how are those ~70states "measured" (for lack of better word)... ? only by current on solenoids? p.s. can you tell us some statistics on firmware? how many tables, routines, constants, datastructures or something like that. unfortunately - I am not smart enough to be able understand it fully, but it interests me very much
|
|
| Top |
|
|
|
rimwall
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Fri Oct 27, 2023 10:08 pm |
|
|
| Experienced |
Joined: Fri Aug 21, 2020 6:05 am
Posts: 315
|
|
Yes, oops, definitely decrease.
The states are phases of a brake/clutch's engagement or disengagement. 35 states x 2 (for phase start and then phase continuation)
Tables: 1,883 so far (only a handful RE'd)
Routines: 2,413 so far (of which I have RE'd 1,416). I've RE'd most of the operational ones. I'm not bothering with startup/SSM/CAN/bootloader because I've done this in other ROMs.
RAM variables: a guess is 5,000+, of which I have RE'd 2,339
|
|
| Top |
|
|
|
rimwall
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Tue Oct 31, 2023 2:57 am |
|
|
| Experienced |
Joined: Fri Aug 21, 2020 6:05 am
Posts: 315
|
|
An interesting discovery...
FreeSSM could be used to 'tune' various 4AT parameters (see screen grab), but couldn't tune 5EAT parameters.
However, the 5EAT ROM *does* have the ability to enter similar parameters - pressure corrections for each clutch (IC, DC, HLRC) and each brake (FB, FwdB, LCB) and the 4WD at a specified temperature. 8 inputs in total. Is this of any interest to folks....?
You do not have the required permissions to view the files attached to this post.
|
|
| Top |
|
|
|
rimwall
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Thu Nov 02, 2023 12:49 am |
|
|
| Experienced |
Joined: Fri Aug 21, 2020 6:05 am
Posts: 315
|
|
Digging through the code a bit more, the TCU data that can be entered essentially overwrites the values from the TCU relearn process.
This could mean they can be used to produce 'harsher' but therefore faster shifts... we just need someone to try them to find out what they do.
|
|
| Top |
|
|
|
jimihimisimi
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Thu Nov 02, 2023 12:49 pm |
|
|
| Newbie |
 |
Joined: Tue Apr 05, 2022 12:57 pm
Posts: 58
|
rimwall wrote: Digging through the code a bit more, the TCU data that can be entered essentially overwrites the values from the TCU relearn process.
This could mean they can be used to produce 'harsher' but therefore faster shifts... we just need someone to try them to find out what they do. Fascinating. I am willing to pull the current values, but I would like to compare against someone else's before just pushing random values
_________________
2000 Subaru Impreza 2.5RS EJ251 5MT TY754
2005 Saab(aru) 9-2x Linear EJ253 5MT TY754
2014 Subaru Tribeca EZ36D 5EAT TG5D
|
|
| Top |
|
|
|
rimwall
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Fri Nov 03, 2023 12:11 am |
|
|
| Experienced |
Joined: Fri Aug 21, 2020 6:05 am
Posts: 315
|
|
Ok, an updated FastECU v0.22 (in the precompiled folder of the development branch) has a trial to read these 'hidden' parameters. It will only read them at this stage.
Use the same procedure as a TCU ROM dump. You will get a message box with 3 choices. Pick 'params' and post up the results. I think I have the SSM commands right, so hopefully it will pull some data.
The more folks that do this, the better, so we can compare.
|
|
| Top |
|
|
|
jimihimisimi
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Fri Nov 03, 2023 10:41 pm |
|
|
| Newbie |
|
Joined: Tue Apr 05, 2022 12:57 pm
Posts: 58
|
rimwall wrote: Ok, an updated FastECU v0.22 (in the precompiled folder of the development branch) has a trial to read these 'hidden' parameters. It will only read them at this stage.
Use the same procedure as a TCU ROM dump. You will get a message box with 3 choices. Pick 'params' and post up the results. I think I have the SSM commands right, so hopefully it will pull some data.
The more folks that do this, the better, so we can compare. Got the "TCU Operation Failed" Popup, see console output below: Code: [2023-11-04 02:36:34.832] Attempting to read TCU parameters
[2023-11-04 02:36:37.082] Commencing to read TCU parameters, please wait...
[2023-11-04 02:36:37.088] Reading TCU parameters...
[2023-11-04 02:36:37.112] Sent: 00 00 07 e1 a8 00 00 01 6c 00 01 6d 00 01 6e 00 01 6f 00 01 70 00 01 71 00 06 f0 00 06 f1 00 06 f2 00 06 f3
[2023-11-04 02:36:37.118] 0: 0xA8 response: 00 00 07 e9 7f a8 12
[2023-11-04 02:36:37.128] Sent: 00 00 07 e1 a8 00 00 01 6c 00 01 6d 00 01 6e 00 01 6f 00 01 70 00 01 71 00 06 f0 00 06 f1 00 06 f2 00 06 f3
[2023-11-04 02:36:37.135] 1: 0xA8 response: 00 00 07 e9 7f a8 12
[2023-11-04 02:36:37.146] Sent: 00 00 07 e1 a8 00 00 01 6c 00 01 6d 00 01 6e 00 01 6f 00 01 70 00 01 71 00 06 f0 00 06 f1 00 06 f2 00 06 f3
[2023-11-04 02:36:37.149] 2: 0xA8 response: 00 00 07 e9 7f a8 12
[2023-11-04 02:36:37.149] Sent: 00 00 07 e1 a8 00 00 01 6c 00 01 6d 00 01 6e 00 01 6f 00 01 70 00 01 71 00 06 f0 00 06 f1 00 06 f2 00 06 f3
[2023-11-04 02:36:37.165] 3: 0xA8 response: 00 00 07 e9 7f a8 12
[2023-11-04 02:36:37.176] Sent: 00 00 07 e1 a8 00 00 01 6c 00 01 6d 00 01 6e 00 01 6f 00 01 70 00 01 71 00 06 f0 00 06 f1 00 06 f2 00 06 f3
[2023-11-04 02:36:37.180] 4: 0xA8 response: 00 00 07 e9 7f a8 12
[2023-11-04 02:36:37.190] Sent: 00 00 07 e1 a8 00 00 01 6c 00 01 6d 00 01 6e 00 01 6f 00 01 70 00 01 71 00 06 f0 00 06 f1 00 06 f2 00 06 f3
[2023-11-04 02:36:37.195] 5: 0xA8 response: 00 00 07 e9 7f a8 12
[2023-11-04 02:36:37.197] Input Clutch Pressure Correction (raw byte): 168
[2023-11-04 02:36:37.199] High Low Reverse Clutch Pressure Correction (raw byte): 18
[2023-11-04 02:36:37.202] Direct Clutch Pressure Correction (raw byte): 0
[2023-11-04 02:36:37.204] Front Brake Pressure Correction (raw byte): 0
[2023-11-04 02:36:37.206] Correction of AWD Clutch Torque (raw byte, high): 0
[2023-11-04 02:36:37.211] Correction of AWD Clutch Torque (raw byte, low): 0
[2023-11-04 02:36:37.214] Forward Brake Pressure Correction (raw byte): 0
[2023-11-04 02:36:37.216] 4WD Pressure Correction (raw byte): 0
[2023-11-04 02:36:37.218] Low Coast Brake Pressure Correction (raw byte): 0
[2023-11-04 02:36:37.219] Temperature basis for all above Corrections (raw byte): 0
_________________
2000 Subaru Impreza 2.5RS EJ251 5MT TY754
2005 Saab(aru) 9-2x Linear EJ253 5MT TY754
2014 Subaru Tribeca EZ36D 5EAT TG5D
|
|
| Top |
|
|
|
rimwall
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Sat Nov 04, 2023 8:25 am |
|
|
| Experienced |
Joined: Fri Aug 21, 2020 6:05 am
Posts: 315
|
|
Aw shoot... sorry, I forgot to divide the second lot of offsets by 4. I suspect that's why it is was returning a 0x12 error.
Please try again. v0.23 in the repo. Thanks!
Note: the 14 Tribeca ROM has a few more ssm_get parameters than the 08 Outback ROM I've looked at in detail.
|
|
| Top |
|
|
|
V6er
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Sat Nov 04, 2023 6:41 pm |
|
|
| Newbie |
Joined: Wed Oct 16, 2019 2:25 pm
Posts: 53
|
I will to at least one of my laptops to be working properly and read those dumps. @rimwall, those manual corrections would mean that (for example - my situation) - I do adaptations. dump the result. then test all those interesting things you will find and offer to test and then I can just enter adaptations manually, without requiring to find possibility to lift car in the air and run adaptations. kinda backup for those adaptations. plus ability to manualy change line pressure and test it out (I think that one of features for sport mode was higher line pressure... plus all 5eats are getting older and their oil pumps are also getting weaker)... is my "supermegapoweridea" legit or I am not understanding it fully? p.s. idea about comparing adaptations is interesting, because - a lot of people complain about harsh 2-3 gearchanges. then we can somehow see - if adaptations are ok, or after adaptations we can see that their hardware is way off... p.p.s. I hope my rambling is not like madman "under influence" 
|
|
| Top |
|
|
|
V6er
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Sun Nov 05, 2023 7:18 am |
|
|
| Newbie |
Joined: Wed Oct 16, 2019 2:25 pm
Posts: 53
|
ook. a s newbie here (while I sort out qt missing dlls): 1) I need to download newest TCU_023.exe, kernels folder and protocol folder(and add newest protocols.cfg)? or do I need full project folder from github? 2) what is right way of getting Qt installed? open source 3.7gig download (like https://www.qt.io/offline-installers ) to get those qt5core.dll, qt5gui.dll, qt5widgets.dll, qt5serialport.dll ?
Last edited by V6er on Sun Nov 05, 2023 8:40 am, edited 1 time in total.
|
|
| Top |
|
|
|
MiikaS
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Sun Nov 05, 2023 8:12 am |
|
|
| Experienced |
Joined: Tue Jun 06, 2017 2:11 pm
Posts: 206
|
V6er wrote: ook. a s newbie here (while I sort out qt missing dlls): 1) I need to download newest TCU_023.exe, kernels folder and protocol folder(and add newest protocols.cfg)? or do I need something else? 2) what is right way of getting Qt installed? open source 3.7gig download (like https://www.qt.io/offline-installers ) to get those qt5core.dll, qt5gui.dll, qt5widgets.dll, qt5serialport.dll ? FastECU windows precompiled folder includes all necessary files to run it, so download it (test it) and copy all other files in that folder.
|
|
| Top |
|
|
|
V6er
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Sun Nov 05, 2023 8:44 am |
|
|
| Newbie |
Joined: Wed Oct 16, 2019 2:25 pm
Posts: 53
|
MiikaS wrote: FastECU windows precompiled folder includes all necessary files to run it, so download it (test it) and copy all other files in that folder. ah! thanks! will go try it out now
|
|
| Top |
|
|
|
jimihimisimi
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Sun Nov 05, 2023 9:49 am |
|
|
| Newbie |
|
Joined: Tue Apr 05, 2022 12:57 pm
Posts: 58
|
rimwall wrote: Aw shoot... sorry, I forgot to divide the second lot of offsets by 4. I suspect that's why it is was returning a 0x12 error.
Please try again. v0.23 in the repo. Thanks!
Note: the 14 Tribeca ROM has a few more ssm_get parameters than the 08 Outback ROM I've looked at in detail. Same error popup, log below: Code: [2023-11-05 13:46:54.575] Attempting to read TCU parameters
[2023-11-05 13:46:56.289] Commencing to read TCU parameters, please wait...
[2023-11-05 13:46:56.294] Reading TCU parameters...
[2023-11-05 13:46:56.318] Sent: 00 00 07 e1 a8 00 00 01 6c 00 01 6d 00 01 6e 00 01 6f 00 01 70 00 01 71 00 01 bc 00 01 bd 00 01 be 00 01 bf
[2023-11-05 13:46:56.321] 0: 0xA8 response: 00 00 07 e9 e8 00 00 00 00 00 00 00 00 00 00
[2023-11-05 13:46:56.331] Sent: 00 00 07 e1 a8 00 00 01 6c 00 01 6d 00 01 6e 00 01 6f 00 01 70 00 01 71 00 01 bc 00 01 bd 00 01 be 00 01 bf
[2023-11-05 13:46:56.335] 1: 0xA8 response: 00 00 07 e9 e8 00 00 00 00 00 00 00 00 00 00
[2023-11-05 13:46:56.345] Sent: 00 00 07 e1 a8 00 00 01 6c 00 01 6d 00 01 6e 00 01 6f 00 01 70 00 01 71 00 01 bc 00 01 bd 00 01 be 00 01 bf
[2023-11-05 13:46:56.349] 2: 0xA8 response: 00 00 07 e9 e8 00 00 00 00 00 00 00 00 00 00
[2023-11-05 13:46:56.360] Sent: 00 00 07 e1 a8 00 00 01 6c 00 01 6d 00 01 6e 00 01 6f 00 01 70 00 01 71 00 01 bc 00 01 bd 00 01 be 00 01 bf
[2023-11-05 13:46:56.362] 3: 0xA8 response: 00 00 07 e9 e8 00 00 00 00 00 00 00 00 00 00
[2023-11-05 13:46:56.374] Sent: 00 00 07 e1 a8 00 00 01 6c 00 01 6d 00 01 6e 00 01 6f 00 01 70 00 01 71 00 01 bc 00 01 bd 00 01 be 00 01 bf
[2023-11-05 13:46:56.379] 4: 0xA8 response: 00 00 07 e9 e8 00 00 00 00 00 00 00 00 00 00
[2023-11-05 13:46:56.390] Sent: 00 00 07 e1 a8 00 00 01 6c 00 01 6d 00 01 6e 00 01 6f 00 01 70 00 01 71 00 01 bc 00 01 bd 00 01 be 00 01 bf
[2023-11-05 13:46:56.392] 5: 0xA8 response: 00 00 07 e9 e8 00 00 00 00 00 00 00 00 00 00
[2023-11-05 13:46:56.394] Input Clutch Pressure Correction (raw byte): 0
[2023-11-05 13:46:56.396] High Low Reverse Clutch Pressure Correction (raw byte): 0
[2023-11-05 13:46:56.398] Direct Clutch Pressure Correction (raw byte): 0
[2023-11-05 13:46:56.401] Front Brake Pressure Correction (raw byte): 0
[2023-11-05 13:46:56.403] Correction of AWD Clutch Torque (raw byte, high): 0
[2023-11-05 13:46:56.405] Correction of AWD Clutch Torque (raw byte, low): 0
[2023-11-05 13:46:56.407] Forward Brake Pressure Correction (raw byte): 0
[2023-11-05 13:46:56.409] 4WD Pressure Correction (raw byte): 0
[2023-11-05 13:46:56.411] Low Coast Brake Pressure Correction (raw byte): 0
[2023-11-05 13:46:56.413] Temperature basis for all above Corrections (raw byte): 0
_________________
2000 Subaru Impreza 2.5RS EJ251 5MT TY754
2005 Saab(aru) 9-2x Linear EJ253 5MT TY754
2014 Subaru Tribeca EZ36D 5EAT TG5D
|
|
| Top |
|
|
|
V6er
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Sun Nov 05, 2023 10:13 am |
|
|
| Newbie |
Joined: Wed Oct 16, 2019 2:25 pm
Posts: 53
|
ok. the car is MY2008 Subaru Tribeca (TG5D and EZ36). manufactured in may 2007. FreeSSM reports TCU as ROM-ID: 8C FB 20 63 00 FreeSSM reports ECU as ROM-ID: 57 1B 34 61 07 with overcoming my "knowledge and skills" with help of MiikaS - got the app running, but it doesn't work. bottom left corner has green "canvas" color and "FastECU|ECU connected| ECU ID: 57 1B 34 61 07" bottom right corner has text "Unknown unk-unk CAN (Hitachi M32176F4/384kb)" Chose vehicle "unknown" and "5eat" (tried SH7058 variants, but it didn't work). and here is log file: Quote: [2023-11-05 08:43:33.838] Read memory with flashmethod 'sub_tcu_hitachi_can' and kernel 'kernels/ '
[2023-11-05 08:43:50.784] Connecting to Subaru TCU Hitachi CAN bootloader, please wait...
[2023-11-05 08:43:50.805] Checking if kernel is already running...
[2023-11-05 08:43:50.812] Send msg: 00 00 07 e1 31 02 02 01
[2023-11-05 08:43:51.019] Received msg: 00 00 07 e9 7f 31 12
[2023-11-05 08:43:51.021] Trying TCU Init...
[2023-11-05 08:43:51.023] Sent: 00 00 07 e1 aa
[2023-11-05 08:43:51.039] 0: 0xAA response: 00 00 07 e9 ea a2 10 22 8c fb 20 63 00 01 00 80 04 00 00 00 00 a1 42 0c 00 08 00 00 00 00 00 00 00 dc 06 00 0a 29 c0 04 7a 01 1f 00 bc 00 00 00 00 00 00 00 a6 c0 00 fe fe 03 09 20 00
[2023-11-05 08:43:51.050] Init Success: CAL ID = 8CFB206300
[2023-11-05 08:43:51.107] Trying 0x09 0x04...
[2023-11-05 08:43:51.111] Sent: 00 00 07 e1 09 04
[2023-11-05 08:43:51.121] 0: 0x09 0x04 response: 00 00 07 e9 49 04 01 30 32 46 42 32 57 41 33 00 00 00 00 00 00 00 00
[2023-11-05 08:43:51.126] Init Success: TCU ID = 02FB2WA3
[2023-11-05 08:43:51.132] Initializing bootloader...
[2023-11-05 08:43:51.138] Send msg: 00 00 07 e1 10 03
[2023-11-05 08:43:51.346] Received msg: 00 00 07 e9 50 03
[2023-11-05 08:43:51.347] Starting seed request...
[2023-11-05 08:43:51.349] Send msg: 00 00 07 e1 27 01
[2023-11-05 08:43:51.558] Received msg: 00 00 07 e9 67 01 1c 76 47 27
[2023-11-05 08:43:51.560] Seed request ok
[2023-11-05 08:43:51.562] Sending seed key...
[2023-11-05 08:43:51.564] Send msg: 00 00 07 e1 27 02 4f ea 30 bd
[2023-11-05 08:43:51.766] Received msg: 00 00 07 e9 7f 27 35
[2023-11-05 08:43:51.768] Bad response to seed request
[2023-11-05 08:43:51.771] Seed key ok
[2023-11-05 08:43:51.773] Jumping to onboad kernel...
[2023-11-05 08:43:51.775] Send msg: 00 00 07 e1 10 02
[2023-11-05 08:43:51.978] Received msg: 00 00 07 e9 7f 10 22
[2023-11-05 08:43:51.981] Bad response to jumping to onboard kernel
[2023-11-05 08:43:51.984] Jump to kernel ok
[2023-11-05 08:43:51.986] Checking if jump successful and kernel alive...
[2023-11-05 08:43:51.988] Send msg: 00 00 07 e1 31 02 02 01
[2023-11-05 08:43:52.192] Received msg: 00 00 07 e9 7f 31 12
[2023-11-05 08:43:52.194] Test script complete
[2023-11-05 08:43:52.195] Not yet implemented: Reading ROM from TCU Subaru Hitachi using CAN
[2023-11-05 08:43:52.198] Settting dump start & length...
[2023-11-05 08:43:52.201] Send msg: 00 00 07 e1 34 04 33 00 80 00 05 80 00
[2023-11-05 08:43:52.416] Received msg: 00 00 07 e9 7f 34 12
[2023-11-05 08:43:52.417] Bad response to setting dump start & length
[2023-11-05 08:43:52.420] Start reading ROM, please wait...
[2023-11-05 08:43:52.423] Send msg: 00 00 07 e1 b7 00 80 00
[2023-11-05 08:43:52.626] Received msg: 00 00 07 e9 7f b7 22
[2023-11-05 08:43:52.629] Page data request failed!
[2023-11-05 08:43:52.631] Received pagedata: b7 22
[2023-11-05 08:43:52.634] Kernel read addr: 0x00008000 length: 0x00000100, 1 B/s 485 s remaining
[2023-11-05 08:43:52.637] Send msg: 00 00 07 e1 b7 00 81 00
[2023-11-05 08:43:52.846] Received msg: 00 00 07 e9 7f b7 22
[2023-11-05 08:43:52.848] Page data request failed!
[2023-11-05 08:43:52.849] Received pagedata: b7 22
[2023-11-05 08:43:52.852] Kernel read addr: 0x00008100 length: 0x00000100, 1174 B/s 307 s remaining
... and it goes on and on up to Quote: [2023-11-05 08:54:59.284] Send msg: 00 00 07 e1 b7 05 ff 00
[2023-11-05 08:54:59.487] Received msg: 00 00 07 e9 7f b7 22
[2023-11-05 08:54:59.489] Page data request failed!
[2023-11-05 08:54:59.492] Received pagedata: b7 22
[2023-11-05 08:54:59.494] Kernel read addr: 0x0005FF00 length: 0x00000100, 1196 B/s 1 s remaining
[2023-11-05 08:54:59.497] ROM read complete
[2023-11-05 08:54:59.499] Sending stop command...
[2023-11-05 08:54:59.504] Sent: 00 00 07 e1 37
[2023-11-05 08:54:59.707] 0: 0x37 response: 00 00 07 e9 7f 37 22
and I got empty 35kb file with trash at the end. any suggestions?
|
|
| Top |
|
|
Who is online |
Users browsing this forum: No registered users and 0 guests |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum
|
|
