The facts:

Stock Euro-speced SR20DE ECU from a car with CAI/Exhaust and S4 cams has been sent to tuner for tuning.

On return, its behaviour (when compared with the stock ECU)was very noteworthy:

1. Idle smoother and close to 1000-1100 rpm.
2. Car seemed to pull much harder throughout the rpm range.
3. Up top there was a very noticeable gain.
4. Rev-limiter removed (we never let the car go above 8400!!! rpm as shown on the instrument cluster).

This behaviour has been duplicated in another stock SR20DE when we substituted the tuned ECU for the stock one. Without even allowing for a "learning" period so we could do back to back comparisons between stock and "tuned" ECU, there was definite improvement troughout the rev range and the rev limiter was indeed somewhere above 8200rpm (if at all).

Now comes the tricky part!

We opened the ECU in order to pull out the chip from the daughterboard and see what it contained. Well, there was a 40-pin connector soldered on the ECU but NO DAUGHTERBOARD. Furthermore, the jumper on the back side that needs to be "changed" for the daughterboard to work had never been touched so we know that the ECU never worked off a duaghterboard located ROM. Apparently the "tuners" for some reason soldered the connector there but did not proceed in altering the CJ1/CJ2 jumpers. Still, the ECU IS DIFFERENT than the stock one.

To put it more eloquently.... WTF???!!!???!!!???!!!????????

During a very close visual inspection fo the moded ECU, we found that the only thing with visual evidence of tampering was the little metal thingy on the right of the 84-pin CPU chip indicated by the red arrow in the following image (this is a stock ECU but the compenent is shown).

http://www.depa.gr/~1/ksanthou/image46b.jpg

I am totally lost here people. Anyone technically inclined with an educated guess among you???

Chris
1992 Sunny 2.0GTi

Can't tell you what they did, but that metal thingy is the crystal that sets the operating frequency of the CPU.

Where is this connector they soldered in? Your picture shows nothing in the 2x20 header section.

Not really educated, but a guess.

Maybe the rom image on the ecu is an eeprom, reprogrammable through the 2x20 port, that's why they left the connector there, possibly hooking up an interface to burn a new image ? Sounds wild.

Post a pic of the ecu you are talking about.

How much are they charging for the upgrade? I just installed S4's.

Chris

Originally posted by Probedude
Can't tell you what they did, but that metal thingy is the crystal that sets the operating frequency of the CPU.

Where is this connector they soldered in? Your picture shows nothing in the 2x20 header section.
Dave,
this is my guess too.

If you note in the 1st post, the picture is from a stock ECU (I had taken the pictures long ago) just to pinpoint the "crystal".

In the modded the connector is there (albeit without any board or the CJ1/CJ2 mod on the back).

I am 99% sure the metal part is th eonly one they fiddled with since there is no visual evidence of other intervention. Actually, some of the resistor on the bottom right of the ECU (not shown in the picture) were also different from the stock but there was no visual evidence of de-re-soldering so I assume that the factory simply used a little different resistors.

Chris

Chris

Originally posted by art_from_ct
Not really educated, but a guess.

Maybe the rom image on the ecu is an eeprom, reprogrammable through the 2x20 port, that's why they left the connector there, possibly hooking up an interface to burn a new image ? Sounds wild.

ART,

there is a person here that claims exactly that!!!

However, I have never seen any EEPROM in 64pin formfactor like the one in our ECUS. Plus, when we asked this person to read the supposed EEPROM he came up with a 64KNyte image (aka 512kbit) that was not readable with any memory map I know about. Plus, I do not know of any early SR20 ROM (prior to late S14s) that was 512kbit instead of 256kbit.

Chris

Originally posted by se-r sam
Post a pic of the ecu you are talking about.
Sam, I can do that but it is identical to the one shown. There is NO VISUAL difference at all from the top side except the added 40pin empty connector.

From the bottom side, there is also no difference except very noticeable amateur re-soldering where the metal part conencts to the board. I used a magnifying lens and this is the only visual evidence.

I will give a little later the markings on the 2 metal thingys: the stock one and the supposedly modified one (they are VERY different) and I have not been able yet to figure out what they mean.

Chris

Originally posted by chriscar
How much are they charging for the upgrade? I just installed S4's.

Chris

Chris, they charged an exorbitant ammount of money assuming this is actually the only mod made, close to $350.

However, we have an extra ECU and we will try modifying it the same way and see what comes up. So stay put, it will not be long.

My only concern is that IF I do not know what actually happens when we do it (the theory behind it) I would be very hesitant to do it in any car and run it fo rextended priods of time.

Chris

Markings on the 2 different "crystals":


"Modified": 8.860
NDK.82

Stock Part: 8AMQ-8
TEW2L


Any resourcefull member please comment.


Chris

Comrades,

This could be too good to be true. I have a theory as to why he changed the crystal. Here's a clue as to what I'm thinking: that specific crystal is not used as only a baseline for microprocessor speed.

Let me put together some more proof and I'll spill the beans ;)

edit: small correction

-Art

Disclaimer: I suck at the w0rdz. Anyway...

I am hobbyist so forgive my non-professional terminology but I believe that based on the data from this post and other information gathered I am correct about the Nissan ecu. It is a very intriguing and sophisticated computer.

The stock micro controller is based on a Motorola clone as previously researched. This one may not be the exact one but I believe it works in a similar fashion. If you look through the pdf you will find the details of what I'm talking about. www.gaw.ru/doc/Motorola/7rc17r2.pdf
The reason the crystal was changed was to set the eeprom user area to be able to receive programming instructions from an external source. Now your saying, "Didn't you just say that it's a micro controller?" Yes I did, what I'm saying is that we are modifying from one set of addresses to another inside the micro controller, this being our EPROM area.
This was done by changing the frequency of the crystal therefore setting a security bit in the user area EPROM inside the micro controller circuit. The Nissan micro controller not only contains the user EPROM (the one we're interested in) but also a bootrom and a RAM area. By setting this security register we enable programming and redirect the boot loader to allow us into programming mode, we are able to reprogram the user area. By changing the ossicilator, the crystal, we are able to keep the EPROM user area open by having the micro controller see the frequency it needs to be externally reprogrammed.
The external ROMS on the daugherboards that are the standard way of reprogramming this user area is a matter a of convenience. Easier to go back to stock if we mess up the area buy leaving the stock area intact, NEVER really changing it. We are basically redirecting the microcontroller to use an external source for this userarea, the user area being our timing/igntion/fuelmaps/rpm/etc.. when we attach external eproms.
What it looks like that this user area is, to able to be fed external data by resetting the security register in the EPROM and allow for reprogramming by changing the external crystal (oscillator) to what the EPROM expects it be for reprogramming. Therefore REALLY reprogramming the ECU. Otherwise the micro controller is in user mode only allowing us to read the information. Like in this kind of lame example but I believe it fits our criteria.http://www.intel.com/design/mcs96/technote/2313.htm

This would be why he left a 40-pin connector on there and also why the crystal was changed to a different frequency one. The reason why the resistor was NOT moved to the C2 location was because he was reprogramming this user area rather then directing it to a separate source on the daugherboard!

So based on this huge assumption I believe the user area is externally reprogrammable and Chris has one of the first reprogrammed ecus. The connector allows the programmer to interface with the EPROM area in the micro controller.

Comments welcome. :)

-Art

Hmm, wow i like your line of thinging, jsut a few questions from EE though.

After looking through that pdf for the microcontroler i didn't see any mention of the oscillator being used to change from boot mode to user mode, although i may have missed it. Also why would you change the oscillator so that you can reprogram the EPROM?? And on top of that, why didn't they put back the stock oscillator to put the ecu back in normal operation mode if this is so. So somethign seems very fishy here to me. On top of that changing the oscillating freq of the circuit should have drastic affects i dont understand why this ecu would even run at a different freq that it was designed for with all other car circuits and syncing.

Has this ecu been tested with this new crystal?

Also are there any other crystals on the ecu?

Where did you find the information on the trype of MPU in our ECU's is a number stamped on the chip itself?

I am not trying to be mean, just trying to come to an understanding, but i think were all on the right track. Good research!

art_from_ct please respond :)

Originally posted by art_from_ct
Comments welcome. :)

-Art

Art... I am STUNNED!!!

At this moment I prefer to NOT check the validity of your findings but just ENJOY the idea!

Actual comments later... :eek: :confused: ;) :D :D

Chris

Originally posted by Synx
Hmm, wow i like your line of thinging, jsut a few questions from EE though.

Nice to hear from an EE on this matter. Please feel "obligated" to keep looking on it... :)

After looking through that pdf for the microcontroler i didn't see any mention of the oscillator being used to change from boot mode to user mode, although i may have missed it. Also why would you change the oscillator so that you can reprogram the EPROM??

This is the "beef" of Art's argument. We will obviously have to look into it but for the time being I prefer to believe it actually happens! Art will obviously respond.

And on top of that, why didn't they put back the stock oscillator to put the ecu back in normal operation mode if this is so. So somethign seems very fishy here to me.

They did not because they were bored/busy/whatever! If it still works they did not have to put it back since (as far as I know) they were the first and only ones to do it this way. It is inconceivable that someone else would fiddle with it. Actually ***** did so much as to open the ECU for the past 30 months! That is not until it came in my attention!... :)

On top of that changing the oscillating freq of the circuit should have drastic affects i dont understand why this ecu would even run at a different freq that it was designed for with all other car circuits and syncing.

YEs, this is my initial concern and we are about to test the validity of the hypothesis! However, note that the new crystal has been on the ECU for 30 months now and running happily with no apparent side-effects.

Has this ecu been tested with this new crystal?

As stated, yes for 30 months. See the 1st post on this thread.

Also are there any other crystals on the ecu?

Not that I can see.

Where did you find the information on the trype of MPU in our ECU's is a number stamped on the chip itself?

AAARRTTTTT.... Aaarrtttt.... Please enlighten me. Where did the Motorola assumption come from? (see also my next post....

I am not trying to be mean, just trying to come to an understanding, but i think were all on the right track. Good research!

You did not sound mean.

art_from_ct please respond :)
Yes Art, show some mercy and come back with more educated guessing when you can!...

Chris

Originally posted by art_from_ct
The stock micro controller is based on a Motorola clone as previously researched.

OK, lets go back to researching this issue.
What "mind-path" led you to the Motorola conclusion? I am dying to go down this path too!!!

As for my amateur efforts to figure out what is going on in our ECUs, after some guessing I followed the following reasoning:

1. Information about JECS devices is nowhere to be found. ANy search about "JECS" or any of the #s stamped on the 2 JECS chips on the ECU returned nothing of interest.

2. Hitachi has been a major supplier to Nissan for over 30 years. Plus, they manufacture countless automotive products among which (in a very prominent position) ECUs (I could find no specific information on the customers that actually use them).

3. Hitachi is also one of the 3 major stockholder (read partners) with Nissan of... you guessed it!!! JECS!!!!

Using this line of reasoning, I checked Hitachi MPUs with particular interest on microprocessors using the QFP packaging type (the one of the 2 JECS chips) and particularly anything with 68 or 84 pins.

I am in the process of digging in the mass of PDFs I have downloaded and will soon have some results. However, if I ma down the wrong path you will save me a lot of time!!!

Chris

Chris, who was the company that tuned this ecu? Are they still in buisness?

Project at work...will respond to all inquiry's tommorrow.

For right now, the "logic" if you can call it that that led me to research motorola stuff was this message from a previous discussion we had about ecus.


I don't have a ROM reader, but, in the past, I have tried to find data sheets for either of the processors inside our ECU's to no avail. I believe I discovered that it was a Motorola clone, but that's about all I could find out. I think I did get a matching pinout (with the funky numbering scheme) from Motorola's website a long time ago, but I could not re-find that document. Nor could I even come close to finding any other information on it. The name JECS is printed on the chip, but there's no technical information on their website. After I attempted to monitor the Consult port pins with a scope and got nothing I totally gave up on trying to speak electricity with this thing. I did note the type of ROM chip that JWT used, I believe mine was an AMD 1024K chip. I wrote the numbers down somewhere a while back.

That's pretty much been the extent of my dealings with our ECUs.



This was mentioned by Ben and it sounded conclusive enough to try to look somewhere else.

Also my ecu has 2 crystal on next to each other. (obd2) Will get more indepth later.

-Art

Sorry for the unreadable post before, i was in the mist of studying for finals so my brain was not where it needed to be for posting a responce. However im a little bit better now. Again like i said i just done see how changing the crystal unless there are two on the ECU board because you would be changing the operating frequency of the ECU and this can be fatal. However it may be that there are two crystals or even more on the board in which case the one that was changed wound't/shouldn't be the one controling the circuit frequency.

I will be doing my own research into this matter and maby i'll be able to find out who makes the chip.

Also on the OBDII note i have developed a circuit using high speed comparators and a few resistors and a zener diode to be able to converte the +12v to 0v logic of the OBDII port to that of the RS232, inverted +-15V. There is a basic format for communicating with the OBDII port on our NISSAN cars, its called the ISO 9141-2 standard. There are 3 or 4 standars as of now, PWM for i believe ford, VPW for GM, and ISO 9141-2 for japanese and euroean cars, however not all confrom to the same standars(ie some toyotas use the PWM or VPW standards i believe).


ISO 9141-2
The basic communication is as follows, if memory servers:
Tester Device issues 0x33 at 5baud(yes thats 05 baud) with 1 Stop 1 Start 8 Data and 0 Partiy bits

The ECU responds with a sync byte of 0x55 at the baud it would like to communicate at, usually 10.4Kbaud

The ECU then waits a small time and sends two keyword bytes that describe the communications protocal etc.

After the last keyword the Tester Devices responds with the logic inverse of the last keyword

At which point the ecu responds with the logic inverse of the initial address, in this case 0x33.

Now communication is established and you can request data grams basied upon SAE standards.

Originally posted by se-r sam
Chris, who was the company that tuned this ecu? Are they still in buisness?

They are the local distributor of Superchips (naturally there is noSUperchips application for our cars).

They were also involved with a team that wqas running normally aspirated SR20DEs in local rallys and selected events of WRC (not called WRC back then) from 92-96.

They are basically the "bring your ECU here and we will tune it" types that do not disclose their "secrets". I was pretty sure they would have added a daughterboard and the surprise after seeing the ECU was the motivation for this thread.

Chris

PS. Check the "Location" on the left....