I was reading with great interest this thread from Enervation about building software to talk to the stock FD3S ECU.

So I decided to give it a go and I can happily report works as advertised. I know all this is moot with an aftermarket ECU but mine's stock and I'm just doing this for fun.

I've updated the software here and put some notes and thoughts in the README.

I know most folks originally wanted to dig into the ECU internals to tweak the fuel maps and of course that problem has long been solved with aftermarket ECUs. For me, I'd like to replicate the functionality of a TECHTOM - I have one in my Nissan and just thought it would be cool to display the same on the FD.

What I haven't figured out is where to get the diagnostic codes. I've been using the DumpBytes function and can't seem to locate them. Maybe there's an undocumented command code?

I expect these codes are stored in non-volatile manner - saving the codes when the car shuts off. Also would explain why disconnecting the battery clears the codes. I don't think there's any programmable NVRAM - it's just the constant power keeping the ECU and these values alive.

The 0x100-0x1FF address range seems to be where some preserved values are stored. Most are stored as complimentary bytes (byte 1 + byte 2 = 0xFF). I read somewhere that this was done so the ECU could check if there was any bit drift (power off) and reset the values if needed. I didn't (sadly) find the diagnostic codes here - I've got an ECU on the bench and I have been adding resistors (330 ohm) to the solenoid pins to enable disable codes and confirming through the blinking light technique.

I guess the next step would be to desocket the UVPROM from the ECU and dump the binary. This would theoretically allow me to decompile the routines that control the serial comms and get/set those codes. Seems like a bit of a bear but what's the worst that could happen.

Anyway, thanks for reading my rant. Any tips/advice are most welcome.

 

If you are successful and can make it financially feasible, this would be a possibility for those that want to remove the Air pump and EGR to maybe disable the feedback, control and MIL for those items for the people that want to remove them and have adequate back pressure to keep the boost from running away. Other than that, I would probably go with Power FC and FC tweek over a ROM tune style on an FD until it was VERY proven by the tuner. I would comfortably run a Knights sports or similar shop's ECU with confidence, but the tuner is a key part.

 

Nice! Yeah the stock ECU is still something of a mystery. Would be super interesting to figure out what they goofed up that causes the 3k hesitation - supposedly the later 16 bit stock ECU's fixed that and the PowerFC doesn't have that issue.

Dale

 

You got mad skillz. Thanks for the contribution! Added both the old thread and this one to the FAQ.

 

Is the ROM dump for the N3G1C 280PS ECU available?

 

I dumped a N3A1. Not sure where to source any others.

For reference, It's a 27C256 EPROM 28PIN - DIP. I did not find it easy desoldering it.

 

That's great. I don't have access to a stock ecu. Any chance you can share your binary dump with us?

 

Enjoy!

 

we don't have any kind of XML file or other address look up for the binary, similar to what you'd find for reflashing say a SUbaru. that's the key for reprogamming stock ECUs, and where the reverse engineering comes into play.

 

Right. This guy found the fuel map https://www.rx7club.com/3rd-generati...n-maps-876250/.

I was hunting for the CEL codes and the various sensor values and found a healthy chunk.

 

What you want is an N3G1C ecu. I have one but its in storage in another town. I'm going to open that rom dump in reverse eng tools and see what I find.

 

https://github.com/chirpy8/ghidra_68HC16

Kaele reported the ecu is a MC68HC16. It looks like it will be possible to disassemble the binary with ghidra