Power FC is reflashable
 

Some months ago when i had the idea to modify the firmware (internal software) of the Power FC i opened my personal PFC to figure out the processor type.

What i found was a 78P3 cpu from NEC. So i called our NEC distributor to get a compiler (program to translate source code to a binary executable program) and a development board. Unfortunately the production was already stopped and even NEC Japan didn't had any CPU's anymore.

The 78P3 CPU has an internal Programmable Read Only Memory which can only be programmed once. The last option would now have been to tell the CPU to execute the code from an external EPROM and not from the internal PROM. But the PFC has an 8 Kb external RAM chip and if the code is executed from an external EPROM the program can not access the RAM :sad:

The conclusion was that it is not possible to reprogram the PFC.

I had then also a discussion with a buddy that Apex'i either had to buy a batch of the CPU before the production was stopped or they are now just selling what they have in stock and then they don't make the PFC any longer. Or they must have replaced the CPU with an other one.

http://andre.honda-tech.de/powerfc/cpu/78p3.jpg

I've then got a newer spare RX7 PFC and when i've opened the case i've found a 78F4 CPU:

http://andre.honda-tech.de/powerfc/cpu/78f4.jpg

The F means the CPU is flashable. That means the CPU can be reprogrammed as often as you want. The PFC has now also a white connector on the board which i guess is the interface to program the CPU. It's a common connector but i have to figure out the pins.

What i would like to say is that it is either way possible to reprogram the PFC, for example update version 5.07 with 7.07. It is also possible to add new features directly to the PFC.

I don't know yet if it is also possible to reprogram the 415-X001 Commander, the older ones can't.

I'll be the first to say, wow, awesome news! Does this mean you could potentially add new selections to PFC menus etc?

Do you mean with "add new selections to PFC menus" to add new features to the PFC or to the Commander? I don't think that i will ever touch the Commanders code, maybe 2008 when i'm bored. But i may add some features to the PFC.

Please don't ask me which and when, i just wanted to say that it is possible. A downside of "patching" the PFC is that every model and version has to be patched. That means i start with patching the newest Honda version and then maybe the RX7 version. I need the PFC do dump and modify the code and i won't buy every PFC model to patch it.

The required flash programmer is the PG-FP4.

http://www.eu.necel.com/products/micro/images/pgfp4.jpg

I see so you could add features like antilag? What other types of features could you add? In regards to needing each model of PFC, I'm sure that when the time comes people would be more than happy to volunteer theirs for testing.

Any feature you can think of could be added. Even knock retard would be possible because the knock sensor voltage could be read in real time and corrections to ignition timing could be made in real time too. Not sure if the hardware is good enough, but on the software side it would work.


Sorry, but I don't think that I will ever made patches for other models. I may show how to, but for other models other people have to made it. Maybe all models share most of the code. I don't know yet.

I haven't made this thread to say that i will add any feature, i just wanted to say that it is possible.

The equipment is pretty expensive, i think about USD 3,000 if you start from scratch.

Hey this would also mean being able to update fixes on PFC with faulty programming that Apex didnt catch.

Kickass find! It's just amazing when you think of what all can be done with the PFC!

Dale

Why do you feel knock retard was omitted from the PFC? Simply the variability of the knock sensors perhaps?


And does this potentially leave you open for correcting code/changing code to facilitate features that you want to add to FC Tune?


Would this allow you to reduce the amount of superfluous information sent back and forth through the port, to increased resolution? (if I am understanding the way data has been described to me to move through the system)

Maybe the old CPU was too slow with 16 MHz (new has 32 MHz), maybe they thought knock retard is not required, maybe it was not reliable or whatever. Email them and see if you get a reply :)


As far as correcting code i think it's the best idea to start with the latest PFC version. I guess the hardware is the same and only the software has changed so it should be possible to update the PFC with the latest version.

Changing code and adding new features is also not easy because the code has to be disassembled and than you've read through every single instruction. It helps that the calibration/settings are written to fixed addesses, so the memory address is a good way to start to understand what happends where.

But don't ask what i can do, do it yourself ;) I hope that some people start to add new features to the PFC. Many people have done this with the stock Honda ECU.

Maybe someone can make a programming adapter only for the PFC? The one from NEC costs about USD 1,000.


It would be possible to extend the interface to request single channels.

Is the 5.07 version the 93-95 spec ecu's, ala fit our engine harness (2 pin row)? The 7.07 ecu for the 96 and newer cars/ecus that have the 3 pin row engine harnesses?

Tim

hi a bit of an off topic question
but the main skyline versions r33 and r34 gtst are discontinued, as we all assume the main nec processor isnt made. couldnt apexi just adapt the board to use the new 78F4 cpu ?
like the one fasthatch found in a new rx7 rotary PFC ?

The 78K3 CPUs have already been discontinued a while ago, I wasn't able to get any equipment or CPUs last year anymore.

The 78K4 is not pin compatible (that means you can't just put a K4 into the socket of a K3 and it works), like AMD and Intel CPUs.

So the board layout needs to be redesigned and the software needs some modifications.

I don't know if Apexi already made those changes in the past with the now discontinued models. Maybe someone could open a recently bought PFC.

One reason could be that they bought a last batch of 78K3 and just run out of them now and made the business decision that it won't be profitable to redesign those models.

An other reason I could think of is that they just don't sell enough of these models anymore. They get the circuit boards made somewhere and you have to buy a batch of 100 or 1000 boards. Those boards are only cheap if you are having them mass productioned. Every PFC is different, so you have to prepare the production line for each PFC. So if they don't sell enough of them anymore they can't produce them profitable.

yeah i understand what you are saying andre
hopefully they are redesiging the r33 and r34 versions, they were really popular
will try and get a recent ish FC opened up for some pics

Threadreseraction LOL

I just found some more info on this topic if someone can translate it

http://www.kaele.com/~kashima/car/pfcadp

http://www.kaele.com/~kashima/car/powerfc/

I really wish there was a way to do this and relatively easy.

The powerfc is great, and would be perfect if there was a launch control feature, and an antilag feature.

Surely there is a way or someone has done this.

Any luck translating the links above?

I sent an email to the dude in those above links, and I will let you know if he responds. If he can add features to the standard powerfc to make them like a PRO unit, it will be the biggest hit in the entire ECU market I'd say.

http://andre.honda-tech.de/powerfc/cpu/78f4.jpg

http://andre.honda-tech.de/powerfc/DSC00003sx.jpg

http://andre.honda-tech.de/powerfc/DSC00005sx.jpg

explain?

What are you doing there? I also have opened my PFC since my motor is blown and funds don't permit a speedy rebuild. So in my free time I started looking at the actually parts of the PFC but didn't get very far since most of this is over my head. However I do work for a company that hacks Bosch ecu's all day long and when they have a little down time I talk to the "hacker" that does all the work for them and I was hoping to atleast get the source code out and have a look at it.

FastHatch I don't know how far along you are with what your doing there but if you run into a hurdle and need some help let me know. The guy I have access to can do some crazy shit when it comes to cracking code and I'm sure he'll be up for a challenge.

3rd time back from the dead

hmmmm a pfc going to mars... not a bad idea ....hmmmmmm:wallbash:

Yep. I wish I had the equipment already a few years ago, but actually it's very expensive. Everything together almost $3,000.

http://www.semiconductorstore.com/ca...idproduct=3044

http://andre.honda-tech.de/powerfc/DSC00008s.jpg

So FASTHATCH, What have you been able to do?

I think the one thing that I would love to have is a Ignition Cut instead of a Fuel Cut, for Limits

Also very interested in your findings Fasthatch!

If you have any more info to share I would love ot hear it.

It's currently only a proof of concept. I have all the required equipment now and have severall ideas and checking them for their doability, price etc.


"I think the one thing that I would love to have is a Ignition Cut instead of a Fuel Cut, for Limits"

Unlikely.


"The powerfc is great, and would be perfect if there was a launch control feature, and an antilag feature."

Likely.

Just set your top RPM row (or rows) of ignition timing to be very retarded for a "soft" ignition cut.

^^^ Well I all ready have a true Ignition cut for RPM and boost, so that isnt a problem. Just would like it built in.

If he could get a flash of a Power FC Pro then he should be able to flash that onto a normal Power FC to create a Pro.

Yes, but there is no FC Pro for the RX-7. There is supposed to be a 13BR2PRO, but I've never seen one.

I've figured out how the PFC stores the settings internally. You can actually make more changes than over the interface. Not yet sure how I can make them accessible for everyone because currently hardware mofifications and $900 equipment is required.

Just wondering are there setting for the idle control PID loop? Also anything like trims for each rotor? I've always wondered if thing like this are in there just not accessible threw the regular means of tuning (FcTune or Datalogic)

There is a Power FC Pro, I have seen 2 of them in my life time, one at the drag strip on a FD and the other in a FC. This was a few years apart

I was looking around to buy one, but have never seen them for sale.
Also AFAIK the Pro models are all based on the older PFC models with socketed processor, so it would not be possible to turn a FD3S4/FD3S5/FD3S6 into a Pro.

Does the socketed model processor means that you can swap the cpu without soldering? I assume its the AP Engineering version?

I found this one from Japan. Is this the the socketed type? Its the PRO version type cpu for Toyota.

http://i5.photobucket.com/albums/y172/oloy/cpu1.jpg

Yes, you can swap the socketed CPU like the CPU in your PC. The Pro and AP Eng. models are different, the Pro has additional functions while AP just adapted the PFC to other cars.


Where have you found this? Link?
I've bought the Flash Programmer for the NEC CPUs and it would be possible to turn a normal PFC into a Pro for about $10.

What you mean is the PRO would give access to the hidden maps that we cannot change with the direct Power FC interface?

Or is the FC Pro reffering to Apexi's own "Dataloggit" thing. I have seen many of the later, it is alot easier to use than the FC Edit IMO.

These units have two additional functions over the regular units:

1. Ignition cut used for rpm limiter - Regular Power FCs cut fuel feed when the preset revolution limit is reached. At high rpm, there is the possibility of knocking when the fuel is cut in high powered cars. The Power FC Pro Spec.CPUs cut ignition at the rpm limit to prevent the knocking that could potentially destroy the engine.
2. 0km/h rpm limiter setting - Allows for the setting for an initial rpm limiter that is active whilst the car is not in motion. This allows for mainting a rpm level for consistent launches

So would this be USDM compatible?:) Pro sounds awesome

FastHatch: how far are you? Are there checksums or compressed obsuficated areas? Are they using the standard instruction set or is it a special processor?

But yes! The only issue I have is the lack of idle control, there's something operating in the background where the main timing map is ignored for some reason and control reverts to something that isn't accessible. In the Saab world closed loop idle is handled by map driven PID control separate from the main mapping, I suspect the same is true for these boxes, but those setting just aren't present in the Datalogit.

Not to promote my website (don't worry we don't make any money), but there's a place where the right people are already gathered to tackle a project like this. There was a similar problem with Saab's Trionic engine management, it was completely closed and tunes were $1200 each. Instead of paying that a friend and I spent about 3 years reversing the Saab Trionic 7 engine management, we got the point where more information was needed (I'm an E-Engineer, not an embedded systems guy), and decided to take everything public; started ECUProject.

And ultimately the project was a successful international effort, the correct group of people assembled together and sometime last year T7Suite and T5Suite were released.

Anyway, if anyone is interested in sharing what they have with a group of guys fluent with tools like IDA Pro, I can make an RX7 specific forum over on www.ECUProject.com. Right now there's an 'Other' forum but if there's interest it's no problem to expand the scope of the site. The right people are there with the right skills & tools.

So can somebody make me a copy of the PRO cpu for toyota... Need one for my 2jz powerfc... Come on, you know you wanna.

So i'm a bit confused, can pfc pro features be put on a normal pfc for a 93-95 rx7 at this point in time? I want to say there was an older and newer pfc for the 93-95 rx7 is it only one version thats able to be updated to the pro features? Which one is it? And does someone already have whatever hardware thats needed? I'm just trying to figure out whats possible right now and what is more theory based.

I'm sorry, but the required equipment totals $4,000 (just a programing ADAPTER and a SOCKET for the CPU costs $500 and $200) as well as a lot of time is required, so obviously I can't give all technical infos away for free.


The PFC has an idle ignition function. From the top of my head it's set to 16° and if the engine speed falls below the target idle speed the ignition is advanced, otherwise retarded.

Sure, I'll buy a Toyota Pro CPU and make you a free copy. Anything else?

Not yet, but at least for the 0 Km/h rev limiter it is possible. Ignition cut isn't that easy, maybe later when I have a better understanding of the firmware.


I have all the required hardware and can read/write the CPU and EPROM.

[QUOTE=FastHatch;9139863]I'm sorry, but the required equipment totals $4,000 (just a programing ADAPTER and a SOCKET for the CPU costs $500 and $200) as well as a lot of time is required, so obviously I can't give all technical infos away for free.[QUOTE]

No, actually, you're not sorry at all. Don't worry about the interface cost, it's just another incidental cost in the process that you'll likely never recover. That's the exact reason why nothing will ever be done that anyone can use; if you're doing this to make money you need to reexamine your business model.. I assume you also want reimbursed for the time it took you to post your last message on here too? Why post anything at all? Is the goal to have your ego stroked on here or is it to tune/crack an ecu?

Regardless, your first post on the subject (just in this thread) is from 10/16/2005. So go ahead and keep your secrets, I was just offering to help put you in front of people who actually have successfully reverse engineered two completely different generations of EMS' that are both light years more advanced, in about a year. The first step to helping you is to determine where you need assistance (you obviously do) and what work you actually have completed beyond the interface. Are there checksums? What have you been doing? Is the implementation non-standard? Are you mapping unknown memory or something? Do you have the correct de-compiler? What stage are you at? By keeping everything secret, I suppose you're scheming to make $millions$ developing somthing for an old platform that the OEM isn't even interested-in, and what, you'll be finished in another 5 years or so? :lol:

Maybe I'll dump it and go ahead throw it up on my site. Doing research and dumping a chip or two isn't hard and usually isn't very expensive, especially when a person already has access to readers and when it's *likely* (a guess based-on volume) the box is built from 100% off the shelf components...

Right, the first post was from 2005 where I said that it would be *possible* to reflash the PFC. No one further investigated in that area. Where have you been in the last 4 years? I just recently bought the required flash programmer as well as all other equipment.


Damn right, I'll be a millionaire soon :rolleyes:



Feel free to dump "a chip or two" and put it on your site. Lets see how you dump a proprietary NEC CPU with your eBay EPROM reader :rolleyes:

And a early/mid 80's NEC chip is more difficult than a late '90's proprietary Motorolla? :lol: At least we're getting somewhere with the information sharing. So now we know that processor is proprietary. Now, how about the instruction set implimentation? Have you had success with any custom IDA scripts? That's how I'd do it...

But keep at it dude, good luck; I was just offering to help. You're apparently too talented and capable to need any assistance, the gold is all yours. I expect an update before 2014! :lol: I'm subscribed.

Get your facts straight.


Oh really, that's how you'd do it? Too bad that the CPU isn't supported by IDA :rolleyes: Feel free to contact your local NEC distributor to get a quote for the RA78K4. Life sucks when the equipment isn't free, doesn't it?

Facts straight? I'm not the one that's been "working" on this for 4 years or whatever. I repeated what you wrote. If it's not an '80's NEC chip then why did you write that it was? Like I wrote before, is this thread here to feed your ego or is it to make progress with an ECU. Apparently it's the former. SHould I just write how great you are and give you a wish list, that you don't have a prayer to ever impliment, like everyone else? Is that the proper response?

And Free? As in like I didn't buy IDA? You are mistaken sir. I only see one thing that sucks here. :rolleyes:

Send me a PM when you want some help and I'll make the introductions.

How can I work on this for 4 years when I just have the equipment for a month now :rolleyes:


I never said it was.


No thanks. I prefer to turn to my colleagues and friends for help. Over and out.

So the speed based limiter for drag launches can be set but it would be a fuel limiter rather then an ignition cut? Or does enabling that feature automatically make it an ignition limiter at 0 mph? I wouldn't want to be fuel cutting on a drag launch at 5 k....

It is much easier to modify the code for the rev limiter than adding an ignition cut. I'm not saying that it is not possible, I just don't have the understanding yet to do it and I don't want to promise features I'm not certain of.

I have to build a simulation environment for the PFC so that I can test the input and outputs.