Lotus Elan Central

by **ESM** » Wed 03.05.2006, 07:36

Yeah Doug is right, if the PROM is corrupt then we can bypass it either with a mountain chip or a copy of a stock chip.

However, I'm still not sure quite what is going on here. More than 1kb of data looked changed compared to a stock 1499 chip, this should either have failed the checksum which would set a code and start limp-home mode - but this doesn't happen since you can't get ES logs in limp-home - or, if by some fluke the corruption took out the checksum test then the ECU should crash when it attempts to execute random code. Maybe its not corruption but a poor attempt at chipping and some dunce has removed all the self test code in order to disable overboost fuel cut????

I'll have a more careful look at the code, could you also check the ECU seals to see if there's any evidence of interference? If they are absent or broken it might be worth having a look inside...

by **Sy V** » Wed 03.05.2006, 08:18

Cor! This is getting more intriguing than any soap opera.

Tune in for the next instalment folks!

by **Enright** » Wed 03.05.2006, 08:20

Computation Street. :lol:

by **Rambo** » Wed 03.05.2006, 08:58

Sy V wrote:Cor! This is getting more intriguing than any soap opera.

Tune in for the next instalment folks!

The only problem is that I don't understand a word of it. OEM PROM's, VIN's, HEX, FCD, MAP's, ALDL's............ WTF - are they speaking foreign language ??

Mark

by **GeoffSmith** » Wed 03.05.2006, 13:54

100010101100111010100010100101

Corrrrrrrrr.

Look at the bits on that!

by **GeoffSmith** » Wed 03.05.2006, 19:06

Alan, don't forget that it's been running fine (no overboost) until just recently.

What do you mean Doug, I've got a 49state car? It's got the wheel on the right side and been nowhere further West than Bristol! Can someone enlighten me please?

Anyway, I'm off to the chip shop to gen up on pulling my ECU out. Don't miss this evenings exciting episode (continued straight after the news).

by **GeoffSmith** » Wed 03.05.2006, 19:11

Alan, your website appears to be down!

17:45 No, it's back up now. Back soon.

by **GeoffSmith** » Wed 03.05.2006, 20:21

Well that wasn't too hard.

The ECU still has the warranty label firmly attached so I don't think it's been touched. Is the PROM removable from the MEMCAL and if so, do you know what type it is? If you do, I could check it out on a programmer for absolute confirmation and see if I've got any suitable replacements lying around the lab. If it is possible, could you provide me a copy of the stock memory dump?

I'm off to look at the Peco exhaust thread.

by **ESM** » Thu 04.05.2006, 08:01

Geoff,

I'm mildly surprised its not been hacked.

I had a closer look at you PROM contents last night. The checksum stored in it is wrong and lots of $FF bytes have appeared in blocks where they aren't usually found as well as short runs of code that are different to a dump from a chip with identical program and scan ids to yours. If it is random corruption the ECU self test at start up should detect the corruption via the checksum and shut down ECU control. I can 't interpret the changes very well because I've done all the disassembly work on a 9929 chip download (from my '92 SE) and just found tables in the other types in other versions and not identified code. So while I can say all the tables and constants I have identified are identical I'm not sure what the function of the altered code is.

The chip I use is an SST 27SF512, this is an EEPROM pin compatible with the original EPROM but with twice the memory (64kb instead of 32kb) so the code has to be written to a start address of $8000. From memory the original is a 27C256. Its soldered into the memcal though, which is why the bypass boards I get from Craig Moates are very useful. I'll e.mail you a clean 1499 bin if you want.

As to the fact the car was running ok, I think the boost you're seeing is probably the result of a stuck wastegate (the BSV certainly doesn't seem to be responsible, the duty cycle is non-existent), the PROM 'trouble' was probably there before just not immediately apparent. The fact that your power is so low might indicate that it is having other detrimental effects in general running though.

by **GeoffSmith** » Thu 04.05.2006, 19:26

Alan,

Sorry for not replying earlier - the IT gestapo at work seem to have been busy.

Thank you for spending the time to look at it for me. It is much appreciated.

I must admit to being a bit concerned as I would have thought the write enable pins would be hard wired disabled. In any case, there should not be the high programme voltage present (although I think some later devices had internal biassing circuits) and if there are FF's, it suggests erasure rather than programming bits to zero. Maybe the PROM is slowly dying: About a month ago, it wouldn't start after filling up - not the hint of a spark for several embarrasing minutes but it eventually spluttered back to life and then seemed OK. We did some accelerated ageing work about 15 years ago, looking at measunring long term retention of UVEPROM's charge and found quite a variability.

Anyway, I have found a 27C256, so I think I will programme it with the stock mapping to try and re-establish a baseline before I fit a new exhaust etc. if you wouldn't mind e-mailing me a bin file at your convenience (e-mail address PM'ed). I'll probably just socket it, if I can't find/fit a ZIF socket and I'll try and read the old PROM on the programmer for confirmation.

It's probably a good thing the wastegate stuck as it looks like I might have a problem that may otherwise not have revealed itself embarassingly or, as you say, with other detrimental effects.

I'll keep you updated.

Geoff

by **GeoffSmith** » Thu 04.05.2006, 20:09

Sy,

10/10 for the sticky S2 register fix.
Your "learning opportunity" for today is to move half this thread to a more suitable area as it's gone decidedly :offtopic:

sorry!

by **ESM** » Thu 04.05.2006, 21:58

Bin file sent...

by **GeoffSmith** » Thu 04.05.2006, 21:59

Thanks Alan.

by **GeoffSmith** » Wed 10.05.2006, 23:12

Where's the week gone?

Someone "borrowed" the PROM programmer last week so only managed to blow an Atmel 28F526 today. New sockets ready and waiting but I'll probably wait until the weekend before removing the old PROM just in case.

Alan, is power cut off to the ECU and/or MEMCAL with the ignition off or do I have to disconnect the battery?

Geoff

by **GeoffSmith** » Fri 12.05.2006, 23:31

ECU out.
Seals tampered with? Well they are now!
MEMCAL out.
Superchips PROM soldered in - explains a lot!
Unsoldered and removed (eventually) but a pig of a job.
It's getting late so socket (pain in the proverbial) or solder (easy)?
Done.
All bolted up, connected up and back in the car.
Sound of crickets under bonnet, engine warning light flickering on startup and Elanscan failure to communicate. :evil:

Swapped back to Superchips PROM and at least she runs - yes I did take the trouble to socket it rather than solder the new PROM in

Looking forward to tomorrow.
Anyone want a Superchips PROM for 2s 6½d (RRP £250).
Any thoughts Alan?

by **GeoffSmith** » Mon 15.05.2006, 22:07

B*LLOCKS BOLL*CKS - forgot that 27 and 28 series PROMs have their write enable and A14's swapped :oops:

EEPROM checks out OK so triple socket swapover adapter made.
No chirping from under the bonnet.
It starts but the engine warning light stays on.
Elanscan still failed to comunicate so tried the paperclip test - nothing.
"Original" Superchip replaced and ES and PCT both work.
:smt017

by **ESM** » Mon 15.05.2006, 22:32

I thought it looked hacked....

I'm less knowledgeable than you on the workings of EEPROMs I'm afraid. I can send you a known-to-work Atmel 29C256, programmed and ready to go if you like.

by **GeoffSmith** » Mon 15.05.2006, 23:01

Alan,

Thanks for the offer. You've just reminded me that I should have been looking for a 29C256 rather than 28C256 for pin compability. Damn!

I've got a feeling I've got some original UVEPROMs (27C256) lying around somewhere, so I'll see if I can find them before I trouble you further.

Thanks again.

Geoff.

by **GeoffSmith** » Thu 18.05.2006, 00:54

27C256 found, erased, programmed with Alan's bits and fitted.

Runs OK with no warning light.

The SADIM touch is deserting me it seems.

Now there's only the exhaust, Peugeot A/C and Polo steering rack to sort out.

by **GeoffSmith** » Thu 18.05.2006, 20:30

She ran fine, thanks Alan you're a hero.

Wound up the turbo to check the fuel cutout and nearly ended up hitting the steering wheel! Even at ~£250 a chip, it looks like those naughty boys at Superchips have overiden one of Lotus's normal protection features. This would appear to be necessary at some stage during the Elan's life, as sticking waste valves seem to be a common problem. I wonder how many other "features" are missing?

IMHO, there is only one person to trust if you want to chip your Elan and that is ESM.

Geoff

Lotus Elan Central

overboost damage

Who is online