overboost damage

[GeoffSmith]

Thanks for the words of comfort Doug. I should point out that I'm an electronics engineer and haven't any quarms about blowing up (bad choice of words!) and fitting a stock PROM myself if I can get hold of all the PROM information and code. Having never disassembled the ECU however, I don't know about the construction (I've only had the car 5 minutes and I'm getting enough stick about the ALDL interface and "talking with my baby" - I think I got away with buying a laptop "for the kids" however ).

At the moment, she runs OK but I'm keeping a light right foot and I'm data gathering (forewarned is forearmed and all that).

Alan's website asks for PROM dumps for VINs which have 2, 5 or 6 as the 13th digit which lead me to ask the last question.

Geoff

PS is it alright for Alan and I to talk HEX on a public forum?

[Doug]

the 2 digit means it is like a 49state US car like mine and Alan knows what chip ID you'd need.

PS is it alright for Alan and I to talk HEX on a public forum?

[ESM]

Yeah Doug is right, if the PROM is corrupt then we can bypass it either with a mountain chip or a copy of a stock chip.

However, I'm still not sure quite what is going on here. More than 1kb of data looked changed compared to a stock 1499 chip, this should either have failed the checksum which would set a code and start limp-home mode - but this doesn't happen since you can't get ES logs in limp-home - or, if by some fluke the corruption took out the checksum test then the ECU should crash when it attempts to execute random code. Maybe its not corruption but a poor attempt at chipping and some dunce has removed all the self test code in order to disable overboost fuel cut????

I'll have a more careful look at the code, could you also check the ECU seals to see if there's any evidence of interference? If they are absent or broken it might be worth having a look inside...

[Sy V]

Cor! This is getting more intriguing than any soap opera.

Tune in for the next instalment folks!

[Enright]

Computation Street.

[Rambo]

Cor! This is getting more intriguing than any soap opera.

Tune in for the next instalment folks!

The only problem is that I don't understand a word of it. OEM PROM's, VIN's, HEX, FCD, MAP's, ALDL's............ WTF - are they speaking foreign language ??

Mark

[GeoffSmith]

100010101100111010100010100101

Corrrrrrrrr.

Look at the bits on that!

[GeoffSmith]

Alan, don't forget that it's been running fine (no overboost) until just recently.

What do you mean Doug, I've got a 49state car? It's got the wheel on the right side and been nowhere further West than Bristol! Can someone enlighten me please?

Anyway, I'm off to the chip shop to gen up on pulling my ECU out. Don't miss this evenings exciting episode (continued straight after the news).

[GeoffSmith]

Alan, your website appears to be down!

17:45 No, it's back up now. Back soon.

[GeoffSmith]

Well that wasn't too hard.

The ECU still has the warranty label firmly attached so I don't think it's been touched. Is the PROM removable from the MEMCAL and if so, do you know what type it is? If you do, I could check it out on a programmer for absolute confirmation and see if I've got any suitable replacements lying around the lab. If it is possible, could you provide me a copy of the stock memory dump?


I'm off to look at the Peco exhaust thread.

[ESM]

Geoff,

I'm mildly surprised its not been hacked.

I had a closer look at you PROM contents last night. The checksum stored in it is wrong and lots of $FF bytes have appeared in blocks where they aren't usually found as well as short runs of code that are different to a dump from a chip with identical program and scan ids to yours. If it is random corruption the ECU self test at start up should detect the corruption via the checksum and shut down ECU control. I can 't interpret the changes very well because I've done all the disassembly work on a 9929 chip download (from my '92 SE) and just found tables in the other types in other versions and not identified code. So while I can say all the tables and constants I have identified are identical I'm not sure what the function of the altered code is.

The chip I use is an SST 27SF512, this is an EEPROM pin compatible with the original EPROM but with twice the memory (64kb instead of 32kb) so the code has to be written to a start address of $8000. From memory the original is a 27C256. Its soldered into the memcal though, which is why the bypass boards I get from Craig Moates are very useful. I'll e.mail you a clean 1499 bin if you want.

As to the fact the car was running ok, I think the boost you're seeing is probably the result of a stuck wastegate (the BSV certainly doesn't seem to be responsible, the duty cycle is non-existent), the PROM 'trouble' was probably there before just not immediately apparent. The fact that your power is so low might indicate that it is having other detrimental effects in general running though.

[GeoffSmith]

Alan,

Sorry for not replying earlier - the IT gestapo at work seem to have been busy.

Thank you for spending the time to look at it for me. It is much appreciated.

I must admit to being a bit concerned as I would have thought the write enable pins would be hard wired disabled. In any case, there should not be the high programme voltage present (although I think some later devices had internal biassing circuits) and if there are FF's, it suggests erasure rather than programming bits to zero. Maybe the PROM is slowly dying: About a month ago, it wouldn't start after filling up - not the hint of a spark for several embarrasing minutes but it eventually spluttered back to life and then seemed OK. We did some accelerated ageing work about 15 years ago, looking at measunring long term retention of UVEPROM's charge and found quite a variability.

Anyway, I have found a 27C256, so I think I will programme it with the stock mapping to try and re-establish a baseline before I fit a new exhaust etc. if you wouldn't mind e-mailing me a bin file at your convenience (e-mail address PM'ed). I'll probably just socket it, if I can't find/fit a ZIF socket and I'll try and read the old PROM on the programmer for confirmation.

It's probably a good thing the wastegate stuck as it looks like I might have a problem that may otherwise not have revealed itself embarassingly or, as you say, with other detrimental effects.

I'll keep you updated.

Geoff

[GeoffSmith]

Sy,

10/10 for the sticky S2 register fix.
Your "learning opportunity" for today is to move half this thread to a more suitable area as it's gone decidedly sorry!

[ESM]

Bin file sent...

[GeoffSmith]

Thanks Alan.

[GeoffSmith]

Where's the week gone?

Someone "borrowed" the PROM programmer last week so only managed to blow an Atmel 28F526 today. New sockets ready and waiting but I'll probably wait until the weekend before removing the old PROM just in case.

Alan, is power cut off to the ECU and/or MEMCAL with the ignition off or do I have to disconnect the battery?

Geoff

[GeoffSmith]

ECU out.
Seals tampered with? Well they are now!
MEMCAL out.
Superchips PROM soldered in - explains a lot!
Unsoldered and removed (eventually) but a pig of a job.
It's getting late so socket (pain in the proverbial) or solder (easy)?
Done.
All bolted up, connected up and back in the car.
Sound of crickets under bonnet, engine warning light flickering on startup and Elanscan failure to communicate.
Swapped back to Superchips PROM and at least she runs - yes I did take the trouble to socket it rather than solder the new PROM in
Looking forward to tomorrow.
Anyone want a Superchips PROM for 2s 6½d (RRP £250).
Any thoughts Alan?

[GeoffSmith]

B*LLOCKS BOLL*CKS - forgot that 27 and 28 series PROMs have their write enable and A14's swapped
EEPROM checks out OK so triple socket swapover adapter made.
No chirping from under the bonnet.
It starts but the engine warning light stays on.
Elanscan still failed to comunicate so tried the paperclip test - nothing.
"Original" Superchip replaced and ES and PCT both work.

[ESM]

I thought it looked hacked....

I'm less knowledgeable than you on the workings of EEPROMs I'm afraid. I can send you a known-to-work Atmel 29C256, programmed and ready to go if you like.

[GeoffSmith]

Alan,

Thanks for the offer. You've just reminded me that I should have been looking for a 29C256 rather than 28C256 for pin compability. Damn!

I've got a feeling I've got some original UVEPROMs (27C256) lying around somewhere, so I'll see if I can find them before I trouble you further.

Thanks again.

Geoff.