Toyota GR86, 86, FR-S and Subaru BRZ Forum & Owners Community - FT86CLUB

Toyota GR86, 86, FR-S and Subaru BRZ Forum & Owners Community - FT86CLUB (https://www.ft86club.com/forums/index.php)
-   Software Tuning (https://www.ft86club.com/forums/forumdisplay.php?f=88)
-   -   Tactrix EcuFlash Info for BRZ 86 FRS Rom flash update and logging (https://www.ft86club.com/forums/showthread.php?t=62332)

Td-d 10-20-2015 02:53 PM

I'll have a look at the def, looks like the wrong addresses for the axes made their way in.

Td-d 10-20-2015 04:31 PM

Quote:

Originally Posted by steve99 (Post 2423258)
pm @Td-d he may be able to help with that

FFF88048 Ram_MAF_Voltage

benk 10-20-2015 06:56 PM

Quote:

Originally Posted by Td-d (Post 2426125)
FFF88048 Ram_MAF_Voltage

I cant work out how to do the "thank" thing on the forum like steve99 did but Thanks!

xtrashocker 10-21-2015 03:02 AM

@ Steve99 and Td-d
I didn't want to alter those tables, i just found them by having a quick check before flashing with wrong def files. No need for alter these tables...

As steve already said: it works very well with this little errors, also in my case.
Now I used Romraider as suggested to edit the file and wrote it via ECUFlash.
No problems :thumbup:

Thanks for all the science and support

Agrael 10-29-2015 11:06 PM

Hi @steve99 @Td-d:
op2 The logger now supports Chinese version of ECU yet?(ZA1JA01N、ZA1JA03N and ZA1JA01O)

steve99 10-29-2015 11:13 PM

Quote:

Originally Posted by Agrael (Post 2436401)
Hi @steve99 @Td-d:
op2 The logger now supports Chinese version of ECU yet?(ZA1JA01N、ZA1JA03N and ZA1JA01O)

Tactrix logger will support any brz\86 rom, you just need the list of ecu ram addresses to suit your rom as each rom uses different addresses, the scaling will be same.

Currently tdd is the only guy with requied skills to discover these addresses for you

the tactrix guys may also be able to assist

Agrael 10-29-2015 11:26 PM

Quote:

Originally Posted by steve99 (Post 2436410)
Tactrix logger will support any brz\86 rom, you just need the list of ecu ram addresses to suit your rom as each rom uses different addresses, the scaling will be same.

Currently tdd is the only guy with requied skills to discover these addresses for you

the tactrix guys may also be able to assist

I do not know how to find these memory addresses, looking for a long time did not find a method, also please guide us.

steve99 10-29-2015 11:31 PM

Quote:

Originally Posted by Agrael (Post 2436418)
I do not know how to find these memory addresses, looking for a long time did not find a method, also please guide us.

@Td-d should be able to help it requires ecu code disassembly.

he will usually respond here or you can try the www.romraider.com forum if you join you can email him same username

Agrael 10-29-2015 11:43 PM

Quote:

Originally Posted by steve99 (Post 2436424)
@Td-d should be able to help it requires ecu code disassembly.

he will usually respond here or you can try the www.romraider.com forum if you join you can email him same username

thx, ecu code disassembly is a bin file or hex file(ZA1JA01N.hex)?or something else?

steve99 10-30-2015 12:10 AM

Quote:

Originally Posted by Agrael (Post 2436435)
thx, ecu code disassembly is a bin file or hex file(ZA1JA01N.hex)?or something else?

The romraider guys look at the instruction set for the processor in this case a Renasis SH72531 micro-controller.

Then using that instruction set and lots of software and scripts they have developed reverse engineer the ecu instructions, highly complex and time consuming task

Agrael 10-30-2015 01:05 AM

Quote:

Originally Posted by steve99 (Post 2436450)
The romraider guys look at the instruction set for the processor in this case a Renasis SH72531 micro-controller.

Then using that instruction set and lots of software and scripts they have developed reverse engineer the ecu instructions, highly complex and time consuming task

Feeling good complex, TD-D directly seek help, first with up ~ Thank you!

steve99 11-01-2015 04:56 AM

Added ZA1JF20P 2015 Manual mystery rom found in Australia ?? and Taiwan supposed to be Japan low final drive. Appears identical to ZA1JF10G rom (note I incorrectly named the ZA1GF10G as F01G now corrected.)

The F10G and F20P definitions are same.

@Td-d I think their is some errors in the Cranking IPW tables for the F10G rom

thambu19 11-06-2015 07:04 AM

I am not sure if this has been asked before. Sorry if it is a repeat. Can one use OFT def files along with OFT rom files and still flash it in using Tactrix?

thambu19 11-06-2015 07:24 AM

I think I got my answer here: http://www.ft86club.com/forums/showthread.php?t=78529
Thanks

D-VO 12-02-2015 02:17 PM

Hey guys. Does anyone have the "ChecksumFix" scaling available? I've searched through all my ROM's with no luck. I'm trying to convert all the SD tables from RomRaider over to ECUFlash. Thanks.

steve99 12-03-2015 07:59 AM

Quote:

Originally Posted by D-VO (Post 2468038)
Hey guys. Does anyone have the "ChecksumFix" scaling available? I've searched through all my ROM's with no luck. I'm trying to convert all the SD tables from RomRaider over to ECUFlash. Thanks.


Im not 100% on what your actually asking for but here is a utility to convert RR defs to ecuflash defs.

you will generally need to correct a couple of things

flash method
mem model
and other initial header values
as per below in the ecuflash def after running the conversion utility

<rom> <romid> <xmlid>ZA1JF00C</xmlid>
<internalidaddress>8000</internalidaddress>
<internalidstring>ZA1JF00C</internalidstring>
<ecuid>A929703007</ecuid>
<year>2016</year>
<market>USDM</market>
<make>Subaru</make>
<model>BRZ</model>
<submodel>FA20</submodel>
<transmission>MT</transmission>
<memmodel>SH72531</memmodel>
<flashmethod>subarubrz</flashmethod>
<checksummodule>subarudbw</checksummodule>



9. How to Convert any RomRaider Editor def to a EcuFlash def
  1. Use the RR2EcuFlash.exe to convert any RR def to an EcuFlash def.
  2. Conversion of 16 bit ECU defs may require some manual updates to make them 100% usable.
  3. Copy the file created by the converter to your EcuFlash rommetadata directory and startup EcuFlash, then open the ROM for editing.
Application: RR2EcuFlash.exe

its a command line utility so you will need to run it from a DOS or command window


The full page on romraider here

http://www.romraider.com/forum/viewtopic.php?t=8449

D-VO 12-03-2015 02:00 PM

I've been doing conversions manually this whole time. Thanks.

Remember the checksum fix we had when ECUFlash was first supporting the FRS/BRZ platform? Everything in RR was defined so I would load my ROM into RR to make the changes, then load it back into ECUFlash to do my reflash, but we had to manually change the checksum value for it to all work properly. That scaling is what I need to make an on/off switch to turn SD on and off for testing.

Anyway, let me see if I can figure this program out. Thanks!

steve99 12-03-2015 02:09 PM

Quote:

Originally Posted by D-VO (Post 2469063)
I've been doing conversions manually this whole time. Thanks.

Remember the checksum fix we had when ECUFlash was first supporting the FRS/BRZ platform? Everything in RR was defined so I would load my ROM into RR to make the changes, then load it back into ECUFlash to do my reflash, but we had to manually change the checksum value for it to all work properly. That scaling is what I need to make an on/off switch to turn SD on and off for testing.

Anyway, let me see if I can figure this program out. Thanks!

I read about that, but by the time i was flashing it was all sorted and you did not have to do it anymore. i think ztan was accross that, maybe PM him ?

Agrael 12-14-2015 02:41 AM

Quote:

Originally Posted by steve99 (Post 2469074)
I read about that, but by the time i was flashing it was all sorted and you did not have to do it anymore. i think ztan was accross that, maybe PM him ?

Chinese version seems a distant dream ~:brokenheart:

thambu19 12-15-2015 06:49 PM

Quote:

Originally Posted by Agrael (Post 2479846)
Chinese version seems a distant dream ~:brokenheart:

A buddy of mine bought the Tactrix clone and it failed in the middle of a write and bricked his ECU. I had warned him not to do so and he did it despite that so I guess it serves him well... Tried to save 100 bucks on cable and now spent another 300 on ECU

EAGLE5 12-15-2015 08:26 PM

The actual Tactrix is cheap for what you get. The OFT too.

Rossi 12-19-2015 04:09 PM

Would it be possible to flash using a ELM 327 cable or a obd2 cable that can read data? Or do you have to have the tactrix cable?

EAGLE5 12-19-2015 05:36 PM

Tactrix's software is locked into their hardware. Some of the clones work with the hardware, but bricking your ECU is no fun. I strongly suggest real Tactrix or OFT. EcuTek is good for people getting a custom tune from a pro. The big boys often use an ECU replacement.

steve99 12-20-2015 02:56 AM

Quote:

Originally Posted by Rossi (Post 2486224)
Would it be possible to flash using a ELM 327 cable or a obd2 cable that can read data? Or do you have to have the tactrix cable?

ELM327 adapters can only do basic interaction with ECU using standard OBD calls, ie read cel codes clear cel codes and access basic engine data that the manufacturer has made available via standard obd call they are required to by law.

To flash the ECU with new ROM data you need a specialized device any one of the 3 below will work they are in order of cheapest to most expensive. Tactrix is the least user friendly

Tactrix adapter
OpenFlash Tablet -comes with free tunes
Ecutek Cable and Licience

dave- 01-04-2016 05:04 AM

Probably been asked before but info seems to be all over the place...

What/where are the most complete RR definitions for the A01G ROM? There are Td-d github repos, I've seen OFT ones from @Wayno dated late last year, revisions by @Kodename47 and various useful additions by @ztan.

I'm not using an OFT to flash but from memory that doesn't matter in the case of A01G def's?

Second question, can someone provide a working G series logcfg.txt file to do tactrix logs with boost? Think I have the wrong addresses or settings. Did try to generate a new logcfg file with that app but it gives me an error because the RR logger isn't configured correctly. I gather most boosted people are running ecutek here from my searches? Sprintex supercharger kit in my case.

steve99 01-04-2016 08:28 PM

Quote:

Originally Posted by dave- (Post 2497609)
Probably been asked before but info seems to be all over the place...

What/where are the most complete RR definitions for the A01G ROM? There are Td-d github repos, I've seen OFT ones from @Wayno dated late last year, revisions by @Kodename47 and various useful additions by @ztan.

I'm not using an OFT to flash but from memory that doesn't matter in the case of A01G def's?

Second question, can someone provide a working G series logcfg.txt file to do tactrix logs with boost? Think I have the wrong addresses or settings. Did try to generate a new logcfg file with that app but it gives me an error because the RR logger isn't configured correctly. I gather most boosted people are running ecutek here from my searches? Sprintex supercharger kit in my case.

kodename47 are probably the most upto date he has usually intergrated most of the other guys stuff.

you can only extract parameters the ecu uses with the logging, if you after some extra parameters you could try asking ztan

romraider logger not set up for our ecu

you might want to talk to @D-VO he has done supercharger open source

ztan 01-05-2016 12:09 AM

Quote:

Originally Posted by dave- (Post 2497609)
Second question, can someone provide a working G series logcfg.txt file to do tactrix logs with boost? Think I have the wrong addresses or settings. Did try to generate a new logcfg file with that app but it gives me an error because the RR logger isn't configured correctly. I gather most boosted people are running ecutek here from my searches? Sprintex supercharger kit in my case.

paramname = MAP
paramid = 0xFFF87C60
isfloat = 1
scalingrpn = x,0.133322368,*

Logs MAP in kPa

dave- 01-05-2016 05:23 AM

Quote:

Originally Posted by ztan (Post 2498464)
paramname = MAP
paramid = 0xFFF87C60
isfloat = 1
scalingrpn = x,0.133322368,*

Logs MAP in kPa

That's what I had, didn't know it was kPa though which helps. But my logs still don't look right as WOT runs peak at 137.297 kPa so ~20psi?

It's a Sprintex SPS/210+ kit with 69mm pulley. Positive the peak was 12-13psi on the dyno.

Did some logs yesterday/today with some spirited driving.
http://datazap.me/u/dave/sprintex-tune
http://datazap.me/u/dave/sprintex-tune-log-2
http://datazap.me/u/dave/sprintex-tune-log-3

ztan 01-05-2016 05:29 AM

Quote:

Originally Posted by dave- (Post 2498579)
That's what I had, didn't know it was kPa though which helps. But my logs still don't look right as WOT runs peak at 137.297 kPa so ~20psi?

It's a Sprintex SPS/210+ kit with 69mm pulley. Positive the peak was 12-13psi on the dyno.

Did some logs yesterday/today with some spirited driving.
http://datazap.me/u/dave/sprintex-tune
http://datazap.me/u/dave/sprintex-tune-log-2
http://datazap.me/u/dave/sprintex-tune-log-3

MAP is in kPa absolute.

137kPa absolute = 100kPa atmospheric + 37kPa (5.3 psi) boost.

Is your MAP sensor scaling right? Which sensor are you using and which ROM address did you adjust (the original def sensor scaling addresses were wrong). Just had a look at your logs - your MAP is pegged high at 137kPa which looks like a maxed out stock sensor. The psi boost value is in your logs as manifold_relative_pressure.

Stock sensor scaling = 250mmHg/V -150mmHg
Stock sensor at 5V = 1100mmHg ~= 145kPa

ps: you can delete the AF_Corr_3 and AF_Learn_3 values from your logcfg.txt - I'm sure the latter is an OL_enrichment value and I haven't traced the AF_Corr_3. You can also boost the sampling rate by dropping some of the parameters that you aren't really looking at and decreasing the calcsampinterval value - I am using 500 at the moment and log 32 parameters at 40ms interval.

dave- 01-05-2016 05:39 AM

1 Attachment(s)
Quote:

Originally Posted by ztan (Post 2498583)
MAP is in kPa absolute.

137kPa absolute = 100kPa atmospheric + 37kPa (5.3 psi) boost.

Is your MAP sensor scaling right? Which sensor are you using and which ROM address did you adjust (the original def sensor scaling addresses were wrong).

Yeah saw the ~5psi bit when I added this from some thread here:
paramname = Manifold_Relative_Pressure
paramid = 0xFFF88F78
isfloat = 1
scalingrpn = x,0.0193367747,*

Believe it is the OEM MAP sensor as the kit doesn't change it. Not 100% sure.

Manifold Pressure Sensor Scaling A/B/C are the same:
http://www.ft86club.com/forums/attac...1&d=1451990136

ROM def's are Kodename's metric & % one:
<table name="Manifold Pressure Sensor Scaling A" storageaddress="1000CC" />
<table name="Manifold Pressure Sensor Scaling B" storageaddress="1000E4" />
<table name="Manifold Pressure Sensor Scaling C" storageaddress="11CC20" />

Logged using:
paramname = MAP
paramid = 0xFFF87C60
isfloat = 1
scalingrpn = x,0.133322368,*

Should add it isn't my tune and from my inexperienced eye, looking at the logs it isn't very good anyway.

ztan 01-05-2016 05:54 AM

Quote:

Originally Posted by dave- (Post 2498585)
Yeah saw the ~5psi bit when I added this from some thread here:
paramname = Manifold_Relative_Pressure
paramid = 0xFFF88F78
isfloat = 1
scalingrpn = x,0.0193367747,*

Believe it is the OEM MAP sensor as the kit doesn't change it. Not 100% sure.

<table name="Manifold Pressure Sensor Scaling C" storageaddress="11CC20" />

The scaling at 11CC20 is the only one that affects MAP.

When you get a uprated MAP sensor, have a look at my boost fuel cut fix to protect you from major overboost. Boost protection at the moment with that stock sensor won't work, but not critical with supercharger compared to turbo.

dave- 01-05-2016 05:59 AM

Quote:

Originally Posted by ztan (Post 2498589)
The scaling at 11CC20 is the only one that affects MAP.

When you get a uprated MAP sensor, have a look at my boost fuel cut fix to protect you from major overboost. Boost protection at the moment with that stock sensor won't work, but not critical with supercharger compared to turbo.

Scaling for C is the same so all good there.

Have all your opensource threads saved, as you said not critical with the blower but would def do it for a turbo.

Will have to confirm still stock sensor but not overly impressed with the setup so far so who knows how long the kit will stay installed anyway!

Kodename47 01-05-2016 09:35 AM

You can't change the MAP sensor on the Sprintex, but there's no need. MAP just caps at the sensor limit.

What's wrong with the setup @dave-?

dave- 01-06-2016 04:12 AM

Quote:

Originally Posted by Kodename47 (Post 2498668)
What's wrong with the setup @dave-?

We're not seeing much of a difference to a couple cars with the standard kit and 75mm pulley after custom tuning. The canned tune that was supplied with the stage 2/plus kit is part of the problem (it's shit) but ultimately the claimed improvements of the stage 2/plus blower and extra boost from the 69mm pulley, I'd expect a lot more than we're seeing.

Need to get the car on a dyno again and put some decent effort into the tune. I'll report back once that is done. Haven't ruled out hardware or install issues either as yet. I do know the intercooler took a few go's to bleed completely. I wasn't present for the install so not sure what happened there or if its a common thing. Haven't read much of the sprintex thread TBH.

D-VO 01-10-2016 03:05 AM

Hey guys. QQ for you: Where exactly does the 'GDI Firing Angle Low Load Cold' become effective? Its a little confusing. Why would there be a designation of "High Load" and "Low Load" if both tables have an X-Axis of 0.20 -> 1.20 load? Also, where does "cold" start and end? @Td-d @Kodename47 @ztan Maybe??

Kodename47 01-10-2016 03:42 AM

Quote:

Originally Posted by D-VO (Post 2504316)
Hey guys. QQ for you: Where exactly does the 'GDI Firing Angle Low Load Cold' become effective? Its a little confusing. Why would there be a designation of "High Load" and "Low Load" if both tables have an X-Axis of 0.20 -> 1.20 load? Also, where does "cold" start and end? @Td-d @Kodename47 @ztan Maybe??

I don't know the answer to your question, but like the PI Ratio tables they are all set to the same so I've only ever seen them set all to the same. There must be some form of hysteresis however I very much doubt anyone would go to the bother of changing SOI dependent on temps.

D-VO 01-10-2016 03:41 PM

Theorizing for an answer to why at .70 load is so lean when the ECT is 65 - 144 degrees F. I was trying to run open loop to correct fueling issues under certain conditions, but its not working out.

ztan 01-10-2016 04:34 PM

Quote:

Originally Posted by D-VO (Post 2504316)
Hey guys. QQ for you: Where exactly does the 'GDI Firing Angle Low Load Cold' become effective? Its a little confusing. Why would there be a designation of "High Load" and "Low Load" if both tables have an X-Axis of 0.20 -> 1.20 load? Also, where does "cold" start and end? @Td-d @Kodename47 @ztan Maybe??

A01G:

High and Low Load switch is based on a value at FFF8A060 (1=high load table). Have not been able to trace where this gets set, I was wondering if it related to A/C on or off.

Cold/Hot switch for these tables is based at FFF89F42 (1=cold table). Again, I have not traced where this gets set - a lot of the RAM switches are set based on indirect referencing and can't be looked up easily.

ztan 01-10-2016 04:57 PM

2 Attachment(s)
Quote:

Originally Posted by ztan (Post 2504629)
A01G:

High and Low Load switch is based on a value at FFF8A060 (1=high load table). Have not been able to trace where this gets set, I was wondering if it related to A/C on or off.

Cold/Hot switch for these tables is based at FFF89F42 (1=cold table). Again, I have not traced where this gets set - a lot of the RAM switches are set based on indirect referencing and can't be looked up easily.


Looked at disassembly for A01G:

I think the Hot/Cold Tables are defined the wrong way around.
From sub 56ECC:

FFF89F42 is set to 1 when ECT>60 (at 10C5C8) and 0 when ECT<55 (at 10C5CC).

Cold tables (as defined) used when FFF89F42 = 1


Updated A01G def:
Code:

<table name="GDI Firing Angle Idle" storageaddress="110440">
      <table type="X Axis" storageaddress="1103D0" />
      <table type="Y Axis" storageaddress="1103FC" />
    </table>
    <table name="GDI Firing Angle High Load Hot" storageaddress="11056C">
      <table type="X Axis" storageaddress="1104FC" />
      <table type="Y Axis" storageaddress="110528" />
    </table>
    <table name="GDI Firing Angle High Load Cold" storageaddress="110698">
      <table type="X Axis" storageaddress="110628" />
      <table type="Y Axis" storageaddress="110654" />
    </table>
    <table name="GDI Firing Angle Low Load Hot" storageaddress="1107C4">
      <table type="X Axis" storageaddress="110754" />
      <table type="Y Axis" storageaddress="110780" />
    </table>
    <table name="GDI Firing Angle Low Load Cold" storageaddress="1108F0">
      <table type="X Axis" storageaddress="110880" />
      <table type="Y Axis" storageaddress="1108AC" />
    </table>


Td-d 01-10-2016 05:12 PM

Yup, you're right... that's what comes from pushing this stuff out in bulk :)

I'd better check all the defs and see if I've swapped them around in all the roms.


All times are GMT -4. The time now is 07:47 AM.

Powered by vBulletin® Version 3.8.11
Copyright ©2000 - 2026, vBulletin Solutions Inc.
User Alert System provided by Advanced User Tagging v3.3.0 (Lite) - vBulletin Mods & Addons Copyright © 2026 DragonByte Technologies Ltd.


Garage vBulletin Plugins by Drive Thru Online, Inc.