Honda Prelude Forum
 
Go Back   Honda Prelude Forum > Tech-Talk > 3rd Gen Honda Prelude

Thread Title
01010100 01101000 01100101 00100000 01010000 01001011 00110010 (The PK2)

 
Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 02-29-2016, 04:47 AM
Bronze Member
 
Join Date: Jul 2015
Location: Seattle WA USA
Posts: 152
iTrader: (0)
luda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond repute
01010100 01101000 01100101 00100000 01010000 01001011 00110010 (The PK2)

Some of you have seen some of my work through other outlets to the community, so for the redundancy I apologize, I just felt like getting all those interested up to speed.

I started breaking down the PK2 code , then took a break for about a year. This weekend I took another look at it and made some progress so I figured I would share. Most of this post will be copied in chronological order from my previous posts around the web, I will try not to copy similar posts. Enjoy the read... or don't, this isn't for everyone.




I have interest in developing support for the 88-91 PK2 preludes and the accord PH3 as the boards and roms are interchangeable. I have been doing allot of research and I have chip set data sheets, many roms, both untouched and some I de-compiled and in the process of sifting through(self teaching as I go). I have a mask created for Tuner Pro RT to allow table editing, and even have a one-off version of turbo edit that wasn't ever released that can read and edit the load maps, but that's about it. I have been going through the syntax of several PK2 roms, and found that the instructions are different for each rom, although I can use any PK2 rom in any combination of PK2 ecu with no check sum or other problems. (I don't know if this normal as I am only into learning how to read code about a week). One thing I have noticed is that when using the 0011 boards, the idle is higher than the 0010 boards regardless of rom used. I have been tracing circuits of the PK2 and have pages of notes and will post when finalized, or requested. Data logging both MT and AT maps, I find that there is next to no difference, however it seems the AT uses slightly less timing. I am sure I am missing some findings, it has been a busy week. If anyone has interest, any help would be appreciated, and also seeing if there is any demand for support for a nearly 30 year old car. If anyone is interested I hope this helps.

Oh and one more thing I am not sure if this is normal or not, but there are six fuel, and six ignition maps. Fuel maps are 16bit, and ignition is 8bit.
======
You could use an OBD0 Civic or Integra ECU, however you have to use a matching distributor. Other OBD0 Honda's us a 16 tooth reluctor wheel in the distributor for the CKP, the PK2 and PK3 BA4 Preludes use a 24 tooth reluctor wheel similar to that found in OBD1 Honda's, however it is at a different phase angle in relationship with the TDC and CMP I suspect because of the faster piston speeds found in the B20A engine family. The other OBD0 ECU's will not run our cars and set a list of CEL codes without the proper dizzy plus the BA4's use a different ECU pinout than other OBD0 Honda's. OBD1 ECUS's will run our cars on the stock dizzy with a custom ECU adapter until about 3500 rpm when a CEL9 is triggered and "limp mode" is enacted due to that phasing angle I spoke of becoming to great, so again you will need to change to a dizzy that matches the ECU family of use. I don't like changing things I don't have to, and our ignition systems are more powerful and more reliable than those found in most OBD1, so I have embarked on this project.

As the post from *members name* states I now have the ability to modify the ignition and fuel maps without setting a checksum fault and going into limp mode. Due to the holiday I wont have time to work on this for a few days, but I believe I have found the serial handler protocol in the ecu that with some modifications would allow us to datalog directly from the ECU at connector CN3 using freelog. Once I get datalogging done, I will be looking to modify RPM cut and hopefully add a two step rev limiter.

At this time if you wish to use boost, you will have to use a GM 3bar sensor, then rescale your load maps by hand.

At this point I do not have a proper rom editor, so most my changes have been on a binary level that is not user friendly for most. At some point down the road I hope to have one in place so anybody can modify from home. I have made a handling mask for TunerProRT(free download) That will allow you to change injector pulse width down to .01% duty cycle, and ignition timing down to the 0.001 degree (ecu hardware permitting), but you will have to disable the checksum by hand in hex/binary format at this time, or I can send a bin file that is ready for table editing. Any testers and or developers will be welcomed, and I will keep posting progress.

The things I want to accomplish before I can call it done:
Modify fuel/ignition tables
Modify idle tables
Modify rev. limits
Add launch control
Add boost control(probably through EGR circuit)
Add boost fuel/ignition tables
Add 1wire VTEC control(for those using B18C/B16 heads, if you're still out there)
ROM editing program
======
I want the entire 3g community to benefit, so I will explain what I can as I can. If there ever any questions just ask and I will do my best. Given time this is something any one can learn, you don't need any fancy schoolin, although it may help. Two months ago before I started this project I had never even looked at coding, I had no idea what it looked like or where to start so I under stand if this is jiberish.

Here is an example of how to disable the checksum. The ECU used in this example is a PK2-0133. this is the stock code for the checksum subroutine.

(the 0133 ecu rom only has 20160 lines of code )

X059e: mov r0,#0f9h
movx a,@r0
mov dph,a
inc r0
movx a,@r0
mov dpl,a
inc r0
movx a,@r0
mov r4,a
clr a
movc a,@a+dptr
add a,r4
movx @r0,a
mov r4,a
inc dptr
dec r0
mov a,dpl
movx @r0,a
dec r0
mov a,dph
movx @r0,a
cjne a,#80h,X05da
mov a,r4
jz X05ce
;
mov dptr,#X1150
movx a,@dptr
inc a
cjne a,#3,X05cb
mov ie,#90h

A little background for those who don't know what the checksum is. Checksum is a subroutine in a computer program that takes all the data bits in that program, adds them all together, then subtracts from a programmed value, then checks this sum to verify memory integrity. In Honda ECU's this sum must equal zero every time, this makes it very easy.

In the code above you will see the code string starts at hex address X059e(same as 059eh just written different). near the end of the code I bolded line "jz X05ce". This is were the sum of all that math must add up. "jz" means jump if zero. So if the math adds to zero, everything is good and the program jumps to X05ce and continues on its marry way. If it does not add to zero, the ECU cannot trust itself and goes into limp mode. If we change anything in the rom file, it will no longer add to zero without extensive work.

So the fast easy way to fix this is make it jump to location X05ce regardless of the math. "sjmp" mean small jump. So if we simply change the one line from "jz X05ce" to "sjmp X05ce" it will pass the checksum routine every time and continue on its marry way.

This line in this rom can be found exactly at hex address X05bc and stock has a value of 60. By changing this value to 80, you have changed the word value from "jz" to "sjmp" and disabled your checksum. You can find free hex editors in tunerproRT, Maotes flash and burn, or download several free editors online.

I hope this helped at least a little bit.
======
Okay, been doing a little work this morning. I think I found data logging. I haven't tested in a car yet because I need to do some work to my laptop, but with ECU powered up on the bench I do get call backs in free log using the following changes. Again I used a 0133 ECU as an example.

Here is a section of the serial handler in stock format:

o4e0 mov ip,#1
mov tmod,#11h
mov tl0,#0f0h
mov th0,#0d8h
mov pcon,#80h
mov scon,#90h
mov tcon,#15h
mov 46h,#5
acall X00cd
mov ie,#17h
jnb 21h.7,X0502
clr ex0

And here it is in a manner that answers:

o4e0 mov ip,#1
mov tmod,#11h
mov tl0,#0f0h
mov th0,#0d8h
mov pcon,#00h
mov scon,#50h
mov tcon,#15h
mov 46h,#5
acall X00cd
mov ie,#17h
jnb 21h.7,X0502
clr ex0

Very little changes, but as you can see I changed lines 4 and 5. The Hex addresses of these changes are X04EE: Stock=80 -> change to 00, and Xo4F1: Stock=90 -> change to 50

I don't have sensor input locations found at this point so the data displays are funny, but it does answer back.

If anyone wants to verify this, that would be great. In free log set your buad to 38400. I will be doing some work on my laptop soon and test this for my self, and I will work on locations for specific data.
=========
Sorry, I haven't been working on this since the new year. I hope to pick it up again when things settle down. In time I hope to create a rom editor for these ecus, or at least the PK2. I am by no means a programmer, I am simply a part time tuner with interest, I am learning as I go. *members name*, I have checked out your photos aswell as your information on the PH3's a couple months ago, good stuff. I have also had some contact with Chen, who started this about 5 years ago, however he has no interest in continuing. I do hope to deal with the EGR soon. Much can be done with EGR, we can disable it for power, modify it for fuel economy, or even modify it for boost control solenoid applications. At this time I don't know enough about it though. Int he past when I have disabled EGR on these cars I simply put a block-off plate between the intake and egr valve or tube. This has never set a code because flow is not monitored, only lift. BR8 jumps the second o2 to sensor ground inside the ECU, I am assuming to disable this sensor, but I haven't had time to test. I have several ECU internal circuit tracks traced out, but most are still incomplete as I don't have data sheets for all the IC's
======
Alright, I know its been its while. Sorry I haven't worked on code lately, but I did get some pics of a french pk2 witch has no EGR. The boards are the same(share same number) but right off the bat I see that the french is missing several components found on the usdm. The list starts with CM2,IC14A,R76,R7,C22,C21,R75,R6(all found in one white option box) plus RM4,TM3,Q21,D20,R127.

now, those interested in EGR disabling, the following components are used in EGR lift sensor monitoring, R116,C88,R114,R113,1C14A,CM2,C12, and C14

in EGR control, D20,Q21,RM1

My traces are incomplete as I need component data sheets.

Maybe EGR can be disabled mechanically, but I am still going to try to do it through code. I am still looking for a euro rom that has no factory EGR.
======
I know its not much of an update, but its still an update. I earlier stated that jumping BR8 would disable the second o2 sensor. I gathered this assumption by studying the circuitry of the ecu. A more accurate statement would have been "should" disable.... well, the other day I finally got a chance to try my theory, and unfortunately I was wrong. Jumping BR8 seems to have no effect on the runnability of the car, and the o2 will still flag fault code. I still think BR8 is for disabling the o2, I just think there is more to it I still need to find.
======
Okay, sorry to take this thread back to where it belongs, but I have finally picked this up again.

Today I improved the equations for turning the raw hex into usable values as I did't feel my original equations were quite accurate enough, and my lab scope when reading real-time telemetry agreed.

My old equation for calculating fuel injector duty cycle % was D=V*0.027.

I now find that D=(V*0.027)-(110.595*M) is a far more exact calculation.

The variables in this are D-duty cycle, V-raw table value in hex converted to decimal, and M-table multiplier.

What was the missing piece that brought about the new equation? Well it was "M". I noticed the "M" value very early on however I assumed it was a FLAG in the code causing a table jump, so I would remove the "M" value in order to display the "V" in a readable manner in the ROM editor as I believe I have mentioned before.

Just for an example of what the hell I am rambling about here, 6411 is the hex value given in the first fuel table at specific location 7230h. This is the first fuel value with a multiplier other than 0. In this example the 6 at the beginning is the multiplier and the 411 is the actual raw base value. The HEX value 6411 equates to DECIMAL value 25617. So after a little math we can find the injector duty cycle (a number that actually means something to a human) for this load cell.

D=(25617*0.027)-(110.595*6)

D=691.659-663.57

D=28.089

So at as you can see at address the 7230h the actual injector duty cycle is 28.089%.

Timing is far easier as it does not use multipliers, and for those who will ask, remember our fuel tables are 16bit and our timing tables are 8bit. My equation hasn't really changed here, I just use a new value that makes it far more accurate. My old equation was A=(V-15)*0.2. I am now using A=(V-15)*0.3061. Again lets list the variables, A=timing advance in degrees, V= raw HEX value in the map. So, just another damn example: I will be using HEX value 40 because it is the first value in the first timing map at specific address 5900h. To save time, the DECIMAL equivalency is 64. Again with the math, when will this crap stop...

A=(64-15)*0.3061

A=49*0.3061

A=14.9989

So at location 5900h the ECU is commanding 14.9989 degrees of timing advance.

Thick as mud? Don't worry, mud will wash off. Happy ROM editing and I will post more as it comes up
=====

okay, if you made it this far and still have interest, I will give you a copy of tunerproRT, the XDF file to handle the PK2 roms, and many PK2 roms from around the world. I stated at some point that the check sum had to be manually disabled, this is no longer the case. I have added the checksum disable feature to my latest tunerpro XDF. Here are some location addresses if you wish to try some of this yourself:

fuel tables-16bit

LOCATION: SIZE:

X70F0-X7397 20X17
X7398-X763E 20X17
X7640-X78E6 20X17
X78E8-X7B8E 20X17
X7B90-X7D04 11X17
X7D06-X7E7A 11X17

ignition tables-8bit

LOCATION: SIZE:

X5900-X5A3E 20X16
X5A40-X5B7E 20X16
X5B80-X5CBE 20X16
X5CCO-X5DFE 20X16
X5E00-X5EAE 11X16
X5EB0-X5FSE 11X16

CHECK SUM LOCATIONS

Ebay pk2 "performance" chips
(they forgot to remove the check sum, no wonder they don't work)
check sum code begins at X059E
address X05BC..60=checksum on..80=checksum off
(changes jz X05CE to sjmp X05CE)


jdm b20

check sum code begins at X059E
address X05BC..60=checksum on..80=checksum off
(changes jz X05CE to sjmp X05CE)


aus b20

check sum code begins at X05F6
address X0614..60=checksum on..80=checksum off
(changes jz X0626 to sjmp X0626)


PK2 ROM 51(ECU UNKNOWN)

check sum code begins at X059E
address X05BC..60=checksum on..80=checksum off
(changes jz X05CE to sjmp X05CE)



0133

check sum code begins at X059E
address X05BC..60=checksum on..80=checksum off
(changes jz X05CE to sjmp X05CE)


6220

check sum code begins at X05F6
address X0614..60=checksum on..80=checksum off
(changes jz X0626 to sjmp X0626)


6640

check sum code begins at X05F6
address X0614..60=checksum on..80=checksum off
(changes jz X0626 to sjmp X0626)


6760

check sum code begins at X0569
address X0587..60=checksum on..80=checksum off
(changes jz X0599 to sjmp X0599)


6950

check sum code begins at X0569
address X0587..60=checksum on..80=checksum off
(changes jz X0599 to sjmp X0599)
Reply With Quote
  #2 (permalink)  
Old 03-01-2016, 12:58 AM
Platinum Member
 
Join Date: Mar 2011
Location: Eastern WA
Posts: 2,261
iTrader: (1)
luzer has a reputation beyond reputeluzer has a reputation beyond reputeluzer has a reputation beyond reputeluzer has a reputation beyond reputeluzer has a reputation beyond reputeluzer has a reputation beyond reputeluzer has a reputation beyond reputeluzer has a reputation beyond reputeluzer has a reputation beyond reputeluzer has a reputation beyond reputeluzer has a reputation beyond repute
Re: 01010100 01101000 01100101 00100000 01010000 01001011 00110010 (The PK2)

Damn son, that's a lot of work. Most of it might as well be written in French as much as I was able to follow though, lol. I kind of wish I wouldn't have gotten rid of my 89 (PK2) and picked up a 91 (PK3). Everyone always said that nothing could be done with the PK2 ecu. I'm glad to see someone who is willing to put in the time to work with it. Keep up the good work!
__________________
1991 Prelude Si ALB 4WS
2017 Ram Rebel
Reply With Quote
  #3 (permalink)  
Old 03-03-2016, 01:24 AM
Bronze Member
 
Join Date: Jul 2015
Location: Seattle WA USA
Posts: 152
iTrader: (0)
luda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond repute
Re: 01010100 01101000 01100101 00100000 01010000 01001011 00110010 (The PK2)

Quote:
Originally Posted by luzer View Post
Everyone always said that nothing could be done with the PK2 ecu. I'm glad to see someone who is willing to put in the time to work with it. Keep up the good work!
Thanks. The reason everyone always said that nothing could be done is because no on ever wanted it to be done. If anyone wants some stuff for the PK3 I could probably look into that too, but I don't have any PK3 stuff to work with.
Reply With Quote
  #4 (permalink)  
Old 03-07-2016, 02:44 AM
Platinum Member
 
Join Date: Feb 2010
Location: Fayetteville, Ga.
Posts: 1,281
iTrader: (0)
Lespaul59 has a reputation beyond reputeLespaul59 has a reputation beyond reputeLespaul59 has a reputation beyond reputeLespaul59 has a reputation beyond reputeLespaul59 has a reputation beyond reputeLespaul59 has a reputation beyond reputeLespaul59 has a reputation beyond reputeLespaul59 has a reputation beyond reputeLespaul59 has a reputation beyond reputeLespaul59 has a reputation beyond reputeLespaul59 has a reputation beyond repute
Re: 01010100 01101000 01100101 00100000 01010000 01001011 00110010 (The PK2)

I've got 3 extra pk2 ecm's if you need to borrow one, luda8890.
Reply With Quote
  #5 (permalink)  
Old 03-07-2016, 07:15 PM
Bronze Member
 
Join Date: Jul 2015
Location: Seattle WA USA
Posts: 152
iTrader: (0)
luda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond reputeluda8890 has a reputation beyond repute
Re: 01010100 01101000 01100101 00100000 01010000 01001011 00110010 (The PK2)

Quote:
Originally Posted by Lespaul59 View Post
I've got 3 extra pk2 ecm's if you need to borrow one, luda8890.
Thank you for the offer Lespaul59. I have a box of USDM PK2 ecus, about twice as many ROM's, and high def pictures of the ECU variants I do not have. If you have a B20A7 ecu it may spark my interest as it seams to be the only one that is actually really different, although I believe I have enough information to create a replica A7 ECU.


The community has been very generous supplying images of the PCB boards, different option layouts, and ROM copies. If anyone wants to help read though the coding or sift through the hex to find other tables that would be great. The greatest issue I have been having is it seems the PK2 ROM construction and calculation subroutines seem to be done in a different manner than many of the other Honda ECU's, so a lot of my limited experience with altering the mainstream Honda ECU's is of little to no help. If anyone is interested let me know and I will do my best to get you up to speed, and if you have experience, maybe you can get me up to a higher speed.


Also if anyone wants a socket added to their PK2 ECU for ROM swapping, let me know. Ship it to me, I will install a socket and your factory rom at no cost (If you want a different rom, it will be $5 to cover the cost of the chip).

Last edited by luda8890; 03-07-2016 at 07:20 PM.
Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT -4. The time now is 02:11 AM.



Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2019, vBulletin Solutions, Inc.
LinkBacks Enabled by vBSEO 3.6.0 PL2 © 2011, Crawlability, Inc.
vB.Sponsors


Copyright © 2006-2009 PreludeZone.com All Rights Reserved.