PDA

View Full Version : Hacking a N/A V6 7202 to work in a VR-4



foxdie
31-08-2011, 12:14 PM
Hi all, crazy thought thread time! :sigh: :evilgrin:

Before all you nay-sayers start saying "this isn't possible!" I ask you to keep an open mind, I've already had a lengthy discussion with Nutter_John who believes there's a chance this may be doable.

History

Yesterday I was handed a MD340289 ECU with a MH7202F chip inside it, serial on the board was JE331B154D, I was told this came from a PFL VR-4, however when we tried to start a VR-4 with it the car started, ran very roughly for a second or two and then died, subsequent attempts to start the car yielded nothing.

I connected EvoScan up, tried to pull fault codes and nothing was listed. I tried logging the ECU and sure enough it was happy to report things like Throttle Position, Battery voltage etc. This ECU will henceforth be referred to as the bad 7202. We swapped this bad 7202 for another 7202 (good 7202 from now on), the car started first time. We replugged the bad 7202 back in, exactly the same problem, car would run roughly for a second or two and then die, no CEL, no errors logged with EvoScan, nothing. I immediately thought "fuelling issue".

I then tried pulling the ROM from the bad 7202, EcuFlash didn't recognise it but I kept a copy of it. I then pulled the ROM from the good 7202 and flashed it onto the bad 7202 without any problems, exactly the same issue as above though, rough running then nada. At this point, I thought the bad 7202 might be toast, so I started to inspect the PCBs;

Bad 7202 Back (http://dl.dropbox.com/u/36481366/ECU/bad-7202-back.jpg)
Bad 7202 Front (http://dl.dropbox.com/u/36481366/ECU/bad-7202-front.jpg)
Good 7202 Back (http://dl.dropbox.com/u/36481366/ECU/good-7202-back.jpg)
Good 7202 Front (http://dl.dropbox.com/u/36481366/ECU/good-7202-front.jpg)

Initially looking over both good and bad, it did indeed look like a VR-4 7202, with no visible signs of blown components or scorched tracks, so I consulted with John :stars:

Investigation

I ran through all the above with John, we started bouncing ideas back and forth, comparing pinout diagrams and between the two of us, we came to the conclusion it was most likely a N/A V6 7202 (more on this in a sec), I also passed him a copy of the unknown 7202 ROM image (http://dl.dropbox.com/u/36481366/ECU/Unknown%207202.hex), his EcuFlash didn't recognise it either so he opened it with a hex editor and the ID was a near match to a known-true N/A V6 Auto ECU ROM ID, further reinforcing the idea this was a N/A V6 7202.

Whilst John and I inspected the photos above, I started tracing back both pins related to fuel pump control (Pin 8 and Pin 35, see this post (http://www.clubvr4.com/forum/showthread.php?59222-Definitive-EFI-ECU-Pinout-(KS-Mod-friendly)) for more info) and noticed the Fuel Pump High / Low circuit was missing a critical component, diode D101, from it's path. I also immediately noticed a couple of other components missing in the same vicinity, diode D103 and an unknown component Q84 (suspected transistor or triac) was also missing, tracing these back to the ECU loom connector identified this circuit as part of Pin 43 (Wastegate Solenoid control), further reinforcing the idea this wasn't a VR-4 7202.

Epiphany

It's common practice in the electronics industry to save money by designing PCBs to be used in multiple devices and then only populating the required components to suit the target, so it's likely Mitsubishi do this with their 7202-equipped ECUs.

My thinking is this, with a bit of soldering, it may be possible to turn a N/A V6 7202 ECU into a fully-fledged VR-4 7202 ECU. We already know that this bad 7202 ECU allowed us to flash a VR-4 7202 ROM Image without any (noticeable) warnings, and that, fuelling issues aside, it seemed to keep a 6A13TT running for a couple of seconds before the fuel in the rails was used up. Speaking with John, he seems to think there's a chance this could be successful, so I figured "why the hell not, for science!" :)

Moving forward from this, my first task is to identify all the components that have changed, I need to get some high res photographs of a known-good VR-4 7202, the one I took above was taken in haste and is slightly blurred. Once that's done, I guess it's a game of "spot the difference" :dance:

lateshow
31-08-2011, 12:21 PM
Did you use the definitions I posted in the N/A section? Do you still have a copy of the suspected v6 rom, i could take a look. Was the rom bigger than 128k?

What about ignition, as said before vr4 gets 3 pulses from the ecu as N/A gets 1 for the old fashioned distributor. Boost control isnt important....

foxdie
31-08-2011, 12:26 PM
Did you use the definitions I posted in the N/A section? Do you still have a copy of the suspected v6 rom, i could take a look. Was the rom bigger than 128k?

What about ignition, as said before vr4 gets 3 pulses from the ecu as N/A gets 1 for the old fashioned distributor. Boost control isnt important....

The suspect ROM is already linked above as part of the sentence "the unknown 7202 ROM image" :)

I think ignition pulses are a non-issue because we're running a genuine VR-4 7202 ROM on a N/A V6 ROM, it'll be the ROM code that controls how many pulses get sent, I could be wrong.

Boost control may not be important but it's not the only thing that's bound to be missing, however I'd like to get boost control working so no external boost controller is required.

lateshow
31-08-2011, 12:41 PM
http://www.clubvr4.com/forum/attachment.php?attachmentid=47530&d=1313157046 <- As this pinout says the vr4 ecu gives 3 physical outputs to 3 separate coil packs , i dont know about the v6 but as it has ha distributor system there must be only one actual wire that transmits the command "ignite". But since you got it running a little....hmmmm.... strage i would say... ?

foxdie
31-08-2011, 01:45 PM
Sorry for delay, pub lunch.. *hic*

Thinking out aloud here, the fuel pump high / low pin was disconnected, one would think that it makes sense that with this disconnected the car wouldn't be able to start (more fuel needed etc), however the car can quite happily idle with a "0" signal being sent (ie. low fuel supply) for idling, so why would it run lumpily for a second or two and then not start at all after that?

This requires more science, and by science, I mean multimeter testing, admittedly I don't have a lot of time to investigate this. I'm going to continue with finding out which components are missing and which differ. I've already found another resistor present on the bad 7202 that's not present on the good 7202.

scott.mohekey
31-08-2011, 01:59 PM
I would follow on from what Lauri has said and trace the pins on the bad ecu that equal the three ignition outputs on the good one. I suspect you'll find differences there.

foxdie
31-08-2011, 03:25 PM
Updated the above images so they can be overlaid on top of each other, also added a grid to reference where components are / aren't present.

Scott / Lauri, thanks, will start tracing the ignition circuits now.

foxdie
31-08-2011, 04:25 PM
I traced back the components for Coil Pack 2 (Pin 23) and Coil Pack 3 (Pin 11), the lines appear to be populated on the bad 7202.

Nutter_John
31-08-2011, 06:03 PM
the ecu can control either 1 line or 3 lines and all that will be different is the actual driver code , would not make sense for Mitsi to not use the same ecu across the 6 cyl range

pbaron
31-08-2011, 08:51 PM
Taking a quick look at the hex file in a hex editor the internal id of this rom is EM2429, the part number for the ecu it was standard on is one of MD359139 or MD359140, these are listed in ASA General Export version as applicable to EA5A Galant autos and manuals.

Why don't you just put a VR4 rom on it and see if it runs.

foxdie
31-08-2011, 08:56 PM
Why don't you just put a VR4 rom on it and see if it runs.

I did say earlier that we tried this, I actually tried a couple of ROMs on it, eventually taking one from another VR-4 7202 that started the car 2 minutes earlier :)

A general update to progress, I'm going through now playing spot-the-difference highlighting every component that changes between the two PCBS, this may be posted up tomorrow depending on how far I get.

Nutter_John
31-08-2011, 08:57 PM
he did and it didn't as both the fuel pump and boost solenoid lines are not connected

scott.mohekey
31-08-2011, 09:00 PM
the ecu can control either 1 line or 3 lines and all that will be different is the actual driver code , would not make sense for Mitsi to not use the same ecu across the 6 cyl range

I've got a 96 ST25 here which has a v6 and the 4 speed auto which has an entirely different ECU in it. Instead of having an ECU for the engine and a TCU for the auto, it has them combined into one, physically larger, item.

crazydriver81
01-09-2011, 10:10 AM
I've got a 96 ST25 here which has a v6 and the 4 speed auto which has an entirely different ECU in it. Instead of having an ECU for the engine and a TCU for the auto, it has them combined into one, physically larger, item.

can confirm the same for the ST-R25 - only one ECU, combined for engine and auto trans. But I know that the european V6 cars have separate ECU and TCU.

foxdie
01-09-2011, 12:33 PM
*Takes a deep breath* 6 hours and literally 2 migraines later, here we go;

Note: Where solder tags are mentioned, these relate exclusively to PCB inter-layer connections (you'll see what I mean when you compare pics)..

Rear
C2 - Solder tags only on bad 7202
D2 - Solder tags only on bad 7202
E2 - Solder tags only on bad 7202
F2 - Solder tags only on bad 7202
G2 - Capacitor C135 only present on bad 7202
I2 - Solder tags only on good 7202
C3 - Jumpers J7 and J10 only on good 7202, Jumper J9 only on bad 7202
D3 - Transistor Q53 only on bad 7202
E3 - Diodes D101 and D103 only on good 7202
F3 - Resistor R526 only on bad 7202
G3 - Resistor R335 only on bad 7202
H3 - Resistor R334 only on bad 7202
D4 - Resistor R168 only on bad 7202
E4 - Transistor Q84 and Resistors R226 and R225 only on good 7202, Resistor R392 only on bad 7202
F4 - Transistor Q202 appears to differ, could be a false positive
H5 - Transistor Q100 only on bad 7202
H7 - Resistor R119 only on good 7202
F8 - Resistors R221 and R222 only on good 7202
I8 - Capacitor C153 only on bad 7202, Jumper J18 only on good 7202
Front
F1 - Resistor R167 only on bad 7202
I2 - Resistor R33 only on bad 7202
H4 - Resistor R180 and Capacitor C103 only on bad 7202
I4 - Transistor Q60 only on bad 7202
H5 - Resistor R191 only on bad 7202
E6 - Transistor Q82 only on good 7202
I7 - Resistor R610 only on bad 7202
C8 - Jumper J8 only on bad 7202
D8 - Diode D84 only on bad 7202
E8 - Solder tags only on bad 7202
G8 - Solder tags only on bad 7202

GalantOnly
10-09-2011, 01:55 AM
with a bit of soldering, it may be possible to turn a N/A V6 7202 ECU into a fully-fledged VR-4 7202 ECU.

What about just soldering 7202 chip from N/A V6 into 7201 VR-4 board? Wouldn't it be a flashable VR-4 ECU then?

foxdie
10-09-2011, 08:43 AM
What about just soldering 7202 chip from N/A V6 into 7201 VR-4 board? Wouldn't it be a flashable VR-4 ECU then?

I somewhat assumed this wasn't possible, that the boards would be quite significantly different ie. the MPU wouldn't be reflashable later on due to tracks / components not being populated or something...

scott.mohekey
10-09-2011, 09:34 AM
The 7201 board is significantly different to the 7202 board. From memory, the chips are so different they even have a different pin count and foot print.

GalantOnly
10-09-2011, 12:12 PM
That's makes sense.../pan 7201 is 25x25, but 7202 is 28x28.
There's no easy way out:toilet:

wintertidenz
10-09-2011, 11:40 PM
Has anyone done the same kind of tracing on the 7201 boards to see if there IS in fact a way to flash it without removing chips etc?

There is still that CN102 connector that people have noticed but never really checked out (myself included, but that's because I don't have the tools required to work out what those connectors really do).

kinkyafro
14-09-2011, 11:23 PM
Has anyone done the same kind of tracing on the 7201 boards to see if there IS in fact a way to flash it without removing chips etc?

There is still that CN102 connector that people have noticed but never really checked out (myself included, but that's because I don't have the tools required to work out what those connectors really do).

Stands to reason that the 7201 is flashable without chip removal because otherwise Mitsi would have saved a few pennies by not putting a flashable rom on the board. I speculated about it possibly being an I2C connector here (http://www.clubvr4.com/forum/showthread.php?39607-VR4-Successfully-Flashed/page4)

foxdie
15-09-2011, 08:44 AM
I2C? Oh god, I'm sensing an Arduino hack :)

scott.mohekey
15-09-2011, 09:11 AM
The problem though, is that no one has been able to find a datasheet for the microcontroller used in the 7201, despite contacting mitsi and the place that made the chip for them (I can't remember the name of the company off the top of my head). This means we don't really have any idea what the pins on the chip do etc, so finding the I2C bus isn't exactly an easy ask. I talked about using an upside down piggy back board to flash the memory chip in one of the previous threads, something I believe is doable (and kinky has proven that the memory chip is flashable, albeit in a different fashion). But it still wouldn't give you the ability to flash the ecu without taking it out of the car and to pieces.

foxdie
15-09-2011, 09:19 AM
Thats true, but it could be developed into a state where you an add a new cable to the box to permit reflashing.

What would be awesome would be a cheap way to do live mapping, I somewhat hope that's on the way with Kens KSMOD ROM but if it can be added relatively cheaply to all 720x then it would only stand to benefit us all :)

scott.mohekey
15-09-2011, 09:23 AM
You could probably do it with a new cable attached. I THINK it would have to be an ignition off flash though, as you don't want the ecu interfering with the rom while you're flashing it.

foxdie
15-09-2011, 09:27 AM
One thing I've not been clear on, does the 720x actually write to it's flash memory in normal use?

I've noticed that every time I reflash my 7202, I have to go through the "idle adjust setup procedure", when you're tuning-on-the-road and making multiple flashes this can rapidly become a bitch because I've had the car stall on me approaching junctions and nearly sailed into traffic because the power assisted braking fails.

wintertidenz
15-09-2011, 09:52 AM
I would say that yes it would be possible to reflash while running - but you would need to find some way to force the ECU to pull the maps back into its RAM from the ROM again, because from what I've read it seems to pull the maps into RAM each time it loads.

Kinky - since yourself and John worked out how to flash these things, is it possible to write a hack to force the chip to dump ALL its ROM contents into a new file, or out to a line? This would allow you to identify what chip it actually is.

For anyone in NZ, I have a 7201 that can be ripped apart for programming purposes, as it is surplus to my requirements.

Nutter_John
15-09-2011, 12:16 PM
The rom image is on here somewhere but it does not help having the code . That code could could run on 100's of variants of the same chip range but not all chips have the same features .

The russians can flash a 7201 for a galant but as yet not the vr4 7201, I do expect them to crack it this year

swinks
15-09-2011, 01:20 PM
Went quickly thru this thread.
Strangely enough, but few blokes in Poland are doing flash of 7201 and 7202 from n/a Galants also are offering flashing those ecus with vr4 flashable image. Their nicks PLPynton (known on Polish and German forums) and pepi.
Unfortunately they won't share any details :thumbsdow
But... to be honest I don't know any of vr4 running on their flashed ecu :whistle:

kinkyafro
15-09-2011, 09:52 PM
One thing I've not been clear on, does the 720x actually write to it's flash memory in normal use?

Nope they only have 8k (IIRC) of onboard ram which is nowhere enough space for the 128k rom - all that gets held in the ram I expect is operating values (such as the learnt idle point, fuel trims etc...). Reseting the ram after the rom has been changed is good practice as your new rom might use the ram in a different way.

kinkyafro
15-09-2011, 09:55 PM
I would say that yes it would be possible to reflash while running

It's not possible to reflash a running car - as mentioned in my previous post the rom is not copied to ram and the rom cannot be read from and written to at the same time.

kinkyafro
15-09-2011, 10:15 PM
I talked about using an upside down piggy back board to flash the memory chip in one of the previous threads

Yes you did and it was a good idea - unfortunately after a lot of time, effort and expense the best me and John managed was a partial read from a rig that could manipulate a disconnected rom without issue. The conclusion was that the ecu board interfered and it's not possible. I'm not going to say that our findings were conclusive but they were good enough for me.

scott.mohekey
15-09-2011, 10:29 PM
Yes you did and it was a good idea - unfortunately after a lot of time, effort and expense the best me and John managed was a partial read from a rig that could manipulate a disconnected rom without issue. The conclusion was that the ecu board interfered and it's not possible. I'm not going to say that our findings were conclusive but they were good enough for me.

Out of curiosity, did the ecu board itself have power while you were trying to reflash the rom?

kinkyafro
15-09-2011, 10:44 PM
Out of curiosity, did the ecu board itself have power while you were trying to reflash the rom?

No it didn't - I considered it might be worth trying with the ecu connected in the car but didn't want to risk frying any more kit for what seemed a remote chance. I also considered that shorter or shielded wiring might yield a better result. Hence I'm not saying that I'm 100% sure it's not possible (But I'm certain enough not to pursue it any further).

scott.mohekey
15-09-2011, 10:54 PM
I suspect powering the ECU would have caused more problems. If not physical damage, then corrupt data on the rom (if it even got as far as flashing).

Nutter_John
15-09-2011, 11:03 PM
One thing we considered was that given the rom was still on the board and we applied power to it via the harness that we could have also been powering other chips up depending if there was any isolation on the 5v bus - this would mean the programmer was having to supply more power than it should do normally and hence the results not being clean

scott.mohekey
15-09-2011, 11:05 PM
One thing we considered was that given the rom was still on the board and we applied power to it via the harness that we could have also been powering other chips up depending if there was any isolation on the 5v bus - this would mean the programmer was having to supply more power than it should do normally and hence the results not being clean

Yeah, that makes sense. Another possibility I just thought of was to have the piggy back be a replacement rom, rather than just a flasher for the existing rom, and carefully cut the pins at the top of the existing rom (so the circuit would still be made to the piggy back.

Nutter_John
15-09-2011, 11:08 PM
That does work , but your still having to do the solder rework of the rom and can not flash the thing still so really gains nothing more than you would get in the way we replace the rom with a socket - which allows the rom to be replaced with other versions easily

paulg23
15-09-2011, 11:25 PM
You could possibly use a dual port flash chip of some sort, this would allow writing on the fly, but a hell of a lot of work involved. The way John is doing it seems to be the only cost effective method. I briefly looked into using an FPGA and a flash chip but again not worth the effort.