39 replies to this topic

[positive_]

Hi all,

 

Would someone be so kind to share an original binary of the VX220 ECU with me? It can be retrieved through OBD2 with many cheap devices. Probably many of you have one.

I make some research about it and try to reverse engineer as many details of the ECU as I can. It would be a great help for me.

 

So far I'm able to:

- Disable EGR functioning.

- Change the idle RPM.

- Calculate a correct checksum for any kind of modification in the binary. (this is necessary to upload modifications without a special device)

- Modify the AFR. (under validation, not posted yet)

 

A summary can be found here:

https://z22se.co.uk/...neer-ecu.28943/

Unfortunately the details are in hungarian but I will answer any questions you have. You can find the original links in the topic above.

 

Thank you in advance.

[karlb123]

The start of the rival to the Dutch ECU maybe!?

[positive_]

The start of the rival to the Dutch ECU maybe!?

 

Not really. I just want to solve my problems. However, I believe in sharing knowledge and all of my findings are and will be publicly available, so anyone can use it as he/she wish.

[Paulus H]

I would like to be able to increase idle speed.

Paul

[positive_]

I would like to be able to increase idle speed.

Paul

 

Do you have any device to read the ECU?

If yes:

- read and save the firmware,

- send it to me,

- determine the desired settings,

- I will send back the modified firmware,

- upload and use it.

 

My default was this:

HEX    6C    68    64    58    54    50    4C    44    40    40    40    40    40    40    40    40    40
DEC    108    104    100    88    84    80    76    68    64    64    64    64    64    64    64    64    64
RPM    1350    1300    1250    1100    1050    1000    950    850    800    800    800    800    800    800    800    800    800
                                                                    
And I've been using this for more than a year:                                         
HEX    6C    68    64    58    54    50    4C    44    44    44    44    44    44    44    44    40    40
DEC    108    104    100    88    84    80    76    68    68    68    68    68    68    68    68    64    64
RPM    1350    1300    1250    1100    1050    1000    950    850    850    850    850    850    850    850    850    800    800

 

Te first part of the table is for warmup and the very last is for overheated conditions.

[Mr Z Ombie]

What is needed to read the ecu?

[positive_]

What is needed to read the ecu?

 

The most easiest way to use an OBD2 programming device. You can find several in the market (e.g: MPPS, KESSv2, Galletto) but the original ones are very expensive because these aren't made for home users. However many cheap chinese clones are also available which are perfect for us.

I have an MPPSv13.02 and a KESSv2.

KESSv2 can do automatic checksum correction and it's more robust, but its usage a bit uncomfortable and much more expensive than MPPS. Moreover the software came with it was unusable for me, and it was very difficult to acquire a right one.

MPPS is a single cable, easy to use and very cheap but you have to write only correct binaries with it since there's no automatic correction in it.

E.g:

https://www.ebay.com...i8AAOSw8W1bgIy0

https://www.ebay.com...zQAAOSwHqxbYNLz

https://www.ebay.com...hQAAOSw1~JZQ3vh

 

Newer version of MPPS and other devices could also be suitable but I have no experience with others.

I also recommend an OPCOM for data logging, error code erasing, immo programming and so on.

E.g:

https://www.ebay.com...HEAAOSw~l5aoQbg

https://www.ebay.com...ogAAOSwhHlan2Dp

https://www.ebay.com...HUAAOSwhsVaoQcL

[Mr Z Ombie]

What is needed to read the ecu?

The most easiest way to use an OBD2 programming device. You can find several in the market (e.g: MPPS, KESSv2, Galletto) but the original ones are very expensive because these aren't made for home users. However many cheap chinese clones are also available which are perfect for us.
I have an MPPSv13.02 and a KESSv2.
KESSv2 can do automatic checksum correction and it's more robust, but its usage a bit uncomfortable and much more expensive than MPPS. Moreover the software came with it was unusable for me, and it was very difficult to acquire a right one.
MPPS is a single cable, easy to use and very cheap but you have to write only correct binaries with it since there's no automatic correction in it.
E.g:
https://www.ebay.com...i8AAOSw8W1bgIy0
https://www.ebay.com...zQAAOSwHqxbYNLz
https://www.ebay.com...hQAAOSw1~JZQ3vh

Newer version of MPPS and other devices could also be suitable but I have no experience with others.
I also recommend an OPCOM for data logging, error code erasing, immo programming and so on.
E.g:
https://www.ebay.com...HEAAOSw~l5aoQbg
https://www.ebay.com...ogAAOSwhHlan2Dp
https://www.ebay.com...HUAAOSwhsVaoQcL

Cool, thanks for the reply. Some reading to be done!

[Paulus H]

Interesting but I do not have this kind of reader.

 

Paul

[positive_]

- Modify the AFR. (under validation, not posted yet)

 

Validated, and posted.
 

[siztenboots]

are you coding the values from hex directly or would you like a nice editor to define the structure and tables?

[positive_]

are you coding the values from hex directly or would you like a nice editor to define the structure and tables?

 

Current modifications were made with manual hex editing. It is fine enough now for simple changes. I've also used WinOLS to finding maps but haven't altered anything with it yet. Do you have some advice?
 

[positive_]

New possibilities:

- Fuel (VE map), and ignition (SA map) adjustment.

[blackoctagon]

Sir,

I am enjoying reading these blogposts.

 

I have a question:

In your recent post on 3D visualisation  ( http://z22sevectra.b.../ecu-12.html ) you show your VECandidate map (below)

and this map appears to show a dip in fueling and ignition around 2500 - 3200 rpm - I cannot translate Hungarian very well, so can you tell me if this was the map as you found it from your ECU, or has it been altered by you in a way that caused the dip?

 

I am asking as I have always had a flat spot in my car's power delivery around 2700-3400 rpm (or close to your map's dip) and after testing all systems, replacing sparkplugs etc.  and doing normal OPCOM misfire checks, and reading other Z22SE websites I have come to think that the mapping in the Z22SE cars was created that way, perhaps to create an zone that was more friendly to emissions tests.

 

I read this post :  https://www.astraown...84973.html   and a user called Sonic Coupe put  a link to a rolling road graph (see photobucket link in his post - http://i41.photobuck...h_scan00011.jpg  ) that shows a big dip in the torque curve. The dip is in the same area as mine feels flat, and similar to the dip in your 3D visualisation.

 

If that theory is correct then your latest VEcandidate4 map (below) would smooth this dip out, and therefore is something I am interested in testing myself when I get my own software.

 

Please continue to update the blogs as they are very useful for me.

 

 

I have a MPPS v16 on order and will send you a binary when it arrives, for your binary collection.

 

 

Edited by blackoctagon, 12 October 2018 - 02:33 PM.

[positive_]

Hi,

I'm glad you found it useful.

That map with the huge dip was my third altered VE map (VECandidate3). In the first (VECandidate1) I made a groove intentionally to prove that 1714a and 1714b are the VE maps. In VECandidate2 I set the values too low, so I tried to refine it in VECandidate3 but I made a mistake. Accidentally I took VECandidate1 for the base of the modification instead of the original. In that range the values were calculated as "(original*0,85)*0,97" instead of "original*0,97". Finally I corrected it in VECandidate4.
You probably also missed that the RPM and MAP values are incorrect in the image. (I'm in a great trouble with the identification of the axis definitions.) The modification had an effect in the RPM range 1600-2000, as you can see it from the structured live data.

VECandidate1
[[   0    0  400  800 1200 1600 2000 2400 2800 3200 3600 4000 4400 4800 5200 5600 6000 6400]
 [   9 1111 1111 1111 1111    0    0    0    0    0    0    0   -1    0 1111 1111 1111 1111]
 [  16 1111 1111   -1   -1    0    0   -1   -1   -1   -1 1111 1111   -2 1111 1111 1111 1111]
 [  23 1111 1111   -1   -1    1    1   -2   -2   -2   -2 1111 1111   -3 1111 1111 1111 1111]
 [  30 1111 1111   -1    0    2    2   -2   -3   -2   -5   -5   -5 1111 1111 1111 1111 1111]
 [  37 1111 1111    0   -1    2    1   -3   -4   -5   -5   -2 1111 1111 1111 1111 1111 1111]
 [  44 1111 1111    0    0    2    2   -2   -4   -5   -5 1111   -2 1111   -1 1111 1111 1111]
 [  51 1111 1111    1   -1    2    2   -2   -4   -4 1111 1111 1111 1111 1111 1111 1111 1111]
 [  58 1111 1111    1   -1    2    2   -2   -4   -5 1111   -5 1111 1111 1111 1111 1111 1111]
 [  65 1111 1111    1    0    3    3   -3   -5   -5 1111   -5   -5 1111    0 1111 1111 1111]
 [  72 1111 1111 1111    4    4    3   -3   -5   -5   -6 1111 1111 1111    0 1111 1111 1111]
 [  79 1111 1111 1111 1111    3    3   -3   -5   -4   -3   -5 1111 1111 1111 1111 1111 1111]
 [  86 1111 1111 1111 1111    4    4   -2   -4   -5   -5   -4   -5 1111    0 1111 1111 1111]
 [  93 1111 1111 1111 1111    1   -1   -4   -5   -5   -4   -2   -2   -1    0 1111 1111 1111]
 [ 100 1111 1111 1111 1111 1111 1111 1111 1111 1111 1111 1111 1111 1111 1111 1111 1111 1111]] B1 Long Term Fuel Trim (Bank 1)

So this is not the cause of the dip in the torque curve for sure that you asked for. However you can find a little dip in the original map also. This original map looks like quite the same as the second image in the blog.

In addition, I don't feel as much improvement in the dynamics of the car as I expected after VECandidate4 and as I felt after AFRCandidate1.
I recommend to modify it first. (https://z22sevectra..../09/ecu-11.html)

Do you have some live data?

[blackoctagon]

Sir,
I understand.
I was excited at what I saw as a quick fix for the flat spot, but now I feel it might be harder.
I am worried that the flat spot is a poor pressure wave behaviour around that speed and load site due to the cam match to the manifolds, and that there is not a lot that the ECU can do to mask it. But finding out is the exciting part now!

I did wonder how you arrived at those map axis, but did not look at the raw tables.
Can I ask - what software did you plot the 3D maps in?

I have not pulled any data from the car yet, as I am waiting for some time away from work to gather some OPCOM logs, and also my MPPS to arrive.
It is better for me to do all the work at the same time, or else i'll forget things - I have a number of car projects and get confused sometimes.

Edited by blackoctagon, 14 October 2018 - 08:51 PM.

[positive_]

I suppose there isn't any quick fix for that and I also think the flat spot is at least partially due to some "mechanical" limitations but some settings (or physical modifications) can reduce its effect. E.g. deactivating the EGR would improve the low/mid range characteristics for sure or for me there was a bump on the AFR map at around 3000RPM that makes the fuel mixture leaner than the surrounding locations.

I haven't visualized it before:
(RPM and MAP values are incorrect)
Original:  AFRmap_AFROriginal.png   99.38KB   10 downloads

AFRCandidate1:  AFRmap_AFRCandidate1.png   94.28KB   9 downloads
Anyway it is difficult to say something certian since I know neither your car nor the program in its ECU.

The 3D maps are drawn by my own script.

[blackoctagon]

My MPPS arrived, but I am having problems with Windows 10 compatibility on the laptop, so I need to get a secondhand laptop with an older version of Windows.

I did find a fix using an imported .dll file, but it simply does not work on my laptop.  An official Windows update removed the .dll, and a lot of programs suffered, seemingly, and the developers had to offer patches and the .dll itself to their customers

 

I did take a look at some of the other ECU adjusting programs, such as Titanium and winOLS, but I suspect most of the versions available are buggy from comments on other forums.

 

A least there is some progress.

[positive_]

Why don't you set up a Virtual Machine (Virtualbox or VMware)? The system requirements are quite low, the installation is straightforward (both for the VM and for the guest OS), it is easy to permanently disable the network connection for the guest which is advisable to prevent upgrades that can brick the devices and limits the effect of a possible malware in the softwares. The restoration is also easy if something went wrong and your host OS remains stable and fully functional.

I use an XP in Virtualbox for these softwares (MPPS, OPCOM, KESS, WinOLS, ...).

[blackoctagon]

The Windows 10 laptop has a small hard drive, sadly, and is already full, so there is no space for a VM.

I'll get another laptop - I wanted one for the garage anyway to keep manuals on and stream music.

 

The drivers for the MPPS worked at least, and I have connected it to a few cars, so I know the hardware is okay.

 

It's just a delay, not a problem.