SwedeSpeed - Volvo Performance Forum banner
1 - 20 of 112 Posts

·
Registered
Joined
·
139 Posts
Discussion Starter · #1 · (Edited)
I just recently took interest into hacking the ECU (ECM) on my 06 S40. Being that I'm a computer engineering student, I figured it would be a fun challenge to take a wack at. I don't think that anyone on SS has ever tried reverse engineering this thing. I started out by researching the Denso company that manufactures our ECUs for Volvo. It turns out that a lot of Denso ECUs have already been hacked and their code dissassembled. I ordered a second ECU off ebay, but couldn't wait long enough for it to get here, so I decided to crack mine open (bad idea).

The Goal:
I hope to make it possible for us S40(and probably V50) owners to be able to dump our ROMs and modify them with existing ECUFlash software.

Pictures:

Before opening




Removed 4 screws, and started prying in the corner with a screw driver.


Once I saw the legs of that SH7052 processor, a huge grid appeared on my face. I was hoping that I wouldn't have to de-pot the PCB.


Presto! The thing opened up like a clam shell revealing this beautiful gem.


When I first saw that cap on the EPROM I thought that it was a connector for some kind of debug interface. I quickly popped the cap off and immediately said ohhhh s**t!!! That cap was protecting a Ultraviolet Erasable Programmable Read Only Memory (UV-EPROM). Me being outside when I did this, I thought that I had just screwed over my ECU. I quickly put the thing back together and reinstalled it in my car, and the thing started right up. THANK THE SUN GODS (low UV index day) that nothing got erased... yet. Perhaps some of the bits got erased in the higher addresses that might not be accessed while driving leisurely.

Datasheets:
SH7052 (32 bit RISC CPU): datasheet (919 pages)
SH7058 (32 bit RISC CPU): datasheet (1132 pages)
MC33186DH: datasheet

Research:
There are few great forums out that focus on hacking these chipset used on the ECU. Here is one that talks all about SH7052 hacking. And this thread mentions reading the ROM with a proprietary AUD interface that these processor use.

Unfortunately I'm gonna be leaving shortly to go to Ohio for a wedding. You can bet that I'll be researching on my phone like crazy. If anyone else is a computer engineer, feel free to chime in.
 

·
Registered
Joined
·
489 Posts
Is this non-turbo?

Jesus, I didn't know that EPROM's were still in use. It's probably for the immobiliser data or similar.

I'm in for a bit of disassembly if you get the file from it.
 

·
Registered
Joined
·
139 Posts
Discussion Starter · #4 ·
NameIdeas, hmm didn't know that. I haven't done much research on Bosch units.

Dream3r, ya I was a little surprised too. Cool, ya I'll post up any binaries that I'm able to pull out of the SH7052.

That AUD (Advanced User Debugger) interface seems to be promising. The datasheet mentions that AUD can be used to monitor RAM and also write to the on board 256kB (kilo bytes) of flash memory. It doesn't mention anything about being able to read it though. There is also a serial communication interface that will be able to communicate with any device that supports basic USART... I love it when company's provide such wonderful datasheets!
 

·
Registered
Joined
·
139 Posts
Discussion Starter · #5 ·
Alright I'm back home, and here is what my research has found. The datasheet for the SH7052 (64F7052F40 in OP pictures) states that the AUD interface has access to all address's within the chip itself. It also talks about having access to external peripherals, but I am unsure of what those may (extern ROM, driving circuitry, etc). Through the AUD interface I will be able to both write and read to the 12KB of RAM. Seeing that AUD does not support writing to the internal flash, this will probably require writing some assembly code into the RAM that will copy the new data from RAM into the flash.
I still haven't received my second ECU off ebay, but once I do I will begin poking around in the memory to see if the maps are even stored internally.
 

·
Registered
Joined
·
206 Posts
This is too cool, what a fantastic project, " @80mhz 32BIT I think my iPhone have 2X the horsepower"

I think you have some very interesting problems to overcome?

1. RISC based assembler where do you get assembler for a 32bit risc chip? maybe ARM..... MIPS

2. I believe that NA = Denso and FI (turbo) = Bosch due to Bosch sensors.

3. Now this is the engineer in me why do this at all? You need to have a "ROI" why not use a KTAG http://www.ktag-alientech.com/en to read our ECU/map MPPS?

4. Check these guys out http://www.ecuedit.com/denso-ecu-tuning-hardware-t759 maybe they can help.

5. Or replace the entire ECU to a HALTCH unit which is the way to go (IMHO) if you want to Turbo a S7 Volvo engine 15psi. and both cams are variable OH BABY 300BHP easy each cam having some 30 degrees of travel or it could turn in to a WMD.. lol 2.4 liter hand grenade
 

·
Registered
Joined
·
139 Posts
Discussion Starter · #7 ·
This is too cool, what a fantastic project, " @80mhz 32BIT I think my iPhone have 2X the horsepower"

I think you have some very interesting problems to overcome?

1. RISC based assembler where do you get assembler for a 32bit risc chip? maybe ARM..... MIPS

2. I believe that NA = Denso and FI (turbo) = Bosch due to Bosch sensors.

3. Now this is the engineer in me why do this at all? You need to have a "ROI" why not use a KTAG http://www.ktag-alientech.com/en to read our ECU/map MPPS?

4. Check these guys out http://www.ecuedit.com/denso-ecu-tuning-hardware-t759 maybe they can help.

5. Or replace the entire ECU to a HALTCH unit which is the way to go (IMHO) if you want to Turbo a S7 Volvo engine 15psi. and both cams are variable OH BABY 300BHP easy each cam having some 30 degrees of travel or it could turn in to a WMD.. lol 2.4 liter hand grenade
Thanks for taking interest!

1. The SH70xx datasheets cover the basic MOV and LD assembly op codes for the RISC processor. The RAM to ROM copier program wouldn't require much to accomplish the task.
2. That's probably the case. Mike mentioned that above.
3. After a quick search it looks like the KTAG will probably do the job, but it would be $2,200+ investment. My solution will just use a $2.00 attiny AVR and some custom written software.
4. Thanks, I've added that link to my resources.
5. This is probably a bit too pricey and complex for me. Has anyone ever done this? If so, can you provide the link I'd love to check it out just for kicks.

... second hand ECU still hasn't arrived (trying to refrain myself from pulling mine out again:D)
 

·
Registered
Joined
·
206 Posts
3. look for 'MPPS' Chinese Clone less than 20 USD just ordered one I'll keep you in the loop on that, for less than 20 I'll take a stab at it. lot of Open Source Software to support it. looking ober ECM titan now...

5. you need a full on race prep for that I had two conversations with one of the Auzie engineers they can work with a five jug engine, problems is if I do this I need a DyNO to tune. its a pipe dream maybe a couple of years from now.

bottom line is we (the sick Volvo owners) have to build our own mods ...... in my heart I beleive that B5 Volvo can kick some ass look at what they do with that jap junk.... No Offense to any of you JDM guys
 

·
Registered
Joined
·
139 Posts
Discussion Starter · #9 ·
bottom line is we (the sick Volvo owners) have to build our own mods ...... in my heart I beleive that B5 Volvo can kick some ass look at what they do with that jap junk.... No Offense to any of you JDM guys
I agree... unleash the beast!!! :D

Nice find, I think this is what your talking about. Too bad for me, it looks like that device mostly supports Bosch ecus. I look forward to hearing your results though!
 

·
Registered
Joined
·
206 Posts
I would assume that AWD settings are in the TCM..

with a Vida you might be able to adjust some settings, I have not tried that yet, the only AWD Volvo I have left is my wife's xc70... she doesn't like mods lol the ipd stage 2 I did scared the @#$% out of her so it went back to stock LOL sorry for the story rule of thumb do not juice the baby hauler
 

·
Registered
Joined
·
38 Posts
Interesting. My neighbor owns a indie Volvo shop, maybe Ill have to mow his lawn and in exchange for letting me hook up my car and mess around with some settings. I would love being able to change between RWD and AWD by the push of a button.
 

·
Registered
Joined
·
279 Posts
This is pretty cool. I have an Evo8 ecu swapped into my Talon, and use Ecuflash to flash the car all the time. Pretty amazing actually.
I hope something becomes of this.

Thanks!!!
 

·
Registered
Joined
·
1,974 Posts
Interesting. My neighbor owns a indie Volvo shop, maybe Ill have to mow his lawn and in exchange for letting me hook up my car and mess around with some settings. I would love being able to change between RWD and AWD by the push of a button.
Or make it more of a 50/50 or come up with launch control and such things :p
 

·
Registered
Joined
·
139 Posts
Discussion Starter · #16 ·
Yes launch control would be achieved through the ECM. However, like CJ2 said, I'm pretty sure diff and transmission control would be handled by the TCM :(. Depending on how all this works out, it may be possible to implement some type of no lift to shift mechanism... Now I'm getting way ahead of myself. One step at a time.
 

·
Registered
Joined
·
38 Posts
Yes launch control would be achieved through the ECM. However, like CJ2 said, I'm pretty sure diff and transmission control would be handled by the TCM :(. Depending on how all this works out, it may be possible to implement some type of no lift to shift mechanism... Now I'm getting way ahead of myself. One step at a time.
That reminds me, I had a buddy in high school who put a button on her motorcycle that would cut the motor for an instant so when he would not use his clutch once he got going, he would just put a little pressure on the shifter, push the button, the load is removed for a few milliseconds and shifts without ever letting off the throttle. Was pretty cool and that thing was fast shifting.

I never understood fully what he had done, that was long before I was really interested in cars but it was fun to ride!
 

·
Registered
Joined
·
1,974 Posts
oh also rev match for manuals :p
 

·
Registered
Joined
·
139 Posts
Discussion Starter · #19 ·
That's pretty much the same idea. No lift to shift (NLTS) is when you depress the clutch and your engine rev limits to a desired rpm, all while your accelerator is still mashed to the floor. This allows you to maintain boost pressures better between shifts, and therefore accelerate quicker. At least that's my understanding of it.
 

·
Registered
Joined
·
1,974 Posts
That's pretty much the same idea. No lift to shift (NLTS) is when you depress the clutch and your engine rev limits to a desired rpm, all while your accelerator is still mashed to the floor. This allows you to maintain boost pressures better between shifts, and therefore accelerate quicker. At least that's my understanding of it.
This seems its based for acceleration. Rev match will be when you are down shifting matching the RPM.
 
1 - 20 of 112 Posts
Top