Improving our dataloggers, requires your ECU ID

[BlackStealth]

Gatecrasher has lent me his MUT2 diagnostics tool so I can improve our dataloggers and produce a better scantool, such as clearing SRS airbag light, communicate with our other computers such as climate control, ABS, ECS, ETACS, etc. I have already discovered/solved the mystery why some people get a CEL, yet no datalogger can read it. Most of our dataloggers behavior are inherited from the DSM platform, and don't address all the minor differences between it and our 3S platform. I am making note of all the differences that I find, but in order to unlock it all, I would need access to all 3S ECUs. What I need is the HEX ID that uniquely identifies your ECU model, the year model of your car's ECU, and what kind of car you have. Evoscan, TMO and recent LCDBC software can reveal the HEX ID. Mitsubishi part number is not important, it's just a bonus info. I can simulate a fake ECU using these new HEX IDs and grab any new information from the MUT2 tool and improve our platform.

Here is what we have so far:
ECU Year Type
----------------------------------------------------
E018 1.8 MPI Cal. (Source: TMO)
E019 1.8 MPI Federal (Source: TMO)
E020 2.0 DOHC Federal (Source: TMO)
E021 2.0 DOHC Cal. (Source: TMO)
E022 90-94 DSM turbo Federal (Source: TMO)
E022 92-94 DSM turbo Federal MD166260 (Source: Gatecrasher)
E023 92-94 DSM turbo Cal. MD166261 (Source: Gatecrasher)
E0C9 2.0 turbo (Source: TMO)
E04D 91-92 3S GTO Turbo (Source: sublime_whatigo & Maddog)
E04E 91-92 3S DOHC Cal. (Source:TMO)
E04F 91-92 3S DOHC Federal MD159963
E050 91-92 3S Turbo Cal.(Source: TMO)
E051 91-92 3S Turbo Federal MD159966
E053 92-94 92-94 Mighty Max 3.0L V6 4WD, Cal MD162825 (Source: Gatecrasher)
E0AE 93 GTO JDM MD189411 (Source: Gatecrasher)
E442 FWD Galant, non-turbo MD172575 (Source: ecmtuning.com/wiki/ecu1gid)
E4B1 98 Lancer Evo V MD360216 (Source: Gatecrasher)
E4B3 99 Lancer Evo VI TME (Tommi Makinen Edition) MR514364 (Source: Gatecrasher)
E4B3 99 Lancer Evo VI RalliArt ECU (aftermarket, white case) MR507004 (Source: Gatecrasher)
E4B4 99 Lancer Evo VI MR420994 (Source: Gatecrasher)
E559 00 Mirage 1.8L MT & AT Fed MR420757 (Source: Gatecrasher)
E569 00 Mirage 1.8L MT & AT Fed MR420757 (Source: Gatecrasher)
E620 96 3000GT DOHC Spyder SL (Source: DuTTch)
E65E 98 3000GT SOHC MD347252
E66C 99 Montero 3.5L V6 Fed (6G74 engine) MD361885 (Source: Gatecrasher)
E66E 98-99 3000GT DOHC MD347251/MD360162 (Source: Gatecrasher)
E692 00 Eclipse ROM MD365884/MD365890 (Source: Gatecrasher)
E693 00 Diamante ES 3.5L V6 Cal (6G74 engine) MD366797 (Source: Gatecrasher)
E696 00 Galant V6 AT Fed MD365888 (Source: Gatecrasher)
E696 00 Eclipse V6 MT Fed MD365883 (Source: Gatecrasher)
E696 00 Eclipse V6 AT Fed MD365889 (Source: Gatecrasher)
E6A0 94-95 Spyder VR4 (Source: SpydermanVR4)
E6A1 94-95 3S Cal Turbo MD192588 (Source: Gatecrasher)
E6A2 94-95 3S Fed Turbo MD192589 (Source: Gatecrasher)
E6A4 98 GTO turbo New Zealand MD355167 non-flashable 3-plug (Source: Paolo)
E6AD 98 3000GT turbo MD347250
E6AE 99 3000GT turbo MD360163
E6AF 99 3000GT turbo EUROPE MD360029 (LHD) {Same as MD360028? (RHD)}
E6E5 00 Diamante LS 3.5L V6 Cal (6G74 engine) MD366798 (Source: Gatecrasher)
E719 98? FTO 2.0L V6 (6A12 engine) MD355250 (Source: Gatecrasher)
E7A4 98? Galant VR4 V6 2.5L TT V6 (6A13 engine) MD362895 (Source: Gatecrasher)
E7E1 98? Galant VR4 V6 2.5L TT V6 (6A13 engine) MD359138 (Source: Gatecrasher)

http://i.imgur.com/tJUiI8W.jpg (https://imgur.com/tJUiI8W)
https://i.imgur.com/1W4swrE.png


For OBD2 cars 96 and newer, with Torque Pro + ELM327 OBD2 dongle, follow these instructions:

1. Open Torque, Settings.
2. Scroll down in the settings list and click “Manage extra PIDs/Sensors”
3. Press the Menu button again (looks like upside down box) and press “Add custom PID”
4. Press “OK” to agree.

https://i.imgur.com/zfLDje9.png

https://i.imgur.com/zWKLNQm.png
What's still missing?
91-92 Japan GTO SOHC/DOHC/Turbo
94-99 Japan GTO SOHC/DOHC/Turbo
91-92 USA SOHC FED
91-92 USA SOHC Cali
93 USA turbo Fed
93 USA DOHC Fed
93 USA SOHC Fed
93 USA turbo Cail
93 USA DOHC Cail
93 USA SOHC Cali
96-97 USA Turbo
96-97 USA SOHC

LCDBC v3.69 with HEX ID display feature:
http://lcdbc.xp3.biz/updates/UPDATE369.zip

[j2k4]

Don't know when I'll get to it, but...:)

[BlackStealth]

I've updated the latest LCDBC software to display the HEX ID.
http://lcdbc.xp3.biz/updates/UPDATE369.zip

[j2k4]

Super - makes it a lot easier. :D

Mine's a '98 SL ECU, looks like you need that one...or maybe not - just saw you're getting hammered with info...:p

[BlackStealth]

Almost all the popular ones have been found, as expected. The rarer ECU versions will take some time I suppose.

[Unlogic]

I have a eurospec 1996 ECU in the garage if that ECU ID would be of any use.

[BlackStealth]

I have a eurospec 1996 ECU in the garage if that ECU ID would be of any use.
Oh yes please.

[stealthee]

I have a few ECU's floating around here. I have a 94 SOHC Cali-spec, a 95 SOHC Fed-spec, and I believe a 1g TT ECU.

[BlackStealth]

I have a few ECU's floating around here. I have a 94 SOHC Cali-spec, a 95 SOHC Fed-spec, and I believe a 1g TT ECU.
Awesome, I forgot about the 94-95 SOHC versions. The 93 TT ECU is still missing.

[stealthee]

I'll try to dig out the SOHC ECU's after work. I'm not entirely sure what year the TT ECU is but we'll see if it matches anything you already have or not.

[BlackStealth]

I'll try to dig out the SOHC ECU's after work. I'm not entirely sure what year the TT ECU is but we'll see if it matches anything you already have or not.

MD190663 is the 93 turbo ECU that's missing.

[stealthee]

Well I found the 95 SOHC ECU and the TT ECU but I must not have read the thread properly because not only is my car not assembled enough but I don't have the software necessary to get the hex ID. I was thinking it was the code on the side of the ECU.

[BlackStealth]

I wish there was an easier way to obtain the ECU ID/HEX ID. I don't think anyone has ever compiled this list ever before.

[Amphiron]

Can I use a ELM327 OBDII cable with any software to pull the ECU ID? Or do I need evoscan and a cable? Might I be able to get it with OBD wiz? I have a 97 SOHC ecu.

[BlackStealth]

Can I use a ELM327 OBDII cable with any software to pull the ECU ID? Or do I need evoscan and a cable? Might I be able to get it with OBD wiz? I have a 97 SOHC ecu.

Actually it can be done with ELM327 too. Assuming you're using a USB elm327 cable, use a program such as Cool Term to connect, try 38400 baud. Enter these two commands and record the response:

A0 FE
A0 FF

And if you're on an Android device + ELM327 wireless, you can use an app called "Elm327 WIFI terminal" and do the same thing.

[BlackStealth]

Okay I made some progress. It took me a long time to build an electronic circuit that convinces the MUT2 scan tool that it's communicating to a real ECU, or in my case a fake ECU. I couldn't have done it without purchasing a $565 oscilloscope to reveal the waveforms generated between a real ECU and scantool.

First thing I wanted to do was decode CEL codes, as our 3S vehicles have more codes than the DSM. Funny thing is, the scantool wouldn't reveal all codes unless it was convinced it was talking to: Turbo ECU, Non-turbo ECU, and California ECU. So the ECU ID contributions is helping.

[BlackStealth]

Update: The MUT2 scantool only reads stored DTC or CEL codes. It doesn't read pending DTC codes, so that is a little disappointing. I guess the pending DTC codes were discovered when they dis-assembled the DSM ECU code. Nevertheless, I can read all DTC codes on OBD1.

Next I wanted to see how the scantool would react to me providing a 94-95 ECU ID through an OBD1 interface. The scantool spit out the ECU ID, and said, this cartridge has no support for this model. I'm not totally surprised, as a 94-95 ECU ID should not go through an OBD1 interface. :) It just means more work.

Today I recorded all the coolant and intake air temperature tables, I will update the LCDBC in the near future to use this new data. It's better to use this 3S Scantool data instead, as it is the authoritative answer of what the values really are.

Next I focused on the Automatic Climate Control computer, and recorded the Room temperature table, and air inlet temp. table. I've also decoded every DTC code, datalog parameter, and diagnostics tests.

[Unlogic]

This sounds great!

How much did the coolant tables differ from the ones previously used in the LCDBC?

[BlackStealth]

This sounds great!

How much did the coolant tables differ from the ones previously used in the LCDBC?
The table is huge, but here's just a small sample of the difference:
3S table, DSM table
192F, 199F
200F, 209F
211F, 223F

Majority of our datalogging software is based on DSM research, so all our datalogging software out there is incorrect. My research so far is respect to OBD1. I haven't got to 94+ and newer ECUs yet, but I expect them to be the same.

Edit: Upon more research, I discovered the E022 DSM ECU has the same coolant and air intake tables. The question now is, where did this inaccurate data originate from? Possible theories come to mind, another Mitsubishi vehicle, or the programmers were too lazy to enter all 256 entries, or wanted to save memory and used an approximate curve to represent all entries.

[BlackStealth]

1992 Automatic computer fully decoded -- what a huge DTC list, much larger than our engine computer. Can clear error codes, view speed sensor, tps, shift position, DCCSV duty cycle, DCCSV rpm, etc. The PCSV actuator can be activated.

1993 ECS computer fully decoded, I can read G-force voltage, read strut current state (Hard,Medium,Soft), read error codes, clear error codes, and set struts into Hard/Med/Soft mode.

1993 SRS computer decoded. I can reset the air bag light, this will save people $100 from paying the dealer to reset it. :)

Next I have to build a circuit to emulate a 94-95 ECU MUT interface, so the MUT2 scantool thinks it is talking to a real ECU.

[Unlogic]

This is awesome news Antero!

Will any of these new features make their way into the LCDBC lineup?

[BlackStealth]

This is awesome news Antero!

Will any of these new features make their way into the LCDBC lineup?
The LCDBC will receive software a bunch of software improvements. I've discovered a few more tests available to certain ECU models, and some new ECU data. I've finished 91-93, 94-95, 98-99. What's slowing me down is the lack of ECU ID numbers for 96-97 vehicles, I don't have any for them.

p.s. I've discovered that our 3S cars have two different coolant tables. 91-93 Car's have different coolant table vs 94-99 cars. My guess this is because the coolant temperature sensor must be different, hence the difference.

As for the other ECS, Climate, Auto, ABS, SRS, etc computers, this will require a new OBD1 or OBD2/MUT cable, along with the associated electronics to communicate with these different computers. So the same LCDBC can be expanded to communicate with all computers that is found on our cars.

[stealthee]

91-93 has the sensors in the radiator. 94-99 has the sensors in the thermostat housing.

[BlackStealth]

Okay, I found a new way to extract the ECU ID on 96 and newer OBD2 vehicles. Users with Torque Pro + ELM327 OBD2 dongle, follow these instructions:

1. Open Torque, Settings.
2. Scroll down in the settings list and click “Manage extra PIDs/Sensors”
3. Press the Menu button again (looks like upside down box) and press “Add custom PID”
4. Press “OK” to agree.

https://i.imgur.com/zfLDje9.png

https://i.imgur.com/zWKLNQm.png

[sublime_whatigo]

Maddog and I tested a 91-92 GTO TT
ecu,(to the best of his knowledge) speed limited to 120mph. It said E04D on my drbii, funny enough it said ecu not recognized.

Sent from my XT1650 using Tapatalk

[Maddog]

Hope it helps. I borrowed Matt's MUT 2 years ago trying to do the same thing. I had limited success trying to get laptops to communicate properly with the various controllers. I bought a scope like you trying to get the bit timing and protocol figured out. Eventually spring came and it was time to drive the car instead of screw with it. Keep up the good work BlackStealth! Thanks again Matt.

[BlackStealth]

Thanks for the contribution guys. I'll see what the MUT2 scantool says about it.

Today I finally figured out how to communicate with the cruise control computer. The MUT2 scantool wouldn't read anything on my car, and the same problem on my bench with a spare cruise control computer. I was puzzled as to why the cruise computer flowed only 0.00 current, it was like it was dead. I referred to the service manual many times, and then I decided to provided 12 volts to the main cruise switch input and bingo. Apparently you can't read DTC codes if you don't flip the cruise control switch to on position -- I didn't see it mentioned anywhere in the service manual.

[BlackStealth]

Update: De-coded a 1995 SRS (airbag) computer. So now I can clear airbag codes from 1991-1996. I purchased a 1998 SRS air bag computer (Thanks to Jeff), waiting on that to be delivered, and hopefully that covers all the SRS year models? I don't know if they changed in the 1999 year model.

Waiting on electronic components (opamps) to be delivered so I can begin decoding ABS computers -- apparently they use strange voltages to communicate. I'll be de-coding 1993,1995,and 1998 ABS computers, so hopefully that's good enough.

While flipping through the service manuals, I discovered that in 1996 models they now have 4-channel ABS, instead of 3. Hmm, that made me think, wouldn't it be cool to upgrade to 4-channel ABS so each wheel have independent ABS control, and build my own electronic stability controller -- I know it can be done, someone did it in Australia (although not 3S specific).

[RealMcCoy]

p.s. I've discovered that our 3S cars have two different coolant tables. 91-93 Car's have different coolant table vs 94-99 cars. My guess this is because the coolant temperature sensor must be different, hence the difference.


Your assumption there is correct, there is a different part number for the 1G and 2G sensors... Even though I was aware of that fact, I never considered the possible implications for someone running Chrome on a 1G. That's a good point to bring to light. I think I'll be installing a 2G sensor in my car when I switch to Chrome.


91-93 has the sensors in the radiator. 94-99 has the sensors in the thermostat housing.

True, but he's talking about the ECU table that converts the coolant temp sensor voltage to an actual temperature value.

[BlackStealth]

First chart shows the difference between the coolant tables, blue is 91-93, red is 94-99. As you can see, they are very similar, but not identical.
https://i.imgur.com/4dyHxRe.png

Second chart shows a close up of the 150F-311F range.
https://i.imgur.com/ngv66Er.png

Third chart shows in yellow what the current LCDBC has for coolant table, it follows more closely to the 94-99 coolant table.
https://i.imgur.com/g9e9Zsr.png

My 93 + 1st gen coolant sensor + 99 Flash ECU drives incredible excellent, I wasn't even aware there was a difference in coolant sensors until I did my research.

[BlackStealth]

Update: I simulated 20 automatic transmission computer IDs through educated guesses for the MUT2 scantool, and decoded their additional transmission error codes, and subtle differences. I just plugged in the 98 3000GT SL Automatic computer in a few minutes ago and looked at the computer ID -- it happens to be the second last one I decoded (F025). :) Perhaps the last ID (F026) is for the SOHC? I don't know.

Next I will work on the 98 3000GT SL SRS computer. And then 95 3000GT SL ABS computer.

[BlackStealth]

Today I wired up the 1998 3000GT SL SRS computer, noted the new computer ID, new baud rate, and a few new error codes. After I built my simulated SRS computer to unlock everything, I randomly found 27 other SRS computers and decoded those as well, noting the small differences between them. So I think I have all the SRS computers for our cars supported.

https://i.imgur.com/P5CaYzT.jpg

[BlackStealth]

Yesterday evening I tried browsing for some other slow baud rate SRS computers, the MUT2 scantool hangs up when I gave an invalid ID, requiring me to power down and power up. I did this about 3 times and decided not to go any further, as I don't want to subject the scantool with so many power ups in a short time span.

I did some research and it seems the 91-97 climate control computers are all the same despite the revisions (or improved models) and communicate the same. I had a few spare climate controls here to test that theory out, they all report back as the same computer ID. The service manual says the 98-99 climate control computers have two extra error codes than what I have decoded, so I went exploring. I sequentially searched 255 possible combinations and found 2 additional computer IDs that connected to the scantool. I'll go investigate those now and note the differences. Perhaps one belongs to the 98/99 climate control computer. After that jobs is done, I'll go test out the latest ECU computer ID contribution.

New addition: E620 96 3000GT DOHC Spyder SL (Source: Thank you DuTTch)

[BlackStealth]

Update: I manually scanned all OBD1 interfaces from computer ID E000 to E0FF and found 11 new computer IDs that support 6 cylinders. Of these 6 matched perfectly to existing information for 91-92 3S vehicles. Some had VICS support (DOHC), some had none. None of them had Turbo related functions or tests ( Muffler change over, Fuel pump low/high test). Maybe I'll scan E100 to E1FF next.

Building an Mitsubishi OBD2 emulator took a few days to build from scratch, and then I remember I already did this project a few years back, duh. Well at least I did it in half the time, now that I have some better spying tools available.

To my surprise, the E620 (1996 Spyder SL) was different (91-93,94-95,98-99), specifically these tests:
MAF Reset Signal, PSP Switch, PNP Switch, IGN. Adjustment signal, Elect. Load switch, TPS Idle switch, A/C Switch, A/C Relay, VICS MRS circuit.

Also, Japanese and Euro computer ECU IDs won't work with the MUT II cartridge that I have here. Apparently I need a Jap or Euro cartridge like this: I tried bidding on them, but failed to win it on ebay.
https://i.imgur.com/UFTQC6S.jpg

[BlackStealth]

Today I hooked up Melbowski's 1996 ABS computer to the scanner, and discovered it shares the same wire (OBD2 connector pin 7) as the MFI or ECU computer -- they both share the same bus. I looked at the 99 manual and it also is connected in the same manner. This is cool, as I can support the 96-99 ABS computer through the existing hardware found on the LCDBC. I can write some software on the LCDBC that will ask for the 97-99 ABS computer ID -- pretty cool.

I noticed Evoscan software supports ABS, but everything is all wrong for the 3S except for clearing the ABS code. Well I didn't verify what Evoscan uses for Actuators tests, that may or may not be the same.

[BlackStealth]

Update: 1996 and newer ABS computers shares the same bus as the ECU, so anyone that wants to view ABS stuff can do so now on the latest LCDBC software.

1991-1995 ABS computers I did some more tests today with the nice weather, and I have learned something new. FWD ABS computers have "rear solenoid+valve test" available whereas AWD ABS computers do not. I have extracted the hex codes to turn on these tests, and clear ABS codes. Next I have to build the LCDBC addon, so it can run the super slow baud rates and pretend to be an ABS computer so I can extract the remaining ABS error codes.

A few weeks ago I made a circuit for the LCDBC so I can pretend to be a scantool for the 1998 SRS computer and it worked flawlessly. For older SRS units, they have really slow UART baud rates, and the add-on for the LCDBC will take care of that.

[BlackStealth]

E6A2 94-95 3S Fed Turbo MD192589 (Source: Gatecrasher)
E6A4 97-00 GTO turbo New Zealand MD355167 (Source: Paolo)
E6AD 98 3000GT turbo MD347250

When I looked at this chart above, I decided to look at the gap between E6A4 through E6AD, and simulated those IDs to see what would happen. I found three turbo 3S vehicles HEX IDs.

E6A5 Both MUT over OBD2, and MUT mode. Two O2 sensors, Yes to EGR sensor. No MDP sensor.
E6A6 MUT over OBD2 only. Four O2 sensors, and MDP sensor. No EGR.
E6A8 Both MUT over OBD2, and MUT mode. Four O2 sensors, and MDP sensor. No EGR. Identical to E6A6 except it can communicate in two protocols.

The rom cartridge I have here does not do Euro or JDM ECU HEX IDs, my guess the cartridge only does USA / Canada vehicles only. So it is very likely the HEX IDs I've found are the missing 96-97 turbos in USA / Canada. One thing I have observed is that the 1996 Non-turbo DOHC ECU (E620) only communicates in "MUT over OBD2 mode", and not the super fast MUT mode. E6A6 is in the same boat, no fast MUT mode either, so my guess is that this is the 1996 Turbo ECU Hex ID.

[BlackStealth]

I spent two days searching for more 3S ECU Hex ID using educated random guesses.

E613 94-95? 100% 3S, "electrical load switch" missing, California SOHC?
E614 94-95? 100% 3S, "electrical load switch" missing, Federal SOHC?
E616 94-95? 100% 3S, Federal, one O2 sensor, DOHC VICS
E61A 94-95? 100% 3S, California, two O2 sensors (one for rear cat), DOHC VICS
E65F 98? 100% 3S, DOHC VICS

ETACS ECU nothing to decode at all, it generates a 90ms pulse each time you press a heater button, open door, close door, insert key into ignition, etc.

Cruise Control ECU: Decoded input checks, and error codes.

To do:
Decode 1996+ ABS error codes (13 computers).
Decode 1991-1995 ABS.

Decode SRS error codes (29 computers)

Summary:
ATX: done
ETACS: done
Cruise: done
ECS: done
Auto A/C: done
SRS: work to do.
ABS: still have to build circuit for 91-95 ABS computer

[BlackStealth]

Okay, was sick for a while, but I've recovered and resuming this project again. I finally figured out how to get my bench ABS ECU to spit out error codes. The ABS ECU is very finicky in that you must have the scantool ready BEFORE you power up the ABS ECU. None of the other ECUs behave like this. And this also explains why I could not retrieve ABS error codes on my own car, the car was running when I tried to pull codes. Mystery #1 solved. When I look at the oscilloscope captured waveforms, the DTC scan request is transmitted in serial format, and then retrieves the error code not in serial format, but in a series of long pulses, short pulses (exactly like how you would with a volt meter or light bulb to pull codes). So this explains Mystery #2, why none of my fake serial error codes did nothing.

Looking at the waveform, you can see that when it communicates in serial mode it uses approx 6v to 12v waveforms, and then in non-serial mode 0v to 6v. Now I have to re-design my electrical circuits as I didn't expect that.


https://i.imgur.com/gUCNtwH.png

[BlackStealth]

Update:

I finally have a 100% working prototype Add-On for the LCDBC. What it does is allows the LCDBC to communicate to all 8 computers on our cars, to read error codes, clear error codes, read diagnostic data, and also perform diagnostic tests. The second phase is to make a touchscreen interface for non-LCDBC users, I'm scrapping my previous prototype design and starting over because previous version is too hard to manufacture.

[j2k4]

I like to read stuff like this. :)

Would this be an easy piggy-back for my...can't remember which gen I have - bigger chip, I remember that...

Antero for Prime Minister! :D

[BlackStealth]

If you have version 3.00 or newer LCDBC software, then it will work. :)

[j2k4]

Great - projected cost?

[BlackStealth]

$120, comes with new OBD cable.

[j2k4]

Ima start stashing gas money. ;)

[BlackStealth]

Okay the new OBD cable is ready -- this reads all eight computers that is found on our cars, such as: Engine, Transmission, Electronic Suspension, ABS, SRS (airbag), Digital Climate Control, ETACS, Cruise. Everything that the factory scan tool could do for our vehicles, this can do also, such as monitoring sensors, reading airbag codes, clearing them, performing diagnostics tests on ABS, etc.

https://www.3sgto.org/threads/17200-scan-all-computers-SRS-ABS-ECS-Transmission-DCC-ETACS-Cruise?p=342860#post342860