Jeep SBEC PCM tuning (91-95)

That would be sweet if you draft a doc on how it works for sure.

My grand is automatic, but it'll happily work with the 781 cal that's manual. The TCM is basically completely independent. It just needs a VSS signal, RPM and Brake switch input from the PCM, and those are given out either way.
 
Yes so is my xj. Reason I wondered was because cruise control cancels if RPM changes very much, which since it is an automatic I can fix that by flashing my weatherproof ECU. :)
 
a_kelley said:
Sure, just wait to build it til I test it out.. that or I can fab a second one when I get it ironed out and just mail it to you. The patent outlines what's necessary, basically send a data block, activate prog volt then wait till the PCM reports programmed those bytes, turn off volt, repeat till finished. I forget what each control line is without looking but DTR/RTS is one side and DSR/CTS is the other side. (Goes back to days of terminals and computers, where one is DCE and one is DTE, which signifies if it is input or output on certain pins, but for my purposes, as long as there are a total of 2 output control lines(should have RTS/CTS & DSR/DTR), it will work, but if it doesn't I have USB microcontrollers I've been using for my interface and sim).. I've got the board nearly complete for the Sim but need to write up the code now (50% done). I'm about ready to do it in stages (ckp/cmp, verify its "running", add map/tps, verify, add CTS/IAT, instead of doing it all at one time and troubleshooting everything at once) at least I've got the interface working to simulate a drb so I can use it to verify the CTS, IAT, TPS, MAP, RPM. Plus that lets me verify code in the SBEC by seeing the code used to send it to drb a which gives me verification that I've got the memory correctly labeled, which in turn verifies my identification of the code routines.

So no, I'm not just recalibrating the PCM for different cam, displacement, etc, but reengineering it to alter the inputs and calculations to accommodate the 2bar map and boost.

@Mac5005

Retuning fuel and spark is very much capable at this point. I just want to verify it works properly before pushing it out the door. (Thus the Sim, which can handle full fuel at idle and lean fuel at high rpm. And still run. Without blowing up. Oh and over advanced timing that would put a rod out the block.) ( Which I will probably do something silly like that because it's easier to see than a minor change, for diagnostic purposes)
Click to expand...



I was skimming through the patent last night, trying to make sense of it. Doesn't seem terribly difficult, but there are a few steps for sure. Seems like you have to upload a bootloader to the hc11 after bootstrap, correct? Where did you get the bootloader binary?? Also how did you figure out what command reads/writes? Pretty cool!
 
Yes. The code isn't difficult to find. It's pretty standard hc11 stuff. Basically treat the sbec like a development board with a eeprom in my case. (No program voltage required) the .bin files in my folder are the code that is downloaded to the hc11. So basically to use the existing flash chip, just need to change the code in the hc11 and the interface to control program voltage and the computer code to control it at the right times.

I say 'just' change but really takes a bit of work to do so and ensure it works as it should.
 
Sweet, thanks for the info. The local boneyard has another 40% off sale coming up the last weekend of the month. I'll try to go snag a few flashable sbec's for us to test. Happy to send you one when I get my hands on them.
 
Question.... on Turbo mopar you mentioned the 356 code using the O2 sensor vs the 781 leaded cal not.

Curious what the code looks like (I'm a total n00b) for o2 sensor...

Would you be able to tell me beginning what line in the disassembled code i can find the o2 sensor code on the 356 cal?
 
It's pretty difficult to follow, because the o2 sensor is read in one place, values compared elsewhere, and then the injection pw is modified prior to outputting the PW. Search for o2volts / o2value and you'll find where it's read first, then where's its compared to the calculated limits (under some conditions, rpm, wot, etc) I'm not near my computer right now..
 
Well, it was 40% off at the boneyard today and with good luck, I managed to snag 2 flashable SBEC-IIs! Both are the same part number, but different than any of the other cal's we have, so I'll bootstrap one and download the cal and post it.

Also got another goodie recently, which is the Chrysler flash module! Figured it'd be good to have on hand for flashing.


Happy to send you one of the sbec's, hopefully we can figure out how to flash these stock.

Hope you have a good New Year!
 
Cool. The flash module might not do you any good without a drbII. And also then you have to load the Cal into the drbII. I've been working on the simulator some, it's about completed. Lots of code to go thru to make it accept a 2bar map.
 
Actually, I did a bunch of reading from Rob Lloyd's posts and it seems like most all that the flash module does is create the +20v and allow communication. Rob was buying these things and using parts from it to build is flashing device for the Neon FCC. One came up super cheap on ebay so I jumped on it, figured it couldn't hurt to have it.

Flashing the SBEC-II - Page 3

For the 2 bar map, are you having to rewrite the table to accept a bigger scale? How are things with the simulator?

BTW - Did some research on knock sensors, found the location where the factory one goes on the older Renix jeeps. I need to crawl under my truck to see if the hole for where it goes is drilled/tapped. Will try to do that soon.
 
Last edited:
It is drilled and tapped on most. The only thing in the module that's really of any importance is the 20v supply, but that could be cheaply done in other ways, (9v battery on top of 12v, or a smps boost converter) other than that it's a simple matter of applying it at the right times to the receive line, like the bootstrap voltage. Has to be automated because it happens every 64 or so bytes.
 
So I went ahead and built my own rig for flashing the factory sbecII. I used the innards of the EATX flash module coupled to a FTDI cable. I was under the impression that MPtune could do this based on what Wowzer has said in the past.

His and Rob's design uses the RTS signal on the FTDI cable to switch on/off the programing voltage. I used some PNP/NPN transistors to make this happen and tested it and confirmed it works with a +5v feed (when RTS goes high). Basically when the input line goes high, it grounds the Bus - wire on the module and applies switches on +12v on the Bus + line on that EATX module. This results in a nice, clean +20v output on the RX line and it has built in protection for FTDI's TX line.

That being said, MPtune isn't having it..I set it to flash a SBEC-II and played with it for hours last night and no go.

I looked thru your utility (love the simplicity of it) and your doc mentions it uses the DTR line for switching on/off programming. I noticed FTDI only has a RTS and CTS line available. obviously I set the RTS line to be inverted. Any way to switch the utility to apply programming voltage to RTS? I'm so close to getting this working (or at least I think).
 
sev80 said:
So I went ahead and built my own rig for flashing the factory sbecII. I used the innards of the EATX flash module coupled to a FTDI cable. I was under the impression that MPtune could do this based on what Wowzer has said in the past.

His and Rob's design uses the RTS signal on the FTDI cable to switch on/off the programing voltage. I used some PNP/NPN transistors to make this happen and tested it and confirmed it works with a +5v feed (when RTS goes high). Basically when the input line goes high, it grounds the Bus - wire on the module and applies switches on +12v on the Bus + line on that EATX module. This results in a nice, clean +20v output on the RX line and it has built in protection for FTDI's TX line.

That being said, MPtune isn't having it..I set it to flash a SBEC-II and played with it for hours last night and no go.

I looked thru your utility (love the simplicity of it) and your doc mentions it uses the DTR line for switching on/off programming. I noticed FTDI only has a RTS and CTS line available. obviously I set the RTS line to be inverted. Any way to switch the utility to apply programming voltage to RTS? I'm so close to getting this working (or at least I think).
Click to expand...

Yes. However, the protocol for programming the flash chip differs from an eeprom. If you can locate a datasheet on it, I can make it work. I could also modify the code to where it can accept different mini tools for the ecu for debugging it. It was a bit time consuming to get the eeprom programming working but I was debugging 4 different things all at the same time.

Do you code in c++? If so, do you do visual studio 6? 68hc11 asm? There's a couple steps to get from asm code to the .bin used by my tool.. but it's straightforward on the PC side to change DTR/RTS and sequencing the on/off needed for download code, RTS on, program cycle, rts off, repeat. Then dump and verify. But need the flash chip datasheet to determine timings for the write/erase. (Or chip ID at least, might already have code to go off of depending)
 
So I mostly do scripting, so I dont code in C++ but I definitely am familiar with the fundamentals of coding. I'm sure given enough time, I can figure it out I'm sure C++... HC11 asm, I've been "learning" through osmosis over the last year thanks to this project. Best I could probably do is read it at this point and understand it. That being said, I think some of those sequences for the hc11 are already written and ready to go. I found the ASM code for reading/erasing/flashing for the chip in the SBECII. It's already in MPTune in uncompiled format. The chip is a ST28F256, and I think (but not sure) Rob L already figured out the timing. At least he did for the FCC. Here is the datasheet for 28F256.

ST Microelectronics - datasheet pdf


I could send along the ASM files if needed as well. They're readily available from MpTune and well commented up by Rob L.

I wouldn't mind taking a crack at your code to change DTS/RTS. Would be a cool challenge.

If I had to guess why flashing fails in MpTune, I think the ChipID is coming back wrong from the SBEC-II. Why though, I'm not sure.
 
It's straight forward. But if it's the same as the fcc, I can merge it pretty easily. Yeah it's actually a list file that is bundled. (Has machine code in the left margin that needs stripped out to be asm, but no biggie) just need to look and see what the code does and finish the PC side... You said you tried mptune but it wouldn't work.. did you capture a log perchance? That's something I ought to add to my code.
 
So the FCC is similar, but not identical to the Sbec-II. I think it uses a bigger, 64k flash chip. But if you look at those list files, there's one specifically for the SBEC-II.

MPTune doesnt have a log per se, it just basically says "Chip write verification failed, chip ID failed"... however..clicking through the menus for multiple attempts gets very cumbersome. Which is why I love the simplicity of your utility.


I got Rob L's FCC flash util and tried that. It's basically a scaled down version of MpTune's flash routines. That has a rudimentary log. I see in that log that every time it tries to ID the chip, a different value is returned. Ultimately it gets identified as a SMEC and the util tries to load the routines for SMEC (which dont exist) and it errors out saying the files for that routine fail.
 
@sev80 @Mac5005

Project update:

Fuel/spark code & tables have been identified. Editor is being worked on.

Flash updating for later model sbecs is in development.

Eeprom programming works currently but requires board modifications.

2 bar cal is on temporary hold until the former goals are achieved.

Stroker & other upgrade cals soon forthcoming.

Hold onto your hats people, this is going to happen unlike 95% of all the other threads claiming it will happen. It's happening. There is a learning curve so not sure as to whether custom diy tuning will be available and cost (we will try our best to do so), but definitely canned or custom online/on vehicle directly tunes will certainly be available, at a reasonable affordable price point.

I will get my Gold diamond when I'm ready to launch it.
 
This kicks so much ass!

Andrew, don't forget plans for knock detection/timing adjustment.
 
sev80 said:
Andrew, don't forget plans for knock detection/timing adjustment.
Click to expand...
Certainly, knock sensing is crucial in stroker cals and forced aspiration and any performance tune to be able to run it closer to the edge without worrying about detonation. Very crucial. That's objective 3 before the 2bar code. Once all that is perfected then we will be able to move onto forced aspiration. FA in itself is a huge endeavor requiring a bunch of rework of existing NA code, as anyone familiar with any ECU code/programming can understand.
 
a_kelley said:
Project update....
Click to expand...

I am completely blown away by this thread. Wow!

Been looking for a way to tune my ZJ for two years now.

My plan is too add small boost to start -- probably only 7 lbs.

I would happily pay a LOT to not have to rewire for megasquirt or some aftermarket ECU.

BTW my profession is C, C++, and embedded development. I've coded in x86 and ARM.
 
Might be able to bring you into the team.. depends how familiar you are with micro coding on 68hc11 and amount of time your willing to invest. This is a side project that Sev and I started on a couple months back. I've successfully programmed a modified sbec and we are working on flashing the stock flash ecus to avoid having to repot and rework boards. But not every ecu if flash. Easiest tell is if the case snaps together or screws together. Takes special hardware to flash the ecus. Software is in development. I'll talk with Sev and we'll get together. Expect a pm from me or him with contact info.
 
a_kelley said:
Might be able to bring you into the team.. depends how familiar you are with micro coding on 68hc11 and amount of time your willing to invest. This is a side project that Sev and I started on a couple months back. I've successfully programmed a modified sbec and we are working on flashing the stock flash ecus to avoid having to repot and rework boards. But not every ecu if flash. Easiest tell is if the case snaps together or screws together. Takes special hardware to flash the ecus. Software is in development. I'll talk with Sev and we'll get together. Expect a pm from me or him with contact info.
Click to expand...

i am sure i can pick up 68hc11 in a very short time

my problem is setting up a test bench to my PC with the spare ECU i have

i dont have a clue what to wire where, what equipment i need to buy, or what pins to connect to what.

those "little things" are what scares me
 
GarageBuild said:
i am sure i can pick up 68hc11 in a very short time

my problem is setting up a test bench to my PC with the spare ECU i have

i dont have a clue what to wire where, what equipment i need to buy, or what pins to connect to what.

those "little things" are what scares me
Click to expand...


That part is very easy. There's wiring diagrams online. The hard part is the coding experience (which I somewhat lack). Would love to have another hand on the project! We're very close to getting the stock ECU to flash. Late 94 and 95's are flashable. Like A_kelley mentions, if the case has screws, it is not flashable, if it has snaps, it is.
 
sev80 said:
That part is very easy. There's wiring diagrams online. The hard part is the coding experience (which I somewhat lack). Would love to have another hand on the project! We're very close to getting the stock ECU to flash. Late 94 and 95's are flashable. Like A_kelley mentions, if the case has screws, it is not flashable, if it has snaps, it is.
Click to expand...

easiest way to get the ecu powered on the bench is to go to a junkyard and hack off a 60 way connector off a dead jeep. Wiring it up is cake.
 
I can supply wiring distance for power and comms. I'm working on a dedicated pc interface that will plug and play. It's a little more involved that just wiring up an adapter, as it must switch power and signals. I should have a board ready here this week or next that will work (and also be upgradeable). Future option is Bluetooth to pc/Android but that's a ways away.
 
Back
Top