Jeep SBEC PCM tuning (91-95)

Ron said:
Looks like the dude you quoted hasnt been on the board in over 7 months
Click to expand...
I still check here from time to time! good to see interest here! Akelly is probably the right guy to share the memory locations. I had them somewhat figured out but it wasnt 100%. I can go back and look at my old notes. Dunno if Andrew still checks this thread.
 
a_kelley said:
Progress.. Ported my XJ head and wound up lean so was forced to accelerate development at least partly. Data logging is working (though it needs severe polishing, as you will see). Tuning is capable of adjusting fuel and spark.. I had an issue in the code where modifications were not saved. I fixed that and was able to fatten up fueling. Lots more to do and add and integrate before beta release ready, but its at a point where progress will seem slow because its integrating the separate tools ( presently, ProgCon, DataView, TestEditor are merging and becoming the final tool ). Binaries of the ecus will not be distributed with the tool, but the editor maps will be. Reasoning is that if you have the ECU, you have the binary already, you just need to download it. (and then I'm not distributing copyrighted material, only outside creations that give a map of said material that you own)

View attachment 270845

here you can see i rolled into the throttle from a stop, accelerated through 1->2->3 and let out, slowed down, then got back on it. elapsed time was probably 30 seconds. you can see there are no scales on the graphs and the height of the graphs are outside the bounding rectangles. also the hex address in the title is the address of the data in the ECU, and the pretty names are in the bottom right window, thats another thing that needs to be added in, is a pretty list to select log data from. in addition, the data is recorded by a separate program, which needs to be integrated.
Click to expand...
Andrew has a few of the memory locations in this screen cap, hope that helps. These were for the 4.0, which are completely different than the 5.2
 
I just finished a small utility that will assist in getting an EPROM out of
an ECU without de-solding the chip, no soldering or special equipment
needed, it will just relentlessly put the SBEC into bootstrap mode and
attempt to upload the bootstrap until the SBEC starts sending the EPROM
github.com

jeep_2.5L/SBEC_download at master · AR1972/jeep_2.5L

91-95 Jeep and Dodge EPROMS. Contribute to AR1972/jeep_2.5L development by creating an account on GitHub.
github.com github.com
 

Attachments

  • sbec_download.jpg
    sbec_download.jpg
    165.4 KB · Views: 251
EEPROM for:
1994 JEEP GRAND CHEROKEE 5.2L AUTOMATIC FEDERAL EMMISSIONS
P/N: 56029302

They barely got the V8 code onto a 32k EEPROM, has a 68HC11E9 CPU and the TI chip
is at 0x400->0x4FF
 

Attachments

  • 56029302.zip
    22.6 KB · Views: 209
Last edited:
Adam, I saw you made a post yesterday but deleted it, how come?
 
sev80 said:
Adam, I saw you made a post yesterday but deleted it, how come?
Click to expand...
I built a programming interface out of a relay board and a boost converter and have started working on
erasing and writing the EPROM without de-soldering the chip. I can get the chip ID and erase the ST chips
but was having problems erasing the Toshiba chips. I have a DOS era EPROM programmer that can
program the Toshiba chips, so I got a logic analyzer and wired it up, but I still had issues with the
code. Sometime after I made the post I figured out the problem, I just needed to add a little delay to the
code to allow the 20 volts to be applied to pin 45 before interacting with the EPROM, I deleted the post
because it became irrelevant. I'm pretty confident I can program the ST EPROM's and likely the Toshiba
chips as well. We'll see, how using relays to switch between data and programming voltage, will work out.

20211229_172418.jpg
 
Last edited:
Here is a short video of a Dodge Ram 1500 5.2L ECU P/N 56028078
running my 4 cylinder 1992 Wrangler, I pushed the code up to 0x1100
just after the 68HC11 registers and stripped out the Emission Maintenance
Reminder code.

 
I can now flash the Toshiba chips, they are basically flashed like an AT29C256
they have a 64byte page and each page is flashed twice, even bytes then odd
bytes or odd bytes first, it doesn't seem to matter, once the 64th byte is loaded
the EEPROM starts writing bytes. a little delay is needed after each byte is
loaded or nothing gets written.
 
AdamRosas said:
I can now flash the Toshiba chips, they are basically flashed like an AT29C256
they have a 64byte page and each page is flashed twice, even bytes then odd
bytes or odd bytes first, it doesn't seem to matter, once the 64th byte is loaded
the EEPROM starts writing bytes. a little delay is needed after each byte is
loaded or nothing gets written.
Click to expand...
nice work! thats awesome you figured out how to flash the toshiba chips. My experience is a majority of Jeep SBEC IIs were Toshiba's. Only the really late 95s seem to be ST.


What are you flashing on them, just stock cals?

edit: Just checked out your Github and saw your write up, very cool youre trying to get 6 and 8 cyl sbec's to work on 4cyls. I had no idea they were so expensive for 4 cyl ones..
 
Last edited:
roelant said:
Yes that's unfortunate, is there any one who can help me with finding the ram locations for a 4.0 liter sbec of a yj from 92? So i can use mpscan to loo into things? Or even a original.bin file? Help would be appreciated a lot... I am trying to get this old jeep going for a friend, It has a stroker motor that was build 10 years ago, never ran, the project was never finished.. Now i can not get it to run, ignition is way off, fires at 60 degree before tdc. I think the sbec might be upset , maybe bad capacitors. Maybe the wrong sbec for this car, it might have been swapped. I have some other sbec but these are for v8 5.2 Cherokee engines. I might try to socket one of these and put 6 cyl code in it. Would that work?

You guys seem to have gained a lot of knowledge about these sbec's. Hope you can give me some hints..
Greatings from the netherlands...
Click to expand...
Apparently so, according to Adamrosas, who took a v8 sbec and flashed it to work with a 4cyl YJ....
 
sev80 said:
nice work! thats awesome you figured out how to flash the toshiba chips. My experience is a majority of Jeep SBEC IIs were Toshiba's. Only the really late 95s seem to be ST.


What are you flashing on them, just stock cals?

edit: Just checked out your Github and saw your write up, very cool youre trying to get 6 and 8 cyl sbec's to work on 4cyls. I had no idea they were so expensive for 4 cyl ones..
Click to expand...
Thanks, of the 3 ECU's, with Toshiba chips, that I have, I can flash 2 of them, the third one can't be flashed, even in a programmer that supports these chips. bummer.

I'll probably dabble with tuning my Jeep, but right now I'm figuring out the system, I'm interested in how the DRB and ATM code works, I'd like to work out
how to reset the EMR light and clear error codes, at the very least.
 
Sweet, I have a DRBII so let me know if i can help with that. I should throw a bus pirate on it and play around.

Andrew was very well versed in the code for these jeeps. he could have told you how it all worked. Looks like he’s stepped away from this.

What is the EMR light? ZJ’s don’t have that.
 
sev80 said:
Sweet, I have a DRBII so let me know if i can help with that. I should throw a bus pirate on it and play around.

Andrew was very well versed in the code for these jeeps. he could have told you how it all worked. Looks like he’s stepped away from this.

What is the EMR light? ZJ’s don’t have that.
Click to expand...
EMR light is an emission maintenance reminder that turns on at 63k, 82k and 120k miles
you have to get somebody with a DRB to turn it off. I got if figured out enough that I
can get the light to go off after 1-5 miles by adjusting values in the MCU eeprom but
it comes back on when the Jeep is restarted.

I got the stubborn Toshiba chip to flash, the address that the last byte is written too, to allow
writes, was different.
 
EEPROM for:
1995 JEEP WRANGLER 2.5L AUTOMATIC FEDERAL EMMISIONS
P/N: 56028832
 

Attachments

  • 56028832.zip
    19.7 KB · Views: 233
Last edited:
Hi guys,

I'm new to jeeps, recently bought a 1992 fixer upper YJ.
I have some past in chiptuning oem ecus of european cars (mostly through obd, but also older stuff like volvos and older tdi's where chip needs replacing).

I've been reading this thread with full interest and i'm gonna dig into it all.

Does anyone have a working link to mptuner or suite?
 
Last edited:
Winnox said:
Hi guys,

I'm new to jeeps, recently bought a 1992 fixer upper YJ.
I have some past in chiptuning oem ecus of european cars (mostly through obd, but also older stuff like volvos and older tdi's where chip needs replacing).

I've been reading this thread with full interest and i'm gonna dig into it all.

Does anyone have a working link to mptuner or suite?
Click to expand...
So MPTuner is written by the turbo mopar guys and doesnt fully work with the jeep calibrations.

The toolset Akelly was working on was not released, I think he went through some life changes and has gone dark. Its too bad because not only was he super smart but he was a good guy all around.

That's where this project is right now.
 
AdamRosas said:
I can now flash the Toshiba chips, they are basically flashed like an AT29C256
they have a 64byte page and each page is flashed twice, even bytes then odd
bytes or odd bytes first, it doesn't seem to matter, once the 64th byte is loaded
the EEPROM starts writing bytes. a little delay is needed after each byte is
loaded or nothing gets written.
Click to expand...

Can you elaborate on how you did this? Did you bootstrap it and upload some code to do the flashing? That's how we were doing it with the ST chips. The code contained the timing and etc to do the flashing.
 
Yes, I wrote a bootstrap for the SBEC that is uploaded to the unit that handles flashing the chip.
On the PC side is a console application that controls the relays that applies the bootstap and
programming voltages at the correct times and handles uploading the bootstap and the
bytes to be flashed. Once flashing is finished the EEPROM is read back out to the PC to
verify a successful flash.

All code can be found on my github, the programming interface is constructed from
a usb controlled relay board and a boost converter from aliexpress for under $20

github.com

GitHub - AR1972/jeep_2.5L: 91-95 Jeep and Dodge EPROMS

91-95 Jeep and Dodge EPROMS. Contribute to AR1972/jeep_2.5L development by creating an account on GitHub.
github.com github.com

Code: 
; 68HC11 bootstrap, download to a SBEC that has been
; placed into bootstrap mode by applying 12 volts to
; pin 45 until SBEC sends 0x00 on pin 25.

    ORG $0000

THE_BEGIN:
Start:
    ldS     #$FF        ; stack pointer = 0xFF
    ldX     #$1000      ; config 68HC11 registers
    ldD     #$330C      ; config SCI
    staA    $2B,X       ; store value in register A ($33) in 0x1000 + 0x002B
                        ; configures SCI for 1200 BAUD
    staB    $2D,X       ; store value in register B ($0C) in 0x1000 + 0x002D
                        ; configures SCI for TXD/RXD
    sei                 ; disable interrupts
    ldD     #$6001      ; load D register with 0x6001
    staA    $3C,X       ; store value in register A ($60) in 0x1000 + 0x003C
                        ; enables Special Mode
    staB    $3F,X       ; store value in register B ($01) in 0x1000 + 0x003F
                        ; System Config Register

    ldX     #$8000      ; load index with value

Next64ByteBlock:
    ldY     #Buffer-1   ; ECU nearly always receives $00 when programming
                        ; voltage is disconnected store it before the buffer
    clr     Odd         ; init our EVEN, ODD flag
    cpX     #$B600         ; PC won't be sending the MCU EEPROM address $B600->$B800
    bne     LoopToFillRAM  ; so just skip it
    ldX     #$B800

LoopToFillRAM:
    ldD     $102E          ; loop until a byte has been received
    bitA    #%00100000
    beq     LoopToFillRAM
    staB    $00,Y          ; store byte to write buffer
    inY                    ; increment buffer address
    cpY     #Buffer+$40    ; test if buffer is full
    bne     LoopToFillRAM  ; loop until buffer is full

; we need to delay a little to allow the PC some time to apply 20 volts to pin
; 45, the ECU will then apply 12 (Vpp) volts to pin 1 of the EEPROM

    ldY     #$4119      ; 50ms
wait_0:
    deY
    bne     wait_0

    ldY     #Buffer     ; point to the beginning of the write buffer

; the Jeep Toshiba EEPROM's have 64 byte sectors, bytes to be programmed
; are loaded EVEN/ODD or ODD/EVEN, once the 64th byte to be programmed is
; loaded, or maybe the 65th, the chip begins writing the bytes. The first
; byte loaded determines if ODD ore EVENS are going to be loaded first.
; it is unclear if each sector is flashed after each load sequence, or
; just once after both ODD and EVEN bytes have been loaded.

pgm_sector:
    ldD     #$AAA0      ; pretty much the SDP disable the AT29C256 uses
    staA    $D555       ; store $AA @ address $D555
    comA                ; $AA is now $55
    staA    $AAAA       ; store $55 @ address $AAAA
    staB    $D555       ; store $A0 @ address $D555
    clrB                ; register B is now $00
    ;staB    $A000      ; works for some Toshiba chips
                        ; store $00 @ address $8000
    staB    $8000       ; works for both discovered
                        ; variants of Toshiba chips

; first pass, 64 bytes are loaded from the write buffer, starting with an EVEN byte ($00),
; second pass, 63 bytes are loaded from the write buffer starting with an ODD byte ($01).
; it's unclear if each sector is flashed twice, after each loading sequence, or just once.

ld_bytes:
    ldaA    $00,Y       ; load byte from our buffer into register A
    staA    $00,X       ; store byte to EEPROM
    inY                 ; increment buffer address
    inX                 ; increment EEPROM address
    ldaB    #$0C                ; a little delay is needed for EEPROM to
    bsr     ShortDelayLoop      ; register the byte to be written
    cpY     #Buffer+$40         ; test to see if we have reached the end
    bne     ld_bytes            ; of the write buffer
    brclr   Odd,$00000001,reset ; test if we need to load ODD bytes
    deX                         ;
    bsr     VerifyWriteComplete ; wait for the last byte loaded to be written
    inX
    cpX     #$0000              ; test if X has rolled over to $0000 and programming
    bne     Next64ByteBlock     ; is finished, or get the next 64 bytes to be written.

Finished:
    ldaA    #$19                ; wait for programming voltage to be disconnected
    staA    Delay               ; EEPROM and ECU need about 2 seconds before we
                                ; start sending bytes or write verification or
                                ; tends to fail.
wait_1:
    ldY     #$0D05*2            ; 10ms x 2

wait_2:
    deY
    bne     wait_2
    dec     Delay
    bne     wait_1

    ldX     #$8000      ; point to the beginning of the EEPROM

SendByte:
    ldaB    0,X         ; load byte into B

WaitForSCI:
    ldaA    $102E       ; wait for SCI to be ready to send
    andA    #%10000000
    beq     WaitForSCI
    staB    $102F       ; send byte
    inX                 ; point to next byte
    bne     SendByte    ; loop until X rolls over to $0000

XXX:
    stop

ShortDelayLoop:
    decB
    bne     ShortDelayLoop
    rts

; reset to the beginning of the write buffer plus one.
; reset to the beginning of the EEPROM sector plus one.
; set flag to indicate ODD bytes have been/are being loaded

reset:
    xgdx                ; move X register to D register
    subD    #$40-1      ; subtract $3F from D register
    xgdx                ; move D register to X register
    ldY     #Buffer+1   ; point to beginning of write buffer plus one
    inc     Odd         ; set ODD bytes flag
    bra     ld_bytes    ; load ODD bytes

; loop until byte has been written, should
; take 20ms MAX to write a sector

VerifyWriteComplete:
    ldaB    0,X
    pshA
    andA    #%10000000
    andB    #%10000000
    cBA
    pulA
    bne     VerifyWriteComplete
    rts

Odd:
Delay:
    fcb $00
    fcb $00
Buffer:
 REPEAT $40
    fcb 0x00
 ENDR
THE_END:

                             ; pad bootstrap to 256 total bytes
 REPEAT 256-(THE_END-THE_BEGIN)
    fcb 0x00
 ENDR
 
Thanks Adam! Wonder if I can use your bootsrap code with the stuff Andrew and I wrote to be able to flash toshiba chips. My main ECU has the toshiba chip. My spare one that had the ST chip that I could write to needs to be re-potted.


Anyway, I recently spoke to Akelley. Poor guy has gone through some major life changes and this project is on hold for him. He offered to give me whatever code he had left for this project and said he's happy to allow me to post it on Github.

I've got some renewed interest to get tuning and flashing for these jeeps off the ground, but im no engineer, I know a tiny bit about assembly language, and have a very fundamental understanding of EFI concepts. But I do have sheer persistence.

If we got enough will, and people with the right skills, I'd love to continue this project. Raise your hand if you can help!
 
sev80 said:
Thanks Adam! Wonder if I can use your bootsrap code with the stuff Andrew and I wrote to be able to flash toshiba chips. My main ECU has the toshiba chip. My spare one that had the ST chip that I could write to needs to be re-potted.


Anyway, I recently spoke to Akelley. Poor guy has gone through some major life changes and this project is on hold for him. He offered to give me whatever code he had left for this project and said he's happy to allow me to post it on Github.

I've got some renewed interest to get tuning and flashing for these jeeps off the ground, but im no engineer, I know a tiny bit about assembly language, and have a very fundamental understanding of EFI concepts. But I do have sheer persistence.

If we got enough will, and people with the right skills, I'd love to continue this project. Raise your hand if you can help!
Click to expand...
The main issue I had with using relays to switch the bootstrap and programming voltages, was noise causing the SBEC to think it was receiving a 0x00, since this
would happen 99.9% of the time I ended up just ignoring the first byte at every buffer refill. I expect that wasn't an problem in the programming interface you
guys came up with, you would likely have to change
Code: 
ldY     #Buffer-1
to
Code: 
ldY     #Buffer
at the very least. also, once programming is complete the bootstrap sends the entire EEPROM back to the PC to verify a successful write.
If I saw the bootstrap for the ST chip I could modify it for the Toshiba chip.

I would love to see what ever code was developed by you guys, it was always my intention to move on to developing a plug and play
replacement ECU based on a Speeduino, but I can help out on this project if needed.
 
well, I finely discovered why I was having trouble getting the emission maintenance reminder light
to turn off and stay off *drum roll* the LED dash lights I installed some time ago, the LED installed
into the EMR light spot wasn't drawing enough current to turn off the diagnostic circuit intended to
tell the SBEC if the light was on. If I want to continue to use an LED in that spot, I'll have adjust the
voltage divider for the current draw of the LED.

Interestingly all the SBEC's I have, don't have the parts installed to turn on an EMR light, Chrysler
must have wanted to save some money a deleted this functionality.
 
reading through the datasheet for the micro controller used in the 5.2L
ECU's (68HC11E9), I discovered they can be clocked faster than it currently
is, so I swapped out the 8 Mhz crystal and installed a 12 Mhz crystal and
adjusted the BAUD register for the faster clock, so I could connect the
DRB. The Jeep runs like absolute garbage, idle is all over the place,
charging at 16 volts, sensor reading all over the place.

Not sure how practical this mod is, but I think I can get it working.

20220909_155410.jpg
 
Last edited:
Back
Top