About the G40/GT Chip

[GTG40]

The G40 inc the GT uses a eprom chip 27C256 that can only be erased by shining UV light on its glass window (that should be covered by a sticker) on top of the chip. The eprom connects to two other chips that are motorolas the're model numbers are: MC68HC11E1 and MC68HC25

Just got a tool that reads the eprom

Just read a standard G40 chip and i didn't think it was going to be this complicated
Its uses HEX programing and i'm tring to figure out which part of the chip does what ie injectors, ignition ect. Don't think its gonna be easy tho.

Blank Chips are quite cheap you can buy them for about £3

Heres the standard Chip for download below
Its in text format. to read it properly you need a program called 'FlexHex' and change the file extension from .txt to .hex

[hayesey]

well your only options are either pay a lot of money for professional remapping software which has the map templates built into it or try and wangle the information out of someone who does remaps.  But to be honest I think they'll probably be reluctant to just give out the information as they'll have spent a lot of time & effort figuring this out for themselves.

Yes chips are easy to get an cheap but the money you pay for remaps goes into the huge amount of time required to understand the maps and develop maps that work well.

This is something I'm quite interested in getting into as well but I don't think I have the time to figure it all out at the moment. 

[Andy]

If you read the code from the micros and then run it through a decompiler you can reverse-engineer the EPROM code. That's the only way to get ALL of the information you need, other than getting the original VW software documents.

You could spend money on a professional mapping tool, which may come with a config library that tells you where all the key memory addresses are - but not all of them are correct, and most are very pricey (as in significantly more than the cost of buying a standalone EMS, installing it, and paying for that to be mapped!).

On the other hand, if you do some statistical analysis on the hex dump from the EPROM then it's possible to get some good guesses as to where the main maps are - but you'll need a decent emulator to suss out what's going on.

[G40supercharged]

I worked out where the maps are a while back - they are pretty obvious - I will have a look and see if I can find my notes. if I remember correctly they are 2 lots of 256 byte tables, 1 for ignition and 1 for fuel. The code was written in assembler rather than a high level language (like C or something).  I worked out where the rev limit was and what the relationship was between the value and the actual rev limit. On one of the early Jabba chips I saw the code for all they had changed was the rev limit value.

[GTG40]

It would be good to get some more info on chips and ECU's as its a bit of a grey area with only a few people in the know

Heres some info on the motorola chips that the G40 ECU uses

http://pdf1.alldatasheet.com/datasheet-pdf/view/127937/MOTOROLA/MC68HC11E1.html
http://www.datasheet4u.com/download.php?id=526378

[G40supercharged]

The rev limit is 2 bytes at hex addresses 5BC2 and 5BC3 giving a 16 bit value. Standard is hex value 11C1 which equates to 6600rpm. The chip I use (TEC) has 1140 which comes out as 6800rpm. Another one I have seen is 10C1 for 7000rpm. To get from the value to the rev limit divide by 500000 to give the time in milliseconds for 1 rev of the engine at the limit. (For those that are interested the 16 bit value is part of a 'branch if less than' instruction. This compares the time between hall sensor pulses with the rev limit value. If it's lower then the engine is rotating faster and the software branches off to the rev limiter code.)

I worked this out by comparing code from stock and tuned chips. I started to disassemble the whole thing a while back, but it is quite hard work to understand what's going on. You also need to work out the ECU circuit to see what A to D channels correspond to what sensors (pressure, temperature etc.) in order to understand how the ECU uses these.

[G40supercharged]

The 2 maps are at hex addresses 4004 and 4104. Each one is 256 bytes arranged as 16x16. It looks to me like 4004 is the ignition and 4104 is the fuel. If you put them in a spreadsheet you can make some pretty 3D graphs.

[hayesey]

10C1 is 4289 in decimal.  divide by 500000 which gives a time of 0.008578 milliseconds per rpm.  60000 milliseconds in a minute so divide 60000 by 0.008578 gives 6994637 to the nearest one.  Which I guess 6994.637rpm.  Although my maths is pretty rusty these days!

[G40supercharged]

10C1 is 4289 in decimal.  divide by 500000 which gives a time of 0.008578 milliseconds per rpm.  60000 milliseconds in a minute so divide 60000 by 0.008578 gives 6994637 to the nearest one.  Which I guess 6994.637rpm.  Although my maths is pretty rusty these days!

Correct! The smaller the value (time for 1 engine rev in units of 1/500000 of a second) the higher the rev limit.

GTG40 - you have converted the hex representations to 16 bit binary (correctly). If you put either the hex or binary into windows calculator (in scientific view) you can get the decimal equivalent value.

[hayesey]

where does this figure of 500000 come from?  just from decoding the instructions in the CPU?  It seems to give a nicer looking figure if you just divide by 500 since then you end up with 6994.637.

Pretty cool though, so if you want a 7500 rev limit:

60000/7500 = 8
8*500 = 4000
4000 in hex is 0FA0.

[GTG40]

GTG40 - you have converted the hex representations to 16 bit binary (correctly). If you put either the hex or binary into windows calculator (in scientific view) you can get the decimal equivalent value.

No i haven't i'll try that thanks

[juan]

Here's a place that supplies make the programming/mapping software:

http://www.alientech.to/



Here's some people that sell various eprom related stuff:

http://shop.cmdelectronics.com/index.php

[Robin]

GEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEKSSSSSSSSSSSSSSSSSSSSSSSSSSS

[Andy]

Lol, I'm going to charge you double for your remap now Rocket! 

[giorgio]

GEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEKSSSSSSSSSSSSSSSSSSSSSSSSSSS

I was thinking it since about post 3 but didn't want to spoil their little geek-athon

wish I was this trick at electronics. I am horrendous at it