'94 Jeep Cherokee Tuning

[jeeper]

I'm obviously new to this forum, and I'm not here because my jeep is boosted (it's not). I came here because i see some fair amounts of intelligence and inquisitive minds in the PCM tuning threads I've read. I've got a '94 Jeep Cherokee 4.0l 2WD w/AX15 trans. Just a few small mods like cold air intake, free flowing muffler, and 24lb 2nd gen bosch 4 hole injectors. I've stopped there because i feel the stock tuning isn't quite cutting it anymore and if i go further, i will see no gains due to lack of tuning. I've got 20-22mpg average. I'm shooting for more power and better mpg by way of PCM adjustments and underbody aerodynamic modifications.

The tuning information I'm searching for doesn't seem to be available on any Jeep forums. I have been doing lots of research on getting into the PCM's on these vehicles. As i understand, the SMEC and SBEC (I/II/III) from my jeep (SBEC II) and from most other Mopars of similar era are basically the same. I haven't gained much ground in interfacing with the PCM yet. I'm just starting with trying to get a basic connection to the PCM, and start to get responses. Then on to live data and tuning. I do know the baud is 7812.5 and 62.5k depending on what you're doing. I've started by purchasing an external serial-usb adapter so i can use my laptop in the vehicle. I know i'm dealing with SCI and that its a motorola setup, but thats all the real definite info i have. I also have a USB ELM327 for live data and DTC's and hopefully tuning some of my friends OBD-II cars.

I'm actually wanting to learn how the maps work and how to actually interface with the PCM down to the OBD commands, the AT commands, actual code, etc. I don't just want to go fast and want it now. I'm here to actually learn something.

[Vigo]

User: ShelGame http://www.turbo-mopar.com/forums/member.php?141-ShelGame is the guy to go to for stuff like this, and i believe he expressed interest in tuning 4.0 jeeps in the past. Depending on how far he has gotten with that particular style of pcm, what you're trying to do could be extremely tedious to learn.

I'm normally not the guy to suggest taking the easy way out on a laudable goal like learning how to tune your own ECM, but i have to wonder if most of the adjustments you would like to make would be possible with an over-the-counter 'piggyback' computer system altering the signals your factory ECM reads. What's your take on that?

[jeeper]

User: ShelGame http://www.turbo-mopar.com/forums/member.php?141-ShelGame is the guy to go to for stuff like this, and i believe he expressed interest in tuning 4.0 jeeps in the past. Depending on how far he has gotten with that particular style of pcm, what you're trying to do could be extremely tedious to learn.

I have indeed read some of shelgame's stuff on here and what i read is what made me join here. i actually would be willing to assist him if needed.

I'm normally not the guy to suggest taking the easy way out on a laudable goal like learning how to tune your own ECM, but i have to wonder if most of the adjustments you would like to make would be possible with an over-the-counter 'piggyback' computer system altering the signals your factory ECM reads. What's your take on that?[/QUOTE]

I do know of the piggy back systems as well but I don't want to shell out the cash and honestly, it wouldn't be as fun to me to just slap it on there and tune away. Changing maps seems like it'd be a blast to me. The challenge is the fun part. I totally understand it won't be the easiest task in the world to disassemble the PCM. I feel like i might be more crazy than a lot of DIY'ers out there but its fine with me.

[shackwrrr]

The hardware is already done and in use by some people here. Some of our cars came with an SBECII just like your jeep. Shelgame makes a chip that you solder in place of the factory eeprom, you then use an FTDI USB to serial cable to interface with the ecu with MPtune. The problem with tuning for the jeep is the code which to my knowledge shelgame hasn't done any work on disassembling. I am very interested in this as I have a 93 grand Cherokee that I would like to make tweaks to but I don't want to take away from the time shelgame spends on the turbo codes.

[ShelGame]

I have a couple of Jeep cals for the SBECII. I've done some work to dis-assemble them. But, it looks like Jeep must have used their own staff to write the code. nothing is the same as the car cals except for some of the utility routines (2D/3D lookups, 16-bit math, etc.). So, finding fuel and spark tables has been difficult.

[jeeper]

I have a couple of Jeep cals for the SBECII. I've done some work to dis-assemble them. But, it looks like Jeep must have used their own staff to write the code. nothing is the same as the car cals except for some of the utility routines (2D/3D lookups, 16-bit math, etc.). So, finding fuel and spark tables has been difficult.

Hmm. Not quite what i was expecting to hear. Nice to hear that someone has some interest and has at least started with them. I wonder if the difference between them being 4 cylinder and 6 cylinder has anything to do with it? I dont know much about the 2.2 and 2.5 you guys work with as far as EFI goes. The only one i worked on was an 87 dakota with lean burn. So i have no idea how the EFI is set up on those. The jeep is very simply set up. Just a small handful of sensors. If your 2.2/.5 has another setup that would explain the difference in coding. A different set of inputs.

[ShelGame]

Hmm. Not quite what i was expecting to hear. Nice to hear that someone has some interest and has at least started with them. I wonder if the difference between them being 4 cylinder and 6 cylinder has anything to do with it? I dont know much about the 2.2 and 2.5 you guys work with as far as EFI goes. The only one i worked on was an 87 dakota with lean burn. So i have no idea how the EFI is set up on those. The jeep is very simply set up. Just a small handful of sensors. If your 2.2/.5 has another setup that would explain the difference in coding. A different set of inputs.

No, that's the funny part - the sensors and fuel/spark systems are very similar. That's part of the reason it's so confusing as to why it's so different. The Jeep cals have some similarities to the V6 and V8 truck cals.

I've seen the same thing even among turbo cars. The Mexican cals were completely different from the US cals until '92. In '92 they were the same code. Even the Masi and TIII cals (the early DOHC engines) were different from the 8v engines.

[jeeper]

Hmm. Kinda makes sense that it'd be similar to the truck stuff considering its somewhat of a truck anyway. But why wouldn't they keep one code format across the board for simplicity in the programming department. It would make more sense to me, but that's just me. What 4.0 jeep cals do you have?

[ShelGame]

The only Jeep cal I have is actually the '95 4.0L 4x4 5-speed cal. I thought I had a 2.5 around here somewhere...

[jeeper]

Thats probably going to be almost identical to mine. (94 4.0l 5-speed) can you send it to me via pm or something? what do you use to view it? i'm wanting to at least see what it all looks like and send a copy to a professional software developer friend of mine. he codes for fun and knows just about any programming language under the sun i wanna see what he says about it.

[ShelGame]

Thats probably going to be almost identical to mine. (94 4.0l 5-speed) can you send it to me via pm or something? what do you use to view it? i'm wanting to at least see what it all looks like and send a copy to a professional software developer friend of mine. he codes for fun and knows just about any programming language under the sun i wanna see what he says about it.

There's not much to look at. Tables, etc. are not defined. But, we use MP Tune to edit cals once we have at least a table definition setup for them.

[jeeper]

what is the raw format? I want to learn all this on a low level first. I understand that me asking for this stuff is like diving head first into an empty swimming pool, but I want to at least get a hold of it and possibly try to come up with definitions.

[ShelGame]

what is the raw format? I want to learn all this on a low level first. I understand that me asking for this stuff is like diving head first into an empty swimming pool, but I want to at least get a hold of it and possibly try to come up with definitions.

Binary is the raw format. The table file is a definition file that tells the editor what the bytes in the tables represent (and where the tables are).

[jeeper]

Can you send me the 4.0 cal you have? I actually have a little, tiny, bit of experience with reading some binary from a class i took in school. And i can learn to read hex if it'd help. I have an a+ certification text book with sections on how to read both of those. I mean we are only talking like a 32 or 64k file right?

[ShelGame]

Can you send me the 4.0 cal you have? I actually have a little, tiny, bit of experience with reading some binary from a class i took in school. And i can learn to read hex if it'd help. I have an a+ certification text book with sections on how to read both of those. I mean we are only talking like a 32 or 64k file right?

Yeah. 'just' 32k...

I found the other Jeep files I have; and a PN list for the ECU's...

[jeeper]

32k sounds like nothing nowadays but it still is 256,000 individual bits. what program do you prefer to use for viewing the .bin's directly?

[ShelGame]

I use a hex editor...

[jeeper]

Ok. I've used a re-assembler and i've got the .asm file now. I see that my next step is naturally going to be learning the 68k command set. IIRC, the cpu in these is a motorola 68HC11?

[ShelGame]

Ok. I've used a re-assembler and i've got the .asm file now. I see that my next step is naturally going to be learning the 68k command set. IIRC, the cpu in these is a motorola 68HC11?

How did you get it to an .asm without knowing what the processor was? The opcodes are all processor-specific. It is a 68HC11. Chrysler used them in everything up until ~'96...

[jeeper]

I knew it was 68hc11. I was just double checking with you. I am familiar with that processor family from my two 68000 Macs. I used a 68k reassembler

[jeeper]

What typically does one do to come up with a definition file? Is it going to involve me actually figuring out what the contents of the table are?

[jeeper]

It's been a minute since I've been on here, but i haven't given up. I've been busy with college finals and whatnot. I have done some work in disassembling this mess of numbers. This is quite difficult actually. I'm using dhc11 as my disassembler now. I'm making some decent progress familiarizing myself with the registers and command set. I find it easier to write the sections of code in question down on paper and make notes that way. Now that i've got my feet wet so to speak, can i have a to-do list? It's kinda difficult for me to get anywhere without any short term goals. It just makes it look like a bunch of code with no meaning. I know i need to come up with definitions at the end of this but I'm here and that's there and i have no idea whats in between.

[ShelGame]

Maybe this will help. I wrote my own dis-assembler (actually, modified someone else's work). This has some Chrysler-specific structure dis-assembly (2D and 3D tables, for example). I included the symbol file, and batch files, etc.

Basically, I edit the symbol file, add definitions, etc. then run the Jeep_all.bat file. It will disassemble the 3 Jeep bins here using the same definitions, and re-write the 3 .asm's.

I read thru the .asm, compare it to a known .asm (from a car cal, for example - you can DL them here) and update the symbol.txt file, save it, and run the .bat again; lather, rinse, repeat, etc.

[jeeper]

I feel like by the time i'm done with this whole deal, i'll be so familiarized with the obd-1 jeep system that i may build a custom intake manifold for my Datsun's EFI setup and just using the sensors, harness, and SBEC from a 2.5 Jeep. crank and cam sensor placement would be the major impediment to completion, though. Totally off topic, but i guess you could call that the sneak peek into my plans for my actual project car. I'll just have a spare SBEC for my jeep for tuning purposes, since its my DD.

[Vigo]

There is no 'cam sensor' per se. The pickup in the distributor serves that purpose.

[jeeper]

i understand that. the on/off telling the pcm what revolution the crank is on. like 1-5-3 or 6-2-4. or 1-3 or 4-2 on the datsun engine. but it still may be a task to get it to actually function properly.

[jeeper]

I had a wrench thrown into my gears last Thursday. The PCM has failed. Sounds crazy? Well i tested it using the TC-2A diagnostic flowchart that i got from the FSM. I was coasting down a hill and lost my tachometer and speedo simultaneously. Since i was engine braking down hill, i didnt notice it stall. But of course it was just being dragge along by the Jeep. I pulled over and did the 'ol key trick to find the sequence 12,11,55. It's not so uncommon on jeeps, so i swapped out the sensor actually twice with known good sensors. Then i finally found a relevant flowchart in alldata. Tested it according to the chart and a technicians youtube video using similar techniques. No response from the ECU when i switched CPS signal on and off (touching signal line to the sensor ground line, and listen for ASD relay to kick). Switched out relays, tested fuses, resistances, and voltages and grounds. Once you reach the last step in the flowchart my result ends in "replace PCM". Literally everything checks out fine except the persistent no spark and code 11 even after clearing codes. Not to mention the incorrect code 21 for a failed, brand new NTK O2 sensor, and the code 24 for the TPS. The 889 PCM is very inexpensive, though. With my O'reilly employee discount its a staggering $73. I will run through the flow chart once again after electrical class on Monday to make sure I didn't overlook anything and then I'm putting the PCM in. One day i'll get to tune it. :p

[jeeper]

I've added some more stuff to my symbols file, now i'm trying to figure out how to make it into a table file so i can use it in mptune. and does it require me to add it to something under the master templates menu option?

[jeeper]

Well, just to say i loaded a jeep cal into mptune, i borrowed (kinda cheated) a .mpt file to see if there was any parameters that matched up between for instance, a tIII and my jeep. i can tell which ones blatantly dont, by the jumble of blue garbage. I'm feeling my way around cal central more than anything right now. just digging around in menus and such. I did add a 4.0 manual, 1994 Cherokee, and Jeep SBECII menu options under cal info. Now i'm on to converting the mildly updated version of the symbols.txt file into a useable .mpt file.

[Vigo]

Sounds like progress. Tedious, as expected. Eventually others could certainly benefit from the work you're putting in. Thanks for keeping the thread updated with your progress!

[jeeper]

It is quite tedious. I am really excited to see what others will be able to do once the door to the 4.0 is open. They have a lot of untapped potential, even in N/A form. I thought it was pitiful to see other jeep owners on other forums doing things that are more difficult than this to get power. like v8 swaps and swapping GM ECU's and things like that. I think the software route is more interesting and more original. BTW, i was able to use a DRBIII on my jeep at school yesterday. That was interesting. I finally got to see some live data on this thing. With the 24lb/hr Bosch Gen-III injectors, my LTFT is a whopping -19%!! I have noticed on my AFR gauge, that any time i move the throttle, it pegs out on the rich side and then starts to adapt back to normal levels. IIRC, ShelGame referred to this in another thread as a transient fueling problem? I feel like once the fuel map alone is dialed in correctly, I'll see some noticeable improvement in throttle response, MPG, and overall smoothness of the engine as compared to factory. They actually have a nice "spray cloud" as i call it. Very nice atomization from these. I'm also in an emissions county, so i'm curious to see how the sniff test turns out when i'm on the rollers (since i'm OBD-1).

[Vigo]

Well, as far as i know the computer will have an acceleration enrichment function that can be modified once you find it. It serves the same purpose as an accelerator pump on a carburetor, to keep the engine running smoothly until the computer is able to get feedback on what the new fueling requirements are. Shelgame might be able to give you some tips on where to find that. I certainly don't know enough about it to help with specifics.

But i think you're right about untapped potential. There is a website out there belonging to a guy who got his n/a 4.0 into the 14s in the 1/4 mile with bolt-on mods and some very crude fuel tuning done by altering the reference voltage to the map sensor. Obviously a better method would give even better results.

[jeeper]

On a 93 T3, its the first line. What is labeled "AccPumpScaleDeltaTPSFromCoolantTemp" is what determines the pulse width that the computer uses in this instance. And i also know that the computer goes open loop after a certain throttle position as well. I can tell when it does it on mine based off of the fact that the AFR gauge stops sweeping and goes in the middle of the rich side and stays. And I have a MAP sensor adjuster on my desk that was waiting to be built. Then i read some more and realized that it only worked during the WOT enrichment stage. I thought i could scale everything down. But that's not the case.

[sev80]

I know it's been a few years since this thread was updated, but curious if this ever got figured out? Would LOVE to be able to tune my Jeep 4.0

[wowzer]

i'm working hard on getting the jeep 781 cal setup for mptune. i've identified quite a few of the tables and will put up a version later this week for all to review. basically all i've done is try to compare the existing disassembly to other cals, primarily the t-t3. unfortunately alot of the stuff does not carry over. rob L is the best one to determine really what the code is actually doing and being able to ID the tables/routines.

[UglyBoost91]

Hi All,

Just wanted to say that I'm very, VERY interested in all the great working being put into the OBD1 SBEC code. I have not been on the forum in a few years (used to own a couple TDs) but I do own a Cherokee and Comanche and found this post after extensive google searching ;)

While my code knowledge is limited (I've built mega-squirts and tuned
GM OBD1 cars with Moates, but that's it; not extensive actual diving into the code) I would be happy to lend a hand wherever needed. I actually have a few different 4.0 ECUs and a 2.5L on a shelf, if anyone would like the reads from their PROMS.

Dumb question, but what are you using to read / write? Would one need to solder in a ZIF socket such as what I've had to do with the GM ECUs and then use an EEPROM? Is there any weird voltages on the Chrysler PROMs such that my Moates Ostrich would not be able to read a factory PROM?

Thanks and looking forward to anyone's progress!

Eric

[wowzer]

here is a first attempt at an updated 781 cal for the 4.0 jeep. there are a LOT of tables/code i have not figured out - hoping some of the more experienced cal guys can help ID them. let me know what you can figure out and i'll update the base cal.

[sev80]

here is a first attempt at an updated 781 cal for the 4.0 jeep. there are a LOT of tables/code i have not figured out - hoping some of the more experienced cal guys can help ID them. let me know what you can figure out and i'll update the base cal.


wow! nice job on getting this together!

[wowzer]

i've been plodding through it some more. i'll do another update this week.

[wowzer]

another update. added a few more tables and updated alot of the underlying code with labels. i probably won't do another update for a couple weeks. i need to firm up the row/column headings for the 3d tables as well as start looking in depth at what the code is actually doing to try to name alot of the other undefined tables. also, a large share of the units and ranges are not accurate.

[wowzer]

also, can someone confirm if the jeep uses a knock sensor? i'm trying to ID if that code exists in the cal.

[sev80]

also, can someone confirm if the jeep uses a knock sensor? i'm trying to ID if that code exists in the cal.

Nope Jeep 4.0's do not have a knock sensor


By the way, i am more than willing to be a guinea pig for any testing once we have these figured out. I have a 94 Grand cherokee with a 4.0 a/t and I have a spare ECU that im going to socket here shortly my spare ECU is a 56028310. I can pick up an eemprom burner if need be to burn/test cals.

[Force Fed Mopar]

Crossing fingers that this helps figuring out the V6 code also :)

[wowzer]

Nope Jeep 4.0's do not have a knock sensor


By the way, i am more than willing to be a guinea pig for any testing once we have these figured out. I have a 94 Grand cherokee with a 4.0 a/t and I have a spare ECU that im going to socket here shortly my spare ECU is a 56028310. I can pick up an eemprom burner if need be to burn/test cals.

that would be great. the version i posted should be able to be burned back to a chip. however, i would suggest you read your chip and send it to me so i can take a look at it and compare to the one i already did to see what, if any differences, there may be.

[A_ Kelley]

tpl missing from the zip? (and/or the 3d tables missing from the .asm)

[wowzer]

try this :yuck:

[sev80]

try this :yuck:


Wow awesome to hear! Happy to Help. I'll work on getting the ecu socketed, can you suggest me burner to buy and which eeprom chip I should pick up?

the only major difference I know off of hand is my ecu is for a auto trans and the 781 code is for a manual trans. I'm wondering if there is any difference between Cherokee and grand Cherokee code.

[Force Fed Mopar]

Moates Burn2 should burn any chip you need.

[sev80]

counted the pins on my sbec II, it's 28 pin. but which chips should I buy that are compatible with it?

[Force Fed Mopar]

I think the 27sf512 should work?

[ShelGame]

I think the 27sf512 should work?

Only with a latch adapter. The original chip would be a 87C257 from Ti. But, a Moates Burn2 won't write them.

[sev80]

So I picked up a very late production (4/95) SBEC II for the jeep. I need to connect it and make sure my truck runs with it but the good news is it's 32 pin!!

[A_ Kelley]

This is the cal I had been working on before I had got pointed over here by @wowzer. https://nc4x4.com/forum/threads/feeler-jeep-sbec-tuning.177279/ (crosslinked since I can't seem to upload files here) Mine has the fuel and spark tables mapped out, with inputs referenced thru tracing the code. Hoping this will help wowzer maybe roll it into his cal and we'd have one nearly complete cal.

[sev80]

I want to tackle this one of two ways for testing:

first way is using that late 95 sbec-2 I just got and using shelgame's flashing tool to flash it with experimental code. I'd prefer to do it this way...


But as a backup, the second way is with an older 28 pin socketed sbec-2 with a latch adapter. To that end, I spent the last 6 hours desoldering the 28 pin eprom from my late 93 sbec2. It seems that I was successful!

All the solder pads look like they're in decent shape and I need to solder in a socket. Trouble is, in all my excitement, I didn't make note of the chip's original orientation.... does the notch face the heat sink or away from the heat sink?

https://imgur.com/gallery/UWJqF

im going to be ordering the latch board and competents from osh park to solder together a latch board.


lastly, a_kelly and wowzer asked me for the 381 bin from the ecu I just modified. Which rom Bruner / reader can I Use to read it? Will the burn 2 do it?

[A_ Kelley]

It should be a 28c256 which most readers should support. I plan on reading mine out over sci before I remove the chip.

[ShelGame]

I want to tackle this one of two ways for testing:

first way is using that late 95 sbec-2 I just got and using shelgame's flashing tool to flash it with experimental code. I'd prefer to do it this way...


But as a backup, the second way is with an older 28 pin socketed sbec-2 with a latch adapter. To that end, I spent the last 6 hours desoldering the 28 pin eprom from my late 93 sbec2. It seems that I was successful!

All the solder pads look like they're in decent shape and I need to solder in a socket. Trouble is, in all my excitement, I didn't make note of the chip's original orientation.... does the notch face the heat sink or away from the heat sink?

https://imgur.com/gallery/UWJqF

im going to be ordering the latch board and competents from osh park to solder together a latch board.


lastly, a_kelly and wowzer asked me for the 381 bin from the ecu I just modified. Which rom Bruner / reader can I Use to read it? Will the burn 2 do it?

Away from the heat sink.

The Burn2 might read it, but it won't be able to re-write it. And, you'll need a UV lamp to erase it.

- - - Updated - - -


It should be a 28c256 which most readers should support. I plan on reading mine out over sci before I remove the chip.

It can't be a 28C256. The pinout doesn't match.

Most likely, it's a 87C257 (if it's ceramic), or a Toshiba chip whose number I forget. Both are also 32k chips.

[sev80]

Away from the heat sink.

The Burn2 might read it, but it won't be able to re-write it. And, you'll need a UV lamp to erase it.

- - - Updated - - -



It can't be a 28C256. The pinout doesn't match.

Most likely, it's a 87C257 (if it's ceramic), or a Toshiba chip whose number I forget. Both are also 32k chips.




Just finished socketing my 12/93 Sbec II and the original chip is a 27C256. Does this mean the latch chip is built into the board?

[ShelGame]

Just finished socketing my 12/93 Sbec II and the original chip is a 27C256. Does this mean the latch chip is built into the board?

Hmm, must be. If the original is a 27c256, then you should be able to sub a 27SF512 in there no problem. Just set the right offset since the chip is double the size. The Moates Burn2 of course can read the 27C256 and read/flash the 27SF512.

[sev80]

sweet :thumbsup

I ordered a Willem style burner and going to order some 27SF512 chips.

Have you guys heard of the latch chip being already on the SBEC II? Or is this a first?

[ShelGame]

Yes, I've seen it in some later ECU's. Might be an SBECIII. I have a list of the later SBECII/III differences somewhere...

[sev80]

that would be great. the version i posted should be able to be burned back to a chip. however, i would suggest you read your chip and send it to me so i can take a look at it and compare to the one i already did to see what, if any differences, there may be.


All around good news today. I got my jeep back from the shop. Plugged in the ECU I just socketed and it fired right up! Looks like the SBEC-II is alive and well!

I also got my rom burner in the mail today. It's old school and uses a parallel port. Luckily I have a cache of old computers and got it working and dumped the eprom file from the ecu I socketed.

This is for a 94 Grand Cherokee A/T 4.0L with Federal emissions. The ECU part number was 56028310 and the date code is 10/07/93

Here is the file:

https://www.dropbox.com/s/hps77grxq5jsc5b/jeep%205638310.BIN?dl=0

[wowzer]

well, the good news is that it is almost identical to the 781 code, bad news is that it is off just enough to require it's own code and table base even though the cals both ID as 94 cals. hopefully will be as simple as just changing addresses. it will be interesting to determine what the new tables/code are.

[sev80]

I did a file compare with the 781 code last night and noticed that in some places the file is identical to 781 and a few places it's not, so hopefully it's easy to find!

Thanks for taking a look. Im getting very excited. I ordered a 2 27SF512 chips from Moates! I might also pick up a USB based burner as I was reading the Willern ones can fry the chips if you dont configure them right.

Im so curious what would hapepn if i burn the 781 code onto this ecu and try to run it.

[wowzer]

here is the latest attempt. there are 2 tables having to do with the ptu that give invalid results. don't know if i have the table type wrong or what. if someone can point me to where the rev and speed limiters are i'ld appreciate it.

[A_ Kelley]

Rev limit is 5k, speed limit is already in the cal I posted. The rev limiter I didn't look too hard for as the 4.0 didn't need to be spun much over 5k. Self disassembly occurs around 6500 rpm if I remember right. Addresses are org'd statically. All the tables in mine reference the actual variables fed to the lookup functions. I spent probably fifteen to twenty hours on it over about a week. I got my flash chips yesterday, but as Rob pointed out, I got the wrong ones but I'll make a adapter for it. Actually thinking of making a SRAM board so I can flash it in about a tenth of a second. (USB interface to it with a dedicated micro, actually could buffer two chips and do a live reflash)

[wowzer]

Rev limit is 5k, speed limit is already in the cal I posted. The rev limiter I didn't look too hard for as the 4.0 didn't need to be spun much over 5k. Self disassembly occurs around 6500 rpm if I remember right. Addresses are org'd statically. All the tables in mine reference the actual variables fed to the lookup functions. I spent probably fifteen to twenty hours on it over about a week. I got my flash chips yesterday, but as Rob pointed out, I got the wrong ones but I'll make a adapter for it. Actually thinking of making a SRAM board so I can flash it in about a tenth of a second. (USB interface to it with a dedicated micro, actually could buffer two chips and do a live reflash)

would you point out the specific table or code addresses where these 2 limiters are. thanks.

[A_ Kelley]

I will once I charge my laptop. If you look at the tpl file I posted, you'll find it along with the address. I don't remember if I bothered with finding the Rev limiter or not.

Cruise max speed is at 0x8900, min @ 0x8901. Didn't look for Rev limiter.

[wowzer]

I will once I charge my laptop. If you look at the tpl file I posted, you'll find it along with the address. I don't remember if I bothered with finding the Rev limiter or not.

Cruise max speed is at 0x8900, min @ 0x8901. Didn't look for Rev limiter.

ya, i've already identified those in the cal. i've found a value in the code that seems to reference 6000 rpm. however, that seems kinda high for a jeep. i've seem some videos that seem to imply it is closer to 5250. i'll look at the code again for the mph.

[A_ Kelley]

Once I set up the bench setup, I'll Rev it to 5-6k and see what happens, if it's fuel cut or spark cut.

[sev80]

are you building a sbec II simulator? :D

[A_ Kelley]

Why not? I've got the harness, extra ecms, and technology to make the sensors appear there... Best way I've ever found to test anything in any situation, duplicate it.

[sev80]

Why not? I've got the harness, extra ecms, and technology to make the sensors appear there... Best way I've ever found to test anything in any situation, duplicate it.


That is really impressive!

[wowzer]

Why not? I've got the harness, extra ecms, and technology to make the sensors appear there... Best way I've ever found to test anything in any situation, duplicate it.

i'ld love one also!!! i've used risen's smecstim for years and actually contacted him recently regarding the sbec stuff. it's invaluable to be able to run the cals on the bench and analyze data. lmk. in fact maybe you/risen could get together to make this happen, since he has done 90% of the ground work already. i think he just needed to rework the sequential injection stuff and some other timing issues. also would need it to run both 4,6,and 8 cyl ecus :-) !!!!!!

[ShelGame]

Once I set up the bench setup, I'll Rev it to 5-6k and see what happens, if it's fuel cut or spark cut.

I can all but guarantee it's a fuel cut. I have never seen a spark cut in any stock Chrysler system.

[wowzer]

instead of posting up new files i'm just going to use this link below and keep the most current zip file there. i probably won't be doing much work on it for a while at this point (but who knows). there's LOTS to be figured out yet

https://dl.dropboxusercontent.com/u/65623639/PublicCals/Ecu6Cyl/jeep1_781.zip

[sev80]

my 27sf512's should be arriving today. Should I try burning and running these cals on my grand cherokee? Any chance it might damage the PCM since its for a different truck?

[Force Fed Mopar]

Should be fine.

[sev80]

So I started my own, separate thread for my dumb questions, as to not clutter up this thread anymore. Here it is:

http://www.turbo-mopar.com/forums/showthread.php?81501-Jeep-SBEC-Flashing-Questions&p=1122074#post1122074

Wowzer, have a few questions for you there for when you got some time!


Long story short. My original 310 bin wouldnt work. I compiled wowzer's cal and it worked. on a 94 grand cherokee with auto.

[vprtech]

Something that might be of some interest, the table type "Fixed X 9 Byte" I have not seen in any of the Magnum V8/V6/Viper cals, however they do appear to be the same table type and shape as what you would find in a Renix ecu used on the pre-SBEC2 Jeeps. My assumption is that the calibration department over at JTE on Plymouth decided to port over some of the code and lookup tables from the Renix ecu's to save on development time and cost. Just a guess, but interesting to think about.

[sev80]

Gents, (wowzer and A_Kelly), where did you source the 781 cal? Im wondering if it is really from a gulf states emissions ecu or if MPtune is compiling and putting something in there to say that. I want to pop the cal back in my truck and drive it around more, it felt more peppy but I didnt push it last time I tried.

I wonder how much there is a difference between california emissions, Federal Emissions, 50 state emissions and Gulf states emissions (I have all the PCMs for each of these.)

The original SBEC II in my 94 ZJ is cal emissions, the 381 cal is Federal emissions, the 95+ cal is 50 state emissions and the 781 cal is "gulf states" emissions.

[vprtech]

Gents, (wowzer and A_Kelly), where did you source the 781 cal? Im wondering if it is really from a gulf states emissions ecu or if MPtune is compiling and putting something in there to say that. I want to pop the cal back in my truck and drive it around more, it felt more peppy but I didnt push it last time I tried.

I wonder how much there is a difference between california emissions, Federal Emissions, 50 state emissions and Gulf states emissions (I have all the PCMs for each of these.)

The original SBEC II in my 94 ZJ is cal emissions, the 381 cal is Federal emissions, the 95+ cal is 50 state emissions and the 781 cal is "gulf states" emissions.

Please post the part numbers for your Ecus.

[sev80]

Please post the part numbers for your Ecus.



My original 94 ECU with california emissions is: 56029301. It is a newer style SBEC II that has the flash chip date code on it is 6/1994

The late 93 ECU I socketed is Federal Emissions: 56028310. It is an older SBEC II that is non flashable. The date code on it is 10/7/1993

The near end of production SBEC II I bought as a spare is 50 State emissions: 56026948. Date code on it is 4/1995

There's 3 ECUs above all fit a 93-95 Grand Cherokee with A/T

The 781 ECU that ID's as "Gulf States Emissions" is the 781 one that Wowzer and A_Kelly are IDing. I'm not sure if this is a by product of MpTune compiling it or if it is actually from the gulf states.

[wowzer]

Gents, (wowzer and A_Kelly), where did you source the 781 cal? ...

http://www.turbo-mopar.com/forums/showthread.php?71712-94-Jeep-Cherokee-Tuning&p=1005818&viewfull=1#post1005818

[vprtech]

My original 94 ECU with california emissions is: 56029301. It is a newer style SBEC II that has the flash chip date code on it is 6/1994

The late 93 ECU I socketed is Federal Emissions: 56028310. It is an older SBEC II that is non flashable. The date code on it is 10/7/1993

The near end of production SBEC II I bought as a spare is 50 State emissions: 56026948. Date code on it is 4/1995

There's 3 ECUs above all fit a 93-95 Grand Cherokee with A/T

The 781 ECU that ID's as "Gulf States Emissions" is the 781 one that Wowzer and A_Kelly are IDing. I'm not sure if this is a by product of MpTune compiling it or if it is actually from the gulf states.

It is a Gulf calibration, leaded fuel, so it should run in open loop.

[Vigo]

I cant contribute much here but i think the 4.0 rev limiter IS actually close to 6000 rpm. I remember this because we swapped from a 3.07 to 3.50 rear end in my friend's 5spd cherokee and then accidentally spun up to the limiter in 2nd when it broke loose through a puddle. Tach went to 6k.. and the water pump immediately ---- out the shaft seal, which ruined our plans to go to the track the next day and beat the 16.0 it had run stock with 3.07s.

[sev80]

Any updates from A_kelly or wowzer?

[wowzer]

Any updates from A_kelly or wowzer?

what info are you waiting for ?

[sev80]

im not waiting for anything, really. A_Kelly mentioned he was going to create a bench teser and try out the cal he built, wanted to see ifhe had any updates..

Are you still working on IDing tables? Did you still want to use MPscan to try to find more tables?

[vprtech]

Looking at the FED vs Leaded calibrations, I was searching for a flag or temperature threshold to disable closed loop, however I did not find any. It appears all they did the the Leaded/Gulf calibrations was to disable the codes for O2 voltage stuck at center (0x8A28 bit 1) and O2 voltage stuck high (0x8A28 bit 2)? Also did some bench testing, and neither cals would go into closed loop unless you toggle the O2 voltage below .5 volts .

Rev limit on all of the SBEC2 4.0L Jeep cals I've seen is 5312 (@ 0x8681 , JTEC it's 5300 rpm.)

[wowzer]

vprtech, is 8a28 the correct table?

i had already noted the rpm and mph limiters in my last update.

[vprtech]

As far as I know, yes.

[sev80]

instead of posting up new files i'm just going to use this link below and keep the most current zip file there. i probably won't be doing much work on it for a while at this point (but who knows). there's LOTS to be figured out yet

https://dl.dropboxusercontent.com/u/65623639/PublicCals/Ecu6Cyl/jeep1_781.zip


edit: Nvm! Nothing to see here! I answered my own question

[sev80]

Damn it.. It looks like my socketed SBEC-II Died. Was heading out to lunch yesterday and the truck started misfiring BAD and stalling. Every time I'd start it it would run very rough and stall. DRB says "internal PCM failure"... Popped in the original sbec-2 I have and the truck runs fine..

Not sure what to do. I took it out and it visually looks fine. I didnt put the potting material back on after socketing, so it was exposed to the elements, but I dont see any corrosion on it or anything. I just dont trust it now. Even if it runs right, I wouldnt want it to do what it did in traffic..

Not sure what to do here. Do I try troubleshooting it? Do I get another one and socket it? hmmm...

[sev80]

So the original SBEC II I socketed is definitely dead. I tried driving the truck around a bunch since July, for a while it was fine, but intermittently it starts misfiring very badly and stalling. I've kept my original, unmodified (56029301) sbec II and a wrench in the car just in case it left me stranded. That happened last week, luckily I limped it to the curb and swapped in the good SBEC II and I was on my way.

I have a total of 3 SBEC's Currently. The one with 56028310 (federal emissions) is dead. At least I dont trust driving anywhere with it at this point... It came with a 27c256 rom, which obviously isnt flashable it's from a very early 93 Grand cherokee. The board layout on guy is slightly different than my other two SBEC-IIs are newer and flashable, however I dont have the tools to flash them.

This weekend I decided to attempt to socket the 56026948 ecu, this one is 50 state emissions. I was successful in desoldering flash chip (getting better at doin, it is a ST28F256. The idea is for me to flash the modified 310 cal I bought from vprtech onto this ECU so I can continue to use it. I am hoping the hardware differences are minor between the 56028310 and 56026948 such that I can just socket the newer ECU, flash the chip and put it in. The problem is my stupid minipro chinese programmer will read thousands of roms EXCEPT For the #@$@#$@# 28F256! I tried setting the thing to read a AM28F256 (which is supported and has a identical pinout) and it doesnt work.

I looked up the pinouts between the 27SF256 and the 28F256 and theyre nearly the same, the 28 series chip has 4 extra pins, of which 1 is VPP, one is NC, one is VCC and one is write enable, none of which seem critical for rom operation. Wondering if the 27SF256 will work in the newer SBECII.. Or if I need to find a new eeprom programer that will read the 28f256. I do want to read it for sure.....

[sev80]

I got my reader to read the cal as a AM28f256. So I have the cal for the 56026948 ecu. It is a very late 95 and 50 state emissions like mentioned earlier.

The problem I have now is the ECU I just socketed is dead. Arrrrgggghhh. despite successful socketing, meaning I didnt lift any pads, damage any traces, scrape off any components the damn thing fails to boot with the original rom in it. It's making a high pitched screeching noise when I give it power. The only thing I could of thought might have killed it is ESD. i used a nylon brush to get the potting material down. I was under the impression this was safe to do? I really wish I could just flash one of these things and be done.

[sev80]

So upon much closer inspection of the board, I found why it stopped working after the work I did yesterday, the soldering iron tip damaged 3 traces on the back side of the board. I discovered through some continuity testing and very very close examination with a magnifying glass. Luckily there were some nearby via's i could solder to so that I could reroute those traces. I did so and viola! the board works! I dont think i'd trust this board for other than bench testing purposes at this point though. I'm sick of getting stranded due to my soldering work.

I also did confirm that the older 28 pin boards (which have a different board layout) for which my tune was written for will work with the newer 32 pin boards. Not only is the board layout different between the two, the newer board is physically smaller than the older board...anyway, I flashed over my tune and it started right up! Woot!

Side note: it appears these boards are built with blank roms soldered into them. The back of the board has every needed pin routed to pads that are used to flash the rom in the board. Pretty cool! I used these pads to check continuity to find my problem.

If anyone wants the 50 state cal (56026948) from this board, I have it available.

[wowzer]

So upon much closer inspection of the board, I found why it stopped working after the work I did yesterday, the soldering iron tip damaged 3 traces on the back side of the board. I discovered through some continuity testing and very very close examination with a magnifying glass. Luckily there were some nearby via's i could solder to so that I could reroute those traces. I did so and viola! the board works! I dont think i'd trust this board for other than bench testing purposes at this point though. I'm sick of getting stranded due to my soldering work.

I also did confirm that the older 28 pin boards (which have a different board layout) for which my tune was written for will work with the newer 32 pin boards. I flashed over my tune and it started right up! Woot!

Side note: it appears these boards are built with blank roms soldered into them. The back of the board has every needed pin routed to pads that are used to flash the rom in the board. Pretty cool! I used these pads to check continuity to find my problem.

If anyone wants the 50 state cal (56026948) from this board, I have it available.

i'll take if. i'll disassemble it and set it up for mptune to see how it compares to the 781.

[sev80]

Wowzer's back!!!! :) Hopefully these cals help getting everything mapped out.

Here's a 948 cal (50 state emissions)

https://www.dropbox.com/s/g4jnhit9uel4edi/Jeep%2056026948.BIN?dl=0

here's the older 310 cal (fed emissions)

https://www.dropbox.com/s/f0m5ja79bzulls4/new%2056028310%2094%20grand%20cherokee%20jeep.BIN? dl=0


Will MPTune read/flash the Jeep SBEC II if it's bootstrapped? I hacked off a 60-way connector from a dead jeep and got my SBEC booted and communicating via SCI on the bench.

[wowzer]

you need to ask rob lloyd. i think flashing requires an adapter to apply a 20v programming charge. don't know about reading. rob is using a scaled down version of mptune to do the reading/flashing of the neon fcc chips i believe, at least as far as those routines are required.

[sev80]

you need to ask rob lloyd. i think flashing requires an adapter to apply a 20v programming charge. don't know about reading. rob is using a scaled down version of mptune to do the reading/flashing of the neon fcc chips i believe, at least as far as those routines are required.

Hmmm that's exactly what I was unsure about was whether the late sbec-IIs require 20v for programming. The ST28f256 in them, it only requires 12v for programming according to the datasheet, hence my curiosity.

Sorry for all my n00bish questions, I really find this stuff fascinating.

[zin]

The ST28f256 in them, it only requires 12v for programming according to the datasheet, hence my curiosity.

Interesting... I'm wondering if Chrysler added a resistor in-line to prevent accidentally corrupting the program from an errant 12V signal on that leg... Makes me wonder if a jumper could be added to make flashing much simpler?

Mike

[wowzer]

perhaps the boostbutton sbec2 flash module would work better in the long run?

[ShelGame]

Hmmm that's exactly what I was unsure about was whether the late sbec-IIs require 20v for programming. The ST28f256 in them, it only requires 12v for programming according to the datasheet, hence my curiosity.

Sorry for all my n00bish questions, I really find this stuff fascinating.

There's an internal circuit that requires 20v be applied in order to get the 12v Vpp to the chip.

The same flash circuit I use the Neons would work with those, as they are basically the same chip and flash circuit.

[wowzer]

rob L, does he require the 20v also to do just a read?

[sev80]

Wowzer, I did manage to get the thing bootstrapped. Only need 12v for reading. Was able to dump the bin no problems.

[wowzer]

what did you use to read the bin?

[sev80]

A_kelly wrote a little program to read his jeep SBEC-II and sent me a copy to try. Im going to try with MPTune next.

[A_ Kelley]

I couldn't get mptune to work with my USB to serial adapter and I'd love to try mpscan but I don't want to upgrade .NET. maybe I will on my laptop but my desktop didn't even have any .NET which is why I wrote my own, plus I wanted it to automate bootstrap.

[wowzer]

I couldn't get mptune to work with my USB to serial adapter and I'd love to try mpscan but I don't want to upgrade .NET. maybe I will on my laptop but my desktop didn't even have any .NET which is why I wrote my own, plus I wanted it to automate bootstrap.

are you using the 781 jeep cal i posted up?

[A_ Kelley]

No I was working on a cal for a 356 but code is nearly identical, just locations changed a little bit and it uses the o2

Interesting fact: the 356 cal has a config switch for 4/6 cylinder in code.

[sev80]

No I was working on a cal for a 356 but code is nearly identical, just locations changed a little bit and it uses the o2

Interesting fact: the 356 cal has a config switch for 4/6 cylinder in code.

no way! That's interesting. Makes sense though, it's for a regular cherokee right? Those came with the 2.5's which are essentially 4.0's with 2 cyl's missing.

[A_ Kelley]

Not quite a 4.0 missing 2 cylinders. It's actually the same 2.5 as used in some Dakota trucks.

[sev80]

This guy, right?

https://en.wikipedia.org/wiki/AMC_straight-4_engine

[Force Fed Mopar]

Yeah it's the AMC 2.5, not the K-car based engine. It is pretty similar to the 4.0 in design.

[Vigo]

Those came with the 2.5's which are essentially 4.0's with 2 cyl's missing.

Wait, are we not agreeing that this is true? It seems basically true to me and ive taken them both apart.

[sev80]

Wowzer, I was looking through the disassembled 781 cal you had on your dropbox and noticed that it says it was disassembled by MPdissasemble. Is this a tool that's publicly available/a part of MPTune?

[wowzer]

no, it's something i developed back around 2004 when i started playing with the cals. i've added "features" to it over the years but it is not overly user friendly. rob lloyd used one developed initially by one of the early mopar ecu hackers which i believe he tweaked also but is more of a "standard" one that a person could use. i guess i could look at seeing if i could clean mine up a bit for others to use. it allows automatic table relocation (i.e. move tables from code portion to table location), code commenting, code deletion/substitution, table byte replacement, optionally creates the asm/tpl files separately, full table definition, etc. works pretty well but i would really need to add better error handling. now i just run the code in the VS IDE and if something locks up i just use the debugger to figure out why! since i never was really in the "disassembly" aspect other than for the hobby aspect it never was polished up! others have asked for it so i'll look at that as a spring project for general distribution.

i also wrote a "tracing" program around the same time which allows you to step through the code line by line and see all the tables, registers, ram, etc as well as creating a log for review. i used it alot when trying to see what code is actually doing. that may be helpful to some also.

[sev80]

no, it's something i developed back around 2004 when i started playing with the cals. i've added "features" to it over the years but it is not overly user friendly. rob lloyd used one developed initially by one of the early mopar ecu hackers which i believe he tweaked also but is more of a "standard" one that a person could use. i guess i could look at seeing if i could clean mine up a bit for others to use. it allows automatic table relocation (i.e. move tables from code portion to table location), code commenting, code deletion/substitution, table byte replacement, optionally creates the asm/tpl files separately, full table definition, etc. works pretty well but i would really need to add better error handling. now i just run the code in the VS IDE and if something locks up i just use the debugger to figure out why! since i never was really in the "disassembly" aspect other than for the hobby aspect it never was polished up! others have asked for it so i'll look at that as a spring project for general distribution.

i also wrote a "tracing" program around the same time which allows you to step through the code line by line and see all the tables, registers, ram, etc as well as creating a log for review. i used it alot when trying to see what code is actually doing. that may be helpful to some also.

Very cool! yeah I noticed the output looks a lot cleaner vs the other disassembled cals I have. I see alot more comments in the code and explanations on stuff. I think it would be cool if you had the time to clean it up and release it :) Obviously easy for me to say though, I'm sure.

[sev80]

Wowzer,

I was poking around MPtune and saw in the list files used for programming routines use the RTS line on the FTDI cable to switch on/off programming voltage. So I built a rig using a EATX Flash module from Chrysler with some transistors to get some programming going.


I verified it works from a hardware perspective but I've been trying to use MPTune set to SBEC-II to try programming, but it's always failing. I can read the cals from my SBEC's from MpTune just fine but the write always fails chip verification and programming. I was also messing with Rob L's FCCFlash util and what I'm noticing is the ChipID comes back as a SMEC. It uses a ST 28F256 chip.


I suspect the same thing is causing the failure in MPTune but wanted to know if you might have more insight?

Any ideas, help, insight, rants would be appreciated :)

[wowzer]

the reason is that the sbec2 routines were never completed!!! if i recall rob L was only focusing on the Fcc chip at the time so the chipID program never knew what to expect for values that would be returned from the routine on the sbec2 chip. i would suggest the following:

1) in setup/program settings make sure the default ecu is sbec2. also set "log ftdi port activity" to true.
2) run the flash program. it will fail but it should write to the log what the id was that it got back from the ecu.
3) post up the mpt2boot.txt file and we'll go from there. based on that data i'll send you a version with that code loaded in.

i know rob L had updated the fcc flash routines but don't know if he updated the sbec2 routines also. they use different ram addresses as well as differences in the delays, etc. taking a quick look at the sbec2 flash code i don't think it will work since mptune waits for certain confirm bytes after each 64 bytes are downloaded to the chip ram as well as after the 64 bytes are programmed to the chip.

Rob L really needs to confirm what needs to be done to get the sbec2 working. it's possible after you get a valid chip id that you could backup the old sbec2 flash routine, copy and rename the fcc flash routine and change the memory locations in the .lst file to what they need to be. remember i'll need to update the code for that id first.

waiting for rob L.................. :-)

[sev80]

Good to know, hopefully we can get this to work :)

https://www.dropbox.com/s/cd7imxmcx0wblz8/mpt2boot.txt?dl=0


There's the mpt2boot.txt you requested. Let me know what else I can provide.

[ShelGame]

the reason is that the sbec2 routines were never completed!!! if i recall rob L was only focusing on the Fcc chip at the time so the chipID program never knew what to expect for values that would be returned from the routine on the sbec2 chip. i would suggest the following:

1) in setup/program settings make sure the default ecu is sbec2. also set "log ftdi port activity" to true.
2) run the flash program. it will fail but it should write to the log what the id was that it got back from the ecu.
3) post up the mpt2boot.txt file and we'll go from there. based on that data i'll send you a version with that code loaded in.

i know rob L had updated the fcc flash routines but don't know if he updated the sbec2 routines also. they use different ram addresses as well as differences in the delays, etc. taking a quick look at the sbec2 flash code i don't think it will work since mptune waits for certain confirm bytes after each 64 bytes are downloaded to the chip ram as well as after the 64 bytes are programmed to the chip.

Rob L really needs to confirm what needs to be done to get the sbec2 working. it's possible after you get a valid chip id that you could backup the old sbec2 flash routine, copy and rename the fcc flash routine and change the memory locations in the .lst file to what they need to be. remember i'll need to update the code for that id first.

waiting for rob L.................. :-)

I think the only thing that needs to change is the chip ID code, and the size of the ROM file. Should be easy to do and then just use the ECUFlash program you made.

[A_ Kelley]

https://drive.google.com/file/d/1A4m9GjL2K1X_dflnbeaHvwKt-vbhviOa/view?usp=drivesdk

356 cal reverse assembled and mostly identified.. for those interested. No template file yet.

[bakes]

I like !!