Opel Corsa B x14xe

[FritzP]

Hello.
I am working with an ecu for Opel Corsa 1.4 16v 1997 model. Engine are going to be used in junior Autograss.
I just want to make some adjustments for ignition and fueling, and maybe raise the rpm limiter.
If Immo could be deleted it would also be nice, but not absolutely neccessary.
I have read the flashfile (am29f010 PLCC32), flash soldered out, and fitted a socket.
I intend to make adjustment with tunerpro and Ostrich emulator.
I have started with a xdf file for Tunerpro, and even if I find many maps, its difficult to know what they are for.
I am used with old Bosch Motronic, but this seem to be som different.
OK engine have multipoint injection and MAP sensor for load detection, there are crank sensor and cam sensor and also TPS.
I post here the BIN file, and also the xdf file I have started on.
Hopefully I will find more what maps are for when I run engine with emulator and map tracing.
I am uncertain wether chksum will be an issue.
If anyone have comments feel free.

[kur4o]

There is 2 64kb bins stacked on the chip, They can be switched by external hardware switch.

First you need to disassemble the first 64kb in IDA pro using 68hc11 CPU option. Than you need to find the datastream location and see what ram addresses are send, also available datastream modes, to rip any needed extra data from pcm.
Than you need a tech2, logging the datastream, reversing each value to a ram address.

Mapping calibration after that is a breeze.

Immo is located on the eeprom , you can read it with mode 23 if pcm supports it.

You also need to figure checksum address and range, it should be simple 16 bit sum.
Guessing some maps is also possible once you have a good disassembly.

[FritzP]

There is 2 64kb bins stacked on the chip, They can be switched by external hardware switch.

First you need to disassemble the first 64kb in IDA pro using 68hc11 CPU option. Than you need to find the datastream location and see what ram addresses are send, also available datastream modes, to rip any needed extra data from pcm.
Than you need a tech2, logging the datastream, reversing each value to a ram address.

Mapping calibration after that is a breeze.

Immo is located on the eeprom , you can read it with mode 23 if pcm supports it.

You also need to figure checksum address and range, it should be simple 16 bit sum.
Guessing some maps is also possible once you have a good disassembly.

Thank you for comments.
I think I have figured out the chksum.
As you mention there are two 64kb stacks, and each have their own chksum.
1. chksum area are from 0x03008 to 0x0FFFF, and sum are 2 byte 8-bit and located at 0x03006
2. chksum area are from 0x13008 to 0x1FFFF, sum are located at 0x13006
I dont know wether this ecu will operate with wrong chksum, otherwise I will have to make correction in Tunerpro.
OK, I dont have tech2, but I have Op-com. I think this could be useful as well.
For disassembly I dont have any experience, I dont even have IDA pro.
I know Immo should be in CPU, but I dont have equipment to read it at the moment, hopefully I dont have to desolder it from PCB.
Mode 23, is that a tool?

[kur4o]

mode 23 is special diagnostic mode that allows you to read xx bytes of data from memory, either RAM or ROM, via a logger.
It really helps to dump some memory regions that are not on main flash chip.

With opcom in use, you can hook external sniffer that will listen on messages being send to and from pcm.

Do you have a pictures from pcm case and board and some schematics.

Immo signal is tied with speedo signal and read on the same AD channel. Usually a byte from eeprom should be changed, but even with that you can loose speed input.

Without Disassembler you can`t figure much of internal operation, some big 3d tables can be guessed, but once you know ram addresses for main scalars like rpm, tps, afr, map and figure the scaling, most table will make sense.

What is the ignition coil used. 2 channel DIS or with distributor.

[FritzP]

Regarding ignition, it is distributorless, wasted spark coils.
I post here some pictures.
As can be seen PLCC32 socket are fitted.
Regarding schematics I only have in paper format, but I will scan and post a copy.
I intend to try som emalator operations with Ostrich and try to figure out at least ignition, fueling and load map.

[FritzP]

More info:
I have connected Ostrich and started testing with emulator and Op-Com diagnostic.
For this flash (PLCC32 29F010) you have to use PLCC32 to DIP32 adapter with 32 pin cable, and also select correct setting on Ostrich (32 pin)
For smaller PLCC32 (up to 512 kb) you can use DIP28 adapter, but for bigger you will have to use DIP32 adapter with correct cable.
OK. Engine started, and Op-com connected.
There are 2 stacks inside this bin, engine seem to run on the second stack, verified with emulator tracing which work fine.
I was able to detect and verify some maps, first I was consentrating on ignition maps which are easy to find and alter to see result in diagnose.
Ignition idle: 0x13C37_ 9x9 map, part load 0x13D49_11x17 map , factor seem to be approx (x*0.35)-10, but this is not accurate verified, I assume full load are at 0x13EC5 13x8 map, but this is not verified yet.
Idle rpm: 0x1432D 1x13 map, factor x*12.5
Tank ventilation map: 0x14A2D 9x12 map_factor x*0.39215
OK. more testing to be done in next days, car is not in driving order at the moment so not able to make som testing with real load yet.
Just som more info: the ecu does not seem to worry about chksum, even though I have set up chksum correction in Tunerpro, I tried to make altering without correction, and there is no complain or errors from ecu, engine run as normal.

[FritzP]

I have had no more time for emulator testing, however, I have started to disassembly the bin file, even though I have no experience with these things.
Because of capabilities of the choosen disassembler I have divided the bin in 2. Knowing that the ECU use the 2. block while running I have been using this.
I have also started to look into the instruktions for the CPU in this ECU, the MC68HC11F1.
Link: https://www.nxp.com/docs/en/reference-m ... HC11RM.pdf
I post here the 2. half of the divided bin, and also the disassembly file.
I think I have found the rpm limiter to be at location h 0x38F7, there seem to be 3 limiters in row, probably for different running conditions.
I am using winOLS for finding maps because I find it easier, and also post a OLS map here, should be possible to beopened with demo version.
Feel free to shed some more light into this.

[delcowizzid]

There's another corsa thread here with a couple xdfs might help you work some stuff out viewtopic.php?t=565