QR25DE Tuning

[Tom]

A good write up! Thanks.
The Cam Advance hunting is really weird. Why would Nissan do that.

I can see the 3 timing maps in my ROM. They are not identical though and one of them doesn't have the aggressive knock sensing. When you say "I keep these identical when editing." do you mean when you make a change you change all 3 of them in the same spot?

You can now upload bin files larger then 200KB.

[jaf]

Part 3.... Out in the cold

If you ever thought it impossible that a manufacturer would run 50 degrees advance at 1600rpm then look carefully at the log. This is the
addition of a cold map on top of the low knock map - you can see in the lower graph window how the total advance drops away as the engine warms.
So I needed to pull some cold advance back to account for the extra advance at normal temps - cold driving suddenly got a whole lot better!
This map had me fooled for a long time. I assumed (incorrectly) that it was the fuel compensation map. Finally I put a big hole in this map and
another to prove beyond doubt what each map actually did. Yep, it is the cold advance map!

[jaf]

Hi Tom and any others watching this,

On the issue of Cam Advance hunting, it starts off O.K if you clear self-learn but reverts to hunting after a short time. It has always done this and it is not a faulty sensor. I think it is conserving the limited processor time for more important tasks like checking checksums. It sucks all the same.

The timing maps in your ROM are more straight forward: A low knock map, a high knock fallback map and a cold map. A little bit like older Nissans but not quite.
I edit one map and clone the values to all 3 maps in my ROM. I think the 3 maps are to allow a staged fallback on knock i.e. the advance is all 3 maps added together. Makes a lot more sense when you look at the cold map values.... you could almost work out how 15 degrees at idle becomes 26 degrees when cold

Regards,

John

[fenugrec]

Very interesting work. I imagine my ECU (B15 Sentra, QR25DE) will be similar but haven't opened it yet... Could you tell me more about that ECU :
- What is the processor / controller, is there a part number on it, etc (can't tell on the pictures you posted) ?
- What about memory, have you established if the CPU has on-chip ROM/Flash for its firmware or is everything on the external Flash IC (that you seem to have wired to a header on one picture) ?
- What is that flash IC... MX*** something ? Did you reflash through JTAG, OBD or directly to the chip (SPI ? It doesn't look like enough wires for a full bus width plus addressing...)

On another note, did you notice anything related to "rev hang", i.e. the ECU prevents the RPM from dropping instantly when you release the gas pedal and press the clutch during a normal up-shift.
I hear Ford Focus owners have a similar problem (well it's a "feature", if not a very desirable one for aggressive driving) but can disable it with a reflash...

Thanks !

[jaf]

Hi fenugreg,

The Sentra ECUs are the same for the same model years. The processor is a SH7055 which has internal 512K memory. I am flashing at a very low level (AUD) mode hence the direct connections to the chip.
What year is your Sentra? Can you use NDS2 to log all engine parameters? If so, you may be able to download your ROM to a file as a starting point.
I have looked into the very annoying throttle hang issue with no success but I have found that a dirty throttle body increases the severity of the problem. For a while I was running with a modified throttle map that limited throttle openings on deceleration to try to defeat the throttle hang. That sort of worked but I had a few limp mode events so I put that back to stock. Large maps are easy to find but smaller maps and logic functions are much more difficult to work out.

Regards,

John

[fenugrec]

Hi John, thanks for the info. I'm actually a bit surprised the whole thing isn't read-protected, but I guess tapping into the AUD port gives you basically "root" access to the chip. Lucky us !

I have a 2004 Sentra, but haven't done any tampering yet. It's a been a bit cold lately (-20 to -25C) so I'm doing some brain-digging first.
My main target is the rev hang, I'm glad to hear that it annoys you too ! I'm not sure how much work it will be, but my plan is to find and reverse part of the code that handles the throttle body actuator. I figure if I can trace the pins that the SH7055 uses to control the actuator and trace any writes to the relevant registers, I might find a control loop in the code and work from there. Or maybe find out which code accesses the throttle mapping tables you found and start from there.

If you have done some datalogging during a test drive, did you try graphing the TP value from the pedal and the throttle actuator position (I forget the precise name), to see if there's a delay between them? I'd be curious to see if the throttle hang is simply caused by a hard limit on the rate of throttle closure, i.e. the ECU still follows the normal throttle tables you mentioned, except it will only close the throttle say 1% per 10ms until it reaches the commanded actuator position... This is just speculation and wishful thinking of course.

Until I get the real ROM from my ECU, I'm picking at your X-trail 's ROM to get a feel for things. I did some reversing with IDA but I got discouraged trying to automate the parsing of the reset & interrupt vectors. Not to mention the dozens of memory-mapped registers that aren't recognised by IDA. Luckily I found an SH2 dissassembler that should take care of some of those things :
https://github.com/logic/sh2dis
( from this thread : http://forums.evolutionm.net/ecuflash/4 ... mbler.html )
I'll need to set up Python (ugh) somewhere, but I feel it's going to be worth the trouble.

[jaf]

2004 Sentra will be the same ECU but I am yet to see a ROM posted for that car although I would be very interested to see what differences there are - a SpecV ROM would be even better.
The electronic throttle can easily follow the accelerator pedal movement opening or closing - it is a programmed hold up to stop nitrous oxide production on overrun amongst other things. See attached image which shows the response time and taper off after close.

[fenugrec]

I intend to eventually dump my Sentra Spec V ROM, but it won't be right now I'm afraid. For now I'm investing some time in your Xtrail'S ROM, I expect to be able to re-use a lot of what I'll discover.

John, thanks for that interesting graph. I'm very disappointed not to see a delayed throttle closure though !! DId you log that during a normal up-shift while driving ? I guess the engine was running (after the step down it looks a lot like the idle control loop taking over)...

I did some disassembly on the xtrail ROM. The interrupt vectors looked weird at first (i.e. there should be no code before 0x400, but your ROM has the power on reset at 0x104) but I discovered a few lines down that the code sets the vbr register to point to another vector table elswehere in the ROM, starting at 0x1000. So it's all good... Next I'll try to find the code that reads through the throttle map and see what happens there.

While digging around I also found pieces of serial communication routines; there might be a way to reverse the J2534 reflashing protocol. This is very interesting. Anybody interested in working on this with me ?
Maybe I should bring this to another forum / thread, it might be deviating from QR25DE tuning per se.

[jaf]

Happy for you to add onto this thread. I have little programming ability so can't help in that respect but happy to help wherever possible.
The image does show the delayed throttle closure - it is the little ramp at the bottom of the abrupt throttle closure. You get an instant closure down to a certain percentage, then the gradual taper off. The effect is to give you that awful hold-up on gear changes. I'll post a long log for you to dissect further.

[fenugrec]

Thanks for the log... there's a lot of data in there.
If you still have your ECU open, can I ask you to do some signal routing ? I figure if you were able to implant an AUD connector it should be no big deal p-)
I'm discovering just how big the SH7055 code is... I could use a few more clues to find what I'm looking for.
[EDIT: I confirmed the ECM harness connector is the same on XTrail and Sentra models so the ECM pin numbers should be valid]

a) Which of the SH7055 pin(s) control the throttle actuator. ECM connector pins #4 and #5... there's probably some power transistors or an H-bridge IC to drive these pins...

b) Which pin connects to the OBD K line ( ECM connector pin 85 ). There's either a level-shifter IC (MC33290 maybe?) between the 7055 and this pin, or at least 1-2 small signal transistors.
This would be to confirm exactly which serial interface is used for OBD (the 7055 has five serial interfaces, so it's not exactly trivial)... I also maaay have found some flash writing code, I would be thrilled if it was actually part of the J2534 reflashing code. But I'm probably way too optimistic at this point.

For the J2534, I'm realizing it would be easier to reverse engineer Nissan's own "NERS" software, but I don't have access to that...