[Mburns212]

Hi all, new to this forum and ford tuning in general. I do have reasonable experience in tuning Bosch ecus however.

The engine is 1679cc, 16v, variable cam timing on inlet, 125bhp. I have supercharged this engine with an Eaton blower from a Mercedes, with ~7psi, different cams, exhaust, intake and makes 218bhp, the car drives reasonably well on part throttle, and wot above 4000rpm, however it can definitely be improved.

I was going to use a standalone but I would rather use the original ecu.

I see that most of you seem to use tunerpro with definition files. I have winols as my hex editor and i usually look and define maps manually. I have a stock puma file(125bhp) and a racing puma(155bhp) file to compare. I thought this would give me good pointers as to where different maps would be but the files are quite different. Both files are from a TAPE EEC-V and I've been told they are interchangeable, so this would mean they are the same strategy, right?
It looks like I've had it easy with Bosch ecus as they have manuals and 'damos' files (which are def files from the manufacturer). I was hoping that i could identify maps manually, but its looking more like i will have to learn disassembly.

I'm using moates hardware to extract the files and a snap on generic reader for live data, but I'm looking to upgrade to a ford specific one soon.

Is there an easy way to locate maps in EEC-V like there is in bosch ecus? eg is there an axis description before the map data or something similar?

Ill attach the files in case anybody would like a look.

regards

[decipha]

welcome to the forum

are you using the electric clutch supercharger that you can enable/disable while driving?

bosch is completely different than ford, ford's do not load an OS the actual calibration file is the complete binary with code and all, there is no other way to figure out the binary other than doing disassembly

just because a single ecu can run two different binaries does not necessarily mean the binary's share the same strategy (def file), the only way to know for certain is to run the file through a disassembler and if all the code locations are identical between the two then they same the same strategy, unfortunately, you actually have to walk the binary to determine whats code and whats data, some disassemblers will give you a pretty good starting ground but none will give you 100% of the code without some user input (i.e. head scratchin lol)

the good news is that since both of those binary's can run on the same ecu hardware, chances are they are very similar code wise so it makes it much easier to figure out the other once you get the first one done (if you choose to disassemble them both)

you may want to check with sailorbob, he's done more disassembly on US/euro/aussie ford ecu's than anyone else

you may also want to check out the SAD disassembler by a member here TVRFAN, its pretty automated
another commonly used disassembler is the older bill lawrence disassembler than mpaton and sailorbob have refined over the years

[mpaton]

I think you have your 2 files mixed up. The one you label racing, might well be a stock ford 2 bank bin, but the format you have it in has bank1 replicated after bank 8. it has the normal ascii copyright mesage in it.

The other one, apart from a garbled copyright message seems to be either corrupted or encrypted.

[Mburns212]

Thanks for the replies,
I was going to look into the SAD dissassmbler tomorrow. I did notice that the files were very different. I will re read them to make sure I have done it correctly. So the files should look like the racing file? With 2banks of data? One did make more sense just to look at.

The charger did have a clutch on it but I removed it so I could change pulley size.
I have definatly been pampered with bosch ecu's. It's going to be a long learning journey but worth it if I succeed.

Edit: just to clear things up, the racing puma file is a genuine ford file. It was a limited production run with wide arches, various handling upgrades, and engine with different inlet manifold, exhaust, cams.

[mpaton]

Thanks for the replies,
I will re read them to make sure I have done it correctly. So the files should look like the racing file? With 2banks of data? One did make more sense just to look at.
Edit: just to clear things up, the racing puma file is a genuine ford file. It was a limited production run with wide arches, various handling upgrades, and engine with different inlet manifold, exhaust, cams.

There is no single standard for binary formats of Ford bins. Yours were 262144 bytes long, which would indicate 4 banks of 64kb each. However at least 8K in each ford bank has RAM from 0000 to 1FFF in each bank. So sometimes that range is left out of bin files making them shorter. If you chop up your racing bin into 4 64Kb chunks, and then discard the first 8kB of each, you will find the last of the 4 56Kb files as all zeros. You'll also find that the first 2 files are identical. That would be a format I haven't seen before, but I suppose that could happen if a 2 bank bin were written to a 4 bank sized chip, and then reread. So if you take your first and third (or second and third) 64kB (or 56kB) chunks and concatenate them you'll have a commonly used bin format for a 2 bank EEC-V bin.

And "interchangeable" might only mean that the hardware codes of the 2 ECUs are the same, meaning that the input and output circuits are the same, and appear at the same software addresses. That wouldn't be the same as the strategy being the same.

Ford 2D table lookups always use a 1D "Function" lookup for each axis, presumably to increase the effective resolution in one area od the 2D table (saving space over increasing resolution everywhere). So a good way to find tables is to find the code that does the 1D and 2D lookups and then find calls to those functions and then find the tables. Once you've found one, it all becomes easier.

[Mburns212]

The files are correctly named. I have another read of a racing puma map, done by OBD, downloaded from internet. This file is missing the first 1FFF, the first bank is the same, and is not repeated. Does this one make any more sense?

If so it looks like I've had trouble reading them with burn2 via j3 port. I'm following the instructions on moates webpage.

Edit: I've tried reading as a 2 bank and 4 bank, it just moves the data. I have tried all of my files in the SAD none of them are recognized as an eec file. However the one off the net (224kb) reads. As far as I know there is only one racing puma file so I must be doing something wrong.

Do i need to supply 12v to ecu when reading it? or is USB power enough?

[decipha]

dont know about the hardware your using but usually the ecu has to have ignition power in order to read the bin

[Mburns212]

Ok I'll try again with ecu in car rather than bench. I'm using moates burn2+fa+fe adaptors. And flash and burn software. It looks like I'm having some kind of error as the racing puma files should be identical.

[mpaton]

The files are correctly named. I have another read of a racing puma map, done by OBD, downloaded from internet. This file is missing the first 1FFF, the first bank is the same, and is not repeated. Does this one make any more sense?

If so it looks like I've had trouble reading them with burn2 via j3 port. I'm following the instructions on moates webpage.

Edit: I've tried reading as a 2 bank and 4 bank, it just moves the data. I have tried all of my files in the SAD none of them are recognized as an eec file. However the one off the net (224kb) reads. As far as I know there is only one racing puma file so I must be doing something wrong.

Do i need to supply 12v to ecu when reading it? or is USB power enough?

I've always found USB power works just fine.

If you can use a hex editor, you'll be able to munge your files into whatever order your disassembler needs. I can't tremember what provisions SAD has for accepting different formats, but I'm sure you'll be able to edit to whatever format it needs. Which in your case is 2 x 56kB chunks, which are probably NUL or FF padded at the end.

i thought you had the files swapped because I had wrongly assumed that the racing file was done by a tuner who might have encrypted it, or otherwise broken it.

[Mburns212]

Thanks for all the advice, I'm still going to re read the racing puma file, as it's data is duplicated and I don't think it should be. I think it should be more like the one off the net. (Another pointer to this is that winols recognises the processor as Intel in that file doesn't recognise other files, even though this feature doesn't matter).

I also have another standard puma TAPE ecu somewhere I'll read that as well see if it's the same.

I will re post the files once I have done that. Could be a few days.

I appreciate the help, you have saved me countless hours learning disassembly on possibly corrupted files.

[Mburns212]

Back again, this time with much better files. Re cleaned j3 port and read from 12000-2ffff. Still need the null values removed from 256kb bins. But the files are very similar, they use the same strategy. Winols can compare the files and highlight all the differences, so in effect it has highlighted some maps and possibly the rev limiters (if they don't use a factor) already.

I've not ran it trough the SAD program yet, I want more time to start playing with that.

Thanks again for your help, I think I'm heading in the right direction now.

[Mburns212]

I downloaded TSAD and tried that as it was the latest version. I've tried to cut the files down and run them through SAD but i'm getting an error in bin 2.

File sizes I've tried are;
128kb (00000-1FFFF) removed 64kb from start and end.
64KB (0000-FFFF) first half of 128kb file
64kb (10000-1FFFF) second half of 128kb file
112kb with the 00 removed from 0-2000 and 10000-12000
56kb first half
56kb second half


Are these file sizes correct for TSAD? It seems like they are according to the pdf.