Reverse engineering the CA18DET factory ECU

Hi all! I was wondering. Would there be much interest in reverse engineering the CA18DET ECU? I am currently reverse-engineering the Toyota ECUs from the 2000s and later, which involves multiple 32-bit RISC CPUs, emulating a CAN network, and more. It is a big job, with ROMs being 384-768K in size, easily. I am working on the Prius at the moment, which, while not the sportiest car, is not upgradeable at all due to the computers being pretty much unexplored territory.

I am not wanting to replicate the Stage 1,2,3 ECU chips, as these are tried and tested. However, I was wondering if there would be much interest in delving deeper into the code of the ECU, and perhaps changing the way certain things are managed? Beyond modifying the maps and rev limiter. I have done some hand decompilation and can say that the ROM might have been written in 'C', because many of the setup routines are not written very efficiently.

I am also aware that the CA18DET ECU, while it only has a 16K EPROM, can actually use a 32K EPROM (I think there might be a resistor or something that needs modding but that is about it). So, it would be possible to add a lot more code. The early system-on-chip used has built-in serial port / other stuff, so it could be possible, for example, to do stuff like have a serial interface to a single-board computer, to do 'real-time' modding. Other ideas could be a true 'valet mode' for when the car is being serviced or whatever. I am sure that the maps could also be messed around with, perhaps increased in resolution if that would be of any interest?

I can say that I have the ability to reverse engineer this whole thing. The Prius ECUs are so much more complicated, and the SoCs are not documented, but I have still got quite far. The CA18DET stock ECU on the other hand is fully documented (at least, the SoC, and the rest can be gleaned from looking at the circuitboard - which I am going to do soon). It is an 8-bit Motorola 6801 clone with extensions (and additional hardware), with the ROM mapped into address 0x8000h and beyond. It has a flat 64K memory map. It is kind of like a 6502 but more advanced.

I would be interested in any thoughts on this. In particular, ideas as to what might be useful to add / modify in the ECU; new features etc.

I can say that hand analysis of the code thus far does show that, on boot-up, the ECU clears the RAM at addresses &0040 to &00FF (and, later, sets the stack pointer to &FF, so likely a descending stack), then it clears the RAM from &1000 to &1400, then branches to a subroutine, sets up a few of the hardware registers. This already helps as it shows where the internal RAM is mapped.

no one really pours money into CA engines anymore.

Quote:

---

Originally Posted by landspeed

Hi all! I was wondering. Would there be much interest in reverse engineering the CA18DET ECU? I am currently reverse-engineering the Toyota ECUs from the 2000s and later, which involves multiple 32-bit RISC CPUs, emulating a CAN network, and more. It is a big job, with ROMs being 384-768K in size, easily. I am working on the Prius at the moment, which, while not the sportiest car, is not upgradeable at all due to the computers being pretty much unexplored territory.

I am not wanting to replicate the Stage 1,2,3 ECU chips, as these are tried and tested. However, I was wondering if there would be much interest in delving deeper into the code of the ECU, and perhaps changing the way certain things are managed? Beyond modifying the maps and rev limiter. I have done some hand decompilation and can say that the ROM might have been written in 'C', because many of the setup routines are not written very efficiently.

I am also aware that the CA18DET ECU, while it only has a 16K EPROM, can actually use a 32K EPROM (I think there might be a resistor or something that needs modding but that is about it). So, it would be possible to add a lot more code. The early system-on-chip used has built-in serial port / other stuff, so it could be possible, for example, to do stuff like have a serial interface to a single-board computer, to do 'real-time' modding. Other ideas could be a true 'valet mode' for when the car is being serviced or whatever. I am sure that the maps could also be messed around with, perhaps increased in resolution if that would be of any interest?

I can say that I have the ability to reverse engineer this whole thing. The Prius ECUs are so much more complicated, and the SoCs are not documented, but I have still got quite far. The CA18DET stock ECU on the other hand is fully documented (at least, the SoC, and the rest can be gleaned from looking at the circuitboard - which I am going to do soon). It is an 8-bit Motorola 6801 clone with extensions (and additional hardware), with the ROM mapped into address 0x8000h and beyond. It has a flat 64K memory map. It is kind of like a 6502 but more advanced.

I would be interested in any thoughts on this. In particular, ideas as to what might be useful to add / modify in the ECU; new features etc.

I can say that hand analysis of the code thus far does show that, on boot-up, the ECU clears the RAM at addresses &0040 to &00FF (and, later, sets the stack pointer to &FF, so likely a descending stack), then it clears the RAM from &1000 to &1400, then branches to a subroutine, sets up a few of the hardware registers. This already helps as it shows where the internal RAM is mapped.

---

this is quite nicelly covered by nistune, in feature pack version also with additional code added. lot of nistune development is based on reverse engineering anyway...or I didnt got point of message...?

Im not very well versed on ECU's and what goes on inside,I do like the idea of it being improved with better parts so it works better
and/or it can be adusted easier like DIY tuning, I'm sticking with the CA as weapon of choice and can't be alone in wanting to see
improvments we can use to make them work better
I also run a toyota yaris as a daily and FWD drag car and problem I have is it has a self learning ECU (how it was described )
so if I try to run a SAFC or similar device to adust AFR's the settings constantly revert back to stock over a few mins of running
there is a piggy back thing called CAPCOM iirc that removes the self learn function so it can be adusted and stays set
but it was £250 plus some subscription licence fee to use the thing and limited tuning and need some other things for it to work
I would be interested in both CA ecu if you could improve them and the Toyota ecu as no one has delved into them afaik
I do recall people with a CA using a 300zx ECU with a nistune board no idea why other than it was better in some way? than the CA internals
interested in what could be done with them

Quote:

---

Originally Posted by ANDY black s13

Im not very well versed on ECU's and what goes on inside,I do like the idea of it being improved with better parts so it works better
and/or it can be adusted easier like DIY tuning, I'm sticking with the CA as weapon of choice and can't be alone in wanting to see
improvments we can use to make them work better
I also run a toyota yaris as a daily and FWD drag car and problem I have is it has a self learning ECU (how it was described )
so if I try to run a SAFC or similar device to adust AFR's the settings constantly revert back to stock over a few mins of running
there is a piggy back thing called CAPCOM iirc that removes the self learn function so it can be adusted and stays set
but it was £250 plus some subscription licence fee to use the thing and limited tuning and need some other things for it to work
I would be interested in both CA ecu if you could improve them and the Toyota ecu as no one has delved into them afaik
I do recall people with a CA using a 300zx ECU with a nistune board no idea why other than it was better in some way? than the CA internals
interested in what could be done with them

---

I've been out of the loop with the 200SX for a long time now; but have always liked the CA engine, having had a carby 1.8 bluebird back in the day - CA18S!. I also have 3 turbocharged Bluebirds (T12, T72 and U11 pillarless) - all CA18ET. It is sad that people aren't building up the CA's anymore, but I understand it is an old engine. I still see it as a mini RB, though. I checked out Nistune - that is new to me - looks good!

I'm writing a CPU emulator for the CA18DET, and have the 'decoder' done, and am implementing instructions one by one. It only takes a few ARM code instructions to do the CA18DET CPU instructions, so it won't take that long. I have the official Hitachi manual for the exact SoC as well. The SoC does have unused ports that could be used for minor or major extensions. I will write the emulator just for fun, as it is a reasonably advanced ECU, and it will allow me to better understand ECUs from the ground up. It would also allow me the opportunity to see what changes could be made. My plan for my 200SX is to tidy it up (although it has no rust and runs beautifully - just need an MOT and valet), and get it to about 250BHP (it is an auto, so that is a safe limit). After replacing the bearings pre-emptively. One addition I could add to the ECU could be the 'stop-start' technology on modern cars. This would be great in traffic jams for saving fuel. It would need a bigger battery and monitoring of the battery voltage, and would use some of the unused pins of the SoC, and could be engaged using a switch, so it only engages when you decide (when stuck in city traffic). This would be fairly simple and would save a lot of fuel when stuck in traffic. I would also be tempted to make a modified map whereby the car runs 'lean' (normal AFR) when cruising at low load, but can go very rich when on boost, to try to improve economy as a daily driver while keeping the engine safe when on boost).

Regarding the Yaris - what type of engine does it have? Is it the 1.5 litre? What year is it? What mods do you have? The work on Toyota ECUs I am doing is using the Prius computers; the Yaris engine was actually made for the Prius, and then a 'de-tuned' version was made for the Yaris (de-tuning involved converting to Otto cycle, putting normal pistons and normal cylinder head, and getting a huge power increase!). The work I am doing will work for any Toyota ECUs from about 1998 to the present date (except the current ones will be using multi-core processors and the like, requiring a major update to my emulation of the V850 core). From the Yaris point of view, I am interested in the 1.5 engine as I know it can be turbocharged and the like, and it is a bolt-in for the Prius engine - all I would need to do is modify the Prius ECU code to run the Yaris engine (it actually works in a Prius using the Prius ECU, but has a redline of 4200rpm or something like that, and needs the Prius ECU as the code in that ECU is aware of the stop-start nature of how the engine works in hybrid mode).

I will post back in a while, once I have delved further into the code.

that was some good info, adding a stop start function if not hard to do could be good for a daily ,
something I would like for the CA18 s13 is boost by gear,that would need a gearbox position sensor to detect what gear it was in
,can be done with microswitches mounted to the gearstick base but after that I'm lost regards the ECU
, the yaris is a 1.3 SR (2NZ-FE) 2000 X reg and building a 2002/52 reg T sport 1.5 (1nz-fe)
N/A engine 13:1 CR (from prius pistons) fully worked head,lotus exige plenum with 90mm TB and so on
to compete in FWD all motor class ,turbo kits and superchargers are stupid expensive for this engine
the project is being done for less than £1k so a proper standalone is way out of budget,
the current rev limit is 6500 and would like it to go to 7500 I did read about changing the crystal (chip?)
to change the rev limit point but possibly they were only used in earlier toyota ECU's
raise rev limit and remove self learn function are two main things I'd like to do if possible,
the early prius 1.5 litre engine code is 1nz-fe x, the JDM only yaris RS was factory turbo @150 bhp

Quote:

---

Originally Posted by ANDY black s13

something I would like for the CA18 s13 is boost by gear,that would need a gearbox position sensor to detect what gear it was in
,can be done with microswitches mounted to the gearstick base but after that I'm lost regards the ECU
,

---

Boost by gear doesn't require add on sensors, aftermarket standalone's look at RPM and Speed to work out which gear is being used.

Regarding engines, the 1NZ-FE is derived from the 1NZ-FXE. Interesting that they got 150BHP out of it! What are you aiming for with your build? (also, are you on a Toyota forum somewhere about that car, as I don't want to put too much non-S13 related discussion on this thread!). However, I can say that the Prius ECU can control the 1NZ-FE 'directly' as people have done the swap, but the rev limit is 4200rpm or so, and the Prius 'main' computer is the hybrid vehicle computer, which requests certain power outputs from the engine, so the end result is the engine doesn't make any real difference - kind of like a self-learning engine I guess. Do you happen to have access to the ROM for the 1NZ-FE? I only have the 1NZ-FXE; the files from Toyota Techstream are encrypted, but I have almost broken the encryption 'manually', so I will soon have access to the 'hybrid vehicle' ECU for gen-2 Prius. If I get through the encryption of the downloadable 'CUW' 'binary' files, then I can get any ECU that has had a dealer update (but, not all ECUs). I can imagine that the 1NZ-FE ROMs are already floating around as there must be a community somewhere who mod these engines. I just realised I missed something on your post - about the Prius pistons - some people have swapped the 1NZ-FE head onto the 1NZ-FXE and there were concerns around the possibility of detonation as the Prius does run higher compression. I think Prius pistons in a 1NZ-FE sounds like the best plan, as the Prius bottom-end is designed to be light and efficient, so doesn't have that much strength to it. The rev-limit will be able to be modified. The real challenge is that Toyota implements a special 'key exchange' system, so that you can only reprogram an ECU if the new firmware has a certain 'key'. Reprogramming the ECU requires the key (that comes with the update file) to be sent to the Toyota ECU, and only after confirming this is valid, the ECU enters 'reprogramming' mode, and allows reprogramming to occur. However, this can be bypassed by removing the ECU and directly programming the chip (rather than going via the CANbus).

(edit : in the drag racing, I guess that electric motors are not allowed? if they were, a modified Prius gearbox / hybrid system could be a huge advantage). My Prius is much faster than my 200SX from a standing start (until the turbo kicks in of course). The following video shows this sort-of; the GT-R driver delayed for some reason, possibly because in a Prius, you can hold accelerator and brake, and the engine can go to make RPM, and you then have full power (+ full electric motors) the instant you release the brake. The Prius is still faster at the beginning) : https://www.youtube.com/watch?v=5WY3DAH4p2U

The dangers of adding mods to modern engines, without letting the computers know, is highlighted in this video, where someone adds NOS to a Prius. You only need to watch the first 20 seconds to see the fun, and there are later vdeos where the engine is torn down (it is really messed up inside). In this case, the Prius has 'traction control' (actually full power-cut which disconnects the engine to protect the transmission from shock). I think the 1NZ-FE was disconnected due to 'traction control', and over-revved to (??I don't know, but a lot)... https://www.youtube.com/watch?v=hac-PvKqKQc

(PS I understand that the Prius gets a lot of hate, but I accept that; I own a Prius, a Leaf, several bluebird turbos, 2x S13 turbo, so I see both sides of the story!. My Prius is a Gen 2, in one of the red colours (it is the same colour as the Prius in the movie 'The Other Guys'). :wack:

Regarding the CA18DET; I have to read up more about 'boost by gear' - since the 'ciontrol' of the turbo is all mechanical (at least as 'stock' - the boost 'limiter' / bypass (I forget the proper term) is mechanical inside the turbo, so I don't know how that could be controlled via the ECU. However, if it can be done with an aftermarket, it may be possible to do with the stock ECU and a custom ROM (if control of an external electronic boost controller is needed, it is a case of seeing if the stock system-on-chip has the ability to communicate with that (it probably does as it has a lot of unused features)). It should be possible to implement on a stock ECU; the ECU will be aware of the RPM, and I know speed sensors are fitted - but am not sure if the ECU receives that info, or not!

Stop-start would be something that could be implemented; the main issues would be monitoring the charge of the 12v battery, and making sure there are not too many starts per unit time (to avoid overheating of the starter motor).

I will post back re: CA18DET once I get a running CPU core. It is very simple (8-bit), but it is 'CISC', so there are many, many instructions which each need a slightly different implementation. It won't take that long. The final code will run on a Raspberry Pi 3B+ and later, probably earlier ones. I am using the hardware divide instruction in my assembly language - however this particular SoC probably doesn't even have divide. And, adding a basic software divide isn't really an issue. In all likelihood, the code can run on anything that can run Acorn 'RISC OS' - as long as I just use software divide if needed.

regards the Toyoata ECU ,via the OBD port and bridging 2 with a short bit of wire I have re set the ECU key programing,
as in the stock 2nz ECU the car came with one day lost the key code and had to have car recovered,
Thinking something was wrong with the ECU I swapped in the T sport 1.5 1nz ECU ignition
,key halo, and imob black box and re synced the key code via the bridged OBD port terminals
check this video to see what I mean https://www.youtube.com/watch?v=QocuEYNE6KM
the engine I'm building now will make 150>160 at the wheels N/A going by similar spec engines,
Im using the 13:1 prius pistons and rods in the T sport block, with new rings in Honed bores
Im using a much bigger Lotus plenum and TB and more extreme head work so hoping for 160, extended 1k rev limit to 7.5k will help there
I'm keeping the VVTi system with the stock T sport cams and would also like to be able to adust the range of the VVT sprocket
to possibly pick up some more top end revs power,
with Honda engine using the Vtec system Apexi make a Vtec controller to adust the Vtec switch point,
if the toyota ECU didn't have the self learn function one of the Vtec adust controllers could be used and the adjustments would stay set afaik
I will make do with the closer gearset in the T sport gearbox for now, can't deny it could work well to try the prius trans but out of budget atm

I will wait for your up dates on the CA ECU

I have got the emulator to version 2 (actually version 2 alpha); I am a bad programmer as I don't plan ahead; however, what I do do is learn from the challenges the coding presents. Specifically, I have an emulator that gets quite far into the ECU, but at this stage, a full rewrite using a RISC approach will save time, especially since it has only taken a few days worth of spare time to get to the current stage! I can't find the UI to add an image, but will do so after this post...

EDIT : I can't find the UI, but I do know that the 'butterfly' valve JDM 200SX must have a way to communicate with the ECU; given that most of us in the UK don't gave the butterfly valves (and also don't want them when doing custom builds), it may well be that the part of the ECU dedicated to controlling these valves could be used to control 'other things'). However, I need to do more research before saying if this is possible!

EDIT 2 : I think the SXOC forum doesn't allow direct upload of images, because that would cause a hugely increased usage of data; please correct me if I am wrong!

CA18DET ECU is to all intents a BBC model B, running at 1MHz.

It gives up on closed loop lambda operation at 3200 rpm as it can't do the calcs fast enough.

The trick is it has a programmable timing chip to run the ignition and injection, takes timing signals direct from CAS and CPU sends it advance & dwell for ignition and time & duration for injection. A chunk of the code in the ROM is used to program this timing chip during ECU boot up. To make a new ECU you have to emulate this chip and not just the CPU.

Nissan use a CAS that produces a 1° pulse, each pulse rise and fall is 1°. This is way too fast for many after market ECU's that can only cope with 36 teeth (5 degrees).

CAS also has 2nd output for cylinder, the window is progressively longer, one 1° pulse width for no1, two pulse width for No 2..

Lacks ODBII.

The JDM butterfly control signal is via an open collector transistor. Euro ECU lacks this transistor but the pads are there. It also controls a bleed valve for turbo wastegate. JDM actuator is set to 6 psi, when bleed valve opens it boosts to 10psi. Japan ROM has low/high octane fuel maps and on low octane the butterflys and bleed valve won't open. The magic speed for operation of this is 3200 rpm.

CPU can't access bigger than 16K ROM. A bigger ROM has external switch on A14(?), this switches the whole map and code from low 16K to high 16K. Could be used for
LPG map?

Stop/start requires a gearbox change. Manual gearbox has no neutral detection so it would very risky as you fire up in gear. Auto has inhibitor, most people leave autos in gear and hold on brake, stop engine and it won't restart in gear.

Please don't add Start/Stop, it's annoying enough as it is, I'm always turning that off when I get in a car.

Why not try cracking the Mk1 MX5 ECU, no-one ever really managed that.

I had a look, and found this thread - https://forum.miata.net/vb/showthrea...226162&page=30

It turns out the Mk1 MX5 uses a very similar CPU to the 200SX - 6800 based; the ECU used a mask ROM, so couldn't be reprogrammed, but Rhinopower made a daughterboard which can be installed in place of the original CPU/MCU and has the ability to reprogram it with EPROM / Flash memory; it is on the website here: http://www.rhinopower.org/Mazda/DB5/db5.html

I will continue to explore the CA18DET ECU; the programmable timing chip will be a challenge - I need to remove my ECU and take high-res photos to identify the chips. / wiring etc. The thing that puts me off it, to some degree, is that the main modifications that could be made would be around performance / remapping, and that has already been done on the stock ECU. Stop-start - that is a very valid point; it would need to be connected to something like a clutch switch on a manual (like the Mk 1 Honda Insight manual, which had stop-start despite being manual), and may be more trouble than it is worth. The only things that could be interesting would be to use the butterfly control circuit on non-butterfly cars to do something else, such as changing the level of boost in certain gears / certain speeds?