CEL and malfunction when re-flashing A2ZJ700J

[Navybluesubaru]

Whenever I reflash the ecu with the appropriate A2ZJ700J-version map that is not the orginial map, the car throws a CEL and says there is an ECU error. If I flash it with an A2ZJ500J-version modded or stock it works just fine.

All I want to do is up the redline but it doesnt work. I know I am modifying the correct spot in the map so I have no idea why its not working. Does anybody have any ideas?

Here is my Rev-Limiter code for ECUedit1.2.0.70b, I know its an older version.

<map name="Rev Limiter" type="1" active="1" help="" class="" level="0">
<data count="2" offset="#5B960" scaling="" storagetype="float" func_2val="[value]" func_val2="[value]" format="%.0f" metric="" caption="" desc="" inc="1" incb="5" incdata="0" incdatab="0" inc_dir="1" min="-2147483648" max="2147483647" cols="1" view="num" color_dir="1"/>
</map>


Jeff

[Tea cups]

You probably didn't update the checksum. Not sure how to do that with Ecuedit, but there should be a selection in the menus somewhere to update your checksum.

[Navybluesubaru]

Is the checksum thing only for STI's? I never have to do that with my wrx. Also, when the 500J version I can mod it just the same as when I attempt to mod the 700J, but the 500J will flash just fine. The guy whose car im flashing does not want to have the older revision code in there so we really need to figure out why the 700J wont flash once modded but the 500J will work when modded.

[Tea cups]

The checksum is for all 32bit ecus so for USDM this is 04+ Sti, 06+ wrx, 05+ LGT, etc. 16bit ecus like the 02-05 wrx did not have this issue. The 500j and the 700j use the exact same checksum address range and it includes all the tuning data. Not sure why the 500j works with changes though. There is a fix which disables the checksum check all together and may have been done to his rom already by a previous owner or himself? If not, there is also an auto checksum update selection in Ecuedit which he may have enabled for his 500j rom, but not the 700j.

[Navybluesubaru]

That might be it...i'll have to check that out, I didnt know about that. I'll check that out next time I get into it.

Jeff

[Freon]

My 500J would not work without the checksum fix. In fact I think I was the first to flash a 500J with changes. Colby had to find and post the fix when my first attempts failed.

[Navybluesubaru]

Freon, can you point me in the right direction when looking for the checksum? If you dont know the 700J location thats fine, I can reference a 500J map and attempt to locate it in the 700J myself.

Jeff

[Tea cups]

It's at 0x7fb80 for the 04s.

[Navybluesubaru]

Thanks. How does modifying the map affect how the checksum is valued? Someone mentioned that you can "fix" it or something....how is that performed?

Thanks a bunch,
Jeff

[Tea cups]

You can use Enginuity's checksum fix. Load in Enginuity. Click enable on the fix. Save. And you won't have to mess with it again. Basically changes the address range to 0x0 to 0x0 (and a valid checksum calculation for no range) so it no longer checks anything. You'll see how Subaru does this as there are multiple tables. Only the first table 7fb80 on the STi is active.

I think Ecuedit actually calculates the checksum based on the changes you made to the rom. But you have to either manually select that each time you edit the map or there should be an auto update that once selected will do it for you.

[Freon]

I manually hex edited my roms with the checksum fix once, zero'd them out, and haven't looked back. I mainly use Ecuedit.

I'd say just do that. Then not worry about it again.

Even if your editor did a "correct" checksum fix (i.e. recalculated the value rather than disabling it), it would only really save you from some sort of freak error. Ecuflash itself verifies the checksums on each block it writes, so whatever is in your ROM file on your laptop is verified to make it to the ECU. The checksum in this circumstance is only protecting you from the file becoming corrupt from the time you save it in your editor to the time you open it with Ecuflash.

[Tea cups]

Even if your editor did a "correct" checksum fix (i.e. recalculated the value rather than disabling it), it would only really save you from some sort of freak error. Ecuflash itself verifies the checksums on each block it writes, so whatever is in your ROM file on your laptop is verified to make it to the ECU. The checksum in this circumstance is only protecting you from the file becoming corrupt from the time you save it in your editor to the time you open it with Ecuflash.

The checksum that Ecuflash does when flashing is different from the checksum by the ecu. Ecuflash does this by reading blocks of what was just written to make sure it was written correctly and doesn't have anything to do with the checksum failure where your CEL start blinking and the car runs like crap.

This is from the ecu's checksum procedure involving the address ranges specified by each checksum table (up to 12 located at 0x7fb80 04s or 0xffb80 05s+). It will fail if data is changed in the range because the checksum will no longer match what is indicated in the table (most ecus only have 1 active table, except for some 06s which have more). Ecuedit and Ecuflash will automatically recalculate the checksum based on your new changes and therefore the ecu will pass the checksum procedure (not sure how often the ecu checks it - probably at startup every time). With Ecuedit, you have to select to do the checksum fix (I think there's a selection to auto update but you have to choose this). Ecuflash will update your checksum automatically but only if you save the rom after opening it in Ecuflash (and assuming the checksum method is set in the xml). If you just open a rom edited with another editor in Ecuflash and flash, Ecuflash won't update the ecu's checksum for you.

The Enginuity fix is the same as the hex editor fix you mentioned in that it uses the same method Subaru uses to disable the checksum tables by zeroing out the range and setting the checksum to the valid value for that range (0x5aa5a55a).

[Navybluesubaru]

Well I opened a stock 710J rom that had been modified with the "checksum fix" already. I adjusted the rev limiter up to 8k and flashed my buddys car, but it didnt work. It did not throw a cel but the rev limiter is still the same as before. Anybody have any ideas? His stock revision is a 700J, cant I flash it with the 710? perhaps the answer is "apparently not"

Jeff

[Tea cups]

710j should not be a problem. How do you know the rev limiter change didn't work? I wouldn't recommend taking it up to 8k to test it though. Try reopening the rom in the editor you used and make sure the changes were made.

[Freon]

I am running a modified AJ243 710J on my AJ241 500J ECU. Runs fine so far, but only been running it a day or two. I had been doing all my tuning on the base 500J and copied my maps over one at a time. Unless I spot something odd I will be sticking with the 710J from here on out. I have been logging, nothing unusual so far.

Not sure if anything important for my uses is in the 710J vs. the 700J or 500J. I haven't gone through the maps one by one to see, but at a glance they all seem to be essentially the same. Certainly the base fuel, timing, boost control, AVCS, MAF scaling, etc are all exactly the same. When I did flash, it reflashed about 75% of the blocks. The maps are all in different locations and most of the code is at least rearranged in the ROM. Not sure that tells us much, but worth noting. I would say it at least means a chunk of code was rewritten and it isn't just a few map values tweaked.

Teacups, I am fully aware of what the Ecuflash write checksum is checking. That's exactly why I made my comments.

If you are going to open your ROM in Ecuflash and resave it to fix the checksum, you have completely negated the use of the checksum! It is doing you no good if you use it like that. I don't want people thinking that means they're any more secure doing it that way then if they just disabled it outright. The only thing the file checksum is saving you from is a file corruption from the time you save it in your editor to the time you open it with Ecuflash. That's it. So opening and resaving it in Ecuflash moments before you flash it makes the checksum useless. Might as well just disable it once and never bother with it again. People need to understand this...

Checksums are there to ensure things transmit properly. Say, at the factory when the ECUs are burned, this ensures the exact ROM that Subaru intended made it into the car. Or if Subaru sends out a CD to dealers for a TSB reflash, it ensures the data gets from Subaru, the CD, the flashing machine or whatever, all in one piece without any corruption. But it only works from the time the checksum is calculated to the time it is checked. If you calculate the checksum in the ROM image itself immediately before you flash it, you are only protecting yourself from some serious freak corruption in those few seconds before you use that ROM to flash. Ecuflash only ensures what is in the ROM (corrupt or not) makes it into the ECU.

If your editor can set it for you automatically just by turning a feature on, do it. I just turn mine off. I'm not that worried about file corruption between the editor and Ecuflash. Ecuflash confirms correct writing to the ECU from the file on my laptop and that's all I'm concerned about.

NBS: On some DBW ECUs, you need to fix the Accel/Throttle table (or whatever it may be called in your editor). This has come up several times. The drive-by-wire system shuts the throttle body from 100% to 20% from 6900rpm to 7000rpm on the 04-06 USDM STI and possibly some other DBW models. You need to modify this map when you change your rev limiter.