openecu.org

I noticed this thread a couple of years ago from someone whom I believe was insturmental in developing Cobb's AccessPort: http://forums.nasioc.com/forums/showpost.php?p=4064586&postcount=11 (click on the upper right area to see the full discussion):

That's why I asked... is this something you've done? And do you know how to pull all 4 rom areas? I know ONE part of rom is trivial to get at. The other data is extremely difficult to get at unless you do it through a hardware interface.

Now I see when I look closely at SOA's reflash list at http://forums.openecu.org/download.php?id=214 that there can be separate Calibration IDs for ECM and ETC (Electonic Throttle Control).

Coupled with the ECM initialation process for new keys/ECM, I'm sensing there's more than one ROM in the new ECMs.

There is a seperate 128-pin CPU on the Subaru DBW ECUs which I'm assuming the main function of is ETC. It make sense to seperate out this controller for safety purposes so the two CPUs can keep each other in check. I'm not sure to what extent that really happens yet. I haven't spent much time looking at the main operational code of these ROMS beyond the SSM commands to load the kernel and such.

Jon,

Just asking the question as I am curious, but why would you want to find more information about the ETC? Is there something interesting that can be done with it?

It could probably be used for map switching or perhaps even realtime tuning

How would you use ETC for realtime tuning? Sorry if my questions sound stupid, just trying to understand a little more.

I don't know, that was just a guess. If you can flash it while using another map then switch, or something like that.

It's not uncommon to have multiple sectors in an embedded flash processor. You might have a unique code programmed into an OTP (one-time programmable) sector. This could be used to uniquely ID the ECU module, and then read by the BIU for immobilizer operations.