When you tune your car what your actually changing. An inside look.
Thread Starter
Mach 1 Member
Joined: March 1, 2007
Posts: 669
Likes: 5
From: Kansas City
When you tune your car what your actually changing. An inside look.
When you load a tune on your car, what exactly are you changing?
This is another popular question i'll try to answer
But first I want to go into some of the Major parts of the PCM. This post will stay high level on just what a tune changes. I'm going to write about how the PCM thinks next week
Most all Electronic Engine Control units have 3 BIG parts where all the computation happens.
1. MCU (Microcontroller) - Some people may call this the processor, or Similar.
2. RAM (Memory or Random Access Memory) - This is volatile memory where the application is loaded and executed. (This is a whole post in its own.)
3. FLASH (Persistent storage) - This is non-volatile memory, and where everything is stored. Such as, The bootloader (1 and 2), the O/S (In the case of Copperhead its a RTOS), codes, Engineer console, and most important the calibration (or parts called the "tune").
When a EEC is first powered on, there is some initialization that happens in the processor (such as clocks), then the application is ran (RTOS) Once the o/s is initialized, the calibration is loaded into memory and computation starts. (For Example)
So lets talk specifically about the Tune itself.
When you plug a tuner into your car and start the tuning process it does the following things. (Specific to the PCM, it does other things as well that will be covered in another post).
1. Identifies the PCM - This way the tuner knows what PCM unlocking algorithm, security hash, and memory sections.
2. Unlocks the PCM - Since about 1996, the EEC has to be unlocked to prevent un-auhtorized access by rouge modules. Unfortunately, over the years, this has been quiet easy for folks to reverse engineer.
3. Downloads the stock tune - It starts a session with the PCM asking either to download the entire calibration (rarely used) or queries sections of memory to download. In the case of a SCT, most (meaning 90%) of the time its downloading certains sections, not always in concurrency. This will make more sense soon why you would only download sections and not all of it.
4. Uploads the modified tune - Now here is where the modified tune starts to be uploaded to your PCM. The device may choose whether to upload all of the tune, or again only certain sections. (Sections that have been modified).
5. The PCM/TCM is reset
All tunes start from the Factory Calibration.
Which is a image of the calibration portion of flash memory. Typically this is handled as a HEX type, but sometimes Intel bin is used. Personally, I prefer to deal with hex, as they contain a better mapping as well.
So for this example i'm going to use a make believe portion of memory here to adjust High Speed Fan on ECT. In this example I'm going to use a PCM with a tear tag of CDC2.
Each part of the calibration has a address. So each setting and change is stored at an address (much like your home address). So lets say in this example that High Speed Fan on ECT is located at an address of 0x000CABC5.
So a stock hex file could look like this
Offset(h). 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000CABC0 43 60 00 00 43 64 00 00 43 64 00 00 40 A0 00 00
After modify the stock setting to say 200F it could look like this
Offset(h). 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000CABC0 43 60 00 00 43 48 00 00 43 64 00 00 40 A0 00 00
Notice that row 05 changed from 64 to 48. That one byte controls the C temperature of the HSF cut on.
When you use your tuner you are uploading a version of the stock calibration slightly modified as described above. That is a single change there, things like spark, maf, etc require 2 and 3 dimensional arrays and can cover many bytes of memory. (I'm not going to cover this here, but can if requested. Its for someone who understands coding or matlab).
So when you return your vehicles PCM back to stock your changing the memory map values back to their downloaded values. This is how Ford cannot detect that there was an aftermarket calibration or what the calibration that previously was on it was. They have had to resort to other methods of tracking these changes. There are a few PID's out there that were supposed to stay secret to show the Flash count for many areas of memory.
Tuners like SCT, Diablo, HP, have spent many countless hours reverse engineering these tables and mapping out the EEC memory. However, Ford has started to work with some major companies to share this information. If you had plenty of time and knowledge you could build your own tuning software and tuners. (I'm personally considering it)
I hope I did a decent job at explaining this. I look forward to comments and questions. As most of you know i'm a huge supporter of OSHW and OSSW. Putting the knowledge in the peoples hands is they it should be, we buy these cars and should know how they work, and if we want to make changes we should be able to. (I wish our government practiced same logic).
Cheers all,
-Matt
This is another popular question i'll try to answer
But first I want to go into some of the Major parts of the PCM. This post will stay high level on just what a tune changes. I'm going to write about how the PCM thinks next week Most all Electronic Engine Control units have 3 BIG parts where all the computation happens.
1. MCU (Microcontroller) - Some people may call this the processor, or Similar.
2. RAM (Memory or Random Access Memory) - This is volatile memory where the application is loaded and executed. (This is a whole post in its own.)
3. FLASH (Persistent storage) - This is non-volatile memory, and where everything is stored. Such as, The bootloader (1 and 2), the O/S (In the case of Copperhead its a RTOS), codes, Engineer console, and most important the calibration (or parts called the "tune").
When a EEC is first powered on, there is some initialization that happens in the processor (such as clocks), then the application is ran (RTOS) Once the o/s is initialized, the calibration is loaded into memory and computation starts. (For Example)
So lets talk specifically about the Tune itself.
When you plug a tuner into your car and start the tuning process it does the following things. (Specific to the PCM, it does other things as well that will be covered in another post).
1. Identifies the PCM - This way the tuner knows what PCM unlocking algorithm, security hash, and memory sections.
2. Unlocks the PCM - Since about 1996, the EEC has to be unlocked to prevent un-auhtorized access by rouge modules. Unfortunately, over the years, this has been quiet easy for folks to reverse engineer.
3. Downloads the stock tune - It starts a session with the PCM asking either to download the entire calibration (rarely used) or queries sections of memory to download. In the case of a SCT, most (meaning 90%) of the time its downloading certains sections, not always in concurrency. This will make more sense soon why you would only download sections and not all of it.
4. Uploads the modified tune - Now here is where the modified tune starts to be uploaded to your PCM. The device may choose whether to upload all of the tune, or again only certain sections. (Sections that have been modified).
5. The PCM/TCM is reset
All tunes start from the Factory Calibration.
Which is a image of the calibration portion of flash memory. Typically this is handled as a HEX type, but sometimes Intel bin is used. Personally, I prefer to deal with hex, as they contain a better mapping as well.
So for this example i'm going to use a make believe portion of memory here to adjust High Speed Fan on ECT. In this example I'm going to use a PCM with a tear tag of CDC2.
Each part of the calibration has a address. So each setting and change is stored at an address (much like your home address). So lets say in this example that High Speed Fan on ECT is located at an address of 0x000CABC5.
So a stock hex file could look like this
Offset(h). 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000CABC0 43 60 00 00 43 64 00 00 43 64 00 00 40 A0 00 00
After modify the stock setting to say 200F it could look like this
Offset(h). 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000CABC0 43 60 00 00 43 48 00 00 43 64 00 00 40 A0 00 00
Notice that row 05 changed from 64 to 48. That one byte controls the C temperature of the HSF cut on.
When you use your tuner you are uploading a version of the stock calibration slightly modified as described above. That is a single change there, things like spark, maf, etc require 2 and 3 dimensional arrays and can cover many bytes of memory. (I'm not going to cover this here, but can if requested. Its for someone who understands coding or matlab).
So when you return your vehicles PCM back to stock your changing the memory map values back to their downloaded values. This is how Ford cannot detect that there was an aftermarket calibration or what the calibration that previously was on it was. They have had to resort to other methods of tracking these changes. There are a few PID's out there that were supposed to stay secret to show the Flash count for many areas of memory.
Tuners like SCT, Diablo, HP, have spent many countless hours reverse engineering these tables and mapping out the EEC memory. However, Ford has started to work with some major companies to share this information. If you had plenty of time and knowledge you could build your own tuning software and tuners. (I'm personally considering it)
I hope I did a decent job at explaining this. I look forward to comments and questions. As most of you know i'm a huge supporter of OSHW and OSSW. Putting the knowledge in the peoples hands is they it should be, we buy these cars and should know how they work, and if we want to make changes we should be able to. (I wish our government practiced same logic).
Cheers all,
-Matt
Last edited by zeroaviation; Apr 16, 2015 at 10:28 AM.
Shelby GT350 Member
Joined: April 14, 2013
Posts: 2,460
Likes: 111
From: CT
Good info - I got into tuning with my last car (B5 S4 - twin turbo), and it is very interesting, time consuming, frustrating at times, and rewarding to write a tune and see positive results.
I'm not familiar with the Mustang ECU specifically, but the concept is the same and the above is a good overall view. I'm not a computer whiz (aerospace engineer... I like parts, not electrons and code), but the car tuning world is pretty interesting.
I'm not familiar with the Mustang ECU specifically, but the concept is the same and the above is a good overall view. I'm not a computer whiz (aerospace engineer... I like parts, not electrons and code), but the car tuning world is pretty interesting.
Banned
Joined: August 2, 2013
Posts: 3,090
Likes: 254
From: Little north of Stuttgart, Germany
Matt, you used my least favorite word. Matlab. I still have nightmares about it from my college days. It got so bad, that sometimes I'd have dreams of rows and rows of 1s and 0s.... and then, there would be a 2! I'd wake up in panic. 
On a serious note, I was wondering about why Ford wouldn't be able to tell that a ECM was re-flashed. Most EEPROM has a finite number of life cycles anyway, and in a lot of other applications there is a flash count like yuo said, or date/time code when it was last modified. I'd figure the ECM would use something similar, so even if you flash it back it would be clear the ECU memory was altered.
Also I'm guessing the original Ford ECM uses RTOS? I'm also guessing there would be some fuzzy sets used in calculation of control variables. I work on the electronic brake controllers and we also use RTOS along with fuzzy logic and of course PID control.
Thanks for the good info.
On a serious note, I was wondering about why Ford wouldn't be able to tell that a ECM was re-flashed. Most EEPROM has a finite number of life cycles anyway, and in a lot of other applications there is a flash count like yuo said, or date/time code when it was last modified. I'd figure the ECM would use something similar, so even if you flash it back it would be clear the ECU memory was altered.
Also I'm guessing the original Ford ECM uses RTOS? I'm also guessing there would be some fuzzy sets used in calculation of control variables. I work on the electronic brake controllers and we also use RTOS along with fuzzy logic and of course PID control.
Thanks for the good info.
Last edited by 5.M0NSTER; May 2, 2014 at 04:49 PM.
Thread Starter
Mach 1 Member
Joined: March 1, 2007
Posts: 669
Likes: 5
From: Kansas City
Matt, you used my least favorite word. Matlab. I still have nightmares about it from my college days. It got so bad, that sometimes I'd have dreams of rows and rows of 1s and 0s.... and then, there would be a 2! I'd wake up in panic.
On a serious note, I was wondering about why Ford wouldn't be able to tell that a ECM was re-flashed. Most EEPROM has a finite number of life cycles anyway, and in a lot of other applications there is a flash count like yuo said, or date/time code when it was last modified. I'd figure the ECM would use something similar, so even if you flash it back it would be clear the ECU memory was altered.
On a serious note, I was wondering about why Ford wouldn't be able to tell that a ECM was re-flashed. Most EEPROM has a finite number of life cycles anyway, and in a lot of other applications there is a flash count like yuo said, or date/time code when it was last modified. I'd figure the ECM would use something similar, so even if you flash it back it would be clear the ECU memory was altered.
Sad thing is that I use Matlab professionally... 
I also use LabView... Lesser of the two evils... I guess paying attention in college payed off 
... The flash used in Copperheads have a 100k write cycle lifespan. The "magical counter" that people shouldnt even know about lives in non accessible flash (through the o/s CAN bus)... You could probably break out a JTAG and go that route. I do think there are some flash protection fuses set though.
-Matt
Shelby GT500 Member
Joined: December 20, 2011
Posts: 4,326
Likes: 53
From: CenTex...sort of
I'd be interested in learning about the 2- and 3-dimensional arrays necessary for the other components (sizes, ranges, etc). I've worked with them before so I'm familiar with the concept, I'm curious how they're implemented with a vehicle's functionality.
Thread Starter
Mach 1 Member
Joined: March 1, 2007
Posts: 669
Likes: 5
From: Kansas City
-Matt
Member
Joined: May 21, 2014
Posts: 3
Likes: 0
From: Silicon Valley
Yea, great post. I've been a software engineer for about 25 years. What's happening is updating the config/parameters. It cool to hear what's going on at a low level.
So Ford wrote their own RTOS? I wonder why they didn't use something like VXWorks.
Anyway, thanks for the post. I'd like to hear more.
So Ford wrote their own RTOS? I wonder why they didn't use something like VXWorks.
Anyway, thanks for the post. I'd like to hear more.
Thread Starter
Mach 1 Member
Joined: March 1, 2007
Posts: 669
Likes: 5
From: Kansas City
Thread
Thread Starter
Forum
Replies
Last Post
