Ford Mustang Forum - View Single Post - When you tune your car what your actually changing. An inside look.
View Single Post
post #1 of (permalink) Old 05-02-2014 Thread Starter
ZeroAviation's Avatar
Joined: Mar 2013
Location: Olathe
Posts: 211
When you tune your car what your actually changing. An inside look.

When you load a tune on your car, what exactly are you changing?
This is another popular question i'll try to answer But first I want to go into some of the Major parts of the PCM. This post will stay high level on just what a tune changes. I'm going to write about how the PCM thinks next week

Most all Electronic Engine Control units have 3 BIG parts where all the computation happens.
1. MCU (Microcontroller) - Some people may call this the processor, or Similar.

2. RAM (Memory or Random Access Memory) - This is volatile memory where the application is loaded and executed. (This is a whole post in its own.)

3. FLASH (Persistent storage) - This is non-volatile memory, and where everything is stored. Such as, The bootloader (1 and 2), the O/S (In the case of Copperhead its a RTOS), codes, Engineer console, and most important the calibration (or parts called the "tune").

When a EEC is first powered on, there is some initialization that happens in the processor (such as clocks), then the bootloader is loaded into RAM. The bootloader then calls on the main() for the RTOS. Once the o/s is initialized, the calibration is loaded into memory and computation starts. (This can vary, and is not concrete)

So lets talk specifically about the Tune itself.

When you plug a tuner into your car and start the tuning process it does the following things. (Specific to the PCM, it does other things as well that will be covered in another post).
1. Identifies the PCM - This way the tuner knows what PCM unlocking algorithm, security hash, and memory sections.

2. Unlocks the PCM - Since about 1996, the EEC has to be unlocked to prevent un-auhtorized access by rouge modules. Unfortunately, over the years, this has been quiet easy for folks to reverse engineer.

3. Downloads the stock tune - It starts a session with the PCM asking either to download the entire calibration (rarely used) or queries sections of memory to download. In the case of a SCT, most (meaning 90%) of the time its downloading certains sections, not always in concurrency. This will make more sense soon why you would only download sections and not all of it.

4. Uploads the modified tune - Now here is where the modified tune starts to be uploaded to your PCM. The device may choose whether to upload all of the tune, or again only certain sections. (Sections that have been modified).

5. The PCM/TCM is reset

All tunes start from the Factory Calibration.

Which is a image of the calibration portion of flash memory. Typically this is handled as a HEX type, but sometimes Intel bin is used. Personally, I prefer to deal with hex, as they contain a better mapping as well.

So for this example i'm going to use a make believe portion of memory here to adjust High Speed Fan on ECT. In this example I'm going to use a PCM with a tear tag of CDC2.

Each part of the calibration has a address. So each setting and change is stored at an address (much like your home address). So lets say in this example that High Speed Fan on ECT is located at an address of 0x000CABC5.

So a stock hex file could look like this

Offset(h). 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000CABC0 43 60 00 00 43 64 00 00 43 64 00 00 40 A0 00 00

After modify the stock setting to say 200F it could look like this

Offset(h). 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000CABC0 43 60 00 00 43 48 00 00 43 64 00 00 40 A0 00 00

Notice that row 05 changed from 64 to 48. That one byte controls the C temperature of the HSF cut on.

When you use your tuner you are uploading a version of the stock calibration slightly modified as described above. That is a single change there, things like spark, maf, etc require 2 and 3 dimensional arrays and can cover many bytes of memory. (I'm not going to cover this here, but can if requested. Its for someone who understands coding or matlab).

So when you return your vehicles PCM back to stock your changing the memory map values back to their downloaded values. This is how Ford cannot detect that there was an aftermarket calibration or what the calibration that previously was on it was. They have had to resort to other methods of tracking these changes. There are a few PID's out there that were supposed to stay secret to show the Flash count for many areas of memory.

Tuners like SCT, Diablo, HP, have spent many countless hours reverse engineering these tables and mapping out the EEC memory. However, Ford has started to work with some major companies to share this information. If you had plenty of time and knowledge you could build your own tuning software and tuners. (I'm personally considering it)

I hope I did a decent job at explaining this. I look forward to comments and questions. As most of you know i'm a huge supporter of OSHW and OSSW. Putting the knowledge in the peoples hands is they it should be, we buy these cars and should know how they work, and if we want to make changes we should be able to. (I wish our government practiced same logic).

Cheers all,

I'm not a "tuner", I am a ecu software engineer. Its different.

2011 GT500 = It gets me from A to B

If you want good technical help. Put your Year, trim, engine, and PCM code in your post! Its easier that way
ZeroAviation is offline  
For the best viewing experience please update your browser to Google Chrome