Introduction
Select Monitor Adapter
Subaru Diagnostic Ports
How to build a PC adapter
Protocol
Software
Troubleshooting
Eavesdropping
Engine Control Unit (ECU)
Description
Reading Error Codes
Reverse Engineering
Modifying
ROM images
Transmission Control Unit (TCU)
Description
Reading Error Codes
Reverse Engineering
Power Mode
Modifying
ROM images
Other Control Units
Air Conditioning Unit 4WS Control Unit Cruise Control Unit
OBD2 Information
Select Monitor Cartridge
Downloads
Links to other sites
Custom TCU Development
4 Wheel Steer Control Unit
In 1992, Subaru produced a 4WS version of the SVX. Known as "Version L", they were only sold in Japan, and can be identifed by the applied model code "CXDA25E" on the VIN plate. I am lucky enough to have two of these rare and special vehicles in my collection. During high-speed cornering, or avoidance maneuvers, the version L feels much more stable and composed than a standard SVX.
There is a trick to getting the 4WS unit to communicate and it took me a long time to find it. As usual, you first send a reset command "12000000". The first 4WS address you ask for after the reset MUST be FFFF. Otherwise it just ignores you. So you send "92FFFF00" that makes the unit start talking and afterwards you can ask for other locations or the ROMID in the usual way.
The 4WS ROMID on both of my cars is 719210, but there doesn't seem to be anyway to download the ROM. I tried dumping the whole address space and it returns zero for every address except FF00 to FFFF. Looks like the unit only allows you to read the RAM portion of the address space via the SSM protocol. Here is a typical 4WS RAM dump, taken while the car was parked and the engine was off.
ff00 D6 21 00 00 00 00 00 F9 3C B6 00 00 00 00 00 00
ff10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03
ff20 00 00 00 00 00 00 00 00 00 00 00 00 1F 00 00 00
ff30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00
ff40 81 80 00 00 00 0B 00 00 80 00 00 00 00 00 00 00
ff50 00 00 00 00 00 03 00 00 00 00 00 00 00 1D 00 02
ff60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ff70 00 00 00 00 CC 2F CC 8B 82 01 03 00 00 00 00 00
ff80 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
ff90 E9 06 08 CE 93 CE 02 E0 00 6F 00 4B 00 D5 00 61
ffa0 F8 7F 27 FF B8 77 D3 FF FF FF FF FF FF FF FF FF
ffb0 FF FF 2F 3A FF FF 90 D1 FF FF FB 18 FF FF 53 80
ffc0 FF 40 FF FF C9 E7 FF 00 03 B0 60 FF 9A FF FF FF
ffd0 43 B0 C2 FF 80 FF FF FF 24 7F 7C 7C 87 52 FF 17
ffe0 CD CC 82 82 01 01 01 00 BF BF 7F 7F FF FF FF FF
fff0 00 FF B8 C8 AE 77 65 52 C2 24 42 AA 82 6A 28 C2
I found the 4WS parameters in the Select Monitor Rom. I've listed them below with my best guess as to what they might mean.
| Address | Parameter | Best guess |
| ff24 | vsp1 (km/h) | vehicle speed 1, (rear wheels) |
| ff23 | vsp2 (km/h) | vehicle speed 2, (front wheels) |
| ff22 | ptn1 (step) | steering wheel position |
| ff21 | ptn2 (V) | steering wheel position |
| ff10 | stan | steering angle |
| ff1e | rstan | rear/reference steering angle |
| ffb6 | dio | digital IO bits |
| ff16 | stsp (deg/s) | steering speed |
| ffb3 | dio | digital IO bits |
| ff1c | rstsp (deg/s) | rear/reference steering speed |
| ff25 | mtrcr (A) | motor current |
| ff18 | ddran (deg) | something angle |
| ff1a | ndr (deg/s) | something rate |
| ff12 | k | k coefficient (see patent) |
| ff0a | diag.cod | diagnostic error code bits |
| ff02 | diag.cod | diagnostic error code bits |
| ff02 | memory.clr | clear codes when write to this address |
| ff0f | special | special feature when write to this address |
| ff0f | special | special feature when write to this address |
Subaru's parent company, Fuji Heavy Industries were granted a number of US patents for 4WS systems during the SVX development. The following documents appear to describe the SVX 4WS system. No other car was ever built with this system. Apart from these patents, there is very little information available in English.
5018594 "Rear-wheel steering system for four-wheel steering vehicle"
4979116 "Method and device for rear wheel steering system of automotive vehicle"
Troubleshooting information and error codes for the 4WS system can be found at http://www.subaru-svx.net and http://www.svx-iw.com
The 4WS control unit has a Mitsubishi MH73308CP8 microcontroller. As far as I can tell, it is a custom made and undocumented part. Currently, I cannot see any way of extracting or modifying the firmware in this unit.