Select Monitor Cartridge

The Subaru Select Monitor is essentially just a simple computer. For each supported vehicle, there is a cartridge that contains an EPROM loaded with the program necessary to access the ECU of that car. Here is a partial analysis of the SVX cartridge. There is still a lot of work to do. More details will follow when I have investigated further.

The SSM has a Hitachi 6303 CPU. The cartridge is 32K and is mapped at address 0x8000 in the address space. The binary, hex and disassembly can be downloaded from the end of this page.

The most important part of the cartridge is the Master Table from address 0x8000 to 0x8595. The master table is split into six sections, one for each of the units that it supports: 4WS (8000-80BD), AirCon (80BE-818F), Cruise (8190-81D5), ECU.USDM (81D6-833D), ECU.JDM (833E-84AF), TCU (84B0-8595). Each Row of the table represents a select monitor function mode. The table has seven columns. The first two columns are unknown at present. The 3rd column contains the address of an action function. The 4th column contains an offset into the global Decode table. The 5th Column contains an offset into the unit address table. The 6th column contains an offset into the global name table. Finally the seventh column contains an offset into the global units table.

This is best illustrated by an example:

Suppose we select mode F03 for the USDM ECU. This is the 4th line of the ECU.USDM section of the master table.

?	?	Action	Decode	Address	Name	Units
8f80	8300	9249	02	02	30	01

The Action function is 9249. This function gets a parameter from the car.

Address	Action
9249	Get Parameter

The offset into the decode table is 02.

Index	Address
02	"a4d4"

The offset into the ECU address table is 02.

Index	Address
02	"1071"

The offset into the Name table is 30.

Index	String
30	" VSP (F03) "

The offset into the Units table is 01.

Index	String
01	" km/h "

So, the Select Monitor calls function 9249 to query ECU address 1071. Then it calls function A4D4 to decode the result. Then it displays the parameter name "VSP (F03)" followed by the decoded value and the units "km/h".

The full tables are given below. I plan to add a description to each of the decode functions as I analyse them.

Action Functions

Decode Function Table E01C-E081

Parameter Address Table (4WS) 85cc-85f1

Parameter Address Table (A/C) 85f2-8619

Parameter Address Table (CRUISE) 861a-8625

Parameter Address Table (ECU) 8626-8667

Parameter Address Table (TCU) 8668-868f

Parameter Name Table E186-E795

Unit Name Table E826-E915

Subaru Select Monitor 1992 SVX Cartridge Download

Big thanks to James, who has sent me some binary dumps of all his SVX cartridges, including the 97 OBD2 version.