Introduction

Select Monitor Adapter
Subaru Diagnostic Ports
How to build a PC adapter
Protocol
Software
Troubleshooting
Eavesdropping

Engine Control Unit (ECU)
Description
Reading Error Codes
Reverse Engineering
Modifying
ROM images

Transmission Control Unit (TCU)
Description
Reading Error Codes
Reverse Engineering
Power Mode
Modifying
ROM images

Other Control Units
Air Conditioning Unit
4WS Control Unit
Cruise Control Unit

OBD2 Information
Select Monitor Cartridge

Downloads
Links to other sites

Custom TCU Development



Select Monitor Cartridge

The Subaru Select Monitor is essentially just a simple computer. For each supported vehicle, there is a cartridge that contains an EPROM loaded with the program necessary to access the ECU of that car. Here is a partial analysis of the SVX cartridge. There is still a lot of work to do. More details will follow when I have investigated further.

The SSM has a Hitachi 6303 CPU. The cartridge is 32K and is mapped at address 0x8000 in the address space. The binary, hex and disassembly can be downloaded from the end of this page.

The most important part of the cartridge is the Master Table from address 0x8000 to 0x8595. The master table is split into six sections, one for each of the units that it supports: 4WS (8000-80BD), AirCon (80BE-818F), Cruise (8190-81D5), ECU.USDM (81D6-833D), ECU.JDM (833E-84AF), TCU (84B0-8595). Each Row of the table represents a select monitor function mode. The table has seven columns. The first two columns are unknown at present. The 3rd column contains the address of an action function. The 4th column contains an offset into the global Decode table. The 5th Column contains an offset into the unit address table. The 6th column contains an offset into the global name table. Finally the seventh column contains an offset into the global units table.

This is best illustrated by an example:

Suppose we select mode F03 for the USDM ECU. This is the 4th line of the ECU.USDM section of the master table.
??ActionDecodeAddressNameUnits
8f808300924902023001
The Action function is 9249. This function gets a parameter from the car.
AddressAction
9249Get Parameter
The offset into the decode table is 02.
IndexAddress
02"a4d4"
The offset into the ECU address table is 02.
IndexAddress
02"1071"
The offset into the Name table is 30.
IndexString
30" VSP (F03) "
The offset into the Units table is 01.
IndexString
01" km/h "

So, the Select Monitor calls function 9249 to query ECU address 1071. Then it calls function A4D4 to decode the result. Then it displays the parameter name "VSP (F03)" followed by the decoded value and the units "km/h".

The full tables are given below. I plan to add a description to each of the decode functions as I analyse them.


Master Table (4WS) 8000-80bd
??ActionDecodeAddressNameUnits
8f80800091fa00000000
8f8a8000924901010101
8f8a8100924902020201
8f8a820092490303030d
8f8a8300924904040408
8f8a8500929102060600
8f8a8600924905070700
8f8a8700929103080803
8f8a8800924906090900
8f8a89009291040a0a03
8f8a81809249070b0b04
8f8a81819291050c0c02
8f8a81829291060d0d03
8f8a81839291070e0e00
8f8b80009322000f0f00
8f8b8100932200101000
8f8c8000963f00111100
8f8f8a009f7c02121200
8f8f8b009f7c03131300
Master Table (A/C) 80be-818f
??ActionDecodeAddressNameUnits
8f80800091fa00000000
8f808100924908011405
8f808200924909021505
8f80830092490a031605
8f80840092490b041705
8f80850092490c051805
8f80860092490d061906
8f80870092490e071a05
8f80880092490f081b05
8f808900924910091c05
8f8180009249110a1d07
8f8181009249120b1e07
8f8182009249130c1f07
8f8183009249140d2007
8f8184009249150e2108
8f8185009249160f2200
8f818600924917102304
8f818700924918112407
8f8a8000924919122500
8f8b8000932200132600
818882869b2400002700
Master Table (CRUISE) 8190-81d5
??ActionDecodeAddressNameUnits
8f80800091fa00002800
8f80810092490101290a
8f808200924902022a01
8f80830092491a032b0b
8f8a8000924924042c00
8f8b800092491b052d00
8f8b81009ecf1c062e0c
Master Table (ECU.usdm) 81d6-833d
??ActionDecodeAddressNameUnits
8f80800091fa00000000
8f80810092491d012f08
8f808200924901022a0a
8f808300924902023001
8f80840092491a03310b
8f808500924910043209
8f808600924928043305
8f808700924929053402
8f80880092492a063508
8f80890092492b073600
8f81800092491e083708
8f81810092492c09380f
8f81820092492d0a3907
8f81830092492e0b3a08
8f81840092492e0c3b08
8f81850092492f0d3c08
8f81860092492f0e3d08
8f81870092492f0f3e08
8f81880092492f103f08
8f818900924930114007
8f828000924930124107
8f828100924931134202
8f828200924932144307
8f8a8000924924162c00
8f8a8100924925174500
8f8a8200924926184600
8f8a8300924927194700
8f8a84009249331a4800
8f8a8500924905216000
8f8b80009322001b4900
8f8b81009322001c4a00
8f8c8000963f001d1100
8e8981009965011e4b01
8e8983009965021f4c02
8e898400996503204c02
818882869b2400002700
Master Table (ECU.jdm) 833e-84af
??ActionDecodeAddressNameUnits
8f80800091fa00000000
8f80810092491d012f08
8f808200924901022a0a
8f808300924902023001
8f80840092491a03310b
8f808500924910043209
8f808600924928043305
8f808700924929053402
8f80880092492a063508
8f80890092492b073600
8f81800092491e083708
8f81810092492c09380f
8f81820092492d0a3907
8f81830092492e0b3a08
8f81840092492e0c3b08
8f81850092492f0d3c08
8f81860092492f0e3d08
8f81870092492f0f3e08
8f81880092492f103f08
8f818900924930114007
8f828000924930124107
8f828100924931134202
8f828200924932144307
8f82830092492315440e
8f8a8000924924162c00
8f8a8100924925174500
8f8a8200924926184600
8f8a8300924927194700
8f8a84009249331a4800
8f8a8500924905216000
8f8b80009322001b4900
8f8b81009322001c4a00
8f8c8000963f001d1100
8e8981009965011e4b01
8e8983009965021f4c02
8e898400996503204c02
818882869b2400002700
Master Table (TCU) 84b0-8595
??ActionDecodeAddressNameUnits
8f80800091fa00004d00
8f80810092491d012f08
8f808200924901024e0a
8f808300924902024f01
8f80840092490103500a
8f808500924902035101
8f80860092491a04520b
8f80870092491f055309
8f808800924920055405
8f80890092491e065508
8f818000924921075600
8f818100924922085707
8f818200924922095807
8f8183009249220a5907
8f8184009249230b5a0e
8f8a80009249240c5b00
8f8a81009249250d5c00
8f8a82009249260e5d00
8f8a83009249270f5e00
8f8b8000932200105f00
8f8b8100932200114a00
8f8c8000963f00121100
818882869b2400002700

Action Functions

AddressAction
91FAGet Year Information
9249Get Parameter
9291?
9322Get Diagnostic Codes
963FClear Memory
9965Adjust Parameter
9B24Get Address Data ?
9ECFOutput ?
9F7CSpecial ?

Decode Function Table E01C-E081

IndexAddress
01"a422"
02"a4d4"
03"a540"
04"a57d"
05"b6a3"
06"b6ce"
07"a5bb"
08"a5e8"
09"a659"
0a"a6e0"
0b"a7d9"
0c"a8d2"
0d"a9cb"
0e"a9fe"
0f"aa6b"
10"ab64"
11"acb0"
12"acf8"
13"ad40"
14"ad88"
15"add0"
16"ae2a"
17"ae42"
18"ae76"
19"ae96"
1a"aec6"
1b"af51"
1c"af78"
1d"b1bd"
1e"b2b0"
1f"b453"
20"b4ba"
21"b4fb"
22"b50d"
23"b534"
24"b591"
25"b5e4"
26"b61c"
27"b654"
28"b21a"
29"b24e"
2a"b26e"
2b"b29c"
2c"b2de"
2d"b312"
2e"b346"
2f"b374"
30"b3a2"
31"b3ea"
32"b434"
33"b683"

Parameter Address Table (4WS) 85cc-85f1

IndexAddress
01"ff24"
02"ff23"
03"ff22"
04"ff21"
05"ff10"
06"ff1e"
07"ffb6"
08"ff16"
09"ffb3"
0a"ff1c"
0b"ff25"
0c"ff18"
0d"ff1a"
0e"ff12"
0f"ff0a"
10"ff02"
11"ff02"
12"ff0f"
13"ff0f"

Parameter Address Table (A/C) 85f2-8619

IndexAddress
01"000b"
02"000c"
03"0001"
04"0002"
05"0003"
06"0004"
07"0004"
08"0005"
09"0006"
0a"0007"
0b"0008"
0c"0009"
0d"000a"
0e"000d"
0f"000e"
10"0010"
11"0011"
12"000f"
13"0012"
14"0015"

Parameter Address Table (CRUISE) 861a-8625

IndexAddress
01"00a6"
02"00a6"
03"009c"
04"007a"
05"009d"
06"00fd"

Parameter Address Table (ECU) 8626-8667

IndexAddress
01"102f"
02"1071"
03"106f"
04"1088"
05"10a2"
06"1283"
07"1282"
08"128c"
09"1280"
0a"129d"
0b"1291"
0c"1292"
0d"12b0"
0e"12b1"
0f"12b2"
10"12b3"
11"1097"
12"109f"
13"12a7"
14"12a5"
15"125f"
16"105a"
17"105b"
18"119d"
19"11a6"
1a"14ae"
1b"1026"
1c"12b9"
1d"1496"
1e"149b"
1f"12cc"
20"12cd"
21"1021"

Parameter Address Table (TCU) 8668-868f

IndexAddress
01"1044"
02"0019"
03"001a"
04"00b6"
05"0017"
06"1040"
07"004e"
08"00b3"
09"00b4"
0a"00b5"
0b"1046"
0c"0011"
0d"0012"
0e"0013"
0f"0014"
10"0001"
11"0003"
12"0003"
13"0005"
14"0004"

Parameter Name Table E186-E795

IndexString
00" YEAR (F00) "
01" VSP1 (FA0) "
02" VSP2 (FA1) "
03" PTN 1 (FA2) "
04" PTN 2 (FA3) "
05" STAN (FA4) "
06" RSTAN (FA5) "
07" DIO (FA6) "
08" STSP (FA7) "
09" DIO (FA8) "
0a" RSTSP (FA9) "
0b" MTRCR (FA10) "
0c" DDRAN (FA11) "
0d" NDR (FA12) "
0e" K (FA13) "
0f" DIAG.COD(FB0) "
10" DIAG.COD(FB1) "
11" MEMORY CLR ? "
12" SPECIAL (FFA) "
13" SPECIAL (FFB) "
14" Tset (F01) "
15" To (F02) "
16" Troom (F03) "
17" Tamb (F04) "
18" Tevp (F05) "
19" Qsun (F06) "
1a" Tsun (F07) "
1b" Tref (F08) "
1c" Tw (F09) "
1d" AMRset (F10) "
1e" AMRpot (F11) "
1f" MODEset (F12) "
20" MODEpot (F13) "
21" BLW (F14) "
22" Intak (F15) "
23" Isol (F16) "
24" EGItoA/C(F17) "
25" Sw (FA0) "
26" DIAG.COD(FB0) "
27" ADDRESS DATA "
28"CRUISE (F00) "
29" VSP (F01) "
2a" VSP (F02) "
2b" EREV (F03) "
2c" DIO (FA0) "
2d" CANSEL (FB0) "
2e" OUTPUT (FB1) "
2f" VB (F01) "
30" VSP (F03) "
31" EREV (F04) "
32" TW (F05) "
33" TW (F06) "
34" ADVS (F07) "
35" QA (F08) "
36" LDATA (F09) "
37" THV (F10) "
38" TIM (F11) "
39" ISC (F12) "
3a" O2 R (F13) "
3b" O2 L (F14) "
3c" O2 Rmax (F15) "
3d" O2 Rmin (F16) "
3e" O2 Lmax (F17) "
3f" O2 Lmin (F18) "
40" ALPHA 1 (F19) "
41" ALPHA 2 (F20) "
42" RTRD (F21) "
43" CPCD (F22) "
44" BARO.P (F23) "
45" DIO (FA1) "
46" DIO (FA2) "
47" DIO (FA3) "
48" DIO (FA4) "
49" DIAG.U,D(FB0) "
4a" DIAG.M (FB1) "
4b" IGN-ADV ADJ. "
4c" IDLE-REV ADJ. "
4d" E-4AT (F00) "
4e" VSP 1 (F02) "
4f" VSP 1 (F03) "
50" VSP 2 (F04) "
51" VSP 2 (F05) "
52" EREV (F06) "
53" ATFT (F07) "
54" ATFT (F08) "
55" THV (F09) "
56" GEAR (F10) "
57" PLDTY (F11) "
58" LUDTY (F12) "
59" 4WDTY (F13) "
5a" BARO.P (F14) "
5b" SW 1 (FA0) "
5c" SW 2 (FA1) "
5d" SW 3 (FA2) "
5e" SW 4 (FA3) "
5f" DIAG.U (FB0) "
60" DIO (FA5) "

Unit Name Table E826-E915

IndexString
01" km/h "
02" deg "
03" deg/s "
04" A "
05" degC "
06" Kcal "
07" % "
08" V "
09" degF "
0a" m/h "
0b" rpm "
0c" ready? Yes:0 "
0d" STEP "
0e" mmHg "
0f" ms "

Subaru Select Monitor 1992 SVX Cartridge Download

Binary Dump
Hexadecimal Dump
Disassembly