Introduction

Select Monitor Adapter
Subaru Diagnostic Ports
How to build a PC adapter
Protocol
Software
Troubleshooting
Eavesdropping

Engine Control Unit (ECU)
Description
Reading Error Codes
Reverse Engineering
Modifying
ROM images

Transmission Control Unit (TCU)
Description
Reading Error Codes
Reverse Engineering
Power Mode
Modifying
ROM images

Other Control Units
Air Conditioning Unit
4WS Control Unit
Cruise Control Unit

OBD2 Information
Select Monitor Cartridge

Downloads
Links to other sites

Custom TCU Development



TCU Rom Images

This is my collection of TCU ROMs. If you would like to contribute your ROM, please download it to a file and email it to me. The best way to download the TCU ROM from your car is to use a select monitor adapter and my TCUdump utility. I am particularly interested in SVX ROMS and also any modified ROMS that you have produced and are willing to share with the community.


Stock TCU ROMS
RomIDLabelYearOriginVehicleTypeDownloadsContributor
705005??1990USDMLegacy4EATBinaryHex DumpDisassemblyAnalysisRyan Press
705263??1990EuroLegacy4EATBinaryHex DumpDisassemblyMore InformationAndrey
705402FB1991USDMSVX4EATBinaryHex DumpDisassemblyAnalysisLongassname
705404FB1992USDMSVX4EATBinaryHex DumpDisassemblyAnalysisNomake Wan
705405MQ1996USDMSVX4EATBinaryHex DumpDisassemblyAnalysisLongassname
705503FC1994USDMSVXFWDBinaryHex DumpDisassemblyAnalysisNeedForSpeed
705605FA1992JDMSVX4EATBinaryHex DumpDisassemblyAnalysisB3lha
705607FA1994JDMSVX4EATBinaryHex DumpDisassemblyAnalysisB3lha
705622FF1992UKSVX4EATBinaryHex DumpDisassemblyAnalysisSVXistentialist
705623FJ1994MiddleEastSVX4EATBinaryHex DumpDisassemblyAnalysisSilverspear
705625MS1996UKSVX4EATBinaryHex DumpDisassemblyAnalysisGez
735C04KC1990EuroLegacy4EATBinaryHex DumpDisassemblyShift PlanAndrey
745913KM1993JDMWRX4EATBinaryHex DumpDisassemblyAnalysisLongassname
745917MW1995JDMWRX4EATBinaryHex DumpDisassemblyAnalysisMark Bancroft

Modified TCU ROMS

The ROM images below have been modified and are provided with absolutely no warranty of any kind.

Base Rom (see above)Description of ModificationDifferenceDownloadCoder
705622-1992-UK-SVX-4EATPower mode is engaged when Economy Switch is offdiffBinaryB3lha
705625-1996-UK-SVX-4EATPower mode is engaged when Economy Switch is offdiffBinaryB3lha

The binary and hex dumps above have been padded to 64K for convenience so that the file offset corresponds to the memory address. The actual ROM data is 16384 bytes long and starts at address 0xC000 in the files.

ROM ID Numbers

The TCU ROM ID is stored in the first three bytes of the ROM, at address C000. There is not such an obvious pattern to them, but with more data, we may be able to figure it out.

The TCU program compares the second byte of the ROM ID against the value 55. If it is less than 55 then the TCU expects to get a signal from the atmospheric pressure sensor in the ECU. Not all ECUs have an atmospheric pressure sensor.

The ROM chip inside the ECU has a label that presumably relates to the firmware installed. For example, a 92 JDM TCU is "E23AV12P", a UK TCU is "E23AVFFP", a USDM AWD is "E23AA12P", a USDM FWD is "E31UF1DO". NeedForSpeed pointed out that the 5th character represents the transmission type "A"=ACT4, "V"=VTD, "F"=FWD. It is possible that the 2nd digit could be the year of manufacture.