TLDR: Anybody can tune their OEM ECM for as low as $100. I built V6 definition files for TunerPro to help get you started with the basic maps. I’m searching for aftermarket V6 and L4 tunes to add to the collection and for research purposes.
I will be maintaining some definition files using the following GITHUB project. Technical details can be found at https://opengk.org:
https://github.com/cfhammargren/opengk
Background
This is a continuation of a project that Elricdelyon ended abruptly in 2011 when he upgraded to a standalone unit.
https://www.newtiburon.com/threads/chiptuning-tiburon-gt.199974/
A lot of credit goes to Elric for his financial setbacks, efforts and giving us all of his findings. Also to coupetuner for sharing his tune files. Also to M.Kyle for sharing his research. Also a French dude named Benjamin from the FB groups that helped me locate additional EEPROMs.
I’ve owned a 2006 V6 Tiburon since 2008 and used it as a daily driver for over a decade. I had little to no desire to modify it up until a couple years ago when I bolted on some performance parts but reached a point where I need to start tuning the fuel and ignition maps. I didn’t want to shell out money for a standalone ECM and my goal was already to make as much power with as little money possible. So here I have spent countless hours comparing ECM dumps and testing modifications on my own vehicle. Since I’m also an avid open source fan I want to share this data so that anybody can make these modifications on their own and contribute to the collective hive mind.
Chiptuning is very familiar to me so I took a crack at Elricdelyons work to see if I could unlock more secrets. I have 15-20 years experience in automotive, electrical repair and system administrator work. I have a little experience hacking EEPROMs and resoldering chips for repair work on XBOX360s, PS3s and PC motherboards. BIOS/EEPROM hacking was also a hobby of mine for a short time in the PC world.
DISCLAIMER: I am NOT a tuner! I am not responsible for inaccuracies leading to the destruction of your engine or possible legal and environmental ramifications within your local jurisdictions. All information here is provided as-is without warranty or guarantee. If you choose to modify your ECM with the information provided you are solely responsible for your own legal, financial and mechanical troubles. This is intended for use in off-road applications only. Choosing to violate EPA or other three letter organization regulations is your problem, not mine. The sale of canned tunes from known tuners could be subject to copyright infringement. Sale or distribution of tune files will be at your own risk.
BE RESPONSIBLE: Please do not sell or gift a modified ECM without disclosing the changes to your intended recipient. If you are selling your car and reverting to stock, please also and revert your tune back to OEM. Always physically mark your ECM to indicate it has been modified. Remember, the knowledge of flashing an ECM does NOT make YOU a tuner… so don’t sell yourself like one.
CONTRIBUTE: I am always looking for curious minds that want to help. I’m hunting for custom V6 and L4 tunes from the various shops like NGM/Fiebruz, SFR, BTR and AlphaSpeed. If you are in possession of a custom tune you aren’t using, I would like to borrow it and backup the code for my research. I will offer you one free reflash in return for your contribution.
The ECM
Our ECM is made by Siemens and uses an INFINEON C167 16bit processor. There are two major variations of our ECM known as the 2Mbit and 4Mbit then there are a couple of revisions of each year to year. Where they differ is in storage capacity. The 2Mbit will store 256KBytes and the 4Mbit will store 512KBytes of data. Our ECMs are very similar to the Siemens MS4X units found on early 2000 BMWs. We have a lot we can learn from their work over at ms4x.net:
https://www.ms4x.net/index.php?title=Main_Page
As Elric mentioned, “the EEPROMS are a surface mounted PSOP44 type, model 2Mbit AM29F200 (for 2002 to march 2003) or model 4Mbit AM29F400 (for 2003 to 2004.)” I have later confirmed that the AM29F400 chip was used all the way through 2008 on all variations of the 4Mbit ECM. Some are made by AMD while others are made by ST. The ECMs and calibration tables are very similar to other Hyundai/Kia models that utilize the 2.7L motor. Examples being the Tucson, Sonata and Sante Fe. The same methods we use here can be applied to those other models as long as the ECM has the same processor, EEPROM and software version.
The 2Mbit ECM will not work on a 4Mbit car or vise versa without some modification. The main difference I’ve found is that the 2Mbit cars have narrowband 5V O2 sensors while 4Mbit cars have narrowband 1V O2 sensors. For example, my 4Mbit car will start on a 2Mbit ECM and idle well for about 15-30 seconds… but as soon as closed loop kicks in, the car runs extremely lean. This is due to the 1V O2 sensors giving a false positive for a rich condition to a 2Mbit ECM expecting a 5V signal. You could in theory replace the O2 sensors with the correct model and swap ECMs just fine.
EEPROM Storage Breakdown
The EEPROM stores data in several large chunks spanning these memory offsets. Most of my focus will be in the 0x8000-0xFFFF memory range. Memory addresses are written out in hexidecimal. The numbers 0-15 are represented by single digits like 0 1 2 3 4 5 6 7 8 9 A B C D E F. A 2Mbit (256KByte) chip will store data out as far as memory address 0x3FFFF while a 4Mbit (512KByte) chip will store data out to 0x7FFFF.
0x0000-0x3FFF – Appears to be boot code. Also stores VIN# and hardware serial number.
0x4000-0x7FFF – Adaptive values and CEL memory. This region changes every time I drive the car and read out the memory.
0x8000-0xFEDF – IMMO flags, variables/switches, axis data, 2D and 3D maps.
0xFEE0-0xFEE1 – Calibration data checksum.
0x10000-0x3FFFF – Machine code for 2Mbit and 4Mbit ECMs
(0x40000-0x7FFFF) – Additional machine code storage for 4Mbit ECMs
EEPROM Read/Write
There are still very few methods to read/write the EEPROM as of 2021. While I have not confirmed all methods myself, there are rumors that the Tactrix OpenPort 2.0 with a Hyundai plugin and a hacky Russian software ChipLoader/CombiLoader can read/write through the OBD2 port. Tactrix runs about $250 for all the tools needed to read/write and it comes with a 1 person/computer USB dongle license. I can’t read Russian very well so I’m not going to entertain the purchase or use of ChipLoader/CombiLoader. Neither of which come with a definition file.
I used the same desoldering method as Elric to read and write with a Willem GQ-4X(4). I will include a video which outlines this procedure below. This solution only costs around $100 to get started and maybe $50 more in parts to build a removable socket. I decided to build my own DIP socket instead of using the sprung PSOP44 type socket that Elric used. The DIP socket is more robust and less likely to intermittently stop working due to corrosion or moisture forming on the terminals. The only caveat is that I had to reverse engineer, build my own ADP-019 adapter with a DIP socket, then solder in a removeable DIP socket to the ECM itself. Also each EEPROM has to be soldered to a PSOP44 to DIP44 adapter. Below is also a schematic showing how to build your own ADP-019 hardwired for 29F chips and 5V. Also pictured is my custom ADP-019 adapter and my PSOP44 to DIP44 adapter.
The bonus to using a removable DIP socket is that I don’t need to disconnect power from the ECM between flashes. Disconnecting power triggers an erase adaptive values command the next time power is applied to the ECM. This allows me remove only the EEPROM chip to flash it while keeping my adaptive values. For example, if drove for a week and the ECM learned a +10% long term fuel trim, I want to keep these values if I’m only adjusting the ignition table. I don’t need to run through the drive cycles again just so I can regain an LTFT of 10% if the fuel tables haven’t been modified.
EEPROM Versions
Each year the hardware, calibration data and machine code changed to tighten up emissions and extend fuel mileage meeting new EPA regulations. A lot of new maps were introduced in each revision adding to the complexity of the air-fuel calculations. It is important to identify the version if your EEPROM so you know which definition file to use. Every map’s memory offset will change in each software version. For example the ignition map we know is located at memory offset 0x9D4C in the 652048 version… but it moves to memory offset 0xA13C in the 654012 version. You can find the software version at memory offset 0x8000 in any version. The version string looks like the following:
G3N7TS5C65204801111652004801000011165200480100001116520048010000ca652048.DATG3N7TS5C—-G3N7TS5C—-
The section we are interested in is the first 8 digits at 0x8000 and the 6 digits that follows at memory offset 0x8008. In this sample the model and year are represented by “G3N7TS” meaning a North American 2003 Tiburon 2.7L GK chassis non-Immobilizer with the calibration version 652048. Broken down it looks like this:
G – GK Chassis
3 – Year 2003
N – North America
7 – 2.7L Delta
T – (Unknown)
S – Non-Immobilizer (M would indicate Immobilizer enabled on the GK platform)
If you take an EEPROM from another Hyundai model, their model and year changes accordingly. For example “E3E7MB0A654012” comes from a European 2003 Sonata 2.7L EF chassis with calibration version 654012. Or “J5E7VM0D655019” comes from a European 2005 Tucson JM chassis with calibration version 655019.
At 0x3E22 the VIN number of the intended vehicle is stored in most EEPROMs starting in late 2004. You can use this to match up an ECM to the chassis or to reprogram it to meet inspection requirements.
There is an identifier which is physically printed on each ECM and can also be found inside the EEPROM at 0x3F80. I believe this is a ECM hardware family number and serial number unique to each ECM. Also the manufacture date is found in this region. This is useful if you need to match up an EEPROM with it’s original ECM. For example a 2003 EEPROM may look like the following:
5WY1502B—0525170182-HMC021251191010126577657601H-6577715012–
All three identifiers 1502B, Index 05 and 0182 will appear physically on the ECM. The manufacture date appears as 02125119 in the ROM then reversed on the ECM label as “K 19.12.02/1″ for December 19th, 2002. If you scan the barcode on the ECM’s label you come up with the following which coincides with the 0x3F80 area as well. The 51 in the date stamp correlates with the barcode but what it means isn’t clear:
1502B05251701827
Also printed on the ECM is “N73G” which can be used to identify the region chassis model and year of vehicle. N for North America, 3 for 2003 and G for GK chassis.
The ECM machine code is also tracked by a version. Starting at memory address 0x1005C. The machine code version will appear as “6577715112” on a 2003 ECM or as “KR77035106” on a 2004 ECM. The machine code and calibration data seem to be matched and shouldn’t be cross flashed.
Here are some other version examples I found while dissecting ECMs this last year:
2Mbit 2002-2003 versions 5WY1500 family
G2E7TM0B 652040 6577715107 5WY1503B 2002 EU Manual
G2E7TM0C 652048 6577715112 5WY1503C 2002 EU Manual
G3N7TS0C 652048 6577715112 5WY1502B 2003 NA Manual
G3N7TS5C 652048 6577715112 5WY1541B 2003 NA Manual
G3N7TS0H 652051 6577715116 5WY1502A 2003 NA Automatic
G3N7TS0H 652051 6577715116 5WY1502B 2003 NA Automatic
4Mbit 2003-2004 versions 5WY1700 family
G4N7TS0A 654012 KR77035103 5WY1710A 2004 NA Manual
G4N7TS0C 654014 KR77035106 5WY1706B 2004 NA Automatic
G4N7TS5C 654014 KR77035106 5WY1708B 2004 NA Automatic
G4N7TS0D 654015 KR77035107 5WY1706C 2004 NA Manual
4Mbit 2005-2007 versions 5WY1800 family
G5N7TS0B 654021 KR77035116 5WY1842B 2005 NA Automatic
G6N7TS0A 654024 KR77035117 5WY1857A 2006 NA Manual
G7E7TM0A 654025 KR77035118 (Not in ROM, assumed to be within the 5WY1800 Family) 2007 EU Automatic
4Mbit 2007-2008 versions 5WY1F00 family
G7N7TS0A 655022 KR77035144 5WY1F02A 2007 NA Manual
G7N7TM0A 655022 KR77035144 5WY1F03A 2007 NA Manual
G8N7TM0B 655027 KR77035150 5WY1F29B 2008 NA Automatic
It does seem that you can cross flash within the same ECM family. For example, within the 5WY1500 family you can cross flash any calibration version within 6520XX to convert the transmission type. This also applies to the 5WY1700 family with calibration versions 65401X. Further testing is needed to determine if the 5WY1800 family is compatible with all 65402X and whether the 5WY1F00 family is compatible with all 65502X.
Software
Elric had used ECM2001 and ECM Titanium to modify his EEPROMs but it’s very outdated and the definition file is incomplete or inaccurate. ECM2001 and ECMTitanium were right about the ignition map but they failed to identify the axis data accurately. The only thing that ECMTitanium is good for is correcting the checksum after changes are made. This is not a free software so it’s not ideal for the hobbiest budget.
WinOLS The most popular software in the OEM tuning world is WinOLS but it costs somewhere around $1000 for a single user license. It also doesn’t come with a definition file for our ECM. The DEMO version of WinOLS works great for browsing and comparing files for changes… but we can’t create our own definition files or export our modified EEPROM binary from it. I would prefer to use WinOLS to build a definition file but it is too expensive from a hobbiest standpoint. WinOLS has the capability to do checksum correction with a valid license, but not with the DEMO version.
TunerPro is free and very easy to use, but it does lack some of the advanced stuff that WinOLS is packaged with. For ease of use I chose to build a definition file on TunerPro. It’s what our sister BMW MS43 ECMs primarily uses in aftermarket tuning. TunerPro can perform checksum correction but we don’t have an algorithm for the Siemens Continental ECM at this time. If any mathematicians out there want to help develop a checksum plugin for TunerPro, please contact me for EEPROM samples and their checksum corrections.
MegaLogViewer HD is an excellent program to analyze driving logs and verify your changes to the EEPROM. I’ve used it to verify some of my findings to ensure conversion equations are good in my TunerPro definitions. One example being the ignition table conversion equation. I found that the MS45 ECM had the closest equation for converting hex to real world ignition advance values and I was able to verify it is very close using MegaLogViewer HD. Here is a sample of a logged ignition table while using ADACT ignition advance. Peak advance is around the 130mg/stk and 3200-3700 RPM range which matches very close to my ignition table.
A combination of WinOLS Demo and TunerPro seems to be the way to go for our ECM. I am open to other low cost alternatives if anybody has input on this matter.
Map Data & Observations
While browsing the BMW MS43 ECM files in TunerPro I discovered a lot of similarities not only in the conversion equations but how some of the maps were laid out. I found where they were storing the axis data for various tables and hunted for similar features in our ECM. Unlike the Bosch ECMs, this variant of Siemens stores axis data in locations far from the actual table.
Injector Pulse Width Table:
It wasn’t immediately obvious where the fueling tables were located until I compared several tunes to an OEM file. Once I found similar tables in the BMW ECMs I was able to find our injection table with axis data quickly. In the 652048 EEPROM, the injection table is at 0xC2E8 with a factor of 0.0053333333, the RPM axis is at 0x8CB4 and the load/airflow axis is at 0x8E8A with a factor of 0.021194781. Below is the 2mbit OEM fuel map with 210cc injectors compared to a 2mbit stage 2 S/C map with 310cc injectors showing how they scale with each other. You will notice that the first few columns in the off-boost region are scaled back approximately 30% to compensate for larger injectors. Then the last three columns axis data changes to extend the air flow from 580mg/stk to 800mg/stk. This is clearly a fuel injection pulse width table intended for larger injectors with 30-40% more air flow in boost.
Ignition Advance
The axis values of the injection pulse width table also seem to match the ignition table. Here is a comparison of the OEM ignition table and the NGM stage 2. The scaling is correct so if you advance or retard the ignition by X degrees, it will legitimately move the ignition with that intended amount. However, the real world value may be off by a degree or two due to the CAS offset being incorrect. On two of the BMW ECMs (MS43 and MS45) they use the same equation except the offset changed slightly due to the crank sensor angle offset to TDC. I used the equation from the MS45 which matched up the best with my OBD2 logs to give us ballpark ignition figures.
Injection Pulse Width & Ignition Advance Correlation To Lean CELs
Digging deeper I found that the injector pulse width tables changed in 2004, 2005 and again in 2007. I believe this is the reason why in 2005 and 2007 the ECMs changed and it became less tolerant to modifications. This resulting in a lean CEL from minor modifications like a CAI or ported intake. Below is a 2003 base map then each year following shows the difference in +/- values compared to the base map. You will notice the cruising areas between about 1500-3000 RPM and between about 90 and 230 mg/stk start removing a lot of fuel in 2005 and more so in 2007. This is why 2003-2004 ECMs are popular for N/A mods or stage 0-1 supercharger setups.
Looking at the same ECMs and their ignition advance tables you can see key areas where Hyundai pulled timing. This seems to be directly related to the regions of the map where fuel was also pulled above. This is often for safety and emissions to prevent NOX or pre-detonation from a lean air-fuel mixture. This is further proof of Hyundai trying to meet strict emissions standards while attempting to keep the engine safe from failure. Here is an image showing the OEM ignition advance year to year. Please note that in 2004-2006 the ignition advance did not change even though the fuel maps did change between these variations.
RPM Limiter:
Elric confirmed a memory range where the rev limiter was located but ended his project before identifying which memory offsets set the soft and hard limits. On the 652048 ECM I tested a few bits in the range of 0x80BE-0x8228 and found the precise soft/hard cut values located at 0x8217 and 0x8227 respectively. The raw values can range between 0-255 then you factor it by x32 to find the RPM limits. With that I discovered the following limits in some of the EEPROMs I’ve explored:
-OEM soft/hard cuts are 6816/6912 RPM giving us a ~6800 limit.
-NGM’s stage 2 S/C soft/hard cuts are 7296/7392 RPM giving us a ~7300 limit.
-Upsolute’s soft/hard cuts are 7456/7552 RPM which is a ~7450 limit.
-Elric’s stage 2 S/C soft/hard cuts of 7808/7808 giving him a limit of ~7800.
If you max out these rev limit values at 255×32 you get a maximum RPM limit of 8160 RPM with the OEM ECM.
MAF Calibration:
The MAF calibration table is located at 0xAEC2 in the 652048 EEPROM. I believe I have the correct kg/hr conversion equation which sets our airflow limit at 5v for 740kg/hr. Understanding this table allows us to expand a hard limit of 740kg/hr by using another known MAF and adjusting the calibration table accordingly. Below is the OEM MAF calibration table. Top left cell is 0v and the bottom right cell is 5v.
Swapping a BMW 3.0 MAF and copying the MAF calibration data from the MS43 ECM would be trivial and could set us up with a hard limit of 1024kg/hr. That’s about 33% more airflow than the NGM STG 2 tune which we can account for without needing a MAF clamp or a separate air/fuel/ignition controller. The highest rate of flow I data logged in my N/A car was just over 500kg/hr at a 7300 redline so it’s really not necessary to extend this limit unless you are boosted. The team over at OpenMS41 have an excel sheet that lists MAF tables for several MAF types and tube sizes ranging from 2.76″ to 3.5″. They list MAFs from BMW, Audi, HPX, Bosch, Nissan and Pro-M. These MAF calibration tables would be a viable option to extend our MAF voltage and size limitations for boosted applications. There is also a calculation to scale the MAF table if you were to solder a voltage drop resistor inline with the MAF output signal. Some light reading and excel sheets can be found here:
https://sites.google.com/site/openms41/tuning/maf
Flags
Starting at 0x80A8 there are several flags/switches that enable or disable features of the ECM. Comparing this range of flags from an OEM tune to an ADACT or NGM S/C tune I found lot of disabled features here. Further testing is needed to confirm what each flag will affect.
Upsolute Tune Files
Coupetuner from Finland built one of the first custom N/A motors with ported & shaved heads, 11:1 compression, ported intakes and .351″ billet camshafts which NGM wasn’t involved in. He absolutely hated TC and his overpriced components so he opted to use a different tuner and source performance parts from other vendors. Upsolute built two tunes for Coupetuner at two stages in his build. The first version they worked the ignition table for 98 RON (94 US AKI) fuel then the second version they adjusted ignition again and added some fuel up top for his bigger cams and ported cylinder heads. More information about his build can be found here:
http://www.hyundaiclubfinland.com/forum/index.php?topic=310.0
http://www.khcf.org/index.php?topic=1800.0
ADACT Tune Files
The Russian ADACT tunes modified several areas and disabled a lot of flags/switches. The E2, E3 and E96 tune files remove a lot of functionality such as emissions controls, downstream O2s, LTFT, STFT and closed loop fuel. ADACT’s primary goal was to delete and simplify the fueling strategy for areas that don’t have emissions. You could chop off your O2s with one of the ADACT tunes and the car would run without difficulty and presumably without any CELs. From these tune files I believe I have found open loop fuel tables between 0xA953 and 0xAB52 in the 652048 EEPROM, but I don’t have any conversion equations or additional information on these tables.
N/A Tune Comparisons
I compared the OEM tunes to the N/A tunes from Upsolute and ADACT to try and understand where they made changes and why. It would appear that the Upsolute V1 tune was a little too aggressive in the timing and you can see where they pulled timing out of the map for their V2 tune. Where the V2 tune adds fuel it seems to be linear like they didn’t spend time developing the tune on a dyno… The ADACT tune goes a completely different route and appears to smooth out the whole ignition table also adding fuel in a non-linear fashion. I believe the ADACT tunes were developed on a dyno based on its appearance.
My Experiences
I blindly flashed the coupetuner Upsolute maps to my ECM and drove on it for a week thinking it had a 7300 RPM limit. Many months later I discovered it was actually a 7500 RPM limit. This tune is clearly meant for bigger cams and 98 RON (94 US AKI) which my car didn’t like much in the higher RPM range. It pulled hard in the low RPMs so it was obvious the advanced ignition was doing something… but I was scared to push it too hard without a dyno or the proper fuel. Best fuel I can get is 92 octane which is 2 points lower than the tune was intended for. I reverted to OEM and ran only the raised revlimiter which worked well for a little while. Something felt off when I pegged the revlimiter so I continued the search for more data.
I found ADACT tunes which had a very smooth ignition table compared to OEM and added a little more fuel in the WOT and cruise range. Copying only the fuel and ignition tables it seems to resolve a lot of my problems. My car smells rich but I managed to lower my LTFTs from +15% to near 0% and my AFR gauge shows a steady 14.7 then dips to 12 in WOT pulls. Acceleration is smooth throughout the whole range and generally feels better than the OEM tune. Ignition is clearly advanced because I can smell additional NOX from the exhaust. I was warned not to use the ADACT tunes blindly, but they seem fine. I ran a revlimit of 7500 then lowered to 7300 because I didn’t feel that 7500 is necessary at this stage. With a 6 speed trans I was hitting ~58MPH in 2nd gear at 6800RPM… but with the 7500 limit I could reach over 60MPH in 2nd gear which in theory, brings my 0-60MPH time down.