Our AJ27 ECU design is now about 25 years old, and the AJ26 even older. As items go obsolete (the Pedal Position Sensor comes to mind – although ASI does a good refurb job at a price), it is probably going to get more challenging to maintain everything. In addition, the AJ27 has never been well supported, as far as I can tell, by the tuning companies. Two possible reasons are:
- it’s not so easy to analyze
- there was never enough business out there to justify supporting it

There is probably a bit of truth to both. As far as analysis goes, some of the challenges seem to be:
- Slightly obscure CPU – The Motorola HC16
- HC16 is not the easiest to analyze, since paged memory architecture requires knowing both the page and the address, which are stored separately
- HC16 variant (Y5 or Y6) used is not well documented – proprietary for Denso
- TPU2 module controls the injectors, but the TPU2 microcode (as far as I can tell) is Denso proprietary, not Motorola standard, so undocumented
- Dual CPU architecture adds complexity with shared RAM space to coordinate between the processors, and more complex reflash support – boot CPU1, load CPU1 boot code, boot CPU2, load CPU2 bootcode, reflash CPU1, reflash CPU2
- extracting the bootcode is fiddly, stopping either CPU results in hardware reset by loss of hardware watchdog to Denso power supply chip
- etc.

So, for no good reason, I’ve been poking into the code after pulling together various tools. If you want to do the same, you can find a Ghidra processor module for the HC16, a Ghidra loader for IDS .b68 flash files, and some key documentation at https://github.com/chirpy8. If you want a bit more info, read the posts at https://chirpy8.github.io/posts/

I’ve been focusing on XKR2002 flash files (F27SC074, etc.), so I have much much more info on that particular load. I will try and post more insights as I get around to it. Also I have coded a rough and ready benchtop reflash tool (since I was concerned that IDS would puke on a wrong checksum for a modded file – I now think it won’t for various reasons, but I find IDS annoying anyway), so I’ll try and post/share that at some point, once it’s more stable.

Since a little knowledge is a dangerous thing, this should help you on your way to modding your AJ27 and ruining your engine in no time at all :-) . I hope this is useful to someone, have fun.

 

I have the same year and model so I (and others) I will be following your progress. 👍

 

Since there are a few more canbus extended PIDs (UDS service 0x22) that have showed up after analysis, compared to those listed in Dale's (crbass) spreadsheet (https://www.jaguarforums.com/forum/x...d-list-233056/),
attached is a quick summary. I did not attempt to merge into the original, but obviously that could be done.

 

Wanna try to poke it with WDS on Engineering mode

 

I created an ECU re-flash/cloning tool, and a patching script, for anyone who wants to use a spare ECU to clone their existing unit (all AJ27 ECUs appear to be the same hardware) and tinker with mods. Still a work in progress, but seems to work so far….

Details at the website posted earlier.

 

An_Introduction_to_the_HC16_

This might help the process.