Further Analysis & Notes on SSM Parameters
The air/fuel trim or air/fuel correction is the increment applied to the
fuel injection to bring the air/fuel mixture (as sensed by the oxygen sensor)
closer to the stochiometric ratio.
- when the OxS voltage is low (0.1V-0.5V - a lean mixture), the a/f
correction is positive
- when the OxS voltage is high (0.5V-0.9V - rich), the correction is
- during closed loop operation, the a/f correction oscillates
rapidly along with the OxS voltage, and is roughly inverse in shape
- the longer the mixture stays rich or lean, the greater the
correction that is applied
Here is a graph of the correlation between the OxS and the air/fuel
correction during various engine operating conditions:
- during closed loop operation, when the OxS is oscillating between
0 and 1, the air/fuel correction also oscillates in a roughly inverse
- when the OxS voltage stays low, indicating a lean condition
(blue areas), the air/fuel correction is rapidly increased in an attempt
to correct the air/fuel mixture
- when the OxS voltage stays high, indicating a rich condition
(red areas), the air/fuel correction is rapidly decreased in an attempt
to correct the air/fuel mixture
Here is an example during acceleration, deceleration, and steady state
operation (with an additional effect of the knock sensor):
- during closed loop operation, the OxS is oscillating between 0
and 1, and the air/fuel correction is oscillating in the roughly
inverse shape from positive to negative (note that the sampling rate of the
software in this case is not fast enough to resolve the full frequency
of the oscillation); this is the normal steady state closed loop operation
- during rapid deceleration, the mixture becomes rich and the OxS
reads high, which causes the
ECU to rapidly decrease the air/fuel correction in an attempt to
bring the mixture back to the correct level
- during the heaviest of the acceleration, engine pinging is detected
as indicated by the sudden drop of the blue knock sensor line -
zeroes out the air/fuel correction despite the OxS staying high; it
looks as if the ECU reverts to open
loop operation, reading from internal fuel maps instead of using the OxS
when knocking is detected.
- the ignition advance curve does not appear to be affected during
the knocking; the
knock correction is likely added to the ignition advance to determine the
final timing correction
The MAF measures the amount of air being used for the air/fuel mixture.
This plot shows the MAF reading and throttle position sensor (TPS)
for acceleration from 0-60 through 3 gears (the TPS returning to closed
at the shift time), then deceleration back to 0.
The air flow reading is roughly inverse of the TPS, as expected -
the wider open the throttle, the more air entering the engine.
The engine load is essentially the mass of air consumed per revolution
of the engine. The greater the mass per revolution, the greater demand
on the engine for output power.
The load is calculated using the MAF (mass/time) sensor and the RPM (rev/time)
from the cam/crank sensors:
mass/time / rev/time = mass/rev
For the EJ22's air flow meter, it looks like the air mass is proportional
to the cube of the AFM voltage. Subaru's calculation is something near
the cube of the AFM voltage divided by the fraction of a max RPM:
(AFM voltage)^3 / (RPM / 10000)
The Injector Pulse Width, or IPW, is the time in ms that the ECU keeps
each injector open during the intake stroke. The constant fuel pressure
from the regulator means a somewhat linear relationship between the time open
and the fuel volume delivered (not accounting for variations in temperature,
The IPW is primarily dependent upon the engine load, which from above
can be seen to be the mass of air per rev of the engine; a larger mass of air
requires a larger amount of fuel
to maintain a stochiometric ratio. (Other corrections are applied at
different running conditions, such as starting - where the IPW is increased
to provide a rich mixture for easy starting.)
The EJ22's IPW maps follow something like:
Engine Load^0.6 - 3
(the EG33 factor is closer to 0.62)
Engine timing is primarily dependent upon the RPM of the engine
and the calculated load. At higher RPMs, the timing is advanced; at
larger loads, the timing is retarded.
This EJ22 ROM's (7232xx) timing maps look something like:
(RPM/100)^1.1 - (Load over 60) + 10
- the basic relationship does not hold during the period of open-loop
operation that can be seen in this plot
- other EJ22 ROMs seem to use slightly different factors - something
like (Load over 50), and SVX ROMs don't
seem to follow this relationship well at all
This oscilloscope plot shows the relationships between the cam
and crank angle sensors, the engine timing, and the injector signals
(thanks subaru vanagon yahoo group user "ric8721" for the capture).
A trace such as this can be used to diagnose a slipped timing belt.
- (yellow) crank angle sensor
- (green) cam angle sensor
- (blue) ECU signal to Ignitor cyls 1/3
- (red) ECU signal to Inj #1
Here is Subaru's graphic of the relationships of the signals:
- the rear of the left camshaft sprocket has 4 sets of teeth
spaced at 90 degrees: the first 'set' makes one short pulse,
the second set makes 3, then 1 then 2; this 1-3-1-2 pattern is seen here:
- the crank sensor has 6 teeth on the rear of the crank
timing belt sprocket: 97, 65, 10 degrees BTDC (and also 277 (=180+97),
245 (=180+97), and 190 (=180+10))
- since the crankshaft rotates twice for each one turn of
the camshaft, and has 2 sets of markings, there are one set of crank pulses
for each cylinder.
- this can be seen in the plots: there are 2 crank pulses closer together
(97, 65), then one (10) for each cylinder:
- the ECU uses the time elapsed between the 97 and 65 DBTDC signals
to determine the engine RPM during normal operation, and uses the 10 DBTDC
signal for a fixed timing during starting conditions
- as this trace was taken during engine cranking (starting signal
present) the cylinder #1 injection signal (channel 4) aligns with the 10 DBTDC
signal on every other rotation
(And, here is a plot of the same engine, mistimed (the timing belt had
Note that the injector and spark signal are not near the 10*BTDC timing
mark used for the starting condition.)
The 16 useful binary parameters in the Subaru ECU are located at
two separate memory addresses (bytes), each with 8 bits of information. Each
shows the state of 8 switches (mechanical and/or electronic) which
are used as inputs for the ECU. Finding the individual binary values
requires decoding the byte by bit number. Here are the bit orders within
To read the value of an individual switch, the decimal values output
by the monitoring software for each set of switches must be
converted to 8 binary bits, and
a bit mask must be applied to the correct bit.
- First byte:
- automatic transmission
- test mode (green connectors connected)
- read memory mode (black connectors connected)
- neutral switch in transmission
- park switch in transmission
- california mode
- Second byte:
- idle switch on
- air conditioning switched on
- air conditioning relay active
- radiator fan relay active
- fuel pump relay active
- canister purge valve activated
- pinging detected
- Additional byte: (*)
For example, a retrieved value of '152' for the second
switch byte represents a binary value of 10011000 - showing
the idle switch, radiator fan, and fuel pump active, and all other
(Examining the individual bits of the binary parameter bytes can
be done in Excel. For example, if column Z contains the second
byte of binary parameters, using
shows the binary equivalent of the byte. Each individual
binary parameter can be isolated as such:
MID(DEC2BIN(Z1,8),1,1): idle switch bit
MID(DEC2BIN(Z1,8),4,1): radiator fan bit
The SSM parameter list includes another
binary parameter called "O2 Monitor", described as "A/F ratio is rich".
This parameter appears in a separate SSM "mode" (which corresponds
to a byte of data in the ECU for the other binary parameters).
It is unclear where in the ECU memory this byte/parameter appears,
and I have not seen an aftermarket monitoring program which
correctly locates it.
the 1990-5 EJ22 ECU is a dedicated on-board computer which takes
as input readings from sensors on the vehicle and engine, and
calculates engine parameters such as fuel injector duration.
the dynamic values of the sensors and calculations can be found
in the ECU at one of 32000 addresses in memory.
subaru select monitor diagnostic tools (like the B10 and even subaru's
own 'select monitor' used by suby mechanics) work by reading dynamic
engine parameter values out of the ECU's memory at those addresses.
however, here's the rub - over the years the EJ22s were shipped
with many different versions of the ECUs. as subaru worked on the
software the memory addresses changed, so any parameter (like the RPM or TPS)
could appear in one of many different memory addresses depending upon
when the car/ECU was manufactured and in what market (european, US,
so, how does diagnostic software know where in memory to find its values?
each ECU has a ROM chip which can be queried for its version number. knowing
that version number allows the software to look up the table of
addresses for each sensor and parameter for that particular ECU.
subaru is the only entity which knows for sure the full contents of
that lookup table of memory addresses for any given ROM ID.
since they never gave out that information,
any EJ22 diagnostic
software author had to find the addresses in one of 2 ways: they
could hook up a mechanic friend's real factory subaru select monitor
(which has the correct ROM addresses for all the ECUs ever made) and
intercept the communication to the ECU; or barring that, it was a
trial and error process of looking through over 32000 memory addresses
to find suspicious looking numbers changing in the right way as they
drove or revved the engine!
whether or not the addresses for any given ROM were found depends
upon whether someone had an ECU with that particular ROM series and
the patience to find them.
over the years tables of addresses for some of the ROM series were
found...but many were not. of those found, i've seen some that have
bad addresses for the parameters, and some that have correct addresses
but incorrect conversions. for example, for your particular ROM, the
tool might read everything correctly except the VSS.
(in addition, each of the parameters found in memory uses one of 12
pre-set conversion factors to convert it into a real-world
value for use by a mechanic. in more than a few
cases, the tables used by the B10 tool and other
software also have some of those conversions factors wrong.)
these ROM tables have been passed around the subaru legacy and
internet communities for years, with errors and omissions intact. any
new software uses the same tables.
evaluate carefully the values you get from your aftermaket tools....