For that older (Marelli) car, it looks like you ought to be able to learn something useful just by monitoring the Zytek serial port output into a PC whilst the (floppy) software is running.
Then you need to decide what baud rate and handshake is being used - you’ll know when it’s right as sensible numbers will appear against the throttle opening readout on the screen when you blip the throttle etc.
You may also be able to see an RS232 chip on the Zytek board somewhere.
kind regards
Marek
Thanks Marek,
I suspect with JUST the XJ220 or XJR software running(- the base version and/or super user version-), one could learn something with the RIGHT virtual box setup (tweaked properly).
Yes, it’s been noted that virtual serial ports don’t work, and some have said it has to be an old 386 for clock timing reasons, and that even slowing the virtual processor down isn’t’ working. That may be so, and it may be that there are more ways to take a crack at it and FOOL that software into working. There’s more than one way to get a serial port working in virtual machine. There may be other ways to emulate a 386’s speed. If you couple that with a virtual serial port sniffer, you essentially have an in-system oscilloscope to capture any handshake attempts by the software (although it might wait for an “I’m Here” signal from the ECM to initialize communications.) Lets say one did get this working so that you have a com 1-4 available output in the VM and that goes to a USB to serial port dongle that then can connect to a real SPD1039. One would just need to monitor the other side - ecm side - to get BAUD rate and begin to decipher the protocol. I’d play around, not having either horse, that bit of software would have to land somewhere accessible.
I can see experimentation on an XJRS computer a lot more easily than I can on an XJ220 computer. (desoldering proms for socketing & reading, monitoring communication). I imagine the XJ220 folks might be worried about even cracking the ECM box to take photos of the insides given there’s reports that if the engine comes out the box has to be sent to Zytek for reset (which makes NO DARNED SENSE). I mean, if your XJ220 battery goes flat you have to send the box out? What? If you have a race version and you pull the exterior battery cut off for too long your Zytek box looses it’s memory? I’m HARD pressed to believe that. I can believe a re-tune might be helpful after engine out. That’s what happens w/ the McLaren F1 (individual cylinder tuning). Which until recently ALSO relied on a 20 year old laptop (McLaren re-wrote the software so they could continue to service the car more easily).
~Paul K
Pulling the engine and/or disconnecting the battery overnight will do nothing more than cause a hard reset. The ecu does not need to be sent back to Zytek for reprogramming. They won’t take it these days anyway, back in 2006 there were still people at Zytek who knew the ecu. Now there are 2 people left who worked on these ecus back in the early 90’s, and Continental has them working on OEM projects now. This is a misconception I have seen in a few places, but according to those who have actually pulled the engines out of a 220 it is not true. The program doesn’t reside in RAM. What will happen is that the ecu will need to “learn” all over again. If no changes have been made (e.g remapping) this will happen quickly. If some changes have been made it may take some driving before the ecu learns the changes.
The good news is I just received the following from a contact at Zytek/Continental who I have been annoying for a few weeks (italics mine).
*"Hi Steven, *
Apologies – very busy yes, and out of office a lot recently - but I’m sure I can make something work.
I am told schematics have been pulled from the archives, and I’ll work on getting back with some answers this week.
Thanks,
Richard
Even if it’s not cost effective for them to build new diagnostic kits, I have asked for any hardware/software they no longer have a use for, like their xj220 test setup, as well as schematics, old ecus, broken interface boxes, etc. Let’s see what they come up with.
A friend in the UK has successfully gotten the Zytek diagnostic kit to work on a modern computer in emulation mode and has used it on an XJRS. However, for whatever reason, the serial interface must be hardwired as I mentioned above, or on another forum. A virtual serial port does not work.
One kind person, who shall remain anonymous (as long as they wish) has been kind enough to supply some files to begin to play with.
With this it might be a good idea to document the Zytek SW versions that seem to be in-use as best we can). Dr. Solly, if you get your hands on the XJ220 software or EXEs, would you mind posting the EXE names, version numbers and names of the support files?
FileSet 1 (Supposedly for the 88-89 5.3L XJRS - all params editable though)
EMDAU493.exe <–Base EXE Verson U4.93 1992 186KB
AOPDATU4.CFG <–Blank file
CGA.BGI <–Borderland Turbo C support file (graphics/fonts I think - similar file came w/ games of the time)
V12BASE1.EMU <-- Engine Parameters in some unknown (at this time) coded format.
Zytke.bat
FileSet 2 (XJRS 6.0L Diag SW for locked? ECU 86KB
EMSA06UK.EXE <–V6.0 The Diag Software seen in screenshots in S80 & Jag OBD diag training pdfs.
CHKLIST.MS <–Not sure how this is referenced - coded… checks for command.com (DOS) and the main EXE?
FLTCODE.TXT <–Strangely spaced fault code #s and descriptions.
Zytek.bat <-- nothing important.
V6.0:
V4.93 displaying EMU file data.
Other than running them in VM and, I hope, when I get it right, doing some sort of serial-port capture, I’ll admit I’m in way over my head. BUT I’m learning.
I’ve ran one through an open-source NSA disassembler to look at the code, and well… I can tell it’s code w/ functions rather than gibberish, so that’s a start. (I’ve scripted in VBScript and done a little C for microcontrollers), but mostly hacking other’s work. Really need to figure out how it listens to the ECM datastream somehow.
Regardless, here’s a tantalizing screenshot or two:
V4.93 gut splatters just in time for Halloween:
(none of this is supposed to mean much to anyone at this point other than encouraging a little hope.)
I think this was all written in… assembly? Looks like of like assembly. Assembly is hard. Really compact, efficient, but difficult. Not surprise there given the lack of space for bloatware in 1992.
This would be nice in C++, Python, Tuner Pro data-stream interpretive masks, or something that could be made open source.
I’m also hoping Zytek has little emotional or business attachment to their ancient software at this point.
~Paul K
Actually all the way back to 1993, we just had our 25th anniversary!
Nick
You’re absolutely right Nick! My tenure here runs just under 20 years, so I’m a newbie by comparison.
grin:
I just received a video of the kit running in DOSBOX, so I know it works. It’s being shipped with the software on a USB drive. I’ll post whatever I have soon as I receive it and learn the program.
This is an excellent thread! I look forward to you back-engineering this, and graciously making it a part of keeping the 220 a viable toy into the 21st century.
Got this yesterday, it’s a short video file showing the XJ220 superuser or race software running in DOSBOX. Now he just needs to hook it up to a car, make sure the interface is good. Hope to have the kit in 2-3 weeks.
Can’t upload video- here are 2 screenshots. looking good so far. Now as long as the interface box is good, which I have been assured it is, but want to see some video before wiring a chunk of change overseas, then all will work out.
Very cool!
Will you charge $75,000 to rent it out?
There is dealer diagnostic software as well, but this factory software lets you reprogram ecu (change mapping), either live on a dyno, or by uploading a known map file such as that for the 220S.
I’ll post more as I get it.
No Paul:)
I’ve been retired for 2 years (my 2nd retirement. First was at age 45 for 5 years, but once my kids went to high school I went back into business to keep my sanity). Now I’m 61 and losing my mind again. My bucket list is empty, with the exception of driving the Mille Miglia which I hope to do next year.
So I went out and bought an automotive shop in Ridgefield, CT, about 15 minutes from my home so I can pretend I know what I’m doing. Will close on it in 2-3 weeks. This is not the shop that is restoring my car. I have 2 ASE certified A techs, and one B tech, and will be installing a dyno and looking for some brilliant kid to do tuning. Anyone can bring or send their cars over, normal shop rates (I have never done this before, so I don’t know what normal shop rates are for ecu diagnosis or tuning, but it will be approx. the same as everyone else is charging). The only issue I have with lending it out is if if a carrier loses it, someone drops it and breaks something important, it is literally irreplaceable and I’m 99.9% sure it’s the last available Zytek kit for sale on the planet. Just shipping it to the US from Europe is making me nervous.
However, if anyone wants to come by and hook up an oscilloscope during a diagnostic session in order to try and duplicate the interface they are welcome to do so at no charge. I will let JCNA know that this resource is available. As far as software, whatever files I can pull and upload, I’ll be happy to do so.
Come to think of it, $75,000 sounds reasonable after buying the car, the shop and the Zytek kit within 3 months. Thank god I put my kids through college already.
…in the 220?
I’d pop on in, with my Rover, but all it’d be good for is amusement!
That is excellent, and in keeping with their generous and great tool loan program.
I wish. Must be a pre-1957 car, same marques and models that ran in the original. It’s so hard to get in now that preference is being given to the actual cars that ran up to 1957, not just the same make and model. Almost all were European, but I believe at least 2 large American cars ran the original (Cadillac, Chrysler?). Typical car is a Mercedes 300SL Gullwing/Maserati 250/450, OSCA, Ferrari, etc. But some lower end cars too, like Fiat, BMW. I believe the last real Mille Miglia in 1957 was won by Stirling Moss in a 300 SLR, which is now in the Mercedes museum and worth some insane amount of money.
That’s a tuffie: many of those cars are indeed, stratospheric.
Then, there’s the support costs: for Gatorade, meals, and a cot, I’ll come be one of your wrenches!
Thank goodness you had the ‘r’ in that last sentence 
I can confirm with those two screens you’ve shown, that EMDAU493.exe is functionally setup the same way you XJ220 super-user software is.
Clearly, from the splash screen, your software has something tweaked about it to make it XJ220 specific (I would assume) given what the splash screen says.
I see that that the version is 1.0.97.
Is the EXE name ZMDA2097?
Any support files? Names?
crossing fingers that a TRUE protocol expert/oscilloscope owner will take you up on that offer
In the mean time some of the XJRS owners and I are going to try to pick the brain of the Zytek chief engineer for the XJRS cars to see what he’ll tell us. He’s apparently a helpful Chap, and for some $ amount (not sure what) will reprogram problematic XJRS ECM’s with later software. (Test case on that forthcoming). Anthony Moss, now retired from his company (post-Zytek) Moss Engineering in the UK. Now residing in Scotland so I understand.
If/when I figure out how to capture the PC serial port side of the communication, I’ll let you know.
~Paul Kobres
looks like you just about have the software figured out. Right now those screenshots are all I have. Still have the problem with the interface box, without which the software is useless. I would assume software was somehow tweaked for each car, as the XJ220 software won’t “talk” to an XJRS ecu, and vice versa.
Yes, I noticed that too. While I’d be happy having Paul W. as a co-driver, here’s my previous pit crew with my 360 Challenge. I’m the big one on the left.
I think my competitive driving days are in my Wink mirror, but I’m a hella good crew member!
My legs are almost as good, though.
