B10 Scan Tool

This is a very simple scan tool to read some parameters in realtime from the ECU on 1990-1994 North American Subaru Legacy models using x86-based computers.

Connecting to the car

Diagnosis connector

The pins used by this scan tool are:

		Pin	Wire Color (Main/Stripe)		Description
		2	Green/White		Transmit
		3	Light Green/Red		Receive
		9	Black/Red		Ground

Of course, since you're only connecting to three wires (and in principle you can tap the ground reference from any other ground on the vehicle), you may simply choose to splice into the wires directly or use some other means of connecting to the pins.

ECU connector

Though it is not recommended, you can also tap these wires by the ECU itself. This may be required if you've swapped an EJ22 from a first-generation Legacy into another car but did not use the complete wiring harness, or if your diagnosis connector has been damaged.

The signals needed by this scan tool can be found on the 16-pin connector of the ECU harness. This diagram is of the connector on the harness, not on the ECU itself.

		Pin	Wire Color (Main/Stripe)		Description
		8	Green/White		Transmit
		7	Light Green/Red		Receive

While it is possible to tap ground from one of the sensor shields or returns on this connector, it is better to simply use another ground more easily accessible.

Connecting to the computer

Warning

Whenever you connect a new device, particularly a homemade one, to your computer, you are taking a risk. If you wire everything precisely as I describe here, chances of causing damage to your computer or ECU are minimal but not nonexistant. Be careful, and double-check everything!

Parallel port

This scan tool is designed to communicate with the ECU's diagnosis port through the parallel port of an IBM-style computer (most likely a laptop of course). Also often called the printer port, it is physically a female DB-25 connector. The pins used by this scan tool are:

		Pin	Description
		1	Strobe
		13	Select
		25	Ground

Mating connectors of various types are easily found at a good electronic parts store or Radio Shack. They generally either use crimp-on pins or have solder cups for each pin. Usually, if you look closely you can see pin numbers stamped into the plastic, which can help you make sure you're connecting to the correct pin. It makes good sense to get a hood (plastic or otherwise) to give you something to grip when you need to unplug the connector. It would also be fairly easy to cannibalize a printer cable or something similar. Every parallel printer cable will have wires attached to each of these pins. Note, however, that a serial (RS-232) or SCSI cable with DB-25 connectors may not.

The scan tool simply requires the diagnosis port's "transmit" line to be connected to the parallel port's "select" line, the diagnosis port's "receive" line to be connected to the parallel port's "strobe" line, and for the grounds to be connected:

If you're tapping these lines right at the ECU, you need to connect the same ECU signals to the same parallel port pins.

Serial port

The scan tool also has experimental support for communication using RS232 serial ports. The voltage levels aren't right, and a few extra components are required, so this method is not recommended if there is any other choice. It may work for you though.

On most computers, the serial port is a male DB-9 connector. On certain older computers it may be a male DB-25 connector, however. The pins you would use are:

Male DB-9 port		DB-9 Pin	Description	DB-25 Pin
		1	Data carrier detect	8
		3	Transmit	2
		4	Data terminal ready	20
		5	Ground	7
		7	Request to send	4

To deal with the differing voltage levels, four components are needed. These should be easily found at any electronic parts store:

Two 10K resistors (e.g. Radio Shack part number 271-1335)
One 1N4733A Zener diode (or other Zener close to 5V) (e.g. Radio Shack part number 276-565)
One 2N3904 transistor (or other general-purpose NPN transistor) (e.g. Radio Shack part number 276-2016)

The connections are fairly simple, but it is important that you get the polarity of the diode right (make sure the end with the stripe is pointed the correct way) and that you get each pin of the transistor right (the pins are called the emitter, the base, and the collector; refer to the documentation for the particular transistor you use).

Again, it makes sense to put a hood on the DB9 connector. In fact, the simple circuitry needed can fit inside the hood.

Binary downloads

The scan tool program is available here in three binary forms. If you just want to use the scan tool, download one of these. It is licensed under the terms of version 2 of the GNU General Public License, whose full text is available here:

gpl.txt [about 18 kB]

DOS .COM file

b10scan.com [about 10kB]

This program can be run under DOS. It will not run correctly under any kind of multitasking operating system because timing is very important. If your laptop already runs DOS (Windows 95/98/Me in command-prompt-only mode counts), just download the program itself and run it. Windows NT, 2000, Vista, or 7 won't work.

Floppy / USB bootable image

b10scan.img [about 1.5MB]

If your laptop doesn't run DOS, but can boot from a floppy drive or a USB drive, you can use this bootable image. It can be written directly to a diskette, a hard disk, or a USB flash drive and it will load itself into memory and run without any operating system.

To make a bootable floppy disk, use a tool like Rawrite (see Jeremy Davis' writeup for information on Rawrite) to write it to a disk as a disk image. The image is intended for 1.44MB 3.5" floppy disks. It will work on lower-capacity disks but you may get an error message about running out of space when writing the image; this error is safe to ignore.

To make a bootable USB flash drive, use a tool like the Ubuntu Win32 Disk Imager to write the image to the flash drive.

On UNIX-type systems, you can use the dd command to copy the contents of the file to whichever block device is appropriate.

In any case, do not simply copy the image file onto the floppy disk or USB drive. They need to be written directly to the raw device.

Note that even if you use the USB option you still need a real parallel or serial port to use this scantool; a USB-to-parallel or USB-to-serial adapter will not do.

Bootable CD image

b10scan.iso [about 360kB]

If your laptop can boot from a CD-ROM, you could burn this bootable CD-ROM image to a disc and boot from it.

Running it

When the program starts up, it first shuts off the system's drives if APM is present (this reduces power consumption and also reduces the risk of vibration in the car damaging the hard disk), and then it will display a quick info screen. Press a key and it will show a list of parallel and serial ports found on the system. Use the up and down arrow keys to select the one your cable is attached to, and press enter.

The scan tool will then use that port to attempt to determine the ROM ID of the ECU it is connected to. If it succeeds and recognizes the ID, you may continue on to read parameter values by hitting the space bar. The following parameters may be viewed in realtime:

• Continuous parameters:
  • ROM ID
  • System voltage
  • Vehicle speed
  • Engine speed
  • Coolant temperature
  • Ignition timing
  • Airflow signal
  • Load
  • Throttle position signal
  • Throttle angle (only on 90-91 manual and 91-94 turbo models)
  • Injector pulse width (poor granularity on 90-91 models)
  • IAC valve duty cycle
  • Oxygen sensor signal
  • Fuel trim
  • Timing correction
  • Boost control duty cycle
  • Barometric pressure (except on 93-94 non-turbo models)
  • Boost/vacuum (only on turbo models)
• Binary parameters:
  • Ignition switch
  • Automatic transmission mode
  • Test mode
  • Read memory mode
  • Neutral switch
  • Park switch
  • California mode
  • Idle switch
  • Air conditioning switch
  • Air conditioning relay active
  • Radiator fan relay active
  • Fuel pump relay active
  • Canister purge valve active
  • Pinging detected
  • Pressure exchange (only on turbo models)
• Trouble codes:
  • Stored trouble codes
  • Active trouble codes

You can also clear the ECU's memory. This clears learned parameters and trouble codes.

I do not know the precise system requirements of this program. It was written without the use of any OS system calls or 32-bit instructions. It does require a true IBM-compatible parallel port or serial port, of course. The processor must be at least an 80286 and be fast enough to do all the necessary processing without losing timing; I have no good guess as to how fast is fast enough. The video adapter must be CGA compatible. Though the program itself is tiny, the way the bootloader is written requires the machine to have something like 80 kilobytes of RAM.

Source code

b10scan-0.07.tar.gz [about 20kB]

This scan tool is free software and is licensed under the terms of version 2 of the GNU General Public License, a copy of which is included in the source archive.

The source code available here is meant to be assembled with nasm. mkisofs is used for building the bootable CD image. The included makefile should work with most any make implementation.

Contact info

I highly recommend that any 1st-generation Legacy owner visit Legacy Central BBS:

http://bbs.legacycentral.org/

Begin by browsing the forums (especially reading any "sticky" threads), and then by searching through existing posts. A great wealth of information for our cars is present. My username on Legacy Central is vrg3.

My email address is at the bottom of this page.

Version history

Version 0.07 (6 February 2012)

b10scan-0.07.tar.gz
Fixed bug that sometimes caused garbage instructions to prevent ROM ID reading.
Added functionality to read trouble codes.
Added functionality to clear memory.
Changed zeroed throttle position to throttle angle.
Removed vestigial Hitachi ECU temperature reporting code.
Changed boot code to work with USB or no-emulation CD booting.
Added communications code to test with QEMU and an ECU emulator.

Version 0.06 (26 March 2006)

b10scan-0.06.tar.gz
Changed name to "B10 Scan Tool."
Added home page URL and serial port interface to info screen.
Added port selection menu.
Added support for serial port connections.
Reversed 92-94 NA transmission ID reporting, which apparently was backwards before.
Added feature to clear display if current sample is more than a second old.
Added zeroed throttle position for 90-91 5MT and 91-94 turbo ECUs.
Fixed bug that caused APM detection to fail on some computers.
Ported from TASM to NASM.
Added a simple bootstrap loader to make scan tool self-booting and eliminate dependency on DOS.
Released under GPL.

Version 0.05 (11 May 2004)

bcbfscan_0.05.zip
Added feature to spin down hard drives upon program startup.
Corrected small errors in water temperature readings for 90-91 5MT and 91-94 turbo ECUs.
Changed manifold pressure units from torr to psi (for boost) and inHg (for vacuum).

Version 0.04 (30 April 2004)

bcbfscan_0.04.zip
Fixed bug where 92-94 turbo injector pulse widths were displayed as being 16 times longer than they actually were.

Version 0.03 (30 April 2004)

bcbfscan_0.03.zip
Fixed bug where ROM ID would sometimes not appear initially.

Version 0.02 (30 April 2004)

bcbfscan_0.02.zip
Updated to add digital parameters and support non-turbo models as well as 91 turbo models. Changed name to "BC/BF Scan Tool."

Version 0.01 (25 April 2004)

22t_scan_0.01.zip
Original version. Only supported 92-94 turbo models. Named "EJ22T Scan Tool."

Disclaimer

I make no guarantee of any kind that this information is accurate or that this software will serve any purpose.