Diagnostic Interfaces

[jtgh]

worked on the bench jig and comms.
got my o2 simulator to work, and the VSS generator. (2 x 555 timers)

i confirmed that cmd 0E $005A , is 02 oxy sensor input.
i can vary the O2 now and it tracks right with it. I get 35 hex and BA hex bouncing.
for low and high points on my wave form (.2 to .8v)

I can now run with VSS and o2.
so now my CEL is out (virtual engine).
I now found out the following frozen cmd port no longer frozen.
00 addr. show shows 00 for ok, and 40 hex if i force a VSS failure CEL code 24.
is addr 00 = DTC codes? or CEL alarm bytes.

01 addr. 00 is ok, too, but goes to 20h if I illegally close the TPS switch flying down the road at HG = 10" 2500 rpm, ( idle state while flying)
I will play more with these two bytes ,later.

I also learned the diagnostic will throw an illegal TPS code if your TSP is almost closed and you have low vacuum (load) , it has contradiction logic on that.
smarter than i though it was.
It is saying ,how are you getting Atmospher pressure with at closed throttle (partial) plate ( smart ,huh)

more changes to addresses that were , stuck.
cmd addr 1D now flops from 50 to 53 (was 40h frozen)

that is it, time for bed.

cheers

[Rhinoman]

Good work, some more progress. No sign of the address for VSS? thats curious. Hex addresses 44,45,46 and 47 are copies from other registers and are difficult to work back from.

[jtgh]

more data at dawn: (ecu hacking )
i fiddled command 00 , 01 (44h, to 46hx mem)

each test done with normal inputs, no CEL lamp. ( new VSS timer and new OXY sim. card)
cruising, hot engine, over 2500 rpm , map 10-15HG, VSS 25mph, etc, then id changed each input a little or slammed it to a rail. and noted results.

data at cmd 00:
00 = normal (guess)
02 = ECT open fail
04 = ECT shorted.
08= TPS stuck at WOT (hi volts) (rpm cruise, and map= 10-15hg)
10 = TPS 00 volts , shorted.
00= start sw fail, vss fail, oxy open, rpm max or min and baro anywhere with RPM.
--------------------------------------------------------------------------------
cmd 01:
data:
00 = normal? cruising with all normal ,
20 = Idle switch fail.
01 = baro map unplugged.
causing any other hard malfunction, results in 00 data.
any rpm,baro, ect open/short vss dead or not, map, oxy dead.

next cmd 08, it just bounces 02 to 03 ,and repeats, more later.
-------------------------------------------
cmd 15-18 are frozen ,
same with cmd 13
cmd 14 is 00 engine not running and 44 if running, but that is all.


cmd 19 is a bafflement. ( counts down under unk, conditions)

cmd 1C , i will play with more.
cmd 1D, is not doing things, more later.

and the wierd 1F, ( random)

that is my report . 7-8-08


web link to project:
addr-hacking1a

[Rhinoman]

I now have the CEL on the port expander and its only one pin away from the O2 heater so that should be on the same port (L0031), should be easy to log.

The ASIC is interesting. There is no clock input but it generates timing signals so maybe it has an internal oscillator. It takes the input from the CAS and passes it through. It also generates an inverted CAS signal and another signal that is related to the CAS signal, possibly a base ignition timing.

1F you need to isolate bits 5 and 3.

[Rhinoman]

OK, I'm on to this but I've had enough for today. L0044 and L0046 are copied from L00C3 and L00C4 which are derived from L0081 and L0082 which I already have as fault flags. What was causing me problems is that L00C3 and L00C4 are used as general working registers in at least 3 different routines and I had them down as MAP*4. I guess that they were running out of RAM.

[jtgh]

cmd 1F hex. mem. $0002 loc.
legend: BLC = bounch like crazy pop corn.
bits, data:
0= BLC
1= BLC
2= 0
3= 0
4= 1
5= BLC
6= 0
7= BLC
I WILL see if i can effect the solid bits, 2,3,4 and 6

data taken cruising , all conditions normal. 2500rpm 15 HG, normal air and water temps. vss = 25mph. 4 hz.
more later
now. I varied all inputs. baro, rpm and all binary inputs ,and analog.
the 2,3,4, and 6 bits are stuck , solid.
even RPM to 0 (stop)

[jtgh]

recap yestdays tests.
cmd 00, $044.
i think? this is the internal catastrophic error codes that trip in either.
1: failsafe or cause mimic sensor mode to kick in.
ECT hard fail. or TPS hard fail.
then 01 cmd $0046,
this would force into a deeper failsafe, where baro map is completely dead.
and or the Idle switch sticks open ( never idles).

last:
i cant for the life of me find Long or short term fuel trim.
on cold power up start these should be at 128. (80h). center range before learn happens.

cheers.

[Rhinoman]

This is how it goes:

1. Read some code
2. make some guesses
3. log a load of data
4. find some answers, find more questions
5. go to 1.

I'm currently building my test box, in between I'm updating the schematics. I haven't been able to devote much time to the code. Its raining a lot here at the moment so its not a good time to go out and work on the car (no garage). Just today we have had one months worth of rainfall .
We know where the O2 sensor is in the code and I have found the O2 heater output. It should be easy to find the O2 heater pin in the code so hopefully that will get us into the closed loop code.
I now the location of the diagnostics code.
We have made a lot of progress in a very short time - I have been working on this on and off for over a year. Cracking the diagnostic interface was the big step forward that I hoped it would be. I am extremely grateful for your help in this.

[Rhinoman]

A suggestion for testing for ignition advance:

set WTS, ATS etc to normal running values
set MAP and RPM, log
fix timing using diagnostic plug pins
log again

CEL should be set above a certain RPM set if timing is fixed.

I am going to modify my EEPROM so I can output the internal diagnostic registers and, hopefully, the closed/open loop flags

[jtgh]

same here ,"very greatful, in deed "
the first time it spit back answers to my commands, I was wonder stuck.
wow, UK ECUs and code uses the same protocol as mine. what a lucky break. way cool !

add to your list ,
if i get my cruddy (rusty) C++ code to run and log data raw, can
have wife drive and i can look at things.
have a real engine in real CL , and maybe my ellusive Fuel trims will popup and wiggle.

thanks hard work , looking at the code.

so you think the heater is monitored in the code? and that will flip a bit activating the
startup of the CloseLoop servo?
that is very good. i see the logic of that.


good evening. jerry