|
Title: Diesel ECU? Post by: Rick on April 16, 2011, 03:37:03 AM Was at the Nurburgring last weekend, a friend has a remapped Bora 1.9 PD 130 TDI. I tried to read the ECU and no comms. I don't even know what ECU's these use, but I'm guessing it's not supported?
Rick Title: Re: Diesel ECU? Post by: RaraK on April 16, 2011, 07:53:15 AM Was at the Nurburgring last weekend, a friend has a remapped Bora 1.9 PD 130 TDI. I tried to read the ECU and no comms. I don't even know what ECU's these use, but I'm guessing it's not supported? Rick Gosh i wish i could say i was at the Ring.....anyways, EDC 15/16/17, yes a little different, you need to BDM 17 i i think, otherwise KWP will read the others, or galletto. Title: Re: Diesel ECU? Post by: orienz on April 19, 2011, 01:39:08 AM How do we get NefMoto to read TDI ECUs? I am particularly interested in EDC15 as I am trying to read out a Passat TDI PD 130 ECU.
I know we can use KWP/Galletto but NefMoto just looks so much neater ;) Thanks for help! Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 19, 2011, 11:01:36 AM If someone posts some logs of trying to read and write a TDI with the NefMoto software, I can evaluate how hard it would be to support them.
I attempted to read and write a 2005 VW TDI a while back, and ran into some non-standard communication issues. Title: Re: Diesel ECU? Post by: orienz on April 19, 2011, 11:49:19 AM Yes, I had the same issues this morning. Tell me what you need exactly and I will get it for you.
Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 19, 2011, 01:24:32 PM If you open the NefMoto flasher, and then from the file menu, open the log file or the log file location, and then post the log file to this forum thread.
Then I can see where in the flashing process it is failing. Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 19, 2011, 01:28:42 PM orienz, I got the log file you send me via PM.
The log file shows that the NefMoto flasher was never able to connect to the ECU with fast init or slow init. The reason your Ross-Tech cable may not of worked, is that is did not appear to be in "dumb mode". To change the mode of the cable you need to change the options in VCDS. I believe you need to turn off "use intelligent mode". Title: Re: Diesel ECU? Post by: Rick on April 19, 2011, 01:51:11 PM Tony,
using my normal dumb cable, I couldn't connect with either fast or slow. Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 19, 2011, 01:53:15 PM Is VCDS or Monoscan able to connect?
Slow init uses KWP1281 to connect and fast init uses KWP2000 to connect. I can't think of any reason slow init wouldn't work. Title: Re: Diesel ECU? Post by: Rick on April 19, 2011, 01:58:06 PM Yea, VCDS connected no problem.
Similar issue to UK C box S4 then - maybe it would connect on the bench. Rick Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 19, 2011, 02:09:45 PM I guess I must be missing something in the slow init that is different on these cars.
Title: Re: Diesel ECU? Post by: orienz on April 19, 2011, 03:03:25 PM Tony,
Yes I saw that but then I switched to blue ebay cable and it said "fast init successful" and then it just disconnects. I just read my brother's Skoda Octavia RS successfuly with this blue cable, worked just fine. Diesel support would REALLY be great. We gotta figure this out. Your flashing tool ROCKS. Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 19, 2011, 03:14:47 PM Since connecting to the ECU seems to be the problem, what would help me the most is if someone could record VCDS making a connection to the ECU. If we get a recording using a logic analyzer or a serial port sniffer then I can see what the difference is in the connection method.
I will try to connect Uwe at Ross-Tech to see if he can give me any hints. Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 19, 2011, 04:57:17 PM I spoke to Uwe, and he said that the EDC15 does not have any special connection requirements relative to the ME7. He said that the EDC15 may be more picky about the connection timings and he pointed out that my slow init bit timings may have cumulative error in them. I will see if I can do a quick update that should prevent the connection timings from having cumulative error. Hopefully this is the reason we can't connect to the EDC15.
Title: Re: Diesel ECU? Post by: orienz on April 20, 2011, 02:55:34 AM Excellent news, I will test it out as soon as you publish an update.
Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 20, 2011, 11:57:12 AM If you guys send me a private message with your email, I can send you the test release which may fix the connection issue. Just make sure to mention the EDC15 diesel topic when you message me.
This is a test release because I don't actually know if my timing changes will make any difference. Title: Re: Diesel ECU? Post by: orienz on April 20, 2011, 02:40:54 PM No luck again, I sent an email back with another log file.
Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 20, 2011, 03:21:04 PM Too bad it isn't that easy. I will try to get my hands on my friends logic analyzer again and verify all of connection timings.
Title: Re: Diesel ECU? Post by: orienz on April 20, 2011, 04:32:58 PM Can i somehow capture what VCDS does when connecting and send it to you?
Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 20, 2011, 06:23:26 PM There isn't any easy way to capture the connection data because it isn't standard serial RS232 UART data. You need a logic analyzer like the Saleae Logic, or OpenBench Logic Sniffer.
A friend of mine has a Saleae Logic and I should be able to borrow it again to double check the connection timings. Title: Re: Diesel ECU? Post by: orienz on April 21, 2011, 04:41:56 AM Something like this wouldn't work? -> http://sourceforge.net/projects/usbsnoop/
Title: Re: Diesel ECU? Post by: carlossus on April 21, 2011, 06:23:07 AM Something like this wouldn't work? -> http://sourceforge.net/projects/usbsnoop/ It looks like that's designed for capturing data, but wont be able to look at the exact timing of the transitions. Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 21, 2011, 01:13:18 PM Something like this wouldn't work? -> http://sourceforge.net/projects/usbsnoop/ This could capture the data being sent over the USB port, but it wouldn't be able to record the timing of the bits that actually come out of the OBD cable. Title: Re: Diesel ECU? Post by: orienz on April 25, 2011, 08:08:42 AM Just tried benchreading EDC15P and it didn't work...VCDS connected fine :/
Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 25, 2011, 11:27:25 AM I've got my friends Saleae Logic analyzer again, so I will attempt to verify all of the connection timings in the next few days.
Title: Re: Diesel ECU? Post by: orienz on April 27, 2011, 02:59:02 AM Just to confirm that there is nothing wrong with ECU, i just read and flashed EDC15P using Galletto 1260 clone, worked perfectly.
Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 27, 2011, 10:31:37 AM I have another test release that will hopefully solve this connection issue. I used a logic analyzer to double check the timings, and I increased the idle time between connection attempts.
Title: Re: Diesel ECU? Post by: Rick on April 27, 2011, 12:44:18 PM Tony,
EDCxx and indeed MEx is used in lots of non VAG cars. Are we likely to be able to communicate with them using your software or are there car specific comms protocols? Rick Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 27, 2011, 12:48:48 PM The slow init, fast init, and KWP2000 protocols are an industry standard and are not just used by VAG. The flashing protocol has some custom manufacturer specific algorithms though like compression, encryption, and security negotiation.
Title: Re: Diesel ECU? Post by: mtx-electronics on April 27, 2011, 03:49:26 PM Recently I made a program to read/write EDC15C7 ecu's and at first I was having a few problems with waking up the ecu. The problems I found were:
1) Sometimes the ecu will not wakeup on the first init. sequence during fast mode so you might have to try 2 or 3 times; 2) The first communication done after init. (in my case Start Communication Service) must have a small delay between bytes sent and when finished you must wait a long delay after you receive the ecu reply before continuing with your next service request, this goes on until you reach the Start Diagnostic Session Service after which you can go full speed no problem. I don't remember of the top of my head the exact delay I used but will check my code and get back to you on this asap. I don't know if this connection issue you are having with EDC15P is the same issue or not but anything is possible. Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 27, 2011, 04:39:41 PM Thanks for the suggestions, but the NefMoto Flasher already handles everything you suggested. It will try to connect three times, and it uses all of the default inter byte, and inter message timings until it can negotiate faster timings later on.
Currently we don't get any response from the EDC15 to the fast init or slow init wake up sequences. I have verified that the slow init 5 baud address byte that is sent, is sent with 200.044ms per bit. The spec requires 200ms per bit +/- 1ms. VAG-COM uses 199.934ms per bit for the 5 baud address byte. I have one or two more ideas that we can try in another test release. I would say that the issue is possibly your computer or USB cable, but it is highly unlikely that all people with diesel cars have bad luck with cables. ;D Title: Re: Diesel ECU? Post by: mtx-electronics on April 27, 2011, 04:40:15 PM The timing I'm using is 1ms between bytes sent and 15ms wait after every reply from ecu before next request.
ok, just saw your reply.. Never mind, it's probably something else them. Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 27, 2011, 06:37:36 PM orienz, can you confirm that VCDS connects to address 0x01 when you connect to the ECU?
Title: Re: Diesel ECU? Post by: mtx-electronics on April 28, 2011, 02:39:16 AM Check on my car and the address is 01.
Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 28, 2011, 11:20:18 AM If anyone else with an FTDI USB cable and an EDC15 ECU would like to help test some change to the NefMoto software, please let me know.
I want to make sure the problem is really with the NefMoto software and the EDC15 ECU and not just one users setup. Title: Re: Diesel ECU? Post by: Rick on April 28, 2011, 01:57:09 PM I have a Ford Fiesta TDCI with EDC15 sat here, not sure if that is any use?
Rick Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 28, 2011, 02:16:31 PM I have a Ford Fiesta TDCI with EDC15 sat here, not sure if that is any use? If you have a chance to test, that would be great, but I doubt it will support the VAG protocols. It would be nice to know if it can at least wake up the ECU though. Also, if any EDC15 people get a chance, can you try connecting to your ECU using UniSettings? It is attached in this thread: http://www.nefariousmotorsports.com/forum/index.php/topic,41.0.html UniSettings uses the same FTDI libraries as the NefMoto software does, so I would like to see if there is also a problem with this program. Title: Re: Diesel ECU? Post by: mtx-electronics on April 28, 2011, 06:02:23 PM Here are some logs while trying to init. communications with my EDC15P+ on a Seat Cordoba 1.9TDI 101HP from 2005.
- in the NefMoto file you will find both slow & fast init. with relative log files and saleae logic sessions; - in the VAGCOM file you will find the screen shot with ecu details from vagcom and relative saleae logic session files (There are two saleae files because I repeated the test twice). I used vagcom 3.xx and it connected in KWP1281, I'm not sure why it does not use KWP2000 (maybe v3.xx is too old or there is some option to force kwp2000??). I tried to init. the ecu with a basic fast init. & start communication service request with an interbyte time from 5ms up to 15ms and still no reply, this same procedure on several other EDC15 ecu's I've got laying around works flawlessly. Title: Re: Diesel ECU? Post by: mtx-electronics on April 28, 2011, 06:04:32 PM P.S. The UniSettings prog. does not work on this ecu.
Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 28, 2011, 10:00:26 PM Here are some logs while trying to init. communications with my EDC15P+ on a Seat Cordoba 1.9TDI 101HP from 2005. You are awesome. Now I need to look at some logs. ;D If you send me your email address I can send you a NefMoto test release which may solve some connection problems. I haven't looked at the logs yet though, so it may not fix anything. Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 28, 2011, 10:29:26 PM After looking at the logs, all I can do is hope that my latest test release resolves the issue. In the latest test release my connection timings are more accurate than the ones that VCDS uses for slow init. Anyone willing to try out the test release, please send me a PM or email, with your email address so that I can send you the test release.
I also posted all of the Saleae Logic Analyzer recordings I did of connections by different communication software here: http://www.nefariousmotorsports.com/forum/index.php/topic,568.0.html Title: Re: Diesel ECU? Post by: mtx-electronics on April 29, 2011, 03:34:51 AM After many hours of tests finally I was able to get the ecu identifying itself :) So here is the full procedure for wakeup & reading ecu identification:
1. Fast init; 2. Start communication service (0x81) with interbyte time of 20ms; 3. Ecu reply; 4. Start diagnostic session service (0x10) in diasgnostic mode (0x85) with interbyte time of 10ms; 5. Ecu reply; 6. Read Ecu Identification service (0x1A) with option data set to all (0x80) with interbyte time of 10ms; 7. Ecu reply; 8. Read Ecu Identification service (0x1A) with option data set to software number (0x94) with interbyte time of 10ms; 9. Ecu reply; 10. Stop communication service (0x82) with interbyte time of 10ms; 11. Ecu reply; So in the end I had to give a longer interbyte time for the start com. service, the timings I used are the minimum which my ecu accepted any less and coms. where too flaky so probably it would be better to use slightly higher values... Attached is a saleae logic session of this working on my car. Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 29, 2011, 09:29:55 AM Awesome! Thanks for letting me know what worked for you.
The KWP2000 spec defines the default minimum P4 tester inter byte time as 5ms, and the maximum as 20ms. The NefMoto software uses the default inter byte time of 5ms until it can negotiate a faster time. I will put together a test release using the maximum inter byte time instead of the minimum and see if that works. PS: The MonoScan software also appears to use 5ms for its fast init inter byte timings. Title: Re: Diesel ECU? Post by: mtx-electronics on April 29, 2011, 10:35:21 AM It's strange but so far this seems to be the only way to get this ecu to communicate with my setup. Also if you look at the VAGCOM logs they are using interbyte times of min. 10ms too so maybe for some of these vag ecu's this is normal (at least edc15p).
The Fiat kwp2000 spec. talks about min. 5ms & max 20ms too but like I mentioned in one of my earlier posts on the EDC15C7 ecu I am using 1ms interbyte time for wakeup and for read/writing flash actually drop down to 0ms with no problems. Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 29, 2011, 10:46:09 AM All of the VAGCOM logs I have seen only show the KWP1281 protocol which doesn't have the same timing requirements as KWP2000. I don't think the issue with the NefMoto software and slow init is related to inter byte timing. The slow init connection only sends one byte at 5 baud, so there is no time between bytes...
You can use the AccessTimingParameters KWP2000 messages to read the current P timings, get the limits of them, and set new timings. Title: Re: Diesel ECU? Post by: mtx-electronics on April 29, 2011, 11:17:15 AM I haven't done anything in KWP1281 so don't know much about it.
When do you think you'll have an update to try? I'm curious to see if NefMoto can read/write these ecu's or at least read/clear DTC's. If VW hasn't made any changes in specs. for their implementation of the KWP2000 then probably the only thing that might be different is the security access keys algo. Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 29, 2011, 12:37:35 PM I just sent you an email with a link to the test release. Please let me know how it works out.
Title: Re: Diesel ECU? Post by: mtx-electronics on April 29, 2011, 12:57:02 PM ok, got the mail. I'm on my way home now so I'll test it asap and get back to you.
Title: Re: Diesel ECU? Post by: mtx-electronics on April 29, 2011, 01:51:31 PM Ok, so now the ecu is waking up in fast mode but they seem to have a few problem talking to each other. Slow init does not work at all.
Nefmoto logs attached. Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 29, 2011, 02:12:29 PM Thanks for testing that version out. It's good to know that an inter byte time of 20ms works with this ECU. Maybe we can try some other timings between 5ms and 20ms to find some better middle ground. You said that using anything less than 20ms did not work for you?
I'm not sure why the slow init is not working when the VAGCOM slow init does work. If you have time could you record the NefMoto slow init connection with your Saleae Logic? I would like to double check all of the timings. Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 29, 2011, 02:35:49 PM I forgot to mention that the problems communicating after the fast init succeeds, are likely due to a problem in the NefMoto code that doesn't handle the 20ms between bytes. This is the first time the NefMoto software has ever used an inter byte timing greater than 5ms. I will do some testing myself this weekend to track down what the issue is with this.
Title: Re: Diesel ECU? Post by: mtx-electronics on April 29, 2011, 03:55:29 PM I'll do the logic logs as soon as my wife's laptop is free because it's the only laptop with Vista installed and NefMoto will not allow me to install under XP.
I noticed that when I did the test in fast mode the software once reached the point that it could not understand the reply's just hung there... The grayed out buttons stayed disabled and I had to close the app. to get control back but the application was not frozen, just didn't enable buttons & things. Title: Re: Diesel ECU? Post by: Tony@NefMoto on April 29, 2011, 04:25:22 PM There are a few bugs in the echo handling code. There currently isn't any time out on trying to read the echo of the data you send. Currently the program assumes that if it sent data, then it should be able to read the echo back in, period.
Title: Re: Diesel ECU? Post by: mtx-electronics on April 30, 2011, 07:41:02 AM This is the 5 baud init. logic file.
Title: Re: Diesel ECU? Post by: orienz on April 30, 2011, 04:05:31 PM hey Tony,
Sorry I haven't been able to replay. Been busy for a few days now. The new version you sent doesn't work either. Title: Re: Diesel ECU? Post by: Tony@NefMoto on May 01, 2011, 02:02:55 PM orienz, and mtx, I just sent the two of you an email with the latest test release.
This release should hopefully work for both fast init and slow init. Title: Re: Diesel ECU? Post by: mtx-electronics on May 02, 2011, 01:12:32 PM There are still some problems.
Title: Re: Diesel ECU? Post by: orienz on May 02, 2011, 03:02:36 PM I can't connect slow or fast init either, sent you an email as well.
Title: Re: Diesel ECU? Post by: Tony@NefMoto on May 02, 2011, 03:40:03 PM MTX, it seems as though there is some noise in the communication.
The slow init says it received a sync byte of 0x85 when it should have received a 0x55. The fast init says it received a message not addressed to the tester 0xF1. The logic recording shows that the message was addressed to address 0x0. Did the program freeze after this? Do you get different results if you try to connect without the Saleae Logic attached? Would you be able to get a logic recording of the slow init, because I would like ot see if an 0x85 sync byte really was sent. Title: Re: Diesel ECU? Post by: mtx-electronics on May 02, 2011, 04:25:18 PM yes I have tried without the logic analyzer and have the same result. In the fast init logic file you will see that it seems that the ecu starts replying before nefmoto finishes transmitting the data.. but this only happens when I first boot nefmoto and try to connect, after if I try another connection the ecu correctly waits for nefmoto tx to finish and then replies but the reply is always a negative response.
For the slow init. I'll get you a logic log. Actuaaly I did do it but my battery died on me while I was logging :( Title: Re: Diesel ECU? Post by: Tony@NefMoto on May 02, 2011, 11:09:22 PM mtx, and orienz, I just sent you two another test release.
I reduced the fast init inter byte time from 20ms to 13ms. I think the previous releases that used the 20ms inter byte time may have been causing problems because it was right at the max time. If this doesn't work, then we will probably need to try again at 19ms or something. I'm not sure what could be causing the slow init problem. We are reading the sync byte now because I made it wait longer than the spec requires to receive it, but we are receiving the wrong sync byte. I removed a redundant change in the USB time outs that I am hoping may remove some potential noise in the signal when reading the sync byte. Title: Re: Diesel ECU? Post by: mtx-electronics on May 03, 2011, 06:38:47 AM Here are the logs.
Title: Re: Diesel ECU? Post by: Tony@NefMoto on May 03, 2011, 10:48:02 AM You're awesome MTX. Thanks for taking the logs.
Slow init appears to work, except that the ECU appears to be sending the 0x55 sync byte with a baud rate of 9732 instead of 10400. According to the spec you are supposed to use the 0x55 sync byte to determine the baud rate. I haven't gotten my baud rate detection code to work yet though. I will take a look at it again and maybe I can at least hard code some specific combinations. Fast init does not appear to get a response with the 12ms inter byte timings. I will bump that back up to 19ms for the next test release. Title: Re: Diesel ECU? Post by: Tony@NefMoto on May 03, 2011, 01:48:10 PM Uwe just informed me that it is normal for the EDC15 to respond to a slow init with a 9600 baud sync byte. I will add a special case to support this baud rate in the next test release.
Title: Re: Diesel ECU? Post by: mtx-electronics on May 03, 2011, 03:34:03 PM I'm not surprised to see soch behaviour... It seems that these EDC15 ecu's don't have very elastic kwp2000 protocal specs.
I've got that Fiat EDC15C7 ecu that will not communicate with interbyte time over 2,5ms and find this very strange. Title: Re: Diesel ECU? Post by: Tony@NefMoto on May 03, 2011, 03:57:02 PM I've got that Fiat EDC15C7 ecu that will not communicate with interbyte time over 2,5ms and find this very strange. So it won't respond to the StartCommunication request with an interbyte time longer than 2.5ms? Title: Re: Diesel ECU? Post by: mtx-electronics on May 03, 2011, 04:28:41 PM Yah, I know it's stange :o I also logged a popular flashing tools wakeup procedure and they are using 1-2ms on this ecu too. The cool thing is that with timming params. & init. diag. mode I can set the ecu to 125,000bps without interbyte and download flash content in 1,5min which is not back considering that my Galep4 programmer read's the AM29F400BT in parallel mode in 58sec.
Title: Re: Diesel ECU? Post by: Tony@NefMoto on May 03, 2011, 04:56:42 PM Is this the same ECU that requires 20ms inter byte time to do fast init?
Title: Re: Diesel ECU? Post by: mtx-electronics on May 03, 2011, 05:01:49 PM Wait a minute.. Let's not get confused :)
This ecu I'm talking about is EDC15C7 that is used on Fiat/ALfa/Lancia. The 20ms on fast init. is a EDC15P+ used on Seat/Skoda/Audi/VW. I was using this ecu as a comparison to show how much different these two EDC15's are between each other. Title: Re: Diesel ECU? Post by: Tony@NefMoto on May 03, 2011, 05:59:06 PM I thought you were talking about two different ECUs, just wanted to be sure.
I really don't want to require the user to input the correct timing settings into the program to get it to connect, but ultimately that may be the only way to support all of them. Title: Re: Diesel ECU? Post by: Tony@NefMoto on May 03, 2011, 10:31:45 PM I just sent orienz, and MTX another test release.
This one has the fast init timings using a default of 19ms for the inter byte timings. Also, the slow init connection will fall back to 9600 baud if 10400 baud fails to read the sync byte. Title: Re: Diesel ECU? Post by: mtx-electronics on May 04, 2011, 04:38:01 PM Ok, so now slow init. finally wakeup the ecu:
05/mag/2011 12.10.44.729: USER: KWP1281 connect info: ?38906019NE 1,9l R4 EDC 0000SG 6119 ?) That's my car :) Cool, great work Tony... Instead for fast init. there is still some problem... Seems that the ecu starts to reply with negative response before you finish sending the crc byte. I did notice one very small detail though, if you look at the working log I did using my software for some strange reason my timing between when I sent out 0x81 and 0x01 is only 17ms while after that it correctly uses 19ms... So maybe 19ms is a little to long and 17ms would be better, take a look and tell me what you think? So where getting close to the solution now. BTW after slow init. nefmoto disconnects why is that? This is the first time I use nefmoto so I don't know what to expect... P.S. I'm supposing that even if the protocol from here onward is the similar to ME7 specs. what about the secury key?? I would guess that they used a different algo for these ecu's right? Title: Re: Diesel ECU? Post by: Tony@NefMoto on May 04, 2011, 05:49:35 PM Is it possible to get a longer log for the slow init? After trying two slow inits with address 0x01, I try a slow init on address 0x11. The logs say that there was no sync byte received for that slow init, but the logic analyzer logs didn't record that far. I am wondering if the ECU switched baud rate or something.
With the fast init, I don't know why the ECU responds before receiving the checksum byte at the end of the message. It may be caused by an inter byte time out, and like you suggest 17ms could work better. The ECU also responds to my fast init by sending a message to address 0x00, when the tester address the start communication message comes from is set to 0xF1. I will try changing the inter byte time to 17ms, and also try disabling the dumb mode test 0x55 byte I send before doing any fast or slow inits. Title: Re: Diesel ECU? Post by: nitroCZ on May 05, 2011, 05:54:46 AM Are you tested in car or on board?When will you trying to connect to EDC ECU fast pull down and up supply voltage,maybe help it
Title: Re: Diesel ECU? Post by: Tony@NefMoto on May 06, 2011, 11:56:41 AM orienz, and mtx, I just sent you two another test release.
Aside from a few bug fixes, this release also has another tab to allow you to adjust the communication settings. This way you can try out any P4 inter byte time you want. These settings only take effect when a connection is started, and will have no effect on a connection that is already open. I would recommend testing different P4 inter byte times, as well as testing with "verify cable in dumb mode" turned off. Please let me know if this helps. Title: Re: Diesel ECU? Post by: mtx-electronics on May 07, 2011, 09:43:55 AM Both fast & slow init. connect. Fast init. works with minimum 16ms.
Other commands like identifing ECU & DTC stuff don't work. Logs Attached. Title: Re: Diesel ECU? Post by: orienz on May 09, 2011, 08:53:15 AM Hey Tony,
Unfortunately I can't check up on this anymore. My father left (he came for a visit) and it was his Passat TDI with EDC15+. If I find some other car with diesel ECU I will let you know. I also have an Mercedes E320 CDI but it has EDC16 ECU which uses CAN I think so it won't work I suppose. Title: Re: Diesel ECU? Post by: Tony@NefMoto on May 09, 2011, 05:50:33 PM orienz, no problem with not being able to test. You've already helped a bunch.
mtx, I've got another test release for you. This one has better support for unexpected key bytes, as well as a different format for TesterPresent messages that the EDC15 ECU may like more. One thing I can recall though, is did we ever test with MonoScan trying to connect to the EDC15 for KWP2000? Currently I am wondering if we should use the 17ms inter byte time for connecting, but then switch to a shorter inter byte time after we get a StartCommunicationPositiveResponse. The EDC15 ECU seems to keep sending response messages that collide with the testers requests. All I can think is that the long inter byte time may be causing some time outs in the ECU. Title: Re: Diesel ECU? Post by: mtx-electronics on May 10, 2011, 01:58:50 AM Test I have done show that the long inter byte time seems to be needed only for the wakeup, after you can drop timing down at least 9ms.
Title: Re: Diesel ECU? Post by: Tony@NefMoto on May 10, 2011, 10:55:08 AM Test I have done show that the long inter byte time seems to be needed only for the wakeup, after you can drop timing down at least 9ms. That may give us better results. It would have to be a bit of a hack in code though to do that. Let me know how the current test release fares, and then we can try the shorter inter byte timings after connection next. Title: Re: Diesel ECU? Post by: DJGonzo on May 12, 2011, 10:56:48 PM I have an EDC15 on my bench right now. If anybody needs a guinea pig to get some logs or run some tests I'd be glad to do it.
Title: Re: Diesel ECU? Post by: Tony@NefMoto on May 13, 2011, 12:25:25 AM I have an EDC15 on my bench right now. If anybody needs a guinea pig to get some logs or run some tests I'd be glad to do it. Just send me a PM or email and I can send you the latest test release. Title: Re: Diesel ECU? Post by: DJGonzo on May 13, 2011, 05:27:26 PM Here is your logs for slow init:
Code: 13/May/2011 07:16:19.605: LOG: Opening NefMoto VW Audi ME7 ECU Flasher BETA 1.7.1.0 Title: Re: Diesel ECU? Post by: DJGonzo on May 13, 2011, 05:28:21 PM 10000 char limit... Didn't feel like making .txt files :P
Fast init Code: 13/May/2011 07:25:44.687: LOG: Setting Address: 0x01 KeyByte1: 0x6B KeyByte2: 0x8F I tried reading DTC's with slow init with no luck, but it did connect successfully with slow init. Edit: Just tried reading and failed as well. Ill run some logs again tomorrow. At least it connects though. That's a start :) Title: Re: Diesel ECU? Post by: mtx-electronics on May 15, 2011, 09:19:18 AM Sorry Tony I haven't gotten around to testing the new version, time has not been on my side in the last few days... I'll do some tests wednesday morning and post the logs.
Title: Re: Diesel ECU? Post by: Tony@NefMoto on May 16, 2011, 12:04:12 PM Gonzo, thanks for posting the logs. It appears as though the EDC15 does not like receiving tester present messages before the diagnostic session has been setup. I will send you another test release that starts the diagnostic session right after connecting.
Title: Re: Diesel ECU? Post by: DJGonzo on May 16, 2011, 01:50:58 PM No problem.
Here is slow init again: http://pastebin.com/pmL4JTm0 Title: Re: Diesel ECU? Post by: Tony@NefMoto on May 16, 2011, 02:57:40 PM Gonzo, thanks for the new test. It seems as though my test of sending the start diagnostic session message right away was only setup to work with a positive start communication response, while you got a negative start communication response.
I will send you another test release. Please try with fast init and slow init if possible. Title: Re: Diesel ECU? Post by: DJGonzo on May 16, 2011, 03:02:14 PM I will try again in a bit.
There is a swarm of mosquitos in my studio right now and I really don't want to get any more mosquito bites ;D BTW if you know any way to get rid of em let me know. Haha Title: Re: Diesel ECU? Post by: mtx-electronics on May 24, 2011, 08:38:15 AM Finally got around to testing release 11 using the default settings. I first tested the fast init. without success and afterwords tested the slow init which worked on the second try, still have issues that ecu id, dtc reading & clearing do not work.
You can see all from the attached log. Title: Re: Diesel ECU? Post by: Tony@NefMoto on May 24, 2011, 12:08:08 PM Thanks for testing MTX.
It seems as though the EDC15 is not happy receiving any requests until the diagnostic session has been started. I believe this is why the TesterPresent messages are getting rejected. I will make some hacks for the next test release to immediately start the diagnostic session after the communication session has been started. As for fast init not working, I can think of two things that the EDC15 could be tripping up on. Comparing the NefMoto logic analyzer logs to the log MTX posted a long time ago, it appears as though if the ECU responds in 26ms it will be a good response, but if it responds in 31ms it will be a bad response. When the bad response comes in it is addressed to 0xF4 and not 0xF1. I think what is happening is when we send the StartCommunication message (0x81, 0x01, 0xF1, 0x81, 0xF4), the ECU is timing out on receiving the message or runs into some other problem receiving the message. When it times out or has some other error, it starts detecting a new message starting at the second 0x81 in the StartCommunication message, which causes it to respond to address 0xF4 instead of 0xF1. If the ECU is indeed timing out on receiving the message, it could be caused by the maximum time for the message, or the maximum time between bytes in the message. I think a good test would be to try to increase the "P2 inter byte time when connecting" from 17 to 19 ms. Hopefully this allows the ECU to correctly receive the message. Title: Re: Diesel ECU? Post by: DJGonzo on May 24, 2011, 09:13:34 PM Tony let me know if you need me to do some more testing. Ive been pretty busy but Ill give it a shot again.
Actually if there is a way we can sniff K-line traffic we can sniff a professional tool I have here for EDC15 and work off that :) Title: Re: Diesel ECU? Post by: Badnewsmike on June 22, 2011, 11:43:14 AM Thanks for testing MTX. It seems as though the EDC15 is not happy receiving any requests until the diagnostic session has been started. I believe this is why the TesterPresent messages are getting rejected. I will make some hacks for the next test release to immediately start the diagnostic session after the communication session has been started. As for fast init not working, I can think of two things that the EDC15 could be tripping up on. Comparing the NefMoto logic analyzer logs to the log MTX posted a long time ago, it appears as though if the ECU responds in 26ms it will be a good response, but if it responds in 31ms it will be a bad response. When the bad response comes in it is addressed to 0xF4 and not 0xF1. I think what is happening is when we send the StartCommunication message (0x81, 0x01, 0xF1, 0x81, 0xF4), the ECU is timing out on receiving the message or runs into some other problem receiving the message. When it times out or has some other error, it starts detecting a new message starting at the second 0x81 in the StartCommunication message, which causes it to respond to address 0xF4 instead of 0xF1. If the ECU is indeed timing out on receiving the message, it could be caused by the maximum time for the message, or the maximum time between bytes in the message. I think a good test would be to try to increase the "P2 inter byte time when connecting" from 17 to 19 ms. Hopefully this allows the ECU to correctly receive the message. what ever happened with the diesel ECU stuff, ive been trying to work with my 01 jetta ALH and i cant connect... :( Title: Re: Diesel ECU? Post by: lulu2003 on June 24, 2011, 06:55:33 AM I though NefMoto Flasher won't work with Galletto OBD Cables?!
Here is your logs for slow init: Code: 13/May/2011 07:20:57.777: LOG: Opened FTDI device. Title: Re: Diesel ECU? Post by: passuff on July 18, 2011, 09:35:49 AM I would like to support EDC15 developement.
Besides my edc15V+ ecu I have tools like this: -saleae logic analyzer -vag kkl -kwp2000 plus Here is a log of Version 1.8 connecting with 10400 baud slow init: (works) Code: 18/Jul/2011 06:32:06.194: LOG: Setting Address: 0x01 KeyByte1: 0x6B KeyByte2: 0x0F Code: 18/Jul/2011 06:34:19.135: USER: Disabling Windows sleep mode. If I can do anything to help you developing let me know.. Title: Re: Diesel ECU? Post by: Tony@NefMoto on January 06, 2012, 05:28:46 PM If people are interested in getting NefMoto to support EDC15, let me know, and we can start doing some testing again.
It would be great to get a logic analyzer recording of a working tool talking to this ECU using the KWP2000 protocol. This ECU isn't responding nicely to the standard KWP2000 protocol as I know it. Title: Re: Diesel ECU? Post by: mtx-electronics on January 08, 2012, 04:57:09 AM Tests I have done with EDC15V have shown that this ecu does not use standard kwp2000 protocol. I've attached the saleae logic file showing the wakeup & identification process of this ecu. Initial wakeup is done at 10400 fast init but identification is send at 9600 with different packet format.
Title: Re: Diesel ECU? Post by: jonixins on January 09, 2012, 12:06:35 AM I don't know if it helps, but I have found out procedure to do when my crappy clone galletto do not connect to EDC15V or P.
I connect ECU old vag-com, read faults, swap cable to galletto and try. Usually it works. Title: Re: Diesel ECU? Post by: passuff on January 09, 2012, 04:05:51 AM I'm very interested in an EDC15 solution. Even more in the logguning solution, but I think therefor someone has to disassamble the edc15 first.
But I can help with saleae logs and I own a edc15v ecu with flash emulator (OLS16). So if I can help, just let me know! Title: Re: Diesel ECU? Post by: mtx-electronics on January 09, 2012, 07:07:06 AM I've already worked on EDC15V/P to make the tunerpro checksum plugins and have pretty much all of the info needed to flash EDC15P but don't have the ecu for testing. If anybody has one that he is willing to sell "low cost" I will work on a free software solution.
Title: Re: Diesel ECU? Post by: Tony@NefMoto on January 09, 2012, 12:13:27 PM Tests I have done with EDC15V have shown that this ecu does not use standard kwp2000 protocol. I've attached the saleae logic file showing the wakeup & identification process of this ecu. Initial wakeup is done at 10400 fast init but identification is send at 9600 with different packet format. Your log shows that you do a fast init, and get no response, and then you do a slow init. The key bytes you receive for the slow init are KWP1281 key bytes though. Currently the NefMoto software seems to run into problems after sending a StartCommunication message after doing the double slow init to get a response with KWP2000 key bytes. I suppose I could skip sending the StartCommunication message when connecting with a double slow init. One thing I am confused about though, is when the ECU sends a negative response to the StartCommunication message, it sends an undefined response code... I believe that I may also need to send a StartDiagnostic session message before sending any other types of messages. Although, it may look that way because the StartCommunication message is making the ECU angry. I will try to put together a test release that doesn't send the StartCommunication message when connecting with a double slow init. Title: Re: Diesel ECU? Post by: mtx-electronics on January 09, 2012, 12:39:48 PM That log & bin file for EDC15V was kindly given to me by a person I am in contact with on skype, he logged communications while doing an identification procedure with a tool (I don't remember which exactly...)
I am not sure but I have the feeling that maybe older EDC15V might be using KWP1281 while some of the later models use KWP2000. This would explain why they first try Fast Init. and when they don't get a reply try again in KWP1281... Title: Re: Diesel ECU? Post by: passuff on January 09, 2012, 12:41:49 PM It was me. I did the log while connecting with KWP2000Plus tool...
Title: Re: Diesel ECU? Post by: mtx-electronics on January 09, 2012, 12:43:36 PM ok, sorry but I have you on skype with a different name :)
Title: Re: Diesel ECU? Post by: Tony@NefMoto on January 09, 2012, 01:55:05 PM I just ordered a 2000 VW Jetta/Golf 038906012BD 1.9L TDI off eBay for $55 shipped. Will be much easier to test all of this locally.
Title: Re: Diesel ECU? Post by: Tony@NefMoto on January 25, 2012, 05:38:52 PM I've got my EDC15 ECU now, but I haven't had a chance to make a bench harness to test with it yet.
If anyone wants to test in the meantime, the new 1.9.2.0 version of the NefMoto software has some changes to slow-init that should make it work better with EDC15. You can download it here: http://nefariousmotorsports.com/forum/index.php?topic=1446 Title: Re: Diesel ECU? Post by: passuff on January 28, 2012, 02:28:11 AM I've got a bench ecu over here and just hve tested the newest version. connected with slow init: Code: Validated FTDI device is in dumb mode. Read ECU Info: Code: Disabling Windows sleep mode. Code: Disconnecting because no response was received for the Tester Present message. connection is lost: Code: Failed to read test echo from FTDI device. Then I have to restart nefmoto and replug my usb for getting connected again! I think Diesel ECU's are way more complicated than gasoline... If you would like me to test something, just let me know! Title: Re: Diesel ECU? Post by: TheDSI on January 28, 2012, 05:05:15 AM I've an EDC15P and an EDC15V on the bench for testing purposes, I can do more tests since I've a genuine MPPS to recover those ECU if anything goes wrong .
Title: Re: Diesel ECU? Post by: passuff on January 28, 2012, 06:32:25 AM I don't think you can write with mpps or anything else wwhen something goes wrong... You dont have bdm support on edc15 so there's only obd support for flashing. when flashing goes wrong, you don't have a obd support anymore. Only desolder job will help then... that's my experience with flashing. But maybe I'm wrong.
Title: Re: Diesel ECU? Post by: amd is the best on January 28, 2012, 08:18:02 AM I want to be able to tune my 2010 CR TDI ;)
Title: Re: Diesel ECU? Post by: TheDSI on January 28, 2012, 09:45:14 AM I don't think you can write with mpps or anything else wwhen something goes wrong... You dont have bdm support on edc15 so there's only obd support for flashing. when flashing goes wrong, you don't have a obd support anymore. Only desolder job will help then... that's my experience with flashing. But maybe I'm wrong. I've done some tests with my MPPS and it always recoverded those ecu . i've treid, bad checksum, bad flash, wrong file and even virgin 29f400 . http://www.youtube.com/watch?v=J6x2HclytR8&context=C3197623ADOEgsToPDskKla_OVj9M3Dt6DALTjYqB6 (http://www.youtube.com/watch?v=J6x2HclytR8&context=C3197623ADOEgsToPDskKla_OVj9M3Dt6DALTjYqB6) Title: Re: Diesel ECU? Post by: Tony@NefMoto on January 28, 2012, 12:34:53 PM passusf, thanks for posting the program output from your test. Can you also post the full log file? You can find the full log file by going to the File menu in NefMoto.
TheDSI, thanks for posting your log file. The 1.9.2.0 version of NefMoto does get further with the EDC15 than previous versions. It seems as though the EDC15 is pickier about what messages it will respond to before starting diagnostic sessions. Also it looks like the EDC15 may use a different security key for logging in. Title: Re: Diesel ECU? Post by: passuff on January 29, 2012, 06:02:37 AM OK. You can find the log file attached.What I did:
1. connect slow init 2. read ecu info standard session 3. read ecu info programming session Title: Re: Diesel ECU? Post by: Tony@NefMoto on January 29, 2012, 06:10:31 PM Thanks a lot for posting the log files. I have so far found about five small bugs to fix. None of the bugs prevent talking to the ECU, but they definitely don't help.
TheDSI or passuf, could you save the ECU Info you read from the ECU to a file and post that? I noticed a few entries of "????????" are being stored, but there isn't enough info in the log file for me to know what the problem is. If you click the "Save Info" button after reading it and post that info, that would help a lot. One main problem I see though, is that the SecurityAccess is failing. This could be easy to fix or hard to fix. I need to figure out if the ECU just wants a different security seed, or if it uses a completely different seed/key algorithm. Title: Re: Diesel ECU? Post by: TheDSI on January 31, 2012, 09:06:24 AM here it is .
Title: Re: Diesel ECU? Post by: Tony@NefMoto on February 03, 2012, 04:09:36 PM Thanks for posting the ECU info files. It turns out the entries of all question marks for hardware and software numbers are correct. ::)
But there are a couple of other strange things the ECU is reporting for the ECU info. I will try to get those fixed in a future release. I released an update of the NefMoto software to version 1.9.2.1 with a few small fixes for EDC15. This update should cause less benign errors when talking to EDC15 ECUs. Also, this update allows you to override the default settings for the security negotiation. For testing the security negotiation, I would try changing a few settings on the "KWP2000 Settings" tab. Try turning on the "Security Use Extended Key Request" to see if that works for flashing. If that doesn't work, try changing the "Security Request Seed" to "0x03" and turning on the "Security Support Special Key" setting. You will likely have to keep the ECU turned on for 10 minutes between each failed security attempt. Please post a log file based on the results. You can find version 1.9.2.1 of the NefMoto software here: http://nefariousmotorsports.com/forum/index.php?topic=1446.0 Title: Re: Diesel ECU? Post by: passuff on February 03, 2012, 04:36:47 PM Hey, I've just tried it...
Title: Re: Diesel ECU? Post by: passuff on February 03, 2012, 04:40:10 PM Sorry. here is my file.. I guess it was better before...
Title: Re: Diesel ECU? Post by: Tony@NefMoto on February 03, 2012, 04:58:35 PM Sorry. here is my file.. I guess it was better before... Hmmm... that doesn't look like an improvement. The software only tried 10400 baud, never 9600 baud when starting a diagnostic session, and it seems to get stuck and go no where when reading the ECU info after the timing negotiation fails. In the baud rate drop down box is there an option listed for 9600 baud? Title: Re: Diesel ECU? Post by: passuff on February 04, 2012, 01:45:55 AM Here you are... But also no improvement..
Title: Re: Diesel ECU? Post by: Tony@NefMoto on February 05, 2012, 01:31:25 PM Thanks for posting your log passuf. I just fixed two bugs that were newly introduced with the latest EDC15 changes.
I posted a new release for version 1.9.2.2 with a few more EDC15 fixes here: http://nefariousmotorsports.com/forum/index.php?topic=1446.0 Title: Re: Diesel ECU? Post by: passuff on February 10, 2012, 02:45:31 PM Here's my log. Standard session failed. Programming session gets wierd informations..
Title: Re: Diesel ECU? Post by: Tony@NefMoto on February 13, 2012, 02:37:44 PM Thanks for taking the time to post the log passuf.
It seems to me as though the EDC15 ECU only supports programming sessions and not standard sessions. It would be great if you guys could try reading the ECU flash with some of the different security settings. Title: Re: Diesel ECU? Post by: passuff on February 16, 2012, 02:46:18 PM I tried with different security options.
Title: Re: Diesel ECU? Post by: Tony@NefMoto on February 16, 2012, 05:52:02 PM Great, thanks for testing that out.
Can you do another test with the different security settings, but trying to read flash memory? Title: Re: Diesel ECU? Post by: passuff on February 17, 2012, 01:24:24 PM Here you are ;)
Title: Re: Diesel ECU? Post by: passuff on February 23, 2012, 01:34:53 PM Any news?
Title: Re: Diesel ECU? Post by: mtx-electronics on March 26, 2012, 06:30:00 AM Finally got my hands on a few different vag ecu's for testing. What I've found so far is that EDC15V, EDC15VM, EDC15P & EDC15P+ all use different seedkey algo. and for the protocol it looks like EDC15V uses KWP1281 and others use KWP2000.
Title: Re: Diesel ECU? Post by: chora on March 28, 2012, 11:52:52 AM thank you very much for you suport on diesel ecu , i will test in my vag edc15vm
\ Title: Re: Diesel ECU? Post by: chora on March 28, 2012, 12:35:17 PM i will test in my edc15v 038906012ap
Title: Re: Diesel ECU? Post by: chora on March 29, 2012, 06:23:02 PM hi
i tested in my edc15 ecu can comunicate but cant loging if you could help please here is log Title: Re: Diesel ECU? Post by: Tb205gti on July 15, 2012, 01:24:48 PM any updates on this?
I'm dying to get EDC15 communication to work - mainly to be able to log engine data, but (of possible) also to code eeprom. (coding, cruisecontrol etc.) Title: Re: Diesel ECU? Post by: sean919 on August 07, 2012, 07:22:07 AM Hi guys,
I have been following this thread and finally had a chance to attempt it on my car. VW Polo ASZ PD130 running EDC15. It connects on slowinit but the read ECU operation fails. I have attached the log file for connection and two read ECU attempts. Title: Re: Diesel ECU? Post by: sean919 on August 07, 2012, 07:23:56 AM Forgot to add I am using 1.9.3.2
Title: Re: Diesel ECU? Post by: Rousie on August 24, 2012, 03:40:53 PM Any updates on this guys? :-)
Title: Re: Diesel ECU? Post by: hans j on September 05, 2012, 07:31:06 AM I've been trying to communicate too. I'm using a bench flash harness with VCDS HEX-CAN and can pull the ECU part number up but all other operations fail. One thing I did notice is the chip inside is amd29f400bt and there isn't a memory layout for it yet.
Title: Re: Diesel ECU? Post by: Lord_Verminaard on November 21, 2013, 11:57:52 AM Bringing this one back up. I have a 2005 Beetle TDI with BEW EDC16. Just for kicks, I tried to connect with NefMoto. It would connect but was unable to read ECU data. If I can be of any help with testing, let me know.
Thanks! Brendan Title: Re: Diesel ECU? Post by: kaganader on December 02, 2013, 06:11:42 PM Bringing this one back up. I have a 2005 Beetle TDI with BEW EDC16. Just for kicks, I tried to connect with NefMoto. It would connect but was unable to read ECU data. If I can be of any help with testing, let me know. Thanks! Brendan I just had the same problem with a 2000 1.9 TDI, ECU: R4 038906012BD 1,9l R4 EDC G500SG 2507 It will connect but cannot read ecu data... is there a solution to this as I've seen this thread started back in 2011. Title: Re: Diesel ECU? Post by: k0mpresd on December 02, 2013, 06:57:42 PM yes. the solution is to buy a tool that reads them.
Title: Re: Diesel ECU? Post by: kaganader on December 02, 2013, 07:06:27 PM yes. the solution is to buy a tool that reads them. Should I use Galletto v2 for the EDCxx ecus then? I've not played around with diesel ecus and I just tried one today, I did not know that Nefmoto could not read/write to the EDC ecus. Title: Re: Diesel ECU? Post by: overlucked on June 04, 2016, 09:29:16 AM any updates?
|