NefMoto

Hi all, my 1st post here, so be gentle.

I have a 1999 Volvo V70XC B5254T  Automatic that I'm trying to disable some DTCs.

It is more for fun than anything else.

I got the FLASH out of it in boot mode and was going through it for a few days trying to find DTC Class Table. Unfortunately, I did not succeed. I found the probable location of CARB P-codes (16 bits values) and the DTCs in it but cannot for the life of me find the class table to see if I can disable some codes  :(. I found similar file with corresponding al2 file but the location of the class table is in different location in my file. In my file I found corresponding a2l file, 10R1HJ.a2l but could not find it anywhere.

Maybe someone got better understanding or wants to try to see if we can figure this thing out and learn something along the way.

I attach all related stuff and the file in a attachment.

https://mega.co.nz/#!vwlVBKba!sxlHYspSIrlJsvGC8P_Zdq5V_-J82ndgjG2K0rl_GQE (https://mega.co.nz/#!vwlVBKba!sxlHYspSIrlJsvGC8P_Zdq5V_-J82ndgjG2K0rl_GQE)

Thanks in advance  ;D.

Roth

Can't get that link to work.

select full link, copy, paste.  It works.

I fix for you!

Thanks for answering.

BTW, I noticed that I posted in the noob Guides and FAQs instead of questions. Maybe mods can fix that, thanks.

Here is the closest bin with matching a2l I could find.

https://mega.co.nz/#!n1sRgDjL!ueW4FXR8IduJNhM32aH8GEQVwqkznQx__QU5lBTE2r0 (http://)

0.0Vatlab VOLVO ID.  99W20 P80 B52X4XT ME 7.0 1XEB    F1EBI P80 B5234HT MAN SDB259 EU ŽT9920 981028 02:29 B6EB           1XEB0000    4C2A                                                    

0.0Vatlab VOLVO NO.Jens Ivarsson           96551           +46 31 7651395  DAT3012         1xEbMHde.a2l    981023 12:07

I can see the class table beginning at 0xD886 (in the a2l) which seems to correspond with the file and there is some DTCs I found around 0x149xx, which does not correspond to a2l file that says they should be at 0x14Exx.

This I found based on misfire codes and BTW I found out that the file contains codes for 8 cylinders (even though the engine is 5 cylinder). They look like this, starting at 0x1493A:

0300 0300 0300 0300 0301 0301 0301 0301 0302 0302 0302 0302 0304 0304 0304 0304
0305 0305 0305 0305 0303 0303 0303 0303 0306 0306 0306 0306 0307 0307 0307 0307
0308 0308 0308 0308 0300 0300 0300 0300 0301 0301 0301 0301 0302 0302 0302 0302
0304 0304 0304 0304 0305 0305 0305 0305 0303 0303 0303 0303 0306 0306 0306 0306
0307 0307 0307 0307 0308 0308 0308 0308

So if this is a five cylinder motor, the class table should have corresponding pattern of last 3 codes (cyl 6, 7 ,8) inactive. The only codes then would be P0300 / P0301 / P0302 / P0303 / P0304 / P0305 giving me pattern of:

active active active active active active inactive inactive inactive.

In the file it is 27 27 27 27 27 27 00 00 00, starting at 0xD88C which by the al2 is the P0300 code.

I tried to find this pattern ( xx xx xx xx xx xx 00 00 00 ) in my file as it also is 5 cyl engine but no luck.

Maybe someone has some other idea on locating this table or maybe there is some other method used in this case.

Thanks again Roth.

It doesn't have to be 27 27 27

The value of the error class just determines the fault priority. Engine light on or off, flashing, etc, etc. Chances are this is different in the a2L you are referencing.

Thanks, yes, I tried to look for 00 00 00 proceeded by 6 of the same bytes. Next thing I thought of is to work trough as many files with matching a2ls to discover maybe a different method / location of DTC de/activation.

roth

I made some progress on finding the DTC Class table. You will need WinOls for that, because it has a feature to search for patterns with wild cards.

So, I located the Manufacturer DTC Table by searching for DTCs in the file. The thing is that the table will have DTCs that are not related to the car as well. For example the you have misfire DTC for cyl. 8 on a 5 cyl. engine. That was my case. By the order of the 1st appearance I selected a group of codes that will give me a good pattern to search.


The order by the 1st appearance would be (non existing DTCs in red):

0300 0301 0302 0304 0305 0303 0306 0307 0308 0300 0301 0302 0304 0305 0303 0306 0307 0308

Next, i went to the beginning of the file switch to 8bit view and search for:

?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? 00 00 00

There will be a lot of false hits but they are easy to eliminate. After a while I came upon this:


It looks like a DTC Class Table. To test I filled with 00s from 0x10800 to 0x108AF and written back. There is no codes now. Which tells me this is the right table. But the car does not restart after shutting down.

Now I need to figure out what exactly needs to be done. Checksum is different probably this is why it does not start.

roth

I run out of time on this. I just filled DTC Class Table with 00 and wrote checksumed file back. Car is starting and running now running now. Let see what happens. Checksumed / modded file attached if anyone cares to look.

BR, Roth.

Deleting all DTC's is a great idea...

sigh

He's disabling all DTC's to prove a point that he has the right table, he's not just doing it for funsies.

Doing it to learn about this. Car passed emission test already. It took a lot of headache / driving / etc. So, I figured it would be good to learn how to disable them in the future. Car is and old POS, worth $500 on a lucky day. So, good candidate for experiments. I got another here newer S80. I'm planing to play with this one but got to get it started 1st (immobilizer problem).

BR, Roth.

So line up the DTC table in groups of 4, count the total amount of rows.
Then take the fault class table in 8 bit, it has the same length as there are 4 value rows in the pcode table.
Take the number of the row which contains your DTC to be disabled, and count the same amount of 8 bit values from the start of the fault class table, set it to zero.

At least VAG works that way, I haven't looked at Volvo.

I tried to do that but was unable to really pin point the right positions in class table. Din't really have time. On another note, I was able to drive the car with modded file for 1 day. I had 0 DTCs and all monitors set to ready  ;D. Car blew the heater core so its a done deal now.

I got never S80 here that I can play with. My next project will be finding the class table quicker, switching off particular code and setting readiness in file (maybe EEPROM). I noticed that some monitors are set to ready right away, like misfire. Others, like catalyst take a lot of headache to do. I need to figure out what controls it.

BR, Roth