Hmm.

Complicating circumstances.

I captured the commands on a HIGH series cluster, and the data looks different on a LOW series cluster. So I made some assumptions and took a punt.

What I got was:

LCD on the left locked on DTE.

LCD on right showed the letters 'SC 0'. I thought I'd done it! But when I drove down the road I saw no speedo display.

So I'll go back to reviewing the data, because I've got a few options. Could I have just stumbled upon some secret cluster display mode that nobody has ever seen before perhaps?

Who knows what Police Mode should look like? I'll search for that too. I'm close.


Lukeyson

Awesome. It was working all along.

SC is the 'Speed Capture' Mode and you trigger that by pressing the 'Trip' button. Just press it again for 2 seconds to switch back to Police mode, which displays as 'P 0'. Interestingly, it shows speed in reverse!

So there we have it. I can now turn Police mode On and Off on both High and Low series clusters.

Also, if you have a BF Cluster in a BA, and the DSC light is permanently on, I think I can now turn it off.

Or, if you have a BA cluster with a Traction Control light mismatch (ie, you have TC but no light on the IC, or you don't have TC and the light is always on), I can fix that too.

Interesiingly, on low series clusters I have a single byte with 6 more bits and I don't know what they do yet. On high series clusters there are two bytes, with 7 more bits to play with yet.

I wonder what I'll find?


Lukeyson

Oh, and another thing.

Because I've upgraded to a DZ Climate Control ICC - I get to retain all my DTE, Avg Econ/Speed, Instant Econ/Speed settings on the ICC.

I've lost nothing. Even one of the Trip meters moves to the left LCD.

This is pretty cool....


Lukeyson

OK, here's the drill for a Low Series cluster.

The Module ID for the IC is 720.

The mode for reading the current IC settings byte is 21 - read by offset (See J2190). The offset is 03.

So on an elm:

atsh720
ath1

2103

Gives me:

728 03 61 03 03

So the byte of interest is the last 03.

So bitwise, this is 00000011

I know that the 2nd bit from the right is the Traction Control bit. The 3rd bit from the right is the Police Mode bit.

So to turn on Police Mode I need to write the value 00000111 to the IC, or 07.

To write to offset 3 I need to issue a Mode 3b command - Write Data Block (J2190 again) - writing to Block 03.

So assuming the headers are set as above, the command is:

3b0307

I check this by reading it again:

2103

Which gives me:

728 03 61 03 07

So the bit has been set.

To change it back, simply do the Mode 3b command again using 03.

To turn off the TC jewel on the IC, write 01. To turn it on use 03.

The DSC Jewel is set on high series clusters in the 2nd Byte. So it's not covered in this quick write-up.


Lukeyson

Last edited by Lukeyson on Sat Oct 20, 2007 8:00 pm, edited 1 time in total.

Damn you and your geek code!

Awesoem developments lukey - Police mode is a wank though - you will get sick of it!

Can you develop this into some easy to use software - happy to contribute $$$

hehe

HTFU


Lukeyson

I've just given this a try, unsuccessfully. I seem to be getting more data back than you do (after the 2103 command). Here's my log.



I used the terminal feautre in ProScan, but got the same results using hyperterminal.

Yeah, you've got a high series cluster haven't you. Different rules on that one. The key is Counter Byte.

When you issue a query with the header set to 720, the response will always come back with a header that is 0x8 higher. This is true for all CAN queries. So you got 728, which means we've got one step right.

When you sent 2103 you got the response 04 - saying that you have data in the next 4 bytes. Then you got 6103 saying it was valid response to a Mode21 query to Offset 03. Last, you got 030C. The 03 is telling me that the TC jewel is active and Police Mode is off (I only know 2 bits so far), and 0C is telling me that you have the DSC jewel inactive (to turn the DSC jewel on requires that byte to be set to 0E - and I only know what 1 bit does in that byte anyway).

When you issue a query of any sort, and you get a response back of 7F, the bytes after the 7F will tell you what the problem was. In this case, 3b12. We know the 3b was the query mode, so the code itself is 12 - and from J2190 that translates to 'Sub Function Not Supported or Invalid Format'. So it looks simply like you need to issue a 2-byte write.

So for you to just toggle the Police Mode bit, you need to enter two bytes following the 3b03, not the one you entered on my initial advice for the Low Series Cluster.

So, since you got 6103030C, use this instead:

3b 03 07 0C

Which should just toggle the Police Mode bit in the first byte.

To turn it off set it back to the way it was before:

3b 03 03 0C


Lukeyson

I thought you were playing around with a high series cluster?

I'll give that a try (writing two bytes)

Ok just tried again, got the following. I think it worked, as the 2103 returns the changes, but no noticeable change to the cluster.

Er, yeah, I sniffed on a high, but applied it to a low with ELM.



Lukeyson

It did work, went for a drive today, all good.

Kaching.


Lukeyson

The latest thing to be discovered is changing the ODO.

Although there seems to be a point beyond which an ODO refuses to change. It may be 100, 000km or 200, 000km, as the Odo in question was a 2xx xxx unit. i haven't read anything that says an odo won't change beyond a certain point.

Sound scary?


Lukeyson

By the way, you can read the current ODO value from the IC by doing the following:

Set the header to 720, and display response headers:

atsh720
ath1

Then issue a mode 22 (request by PID) to PID 6180

22 61 80

Also, remember that if you change your ODO after the first 100km, or more than 3 times within the first 100km, the system registers a permanent DTC. DTC's can be read from the IC by the following:

Set header to 720 (atsh720)
Display headers (ath1)

22 02 00

(Cheeky mode on) This responds with the number of DTC's that you have. To get the DTC's you have to do more work, and I've described this before. (Cheeky mode off)


Lukeyson