Hmm. Yes, that might help.

If you can connect your ELm327 to your car and issue the following commands, we should be able to add it to the pool of data we have. We've got a bit of info from some FPV Manuals with it enabled, but not from an FPV Auto with it disabled.

In hyperterm (assuming you've connected OK, and have the ignition in the ON position) issue these commands:

atsp6 - set elm327 to CAN 500kbps mode
atsh720 - set the outgoing header to be the IC
ath1 - Turn reply headers on
atcf700
atcmf00 - Set the CAN filter to only show 7XX replies (Queries with a 720 header will get a reply with a 728 header)

2100 - ODO
2101 - Read Body/Fuel type. The RPM limit may be in here.
2102 - Police Mode Offset
2103 - Bitwise Features on/off - shift alert on/off may be in here.

22e200 - Software version
22e217 - Part Base No.
22e219 - PartNoSuffix
22e21a - PartNoPrefix

22e231 - IC Serial Number

And optionally:

220200 - To read the number of DTC's (if any)
1800FF00 - Read the actual DTC's if previous value was non-zero


Lukeyson

Wow. I'm borrowing a mate's SY Tory TX with AWD (So it's a 6 speed) and DSC to do a full scan.

While much of it is the same, there are quite a few differences. The amount of real-time broadcast traffic on the CAN bus appears to be double that of a BA/SX. So either the ZF Transmission Control Module (TCM) must be a very chatty box, or a box that needs a lot more info from the PCM now that the PCM/TCM function is split apart compared to the single-ECU 4-speed.

The ZF 6-speed has a target header of 7E1 (compared to 7E0 for the PCM), with a reply header of 7E9. It's getting the full scan while I've got it, no holding back!


Lukeyson

>ath1720
OK

>atcf700
OK

>atcmf00
OK

>2100
728 05 61 00 00 AE 41 00 00
matches my current odo 44609

>2101
728 10 2C 61 01 32 E1 01 09
728 21 01 49 01 86 01 C4 01
728 22 F7 02 14 02 5D 02 82
728 23 02 A5 02 AF 00 00 11
728 24 94 21 34 32 C8 42 68
728 25 4E 20 5D C0 69 78 77
728 26 24 84 D0 00 00 00 00

>2102
728 03 61 02 00 00 00 00 00

>2103
728 04 61 03 07 0C 00 00 00
still have police mode on

>22e200
728 06 62 E2 00 51 12 69 00

>22e217
728 07 62 E2 17 01 00 08 49


>22e219
728 05 62 E2 19 0E 00 00 00

>22e21a
728 07 62 E2 1A 35 52 32 39
= 5R29 a BF part number

>22e231
728 07 62 E2 31 60 71 81 61

>220200
728 04 62 02 00 00 00 00 00

>

From mine, BF GT-P ZF6 auto, no shift alert.

Pics are now available here:
http://s136.photobucket.com/albums/q199 ... ectronics/
(Check the subfolders.)

Cool, just figured out how to do an ABS Service Bleed - only on Bosch 8.0 Modules for now....



Lukeyson

Last edited by Lukeyson on Tue Mar 11, 2008 9:58 pm, edited 2 times in total.

I've been unable to collect data on the BA ABS Bleed, so I don't have any way to do it on a Bosch 5.3 Module for now. I shall investigate further to see if I can find another way to collect it.

Although on a more positive note, I do have information on how to do a Steering Angle Sensor calibration on Bosch 8.0 modules....



Lukeyson

Last edited by Lukeyson on Tue Mar 11, 2008 10:01 pm, edited 1 time in total.

I think you need to start a wiki for all of this info.

Or at least get the various parts saved as Tech Docs on this site.

hey you smarty pants

one thing i've been wondering is the modules in a BA are connected by a CAN bus right. so in theory it doesnt matter where you connect the scan tool/capa tuner ?

can you disconnect the ecu from the rest of network and connect a scantool/tuner directly to the ecu?

By ECU in this case I assume you mean PCM.

The answer is yes, we've done it already. I might have mentioned this earlier now that I think about it. You need to make sure that the CAN bus observes the correct electrical properties - which means making sure that it is terminated. Usually this means 120Ohm at either end. But I have a little clip-on cable made up with a 120Ohm resistor on it so i can clip to the CAN-H and CAN-L lines, and a single terminator has been enough for me. I've been able to do certain things to the Instrument Cluster or the BEM or the ICC whilst out of the car doing this very thing. A friend of mine has also done this to a PCM with a CAPA box.

I found the easiest way to do this, rather than try to clip to individual pins, was to buy a loom (I scored 2 x cheap dash looms off eBay once - one a BF Fairlane that's now in my XR8, and the other a Territory Ghia with NAVI,) and cut off the connectors.

The HIM, PCM and ABS, however, are all connected to the LHS Engine Bay loom, which is separate from the Dash Loom. This loom is very different from model to model (ABS 5.3 vs 8.0, ZF 6-Speed TCM etc) wheres the Dash loom is common and only has option variations (Premium Suond, NAVI, driving lights/spot lights) The 2nd connector on the PCM connects to the Engine Loom (Plugs, injectors, etc). On some cars, the 3rd plug on the PCM is for Turbo or LPG models. Most PCM's have the 3rd plug blanked out.


Lukeyson

thats what i wanted to hear

so in theory if its possible to disable the ba security and stuff would it be possible to get the ba pcm/motor running standalone?

Hmm. Good question. Maybe.

The big player in the smartshield arrangement is the BEM. When you do a PATS, it's the BEM that stores the Key codes. It's the BEM that challenges the key via the little transmitter in the Keybarrel (TILA). And it's the BEM that stores the keyfob codes it receives via the RKR on the top of the ICC.

When you do a Parameter Reset, the PCM learns the code from the BEM. So during ignition, the BEM challenges the key, accepts or rejects, then asks the PCM to challenge it, and then either mobilises or demobilises the PCM.

I've heard that smartshield can be disabled on the PCM. I don't know how yet.


Lukeyson

thats what i mean, i think headsex might have some knowledge on this

Yeah, Danny's cracked the method for doing PCM programming. I've never had much interest in the PCM. There are a lot of people better than me and with access to fancier tools doing that sort of work. But to be honest I've never spoken to him about disabling smatrshield.

There's a product out there that can apparently already do it. Can't remember the name of it for the life of me though. I've got the name associated with spiders in my head for some reason.

I thought I saw a PID recently that listed modes for smartshield but can't find it right now with my main PC down.


Lukeyson

^ I'd hope it's more than setting a PID, otherwise anyone with a OBD2 tool and a laptop will be able to disable smartshield and drive off....

I'd imagine (like back in EECV days) it requires some code to be removed from the PCM binary, and reflashed (in the EECV case, a J3 chip with the new PCM code added).

I didn't do all that much with the EECV (just some basic parameters, idle, speed limiter and rev limiter etc.)

Hi

Which Danny are we talking about " Danny's cracked the method for doing PCM "

and what product ? can you find out please ?

cheers