pgmfi.org

Hacking up Honda's ECU
It is currently Mon Dec 10, 2018 6:33 am

All times are UTC - 5 hours [ DST ]





Post new topic Reply to topic  [ 36 posts ]  Go to page Previous  1, 2, 3  Next
Author Message
PostPosted: Tue Jul 02, 2013 10:59 am 
Offline

Joined: Tue Jun 18, 2013 8:59 am
Posts: 21
I did build the interface and when I send an RS232 (COM-port) message I see a message (TTL?) comming out on the K-Line with my Logic Analyzer. So this looks good?! My Audi A3 did gave me some message when putting the ignition on ;-)

Tomorrow I will connect on the K-Line of the Honda CBR 1000RR from 2010 (Do not have the bike here...it's in the shed with a friend).

Now looking for some messages to:
- initialize the ECU
- which message a have to send to let the ECU give me back TPS, RPM or other signal

Someone suggestions?


Top
 Profile  
Reply with quote  
PostPosted: Tue Jul 02, 2013 11:12 am 
Offline

Joined: Tue Jun 18, 2013 1:51 pm
Posts: 17
Location: Pacific Northwest USA
did you review the thread I suggested on the previous page?

http://forum.pgmfi.org/viewtopic.php?f=57&t=22199#p129226


Top
 Profile  
Reply with quote  
PostPosted: Tue Jul 02, 2013 11:34 am 
Offline

Joined: Tue Jun 18, 2013 8:59 am
Posts: 21
Thanks! I will try everything what is mentioned there. I do see a signal, but I think my baudrate from Windows is not customizable to 10.400 bps.

And the initiation sequence: 70 milliseconds low - 130 milliseconds can this be done by sending:

Send the command FE 04 FF FF
Wait 20ms (<-- is this exact??)
Send the command 72 05 00 F0 99


Top
 Profile  
Reply with quote  
PostPosted: Tue Jul 02, 2013 11:40 am 
Offline

Joined: Tue Jun 18, 2013 8:59 am
Posts: 21
PS:
It looks like my driver settings from Windows are overruled by the Software I am using to send the Hex messages (0x..). And in the software I can set the custom baudrate.


Top
 Profile  
Reply with quote  
PostPosted: Wed Jul 03, 2013 2:00 pm 
Offline

Joined: Tue Jun 18, 2013 8:59 am
Posts: 21
Oke an update. I have build the Didier circuit. But talking to the K-Line from Honda: (Keihin ED 38770-MFL-D21-6979-100216) I only get an ff 08 when the ignition is put on from the ECU. When I talk to the ECU as is said in the previous posts here I do not get any answer.

What could be wrong?
http://s995.photobucket.com/user/BMWTouring/slideshow/KLine


Top
 Profile  
Reply with quote  
PostPosted: Wed Jul 03, 2013 8:45 pm 
Offline
Senior Developer

Joined: Tue Jul 27, 2004 2:19 am
Posts: 653
Location: France
Sorry BMWMPower for the delay, much work and busy.
I reply tomorrow to your MP :wink:


Top
 Profile  
Reply with quote  
PostPosted: Wed Jul 03, 2013 9:10 pm 
Offline

Joined: Tue Jun 18, 2013 1:51 pm
Posts: 17
Location: Pacific Northwest USA
BMWMPower wrote:
...And the initiation sequence: 70 milliseconds low - 130 milliseconds can this be done by sending:

Send the command FE 04 FF FF
Wait 20ms (<-- is this exact??)
Send the command 72 05 00 F0 99


At T + 0 you need to pull the kline low (UART Break command can be used)
At T + 70mS you need to release Kline hi (cancel Break)
At T + 200mS Send the command FE 04 FF FF (no reply is sent)
At T + 250mS Send the command 72 05 00 F0 99 (ECU should send a reply)


Top
 Profile  
Reply with quote  
PostPosted: Thu Jul 04, 2013 3:23 am 
Offline

Joined: Tue Jun 18, 2013 8:59 am
Posts: 21
@RidgeRacer

The Honda only has one K-Line. Not an High and Low. Or do you mean with High that the pull-up is working and with Low that there is a signal? What tool do you suggest to time the messages like this? Or do I have to develop my own software to do this. On this moment I am interfacing with some hardware with no Microcontroller and directly from RS232 from the PC.....


Top
 Profile  
Reply with quote  
PostPosted: Fri Jul 05, 2013 5:52 pm 
Offline
Senior Developer

Joined: Tue Jul 27, 2004 2:19 am
Posts: 653
Location: France
dip wrote:
Sorry BMWMPower for the delay, much work and busy.
I reply tomorrow to your MP :wink:


BMWMPower, I read the various posts in this topic and others and I do not fully understand the structure of the protocol.

I made a table with the information found in another topic but I do not understand all :
Image

Should be replaced some sensors (map, tps, ect, iat) by a potentiometer.
Then vary the potentiometer for identify the effect in a frame of data.

Another solution, as I have done to the ecu of car : read cpu programm and disassemble to understand the protocol. But I don't have bike ecu.

Regards


Top
 Profile  
Reply with quote  
PostPosted: Fri Jul 05, 2013 6:55 pm 
Offline

Joined: Tue Jun 18, 2013 1:51 pm
Posts: 17
Location: Pacific Northwest USA
first byte is packet type 72 = diagnostic query, 02 = diagnostic reply
second byte is total packet length
third is sub type 72 = get subset of diag table, 71 = get entire table
fourth byte is table select
in sub type 72 fifth byte is startByte, sixth is numberBytes
last byte is checksum (total 8b sum of packet == 0x00)

Your first and fifth groups have identical reply data because the asked for the same thing

72 07 72 11 00 14 F0 is requesting table 11 starting at byte 00 read 0x14 bytes
You show it reading back 0x15 bytes of data. Your first byte of data is actually the reply echoing back the start offset.

72 05 71 11 is requesting table 11 read all bytes (there are only 0x14 bytes total ) so you get the same data set returned (less the echoed offset)

If you wanted to read just the 98,40 out of table 11 you would send

72 07 72 11 04 02 cs (start at Table_11[4] read 2 bytes)

to which the ecu would reply

02 08 72 11 04 98 40 cs

That is what is happening in the second group. It is a request for just the first two bytes of table 11

The 71 subtypes that return no data are not used by this vehicle (72 05 71 12, ...71 13...etc)

In table D0,D1 data is error code bit flags


Top
 Profile  
Reply with quote  
PostPosted: Fri Jul 12, 2013 7:47 am 
Offline

Joined: Tue Jun 18, 2013 8:59 am
Posts: 21
@dip
Build your schematic and send some messages. See slideshow. But the ECU is not talking back

http://s995.photobucket.com/user/BMWTouring/slideshow/Elektronica/KLine


Top
 Profile  
Reply with quote  
PostPosted: Fri Jul 12, 2013 8:50 am 
Offline
Senior Developer

Joined: Tue Jul 27, 2004 2:19 am
Posts: 653
Location: France
I prepare a little explanation to verify that your interface works correctly.


Top
 Profile  
Reply with quote  
PostPosted: Fri Jul 12, 2013 3:21 pm 
Offline

Joined: Tue Jun 18, 2013 8:59 am
Posts: 21
It looks like your interface (from your schematic) does convert the TTL to RS232 and back. This through the MAX232 and invertion and voltage regulation (12V TTL) with the CD4007.

The message is also presented to the K-Line, but the ECU does not answer. I only get FF 08 when putting the ignition on. This looks like nothin relevant. I also used the interface on my Audi A3 (the same message here)...did that just to check.


Top
 Profile  
Reply with quote  
PostPosted: Fri Jul 12, 2013 4:08 pm 
Offline
Senior Developer

Joined: Tue Jul 27, 2004 2:19 am
Posts: 653
Location: France
on the K-line, have you a pull-up resistor to +12V from 1k to 4k7 ?

:arrow: K-Line : Resistor between pin 2 of CON2 and +12V

Honda car ecu have this resistor inside ecu but not sure for all ecu.


Top
 Profile  
Reply with quote  
PostPosted: Fri Jul 12, 2013 4:20 pm 
Offline
Senior Developer

Joined: Tue Jul 27, 2004 2:19 am
Posts: 653
Location: France
Image


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 36 posts ]  Go to page Previous  1, 2, 3  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Bing [Bot] and 24 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  


Powered by phpBB® Forum Software © phpBB Group