Software On ELM Street - OBD2 Software Development

[jezzab]

Welcome to the world of 29bit and 11bit CAN Tazz if you have any questions feel free to ask.
29bit is more for reading the status of things or the commands the module has sent out to make something do something
11bit is used for diagnostic complete device control plus changing modules configuration etc. Plus with 11bit you are just speaking to one module, not listening to all the conversations in a crowded room like 29bit

[TazzI]

Welcome to the world of 29bit and 11bit CAN Tazz if you have any questions feel free to ask.
29bit is more for reading the status of things or the commands the module has sent out to make something do something
11bit is used for diagnostic complete device control plus changing modules configuration etc. Plus with 11bit you are just speaking to one module, not listening to all the conversations in a crowded room like 29bit

Cheers Jez, Iv started to understand that now after reading the GMlan thread. Still wrapping my head around the whole "mask" thing.. it makes sense one moment, but then I read the elm datasheet explanation and my head just explodes. ELM327 seems to be fairly limited as I saw with Matti testing and getting a buffer full every few lines without a filter and mask present.

If this damn cable ever rolls up, Ill be able to test if my "fake" pcm application works and start reversing bits and pieces. Although dont think there is a whole lot of "goodies" for VZ and below, only manufacture specific pids.

[TazzI]

If anyones ever interested in learning how to reverse a pcm and understand the equipment and process required, I highly recommend googling "dimented24x7". A fair few different forums should have posts from this bloke. Absolutely amazing all the work that he has completed!

Most of his stuff is pcm related, learning how to open them up, edit them and successfully tune them. He also goes through the requirements for developing your own tuning software, Well, how to actually access the pcm and grab the bin, then reupload. Main issues to overcome are actually having a device/cable capable of doing this such as a AVT cable.. it has been found the the elm327 is not cable of being used despite it supports the required protocol(PWM) but lacks the allowed transmitting bytes (8 max). Surprised noone has tried developing their own device to cater for this.. excluding current tuning companies.

The other requirement is developing/coding your own bootloader to upload to the pcm so that it is then executed in ram to allow for a full dump of the pcms memory. And same procedure of writing. Hat off to anyone that has successfully developed a bootloader due to learning machine code/ coding in Motorola isnt easy, let alone the amount of trial and error that would be required!

It has been suggested to get a good understanding of whats going on, is to listen to a read/write from a tune to see what the bootloader is actually doing. Id assume that this is what a tech2 would be doing for software updates possibly? Not 100% sure on that. But a listen would give a very quick understanding of what is actually going on after decompiling the code and commenting on each line, obviously using this code would have "legal" issues, although anyone with a bit of dedication can learn from it and develop their own.

Back onto the elm, it has also been suggested that there is no reason why the elm cant program the pcm over VPW, it will just take 4 times as long. A brave sole over at delco said that he "did" have software that did this.. whether or not this is true is a whole other story.

Well, found all the above fairly interesting, might be something to look into one day. The vpw/can logger im currently working is more amusing at the moment, just need to test the new version on some VZ's to see what protocol is thriving through them, and see if the newly implemented CAN protocol is working happily now.

[jezzab]

Re: programming via an ELM. I have attempted to program a module in 11bit with an ELM. I could 1/2 do it. The problem was timing. See the ECU has to write the blocks as you upload them and while its thinking it will send a 0x78 response which means "Im hearing you but im working, shutup and give me a minute and then send again when i tell you im ready", the problem is there is no IRQ on the ELM so you can only put in a set delay and if the timing goes out then it will fail with a GPF (General Programming Fault)

Jez

[ZerOne]

If it helps Tazzi, Mace (and Trifecta performance) in the states) offer a remote tuning service using this little beastie.

http://store.mp3car.com/OBDLink_SX_2_0_ ... om-145.htm

http://www.trifectaperformance.com/

It looks like trifecta have made their own software for High Speed Can, which they use in combination with the above dongle to email tunes to customers.
(MACE has either licensed the software, or is sending the log files to trifecta in the States to create the tune file, making Trifecta a provider of wholesale priced tunes for Mace).

Uploading Tune files (Engine and transmission) took around 15 minutes or so
So it definitely can be done using some cheap hardware.

[TazzI]

Re: programming via an ELM. I have attempted to program a module in 11bit with an ELM. I could 1/2 do it. The problem was timing. See the ECU has to write the blocks as you upload them and while its thinking it will send a 0x78 response which means "Im hearing you but im working, shutup and give me a minute and then send again when i tell you im ready", the problem is there is no IRQ on the ELM so you can only put in a set delay and if the timing goes out then it will fail with a GPF (General Programming Fault)

Jez

hahahahaha, that made my day.
Sounds like the ecu is a grumpy bugger.

What exactly is "IRQ"?

Doesnt sound..tooooo bad.. just have to monitor for the 78 response each time. I guess Im also assuming that the elm is capable of doing this since its limited by a 8byte write buffer. Would require some know how to develop ya own.

If it helps Tazzi, Mace (and Trifecta performance) in the states) offer a remote tuning service using this little beastie.

http://store.mp3car.com/OBDLink_SX_2_0_ ... om-145.htm

http://www.trifectaperformance.com/

It looks like trifecta have made their own software for High Speed Can, which they use in combination with the above dongle to email tunes to customers.
(MACE has either licensed the software, or is sending the log files to trifecta in the States to create the tune file, making Trifecta a provider of wholesale priced tunes for Mace).

Uploading Tune files (Engine and transmission) took around 15 minutes or so
So it definitely can be done using some cheap hardware.

Are you saying that the OBDlink cable and trifectaperformance cables are the same? Since thres a massive price difference! $250 for the cable from Trifecta, Id assume that cable would be similar to the AVT cables.

But at 15mins, that sounds fairly long since though it normally takes about 4-5mins to tune with AVT or tuner cables ect. The cables look similar although wouldnt think they are.



A few of the boys at delco seem to be having trouble connecting their cable in car. But the software works on bench with power supplied to pin 16. After a little bit of research, looks like its actually a common problem, I even found a few mentioning that they had it communicating on bench to software although failing once connected in car.
Immediate thoughts are the obd port has a dodgy connection, but turns out most sorted the issue by uninstalling the drivers, downloading the newest FTDI drivers directly from their site and then manually clicking on the driver install for the cable and navigating to the FTDI folder downloaded.
I dont see how this affects the cable when in car, but seems to have sorted it for those having issues.

[TazzI]

AAHhhhh HAAA! Zerone, your right, they DO use that cable!.

But...

while we do use that hardware, it has our own custom firmware on it to support reflash. Those cables are readers only, they do not write without or proprietary modifications to the software.

So... reprogramming the firmware hey...if its been done once.. it can done again

[jezzab]

IRQ is an Interrupt Request. Basically you could set a CAN IRQ and as soon as data is recieved it will fire off a function, no matter what you are doing at the time (its all in the background). Means your not sitting in a wait loop with the CPU tied up doing nothing. It will run it then go back to doing what ever it was doing before until another IRQ is fired. And also means you dont have a loop checking all the time for a certain response.

So if you made an IRQ and then had it check for a 78 and then put it into a loop to keep checking the IRQ and nothing else it would work very very well 78 means you can send any more data until you recieve the next packet from the ECM. All ECMs do this but some are slower then others. Even reading DIDs or flashing etc.

[TazzI]

Ahh ok, looks like the pic18f series does have interrupt requests. Just havent been implemented in a way that we would be after. I think the interrupt is set when anything is sent form the computer to the pic, well at least when its doing the ATMA and as soon as anything is sent to the elm from the computer it stops.

I guess having the pic "search" for the 78 response wouldnt be too bad. Would look for the normal response (headers) then if the responsive contains the 78, send back to computer saying "Im busy hold up!". Alternatively, can just send everything back to the computer and do the processing there.

Not sure if the device that the trifecta mob are using actually uses a pic, think it might be using a better chip, a stn110 (something like that) from scantool.net. Didnt find out much about programming one of those.


Back to the standard elm stuff, Im almost certain now that the device drivers play a big role when connected in car, some of these chinese clones use old schematics and software on boards, and either a) need very old ftdi drivers or b) need very new ftdi drivers to work.
I think it depends on the chip used, what software version has been used.

Have bought another 2 cables.. will be able to test in a couple weeks.. if they rock up.

[TazzI]

Updated a few little things. Just need to select the appropriate protocol and connect. Should happily detect elm, set protocol and all other things when connected to car.

Also added support for vin for the CAN, and also redid it for the VPW protocol. If the elm still answers back "NO DATA", then the PCM isnt responding back to the VIN request!

Hopefully the new updates work happily, I am working blind without a cable or car to work on!.