Service Workshop Functions for Diesel

Jochen_145 · **Joined:** Wed Nov 10, 2010 7:56 am **Posts:** 418

Hey,

as allready in Reset oil dilution threat disscussed, there are some workshop functions for service needed at the EURO4/5 Diesel.

After more and more Diesel getting older and do not need to meet workshop for warranty, people do these service function on theire own. After this, at the Diesels, aou need to reset some counter for e.g. oil dilutation.

But there are more interessing reset or service functions with are very nice to have in RomRaider:

- reading FAP parameter, if you like to replace or chance it
- writing FAP parameter, if you have chanced it
- reading injector codes, if you need to replace them
- wirting injector codes, if you have replaced them

- set ECU in forced regeneration mode
- ...

Got some can sniffs of the SSM-III service routines. After knowing they are OBD- Mode22 based, they are more clear.
For wirting e.g. FAP parameter, the SSM-Tool just overwirte the PID parameter with a new value.

Don´t know, if EURO4 (k-line based SSM-II) will do the same..

We have allready some functions like idle speed setting in RomRaider logger.
If these functions are also "only" over wirting stored parameters, I am quite confident, that for other work shop functions it will be the same.

Any one got more info or experiments ?

BR Jochen

gnif · **Joined:** Thu Nov 19, 2015 12:23 am **Posts:** 30

I have a 2010 2.0D Outback (Australian) which I desperately need to perform a forced regeneration on.

Last I sent my car to be serviced by Subaru I attached a home brew data logger to the CAN bus, so I have captured an entire session of data, this session included a firmware update and forced regen.

I believe I have found the commands to trigger a forced regen, but I believe the ECU needs to be in maintenance mode first. There were two authentication challenges, one we already know the algo and seed for (used by RR already). The other is new:

Code:

AAAA     = The CAN ID (0x7e0 = Scan tool| 0x7e8 = ECU)
BB       = The message length & ISO-TP bits
CC       = The Mode ID (or'd with 0x40 for response)
DD to II = The data

AAAA|BB|CC|DD|EE|FF|GG|HH|II
----------------------------
07e0|02|10|03|00|00|00|00|00 <- Enter mode 3
07e8|06|67|03|11|57|38|62|00 <- Challenge (0x11573862)
07e0|06|27|04|36|02|63|d0|00 <- Response (0x360263d0)
07e8|02|67|04|00|00|00|00|00 <- Accepted

Just before the tool starting monitoring the DPF soot level, and the EGT DPF Temp, the following commands were issued.

Code:

AAAA|BB|CC|DD|EE|FF|GG|HH|II
----------------------------
07e0|03|22|10|31|00|00|00|00
07e0|03|22|10|30|00|00|00|00
07e8|04|62|10|30|ff|00|00|00
07e0|02|10|03|00|00|00|00|00
07e8|06|67|03|11|57|38|62|00
07e0|06|27|04|36|02|63|d0|00
07e8|02|67|04|00|00|00|00|00
07e0|04|31|03|80|02|00|00|00
07e8|06|71|03|80|02|00|01|00

gnif · **Joined:** Thu Nov 19, 2015 12:23 am **Posts:** 30

Well, unless we get someone that is VERY good with H8 assembly, this is going to take a while. I managed to find the changes that prevent the Euro5 auth working, it is not the encryption... they made an absolute mess of commands needed to run first to manipulate a variable until it opens up the encryption auth.

Lots of mode 0x10 calls, and mode 0x27 calls.
See my other thread for details

Jochen_145 · **Joined:** Wed Nov 10, 2010 7:56 am **Posts:** 418

Dale,

after "gnif" successfully entered the security access of his E5 Diesel and shared the seed-and-key algothmen, we can start implementation so of the workshop functions to RomRaider.
It is also needed to implementate Mode 0x22 logging, in best, with DAQ-List oder "steamline" like it is called in "gnif"s theart.

Is there any progress yet ?

May it will be a big help to have the test application, like we have for the k-line on CAN too.
If I can easily set values to the 8 bytes of a CAN-ID by hand, lots of stuff can be done in "develloper-mode" and uses the openPORT interface to get access to the CAN bus.

Best regars
Jochen

dschultz · **Posted:** Sun Aug 28, 2016 7:27 pm

I haven't had the time to work on it. I had worked out the seed/key calc but went no further due to time constraints. The bigger challenge would be to write code for something I can't test against on the bench as we have no diesel ECUs over here.

Jochen_145 · **Joined:** Wed Nov 10, 2010 7:56 am **Posts:** 418

If "remote testing" gives enough informations, I think I have a lot test probants

Maybe extend debug functions.

Onbench testing with E4 / E5 and E6 ECU is possible and I think I can activate some Diesel-friends here in europe, with all kinds of generations of Boxer-Diesels

I myself still drive a k-line based E4 model

Jochen

dschultz · **Posted:** Mon Aug 29, 2016 7:55 am

Maybe if someone could send me an ECU to use on the bench I could work on it over the winter then return the ECU.

Jochen_145 · **Joined:** Wed Nov 10, 2010 7:56 am **Posts:** 418

I allready asked for a E5 ECU to send it to you.
Best will be, if someone got an other spare one, you can keep.

If not, my E5 ECU should have "winter-hollyday in CANADA"

gnif · **Joined:** Thu Nov 19, 2015 12:23 am **Posts:** 30

Just to confirm, I have re-written my tool to better implement ISO-TP and SSM3 with streamlining, it works completely on my Euro5 ECU for both extended mode 22 and mode A8

Code:

  if (!ecuIssueMode22Requests(
    SSM3_MODE22_COOLANT_TEMP     , SSM3_MODE22_FUELRAIL_PRESSURE, SSM3_MODE22_PRIMARY_BOOST  ,
    SSM3_MODE22_FINAL_INJECTION  , SSM3_MODE22_EGT_CAT          , SSM3_MODE22_EGT_DPF        ,
    SSM3_MODE22_INLET_AIR_TEMP   , SSM3_MODE22_DPF_ASH_RATIO    , SSM3_MODE22_DPF_SOOT_RATIO ,
    SSM3_MODE22_DPF_PRESSURE_DIFF, SSM3_MODE22_OIL_DILUTION     , SSM3_MODE22_OIL_CHANGE_DIST,
    SSM3_MODE22_DPF_REGEN_DIST   , SSM3_MODE22_DPF_REGEN_COUNT  , SSM3_MODE22_DPF_REGEN_SW
  )) return false;

Code:

TX: 22 00 05 00 23 10 AC 11 16 00 3C 00 3E 11 1F 11 49 11 4D 11 4A 11 4E 11 55 11 56 11 57 12 5B
RX: 62 00 05 3E 00 23 00 00 10 AC 40 11 16 00 00 00 3C 02 0F 00 3E 02 0D 11 1F 45 11 49 2B 11 4D 04 11 4A 00 11 4E 04 11 55 55 11 56 00 17 11 57 00 A6 12 5B 00

And SSM2 A8 read example

Code:

  if (!ecuIssueModeA8Requests(
    SSM2_MODEA8_ENGINE_LOAD      , SSM2_MODEA8_ENGINE_RPM_HB    , SSM2_MODEA8_ENGINE_RPM_LB  ,
    SSM2_MODEA8_VEHICLE_SPEED    , SSM2_MODEA8_FUEL_LEVEL       , SSM2_MODEA8_BATTERY_VOLTAGE
  )) return false;

Code:

TX: A8 00 00 00 07 00 00 0E 00 00 0F 00 00 10 00 00 2E 00 02 22
RX: E8 FF 00 00 00 FF 71

Sir Dan · **Joined:** Wed Apr 20, 2022 3:33 pm **Posts:** 5

gnif wrote:

Just to confirm, I have re-written my tool to better implement ISO-TP and SSM3 with streamlining, it works completely on my Euro5 ECU for both extended mode 22 and mode A8

Code:

  if (!ecuIssueMode22Requests(
    SSM3_MODE22_COOLANT_TEMP     , SSM3_MODE22_FUELRAIL_PRESSURE, SSM3_MODE22_PRIMARY_BOOST  ,
    SSM3_MODE22_FINAL_INJECTION  , SSM3_MODE22_EGT_CAT          , SSM3_MODE22_EGT_DPF        ,
    SSM3_MODE22_INLET_AIR_TEMP   , SSM3_MODE22_DPF_ASH_RATIO    , SSM3_MODE22_DPF_SOOT_RATIO ,
    SSM3_MODE22_DPF_PRESSURE_DIFF, SSM3_MODE22_OIL_DILUTION     , SSM3_MODE22_OIL_CHANGE_DIST,
    SSM3_MODE22_DPF_REGEN_DIST   , SSM3_MODE22_DPF_REGEN_COUNT  , SSM3_MODE22_DPF_REGEN_SW
  )) return false;

Code:

TX: 22 00 05 00 23 10 AC 11 16 00 3C 00 3E 11 1F 11 49 11 4D 11 4A 11 4E 11 55 11 56 11 57 12 5B
RX: 62 00 05 3E 00 23 00 00 10 AC 40 11 16 00 00 00 3C 02 0F 00 3E 02 0D 11 1F 45 11 49 2B 11 4D 04 11 4A 00 11 4E 04 11 55 55 11 56 00 17 11 57 00 A6 12 5B 00

And SSM2 A8 read example

Code:

  if (!ecuIssueModeA8Requests(
    SSM2_MODEA8_ENGINE_LOAD      , SSM2_MODEA8_ENGINE_RPM_HB    , SSM2_MODEA8_ENGINE_RPM_LB  ,
    SSM2_MODEA8_VEHICLE_SPEED    , SSM2_MODEA8_FUEL_LEVEL       , SSM2_MODEA8_BATTERY_VOLTAGE
  )) return false;

Code:

TX: A8 00 00 00 07 00 00 0E 00 00 0F 00 00 10 00 00 2E 00 02 22
RX: E8 FF 00 00 00 FF 71

I'd like to replicate this tool with CANoe, but I'm not quite sure I understand the entire process (from the other thread) of what your tool does in which order. Is there a summary that I just haven't seen?

Or is this already implemented in RomRaider in the meantime?

RomRaider

Forum rules

Service Workshop Functions for Diesel

Who is online