RomRaider

Hi,

I've been looking at the messages being broadcast on the high speed CAN bus (available on the OBD port) on an '08 STi, '08 WRX, and '09 WRX. With the exception of the DCCD messages and SI Drive signals there's not much difference between the STi and base model WRX.

Has anyone looked at decoding these messages, specifically the ones from the powertrain ECU? It looks like the three main consumers of these messages are the instrument panel, VDC, and DCCD. I'm most interested in the messages between the ECU and VDC controller. There seems to be signals within these messages that look like requested torque, actual torque, current load, etc. but I haven't been able to work out the scaling, units, or exact definitions.

I think the pertinent ECU-VDC arbitration IDs are:
410,412, and 601

An easy one is arb ID 600:
bit 2 = Clutch Switch
byte 4 = Coolant Temperature

Have any of the ROM disassemblers gone through this portion of the code?

Is there a direct correlation between the signals in these messages and some of the torque tables that have been defined in the ROM?

Does anyone have the Bosch documentation/CAN matrix from the VDC controller?

Thanks!

Ok, here's a silly question: Has anyone been kind enough to post at least a partially disassembled/commented ROM or am I off to install IDA?

Most of the signals are starting to make sense but there are still a few slow (never?) changing ones and perhaps some sort of interlocking data validator value.

Anyone figure out any of the VDC stuff ? How about repurposing the SI Drive button?

Cheers!

No one's posted any disassembled ROMs for Subarus before.

There are some known switches related to VDC that are loggable via SSM. Search for the SSM.pdf document which outlines the SSM protocol. As far as re-purposing SI-Drive, that is certainly possible. I have not messed with the CAN messaging stuff. I'm not even sure where to start with that even if I wanted to. One thing that interests me is ATF temp.

Thanks for the reply, merchgod.

Yes, I've seen the SSM flags and they certainly are interesting although I haven't made a correlation between them and anything being broadcast on CAN just yet.

I have a TCM from a 2009 WRX but I don't have the pinout for it as it seems to be different than the 2008 judging by the connector. If you'd like to look at it or if you have the pinout I can figure out if ATF Temp is being broadcast on the CAN bus. Other than Romraider, I don't have any SSM tools setup here.

I'm not much of a hardware guy. Here's the AT wiring diagram for an 09 FXT. I did look at all the unknown SSM indexed parameters to see if one could possibly be ATF temp, but none changed in a way that I would expect when going from cold to fully warmed-up, so it must be handled exclusively by the TCM (and is accessible via the dealer's SSM tools according to the manual).

Anyone care to share the CAN message definitions that you have?