I posted this in another thread a couple of weeks ago but removed it temporarily until we did some more tests. So far everything seems to work as it should, so I assume it is safe to repost it again here ...
Based on some sparse info about EDC16 error handling I have examined CRD ECU map file and located the necessary locations for disabling various error codes. There are still a few unknowns here but I gathered enough info to make it work for what I wanted to achieve.
To understand ECU error handling the following terms have to be explained:
(1) Error Class Block
Error classes determine the actions upon various error conditions, for example - does a particular DTC activate CEL, is the error code stored in the permanent memory so it can be read with an OBDII scanner, etc. I know the approx. location of Error Class Block but didn't deciphered the structure yet. For DTC disabling error classes aren't needed anyway and you don't modify anything here.
(2) Error Code Block
This memory area contains all DTC codes known by the ECU. Codes are arranged into groups of four and each group forms one Error Path so all codes from the same group have the same Error Class ID. Most likely it was easier for ECU programmers to organize the processing of similar error codes this way and/or the position of code in the list provides some additional info about the error condition. You don't modify anything in this area - Error Code Block is used only to find the appropriate Error Path for each DTC.
(3) Error Path Block
This memory area contains Error Class IDs for each Error Path and this is where things get very interesting. To disable a particular DTC all you have to do is to write a zero to the appropriate location inside this block. I have located memory addresses for both Error Code and Error Path blocks for all software versions I have access to. The necessary tables are here:
http://www.hrastprogrammer.com/jeep/513_DTC.txthttp://www.hrastprogrammer.com/jeep/516_DTC.txthttp://www.hrastprogrammer.com/jeep/526_DTC.txthttp://www.hrastprogrammer.com/jeep/808_DTC.txthttp://www.hrastprogrammer.com/jeep/809_DTC.txthttp://www.hrastprogrammer.com/jeep/811_DTC.txthttp://www.hrastprogrammer.com/jeep/812_DTC.txtFor versions 513, 516, 526, 808 and 812 Error Code Block starts at $E3FDA and Error Path Block starts at $E4872.
For versions 809 and 811 Error Code Block starts at $E39F2 and Error Path Block starts at $E426C.
As I said before, there are still a lot of unknowns here. For example, according to the error code table 222 ($DE) error paths are possible. But error code block contains more than 222*4 codes and they don't have the associated error path. This could be just unused area reserved for future expansion but I am not 100% sure about it. And on 809/811 it doesn't even start where it is supposed to start so I left this area out in those files.
Practical example ... Disable P0102 DTC so you don't have CEL while using ORM (Off-Road Modification - disconnecting MAF sensor to turn EGR off):
Open the appropriate DTC file for your ECU version. My ECU is 513 so I'll open 513_DTC.txt and locate P0102 code inside the table:
[008] P0103 P0102 ----- -----: E4879=16
From the above data you can see that error path for P0102 is 008 and the Error Class ID (16) for this error path is at location $E4879. To disable P0102 all you have to do is to put zero at this location:
Map[$E4879]:=0;
This will also disable P0103 because it is in the same group and has the same error path.
Save the modified map, write it to the ECU and that's it
I was driving with MAF disconnected and CEL turned off for a few weeks without any problem.
Disclaimer: This is all "gray area" and without source code we cannot possibly know how exactly does ECU/ECM work and what could be the additional consequences of this hack! So, if you decide to use it for whatever reason ... I am not responsible for anything - if you destroy your ECU or your car etc. Use at your own risk!
Note #1: EGR can be turned off using different method described in this thread but this is a very nice practical example of DTC disabling technique.
Note #2: I am using $ symbol for hexadecimal notation.
Note #3: I am not claiming that everything I wrote is 100% correct - all this is based on my own examinations, speculations and assumptions. If anyone has more info about EDC16 unit and EDC16 error handling I will be very happy if this knowledge can be shared here so we can all learn from it ...
Login
Register
FAQ
Search
