It is currently Tue Oct 27, 2020 4:44 pm

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 1774 posts ]  Go to page Previous  1 ... 21, 22, 23, 24, 25, 26, 27 ... 89  Next
Author Message
 Post subject: DTC Disable (with P0102 ORM example)
PostPosted: Fri May 01, 2015 8:40 am 
Offline
LOST Newbie
User avatar

Joined: Fri Jan 16, 2015 5:32 am
Posts: 11
I posted this in another thread a couple of weeks ago but removed it temporarily until we did some more tests. So far everything seems to work as it should, so I assume it is safe to repost it again here ...

Based on some sparse info about EDC16 error handling I have examined CRD ECU map file and located the necessary locations for disabling various error codes. There are still a few unknowns here but I gathered enough info to make it work for what I wanted to achieve.

To understand ECU error handling the following terms have to be explained:

(1) Error Class Block

Error classes determine the actions upon various error conditions, for example - does a particular DTC activate CEL, is the error code stored in the permanent memory so it can be read with an OBDII scanner, etc. I know the approx. location of Error Class Block but didn't deciphered the structure yet. For DTC disabling error classes aren't needed anyway and you don't modify anything here.

(2) Error Code Block

This memory area contains all DTC codes known by the ECU. Codes are arranged into groups of four and each group forms one Error Path so all codes from the same group have the same Error Class ID. Most likely it was easier for ECU programmers to organize the processing of similar error codes this way and/or the position of code in the list provides some additional info about the error condition. You don't modify anything in this area - Error Code Block is used only to find the appropriate Error Path for each DTC.

(3) Error Path Block

This memory area contains Error Class IDs for each Error Path and this is where things get very interesting. To disable a particular DTC all you have to do is to write a zero to the appropriate location inside this block. I have located memory addresses for both Error Code and Error Path blocks for all software versions I have access to. The necessary tables are here:

http://www.hrastprogrammer.com/jeep/513_DTC.txt
http://www.hrastprogrammer.com/jeep/516_DTC.txt
http://www.hrastprogrammer.com/jeep/526_DTC.txt
http://www.hrastprogrammer.com/jeep/808_DTC.txt
http://www.hrastprogrammer.com/jeep/809_DTC.txt
http://www.hrastprogrammer.com/jeep/811_DTC.txt
http://www.hrastprogrammer.com/jeep/812_DTC.txt

For versions 513, 516, 526, 808 and 812 Error Code Block starts at $E3FDA and Error Path Block starts at $E4872.

For versions 809 and 811 Error Code Block starts at $E39F2 and Error Path Block starts at $E426C.

As I said before, there are still a lot of unknowns here. For example, according to the error code table 222 ($DE) error paths are possible. But error code block contains more than 222*4 codes and they don't have the associated error path. This could be just unused area reserved for future expansion but I am not 100% sure about it. And on 809/811 it doesn't even start where it is supposed to start so I left this area out in those files.

Practical example ... Disable P0102 DTC so you don't have CEL while using ORM (Off-Road Modification - disconnecting MAF sensor to turn EGR off):

Open the appropriate DTC file for your ECU version. My ECU is 513 so I'll open 513_DTC.txt and locate P0102 code inside the table:

[008] P0103 P0102 ----- -----: E4879=16

From the above data you can see that error path for P0102 is 008 and the Error Class ID (16) for this error path is at location $E4879. To disable P0102 all you have to do is to put zero at this location:

Map[$E4879]:=0;

This will also disable P0103 because it is in the same group and has the same error path.

Save the modified map, write it to the ECU and that's it :-)

I was driving with MAF disconnected and CEL turned off for a few weeks without any problem.

Disclaimer: This is all "gray area" and without source code we cannot possibly know how exactly does ECU/ECM work and what could be the additional consequences of this hack! So, if you decide to use it for whatever reason ... I am not responsible for anything - if you destroy your ECU or your car etc. Use at your own risk!

Note #1: EGR can be turned off using different method described in this thread but this is a very nice practical example of DTC disabling technique.

Note #2: I am using $ symbol for hexadecimal notation.

Note #3: I am not claiming that everything I wrote is 100% correct - all this is based on my own examinations, speculations and assumptions. If anyone has more info about EDC16 unit and EDC16 error handling I will be very happy if this knowledge can be shared here so we can all learn from it ...

_________________
http://www.hrastprogrammer.com/hrastwerk/
http://hrastprogrammer.bandcamp.com/


Top
 Profile  
 
 Post subject: Re: DTC Disable (with P0102 ORM example)
PostPosted: Fri May 01, 2015 11:48 am 
Offline
LOST Junkie
User avatar

Joined: Mon Oct 20, 2008 12:24 pm
Posts: 977
Location: Victoria, Canada
HrastProgrammer wrote:
Based on some sparse info about EDC16 error handling I have examined CRD ECU map file and located the necessary locations for disabling various error codes.
...

Great work!
This could be used to fix the "Weeks elbow"/"DTC code delete" issue then?


Top
 Profile  
 
 Post subject: Re: DTC Disable (with P0102 ORM example)
PostPosted: Fri May 01, 2015 12:03 pm 
Offline
LOST Junkie
User avatar

Joined: Mon Oct 20, 2008 12:24 pm
Posts: 977
Location: Victoria, Canada
Squeeto wrote:
HrastProgrammer wrote:
Based on some sparse info about EDC16 error handling I have examined CRD ECU map file and located the necessary locations for disabling various error codes.
...

Great work!
This could be used to fix the "Weeks elbow"/"DTC code delete" issue then?

Sure enough!
808_DTC.txt shows P1140 at E4945, exactly correct.

Okay, now we have a fix for the other tunes.
Thank you HrastProgrammer.

According to this information, if you want to remove the DTC P1140 error for someone who removes his/her FCV, you need to set the value to zero at this location:
ecu - hex address
513 - E4945
516 - E4945
526 - E4945
808 - E4945
809 - E433C
811 - E433C
812 - E4945


Top
 Profile  
 
 Post subject: Re: DIY ECU Flash
PostPosted: Fri May 01, 2015 1:00 pm 
Offline
LOST Addict

Joined: Fri Jun 22, 2007 11:43 am
Posts: 4924
Location: Green Cove Springs FL
Squeeto wrote:
Squeeto wrote:
HrastProgrammer wrote:
Based on some sparse info about EDC16 error handling I have examined CRD ECU map file and located the necessary locations for disabling various error codes.
...

Great work!
This could be used to fix the "Weeks elbow"/"DTC code delete" issue then?

Sure enough!
808_DTC.txt shows P1140 at E4945, exactly correct.

Okay, now we have a fix for the other tunes.
Thank you HrastProgrammer.

According to this information, if you want to remove the DTC P1140 error for someone who removes his/her FCV, you need to set the value to zero at this location:
ecu - hex address
513 - E4945
516 - E4945
526 - E4945
808 - E4945
809 - E433C
811 - E433C
812 - E4945


Can the same be done for MAF codes like P0101 and P0103?

_________________
Provent, intake elbow, and EGR delete. 5 volt bosch glow plugs
Yeti stage 4 ECU tune. Straight pipe exhaust. DIY intercooler hoses.
Aftermarket intercooler
Fixed Flex Fan and modified factory 190F thermostat
Replaced cylinder head (cracked) at 160,000 miles + ARP studs
2.5 inch lift, JBA upper arms, 235-85-16 tires.


Top
 Profile  
 
 Post subject: Re: DIY ECU Flash
PostPosted: Fri May 01, 2015 1:11 pm 
Offline
LOST Junkie
User avatar

Joined: Mon Oct 20, 2008 12:24 pm
Posts: 977
Location: Victoria, Canada
I suppose.
HrastProgrammer would be the best for insight but according to the text file for the 811 (I assume that is what you have):
[007] P0101 P0101 ----- -----: E4272=25
[008] P0103 P0102 ----- -----: E4273=16

Set E4272 and E4273 to zero.


Top
 Profile  
 
 Post subject: Re: DIY ECU Flash
PostPosted: Fri May 01, 2015 1:23 pm 
Offline
LOST Newbie
User avatar

Joined: Fri Jan 16, 2015 5:32 am
Posts: 11
Yes, this is correct.

I am not 100% sure what to do if a code is in more than one error path - all paths should be set to zero, I suppose.

I hope this will be useful to you all. Please, post your results here ...

_________________
http://www.hrastprogrammer.com/hrastwerk/
http://hrastprogrammer.bandcamp.com/


Top
 Profile  
 
 Post subject: Re: DIY ECU Flash
PostPosted: Fri May 01, 2015 3:02 pm 
Offline
LOST Junkie
User avatar

Joined: Sat Jul 11, 2009 4:17 pm
Posts: 852
Location: Biella Italia
great great job , but in a 812 there is not a E4945 , but only E4944 -E4946

_________________
ECU Tuner -EGR OFF -DPF OFF Swirl/Flap OFF, Lambda OFF , DTC OFF in many cars , not ONLY Jeep


Top
 Profile  
 
 Post subject: Re: DIY ECU Flash
PostPosted: Fri May 01, 2015 3:22 pm 
Offline
LOST Junkie
User avatar

Joined: Sat Jul 11, 2009 4:17 pm
Posts: 852
Location: Biella Italia
sorry , but I must watch the map in 8 bit ?

_________________
ECU Tuner -EGR OFF -DPF OFF Swirl/Flap OFF, Lambda OFF , DTC OFF in many cars , not ONLY Jeep


Top
 Profile  
 
 Post subject: Re: DIY ECU Flash
PostPosted: Fri May 01, 2015 3:31 pm 
Offline
LOST Junkie
User avatar

Joined: Sat Jul 11, 2009 4:17 pm
Posts: 852
Location: Biella Italia
got it , I must watch the map in 8bit for find the right address , my compliment for these study , great job ...........really

_________________
ECU Tuner -EGR OFF -DPF OFF Swirl/Flap OFF, Lambda OFF , DTC OFF in many cars , not ONLY Jeep


Top
 Profile  
 
 Post subject: Re: DIY ECU Flash
PostPosted: Sat May 02, 2015 12:17 am 
Offline
LOST Newbie
User avatar

Joined: Fri Jan 16, 2015 5:32 am
Posts: 11
Yes, error classes are 8-bit values. Enjoy :D

_________________
http://www.hrastprogrammer.com/hrastwerk/
http://hrastprogrammer.bandcamp.com/


Top
 Profile  
 
 Post subject: Re: DIY ECU Flash
PostPosted: Sun May 03, 2015 6:41 am 
Offline
LOST Junkie
User avatar

Joined: Sat Jul 11, 2009 4:17 pm
Posts: 852
Location: Biella Italia
can you explain me how you can find the address of the dtc ? example P0102 on the map ? I know there is a formula , but I can't find it

_________________
ECU Tuner -EGR OFF -DPF OFF Swirl/Flap OFF, Lambda OFF , DTC OFF in many cars , not ONLY Jeep


Top
 Profile  
 
 Post subject: Re: DIY ECU Flash
PostPosted: Sun May 03, 2015 7:01 am 
Offline
LOST Newbie
User avatar

Joined: Fri Jan 16, 2015 5:32 am
Posts: 11
You don't need a formula for this. Just open the appropriate DTC file from my list (for example, 808_DTC.txt) with a text editor (or in a browser, for that matter). Then search for the code you need:

Code:
[001] P0630 P0630 U0168 P0513: E4872=02
[002] P0647 P0646 P0645 P0647: E4873=00
[003] P0533 P0532 U1113 -----: E4874=02
[004] P0606 P0606 P0606 P0606: E4875=00
[005] ----- ----- ----- -----: E4876=02
[006] ----- ----- ----- -----: E4877=00
[007] P0101 P0101 ----- -----: E4878=25
[008] P0103 P0102 ----- -----: E4879=16 => This is the location you searched for!
[009] B10B5 B10B4 B10B6 B10B5: E487A=02
[010] ----- ----- ----- -----: E487B=00
[011] P2123 P2122 ----- P2138: E487C=02
[012] P2128 P2127 ----- P2138: E487D=02
[013] ----- ----- ----- -----: E487E=00
...


So, all you need to do is to change (using WinOLS) the value at the address E4879 from 16 to zero ...

_________________
http://www.hrastprogrammer.com/hrastwerk/
http://hrastprogrammer.bandcamp.com/


Top
 Profile  
 
 Post subject: Re: DIY ECU Flash
PostPosted: Sun May 03, 2015 10:51 am 
Offline
LOST Junkie
User avatar

Joined: Sat Jul 11, 2009 4:17 pm
Posts: 852
Location: Biella Italia
I understand it , but I'd like to know how you did find them

_________________
ECU Tuner -EGR OFF -DPF OFF Swirl/Flap OFF, Lambda OFF , DTC OFF in many cars , not ONLY Jeep


Top
 Profile  
 
 Post subject: Re: DIY ECU Flash
PostPosted: Sun May 03, 2015 11:46 am 
Offline
LOST Newbie
User avatar

Joined: Fri Jan 16, 2015 5:32 am
Posts: 11
I bought some info from:

https://sites.google.com/site/vagecumapmirror/edc16-error-dtc-removal

... and used it as a kick start while exploring CRD map file (the info is for Seat Leon).

_________________
http://www.hrastprogrammer.com/hrastwerk/
http://hrastprogrammer.bandcamp.com/


Top
 Profile  
 
 Post subject: Re: DIY ECU Flash
PostPosted: Sun May 03, 2015 12:31 pm 
Offline
LOST Junkie
User avatar

Joined: Sat Jul 11, 2009 4:17 pm
Posts: 852
Location: Biella Italia
Image

_________________
ECU Tuner -EGR OFF -DPF OFF Swirl/Flap OFF, Lambda OFF , DTC OFF in many cars , not ONLY Jeep


Top
 Profile  
 
 Post subject: Re: DIY ECU Flash
PostPosted: Mon May 04, 2015 4:57 am 
Offline
LOST Junkie
User avatar

Joined: Sat Jul 11, 2009 4:17 pm
Posts: 852
Location: Biella Italia
now I can do by hand :-)r

thanks again , I have another question , how you have find the start of Error code block and error path block

_________________
ECU Tuner -EGR OFF -DPF OFF Swirl/Flap OFF, Lambda OFF , DTC OFF in many cars , not ONLY Jeep


Top
 Profile  
 
 Post subject: Re: DIY ECU Flash
PostPosted: Mon May 04, 2015 12:13 pm 
Offline
LOST Junkie
User avatar

Joined: Mon Oct 20, 2008 12:24 pm
Posts: 977
Location: Victoria, Canada
Yeti wrote:
now I can do by hand :-)r

thanks again , I have another question , how you have find the start of Error code block and error path block


Is this what you want?:
HrastProgrammer wrote:
For versions 513, 516, 526, 808 and 812 Error Code Block starts at $E3FDA and Error Path Block starts at $E4872.

For versions 809 and 811 Error Code Block starts at $E39F2 and Error Path Block starts at $E426C.


Top
 Profile  
 
 Post subject: Re: DIY ECU Flash
PostPosted: Mon May 04, 2015 5:09 pm 
Offline
LOST Junkie
User avatar

Joined: Sat Jul 11, 2009 4:17 pm
Posts: 852
Location: Biella Italia
thanks Squeeto , but no , I would want to know how to find this address .....example in other map of other car , I know is a very difficult job and HrastProgrammer have impressed me doing this , and I would be honored if he could explain to me how did this

_________________
ECU Tuner -EGR OFF -DPF OFF Swirl/Flap OFF, Lambda OFF , DTC OFF in many cars , not ONLY Jeep


Top
 Profile  
 
 Post subject: Re: DIY ECU Flash
PostPosted: Mon May 04, 2015 5:19 pm 
Offline
LOST Junkie
User avatar

Joined: Mon Oct 20, 2008 12:24 pm
Posts: 977
Location: Victoria, Canada
HrastProgrammer wrote:
I bought some info from:

https://sites.google.com/site/vagecumapmirror/edc16-error-dtc-removal

... and used it as a kick start while exploring CRD map file (the info is for Seat Leon).


BTW, if anyone is interested and this link doesn't work for them (it didn't for me), try the non-mirror:
https://sites.google.com/site/vagecumap ... tc-removal


Top
 Profile  
 
 Post subject: Re: DIY ECU Flash
PostPosted: Tue May 05, 2015 12:45 am 
Offline
LOST Newbie
User avatar

Joined: Fri Jan 16, 2015 5:32 am
Posts: 11
Yeti wrote:
thanks Squeeto , but no , I would want to know how to find this address .....example in other map of other car , I know is a very difficult job and HrastProgrammer have impressed me doing this , and I would be honored if he could explain to me how did this


Well, there is no universal recipe for this. And various greedy dealers and tuners are charging hundreds/thousands of dollars/euros/whatever to remove DTCs but don't disclose any info about how they did it :wink:

Based on this EDC16 info for Seat Leon I searched for a few codes in the map file trying to figure out the beginning of the table. Basically, search for the four consecutive 0606 codes (0606 0606 0606 0606) and you will be very close to the start of Error Code Block table. Then go upwards until the values don't show a meaningful DTCs anymore. I don't have WinOLS here so I cannot give you the exact example but there is a byte like DE hexadecimal immediately before the table.

To find the start of Error Path Block search for a 200+ consecutive bytes of 0 to 31 (hex. 00 to 1F) values and there is a pretty good chance this will be an Error Path Block (I wrote a simple program for this). Then I used those TCM P0700 codes as a reference (15 consecutive bytes with a value of 22) and counted upwards to find the start of the table. Or something like that, I don't remember the exact details anymore.

I am a computer programmer so I am used to try to figure out "what the writer had in mind" ...

_________________
http://www.hrastprogrammer.com/hrastwerk/
http://hrastprogrammer.bandcamp.com/


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 1774 posts ]  Go to page Previous  1 ... 21, 22, 23, 24, 25, 26, 27 ... 89  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 8 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group. Color scheme by ColorizeIt!
Logo by pixeldecals.com