How to build yourself a fault code reader and eraser...
For those that like to tangle a little with electronics and programming I can suggest another thing (fully legal and documented this time)....
Fact:
Because of the known regulations in automotive domain, newer than MY2006 cars should have the CAN-BUS network implemented. And also the diagnostic tools will use the CAN network.
And all JLR cars are compliant with that (even the older ones), respecting ISO14229 (link) and ISO15765 (link). That J2534 stuff (link) we've talked about until now is just an interface standard implemented on top of those ISO14229 and ISO15765. The documentation could be found on the net by accessing the links embedded in text above.
Fact:
One curious person, could buy a CAN BUS monitor like this (link) from the well known Microchip company and use it to monitor the traffic exchanged on the car's networks. Just like any diagnostic tool developer has done it before coming out with his products. Lots of tutorials on the net, one place of start could be this:
Once you'll do this you can see how the car is fully complying with the above mentioned standards.
From this point, it's only a matter of implementing the above mentioned standards and modifying the software sources freely supplied on its website by Microchip with that demo kit and use the kit for building your own fault code reader and eraser and, why not, more....
I've done it and if anybody that's inclined towards software and hardware developing is interested, we can further talk and guide you how this can be achieved. Schematics, protocol, commands, etc...
A small proof is in this thread (link), but the software in this moment is much evolved than that. Sorry, the language is Romanian, but you'll get the picture...
PS: Note that on that 55 USD demo kit are coming two identical boards and you'll only need one for monitoring the CAN traffic. So you'll have an ready to use interface at about 30 USD.
Last edited by alex_pescaru on 28th Nov 2018 5:49 pm. Edited 1 time in total
31st Oct 2013 8:31 pm
Robbie
Member Since: 05 Feb 2006
Location: ¯\_(ツ)_/¯
Posts: 17932
Thanks again Alex as this is a really interesting development that will have much attention on this forum.
I intend to download SDD and run it through my VCI tool to check compatibility and then try the patch to gain full SDD functionality of all of the CCF entries rather than just the normal locked-down version.
Land Rover - Turning Drivers into Mechanics Since 1948
Member Since: 18 Jul 2011
Location: Stockport
Posts: 7830
Hardly a How-To type post, more a This-Might-Work type post.
Maybe it's because Alex's posts are totally lost on me, but this all seems somewhat experimental from where I'm viewing it. Mods:
Front Fogs + Halos
FBH Remote Control
The 1st Ever RRS Modded Grill
Garmin Nuvi + D4 Surround + Reversing Camera.
D4 Steering Wheel.
Rear Boot Spoiler.
Twin Brake Lights.
Wing Mirror Indicator Repeaters.
Long Roof Rails
Make your own Narpy grill thread
I'm not scared, I'm outta here.
31st Oct 2013 9:31 pm
Robbie
Member Since: 05 Feb 2006
Location: ¯\_(ツ)_/¯
Posts: 17932
The how-to post received some criticism. What we have learned so far suggests a multi-model, multi-vehicle VIN-free CCF editing and diagnostic machine can be yours for less than a tank of diesel.
Which is kind of stunning.
I don't think Alex's first language is English either, so his efforts so far have been impressive.
Land Rover - Turning Drivers into Mechanics Since 1948
Sorry, I am from Constanta, Romania, so please excuse my poor English.
Now, for the How to, a little "arid" theory...
All controllers (ECUs) on the car are interconnected on the CAN bus. Each ECU is named a node on this network.
On our cars there are two CAN networks. One high speed network (powertrain) with data being sent/received at 500 kbps and one low speed network (convenience) at 125 kbps.
From the CAN bus architecture (link), we know that each ECU could transmit and receive messages.
A message consists primarily of an ID (identifier), which represents the priority of the message, and up to eight data bytes.
Monitoring the CAN bus, one could easily see that each ECU has one main, principal, ID at which it'll respond.
Those IDs are 11 bit long on some cars (11 bit CAN) and 29 bit long on others (29 bit CAN).
For example, Freelander 2 has a 11 bit CAN network architecture and Discovery 3 has a 29 bit CAN network architecture.
The message IDs at which each ECU respond are well known. I will write them later.
Now, on 11 bit systems, if an ECU is receiving messages with a specific ID, for example 0x7E0 for engine ECU (that 0x prefix is meaning the value following is in hexadecimal), it will respond at that ID value + 8. For the same example, engine ECU will respond at 0x7E8.
On 29 bit systems, all diagnostic IDs have the same base 0x18DA0000. The least significant 16 bit part of that ID (those 0000) will be filled with the tester address, which is an industry standard 0xF1 and with the address of the solicited ECU.
For example, on D3 the engine has an address of 0x10. So the full ID for requesting informations from engine ECU will be 0x18DA10F1. Read from right to left, the tester (0xF1) sends a message to the engine (0x10).
When the ECU responds, is not like on 11 bit systems, where 8 is added to the ID, but by swapping the last two bytes in the ID. The same example, the engine will respond/send messages with the message ID 0x18DAF110. From (0x10) engine to (0xF1) tester.
I hope that up until now is clear.
On Freelander 2 (I keep referring the FL2 as my FL2 was the guinea pig) the IDs for each ECU are as follows:
The "H" and "L" in front mean high speed CAN and low speed CAN networks.
H 0x726 Central Junction Box
H 0x734 Light Control
H 0x737 Airbag
H 0x760 ABS
H 0x765 Occupant Sensor
H 0x792 Terrain Response
H 0x795 Haldex
H 0x797 Steering Angle Sensor
H 0x7E0 Engine
H 0x7E1 Gearbox
L 0x720 Instruments
L 0x733 HVAC
L 0x736 Parking Aid
L 0x740 Drivers Door
L 0x741 Passenger Door
L 0x744 Drivers Seat
L 0x784 Radio
L 0x791 Trailer
L 0x7E3 FFBH
On D3, from what I studied (as I didn't had a D3 guineea pig),
H 0x1C All Terrain Terrain Resp
H 0x15 Cruise Control Acc Cruise
H 0x60 Instrument Pack Inst Pack
H 0x2A Park Brake Park Brake
H 0x10 Eng Management Engine Mgt
H 0x58 Airbag Airbag
H 0x1A Rear Diff Rear Diff
H 0x2B Eas Air Suspension
H 0x32 Steering Angle Stg Angle Sens
H 0x19 Transfer Case Transfer Box
H 0x18 Transmission Auto Gearbox
H 0x20 Abs / Etc
H 0x70 Front Light Afs Head Light
H 0x2C Arcm Ride Control
H 0x5A Ocs Occupant Sens
L 0x80 Head Unit Audio Head
L 0x0F Fbh Fbh Heater
L 0x52 Cjb Body Control
L 0x98 Hevac Hevac
L 0xB2 Pdc Park Aid
L 0xDA Tpm Tyre Pressure
L 0x6D Rdum Dock Module
L 0xC0 Vim Immobilizer
L 0x9C Dcsm Seat Hevac
L 0xBA Rbm Elec Side Step
L 0x99 Rhvac Rear Hevac
More on the next episode...
Last edited by alex_pescaru on 31st Oct 2013 9:53 pm. Edited 1 time in total
31st Oct 2013 9:49 pm
Robbie
Member Since: 05 Feb 2006
Location: ¯\_(ツ)_/¯
Posts: 17932
Nope, I'm lost again!
I really should have stayed awake more in class as I think 'least significant bit' is a trigger phrase that sends me to sleep. Thankfully I am issued with a bunch of guys that understand this stuff at work!
Keep up the work Alex and I will try to catch up.Land Rover - Turning Drivers into Mechanics Since 1948
Member Since: 18 Jul 2011
Location: Stockport
Posts: 7830
Yes fair play, but as these technical posts get more complex ( and lets face it, you need a degree in geek speak for some of it ) it'll only succeed in putting people off until a How-To type post showing you how to put a device together is posted.
I much prefer the posts that show you how and also explain what to do and until that happens, I'm afraid, most of these posts are totally lost on the majority of posters. This might also explain why there's such poor response to Alex's posts when really, he's trying his best to point people in the right direction but not giving any direct help to the majority of us who don't understand the basics let alone the complexities, isn't helping.
Hopefully though something will come out of this that we can all use. Mods:
Front Fogs + Halos
FBH Remote Control
The 1st Ever RRS Modded Grill
Garmin Nuvi + D4 Surround + Reversing Camera.
D4 Steering Wheel.
Rear Boot Spoiler.
Twin Brake Lights.
Wing Mirror Indicator Repeaters.
Long Roof Rails
Make your own Narpy grill thread
I'm not scared, I'm outta here.
31st Oct 2013 10:01 pm
alex_pescaru
Member Since: 19 Dec 2010
Location: RO
Posts: 270
Narpy wrote:
Hardly a How-To type post, more a This-Might-Work type post.
This all seems somewhat experimental from where I'm viewing it.
Indeed, all it was experimental at first, on my sole LR car - imagine the brown pants I had to wear each time I made a trial - but now, on my bench sits a piece of technology with the corresponding software that can fully access my car.
I will explain it all, again, with references to FL2 and not D3 as I didn't had one, but the principles are the same. Maybe one of D3 owners will try to build it. In the end, a starting point is a little more than nothing, isn't it?
Be patient, all in good time, schematics, suggestions, and all...
And I post it here, because on this site I've seen much more technically inclined people than on FL2 (sorry, no offense intended), people that already built electronic pieces of hardware for modding their cars.
Â
31st Oct 2013 10:02 pm
Numpty
Member Since: 18 Aug 2012
Location: Bolton
Posts: 673
Narpy its nearly as complicated as designing the systems on the MRA4 and F35 .......bring back theJaguar with its analogs, discretes and synchro signals.
31st Oct 2013 10:07 pm
Narpy
Member Since: 18 Jul 2011
Location: Stockport
Posts: 7830
At least I'm not alone. Mods:
Front Fogs + Halos
FBH Remote Control
The 1st Ever RRS Modded Grill
Garmin Nuvi + D4 Surround + Reversing Camera.
D4 Steering Wheel.
Rear Boot Spoiler.
Twin Brake Lights.
Wing Mirror Indicator Repeaters.
Long Roof Rails
Make your own Narpy grill thread
I'm not scared, I'm outta here.
31st Oct 2013 10:09 pm
alex_pescaru
Member Since: 19 Dec 2010
Location: RO
Posts: 270
It seems complicated at first, but take into account that many of the technical aspects of what I am saying are already implemented on some devices on the market.
And for the end user will be only a matter of sending some commands from a terminal window.
For example many have heard of the ELM329 OBD interfaces, right? So using such an interface, at least for modules on High Speed CAN, one can diagnose his car...
Last edited by alex_pescaru on 31st Oct 2013 10:20 pm. Edited 3 times in total
31st Oct 2013 10:11 pm
Robbie
Member Since: 05 Feb 2006
Location: ¯\_(ツ)_/¯
Posts: 17932
Numpty wrote:
Narpy its nearly as complicated as designing the systems on the MRA4 and F35 .......bring back theJaguar with its analogs, discretes and synchro signals.
Ah the joys of point-to-point fibre on the F35 eh. I bet you pine for the simplicity of 1553 words on a system that was not locked down to the point of frustration. We never knew we were so well off until it got really really difficult with 'Dave'.Land Rover - Turning Drivers into Mechanics Since 1948
Have you heard of "Land Rover - turning drivers into mechanics since 1948"?
Now, with the new technology why not "Land Rover - turning drivers into geeks since 2005"....
31st Oct 2013 10:14 pm
SteveNorman
Member Since: 14 Oct 2005
Location: Somerset
Posts: 1144
Interesting Alex,
So if you have a Can Bus fault, say a wiring fault, with CAN communication fault codes, is there any way of 'seeing' which modules are offline? Or is it no different than seeing the modules on SDD?
I have scoped can hi/lo, on both hi & lo speed CAN & also LIN, but have failed to make sense of any signals, apart from knowing the signals are there.
regards
steve
31st Oct 2013 10:35 pm
galwaygreen
Member Since: 30 Oct 2011
Location: plymouth
Posts: 6525
glad im a chippy...but it all looks very impresive...good luck
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
