Happy Friday the 13th! Are you superstitious? I'm not - especially not about the number 13. Speaking of which, we're talking about OBD Mode 13 today. OK, so 13 in this case is actually a hexadecimal number, but anyway...
The ECU subroutines that handle Mode 13 are also shared with Modes 3 and 7. It appears that, while the request messages for Modes 3 and 7 do not (actually, cannot) contain a PID, Mode 13 messages can contain extra bytes after the mode number. I wish I could tell you what they are used for, if anything, but at this point, I don't know.
What I can tell you is that mode 13 reports the same DTCs as Mode 3, plus:
P0605 - Internal Control Module ROM Error
P1602 - Immobilizer / ECM Communication Error
P1603 - ID Number Unregistered
P1604 - Code Word Unregistered
P1621 - Immobilizer Code Words Do Not Match
P1622 - Immobilizer ID Does Not Match
P1623 - Immobilizer Code Word/ID Number Write Failure
P1624 - Vehicle anti-theft system malfunction
P1631 - Alternator Regulator #2 Control Circuit
P1633 - Generator Control System - over charge
P1634 - Generator Control System - no charge
I could be wrong about the meaning of the last three. But what you can see from looking at the rest of the list is that they represent a class of errors that have more to do with the system electronics than the engine, so they are different. I'm particularly interested in how the immobilizer works, and will post more about it later.
It's been about 9 months since I have looked at the code, so it will take me a little bit of time to get back to where I was, but if I recall correctly, there may be some additional requirements that must be met in order to access Mode 13 (such as placing a jumper somewhere or something). As I get back into analyzing the code, I will update this post with any additional info I find.
Next up, Mode 14.
Great stuff!
ReplyDeleteNewer Mazda's seem to go do most of the diagnostics over CAN bus. This is laid out in ISO15765 and I think 2008 and newer cars are required to implements at least parts of it.
Services 0-9 are just like normal OBDII modes, and then...
<0x28, 0, 0, 0, communicationControl,
<0x85, 0, 0, 0, controlDTCsetting,
<0x10, 0, 0, 0, startDiagnosticSession,
<0x27, 0, 0, 0, securityAccess,
<0x3E, 0, 0, 0, testerPresent,
<0x11, 0, 0, 0, ecuReset,
<0x21, 0, 0, 0, readDataByLocalID,
<0x22, 0, 0, 0, readDataByCommonID,
<0x23, 0, 0, 0, readMemoryByAddress,
<0x3B, 0, 0, 0, writeDataByLocalID,
<0x18, 0, 0, 0, readDTCbyStatus,
<0x12, 0, 0, 0, readFreezeFrameData,
<0x14, 0, 0, 0, clearDiagnosticInformation,
<0x2F, 0, 0, 0, inputOutputControlByCommonID,
<0x31, 0, 0, 0, startRoutineByLocalIdentifier,
<0x32, 0, 0, 0, stopRoutineByLocalIdentifier,
<0x33, 0, 0, 0, requestRoutineResultsByLocalID,
<0x34, 0, 0, 0, requestDownload,
<0x36, 0, 0, 0, transferData,
<0x37, 0, 0, 0, requestTransferExit,
<0xB1, 0, 0, 0, diagnosticCommand,
<0xFF, 0, 0, 0, disabledTestStub,
This is from a RX8 rom. Lots of work!