Hello, again! I haven't posted for some time now, as you can see. I am still working on the reverse engineering project, when I have time. My latest crazy idea has been to port the code to C# so I can run and debug it on my PC. It's never going to actually run my car, but it is useful to be able to run it and trace the program flow, instead of just staring at static code. It also gives me a perverse sense of nerd joy knowing that I'm probably the only one that's ever run the NB code in C#. :P
Anyway, I'm writing today to (shamelessly) ask you to please click on an ad or two if you find any of this stuff interesting. It won't cost you anything, and it may net me a penny or two. To give you an idea of how little money we're talking about, to date the blog has been viewed about 2,000 times, and I've made less than $2 from the ads. So it's obviously not going to make me any real money, but think of it as your way of encouraging me to continue sharing with you what I'm finding out about the NB ECU. Thanks! And thank you especially for the handful of readers that have left an encouraging note. That's a great motivator for me!
I've been reverse-engineering ECUs since 2001. This blog is to share what I've learned about Honda and Mazda ECUs and to provide you with tips and advice if you would like to hack your own ECU.
Tuesday, May 29, 2012
Saturday, January 14, 2012
NB Miata - OBD Mode 13
Happy Friday the 13th! Are you superstitious? I'm not - especially not about the number 13. Speaking of which, we're talking about OBD Mode 13 today. OK, so 13 in this case is actually a hexadecimal number, but anyway...
The ECU subroutines that handle Mode 13 are also shared with Modes 3 and 7. It appears that, while the request messages for Modes 3 and 7 do not (actually, cannot) contain a PID, Mode 13 messages can contain extra bytes after the mode number. I wish I could tell you what they are used for, if anything, but at this point, I don't know.
What I can tell you is that mode 13 reports the same DTCs as Mode 3, plus:
P0605 - Internal Control Module ROM Error
P1602 - Immobilizer / ECM Communication Error
P1603 - ID Number Unregistered
P1604 - Code Word Unregistered
P1621 - Immobilizer Code Words Do Not Match
P1622 - Immobilizer ID Does Not Match
P1623 - Immobilizer Code Word/ID Number Write Failure
P1624 - Vehicle anti-theft system malfunction
P1631 - Alternator Regulator #2 Control Circuit
P1633 - Generator Control System - over charge
P1634 - Generator Control System - no charge
I could be wrong about the meaning of the last three. But what you can see from looking at the rest of the list is that they represent a class of errors that have more to do with the system electronics than the engine, so they are different. I'm particularly interested in how the immobilizer works, and will post more about it later.
It's been about 9 months since I have looked at the code, so it will take me a little bit of time to get back to where I was, but if I recall correctly, there may be some additional requirements that must be met in order to access Mode 13 (such as placing a jumper somewhere or something). As I get back into analyzing the code, I will update this post with any additional info I find.
Next up, Mode 14.
The ECU subroutines that handle Mode 13 are also shared with Modes 3 and 7. It appears that, while the request messages for Modes 3 and 7 do not (actually, cannot) contain a PID, Mode 13 messages can contain extra bytes after the mode number. I wish I could tell you what they are used for, if anything, but at this point, I don't know.
What I can tell you is that mode 13 reports the same DTCs as Mode 3, plus:
P0605 - Internal Control Module ROM Error
P1602 - Immobilizer / ECM Communication Error
P1603 - ID Number Unregistered
P1604 - Code Word Unregistered
P1621 - Immobilizer Code Words Do Not Match
P1622 - Immobilizer ID Does Not Match
P1623 - Immobilizer Code Word/ID Number Write Failure
P1624 - Vehicle anti-theft system malfunction
P1631 - Alternator Regulator #2 Control Circuit
P1633 - Generator Control System - over charge
P1634 - Generator Control System - no charge
I could be wrong about the meaning of the last three. But what you can see from looking at the rest of the list is that they represent a class of errors that have more to do with the system electronics than the engine, so they are different. I'm particularly interested in how the immobilizer works, and will post more about it later.
It's been about 9 months since I have looked at the code, so it will take me a little bit of time to get back to where I was, but if I recall correctly, there may be some additional requirements that must be met in order to access Mode 13 (such as placing a jumper somewhere or something). As I get back into analyzing the code, I will update this post with any additional info I find.
Next up, Mode 14.
Subscribe to:
Posts (Atom)