ABS Hacking

They go by many names, P01, P59, VPW, '0411 etc . Circa 1999 to 2006. All VPW OBD2 PCMs.
User avatar
Posts: 423
Joined: Fri Feb 02, 2018 3:13 pm

Re: ABS Hacking

Postby NSFW » Mon Jun 29, 2020 6:00 pm

jlvaldez wrote:I haven't made it beyond pulling it out of the housing yet, either. Looks like it "just" needs to be desoldered. I had some stuff happen as all this covid crap happened that required my effort elsewhere. So I had to shelf it. I'm trying frantically to get back on track now.

However, I was at a track here, talking to a guy that knows a few people in GM. I told him about how we're unable to get at the OS and need someone to reach out to. He is actually very interested in being able to remove or defeat ice mode. Turns out that he has 2 contacts he knows at GM. One was involved with the C4 electronics and knows all the people that worked on the C5 stuff.

So I had him reach out and start that dialog. I'll follow up with him soon, but want some confirmation. We need the OS binary. I'm surprised they're separate but that's the missing piece.

I was also told he may be able to get his hands on a C5R unit that could be given. However, I don't know if that would help, since I don't know if the C5R ABS unit is the same. If it truly just is a calibration tweak, then why can't we pull the calibration for a C5R and upload it to C5 (of course the means to upload is not yet determined).

I haven't forgotten, it's just been crazy the last few months but things are mostly back to normal.


I've exchanged a couple messages with an ex-GM guy on Linked In, and I'm waiting to hear back from the last one I sent. He's worked on ABS calibration in the past, but I have no idea whether he'll be able to help with flashing. We'll see.

I wasn't able to even get the lid off of the ABS unit. The electrical half and the valve/motor half came apart easily but the top plate with the connector on it is 100% glued to the case and I can't even get a knife in between the two. My next plan is to attack it with a chisel. :)
Please don't PM me with questions about tuning or flashing - start a thread instead. Thanks!

Posts: 106
Joined: Mon Feb 11, 2019 12:48 pm
Location: DFW, Texas

Re: ABS Hacking

Postby jlvaldez » Wed Jul 01, 2020 4:30 pm

It was someone at a speed ship I was talking to about this. He mentioned he had some bad units he'd be willing to give if I asked.

The hard part is pulling the binaries. I'll keep working on trying to get my hands on binaries.

Posts: 106
Joined: Mon Feb 11, 2019 12:48 pm
Location: DFW, Texas

Re: ABS Hacking

Postby jlvaldez » Thu Jul 02, 2020 11:50 am

ebcmwiring.jpg

I pulled some wiring diagrams. Looks like the datalink bus is a single bus on the entire system.

EBCM has access to some interesting stuff
Attachments
datalink.pdf
(413.45 KiB) Downloaded 36 times

Site Admin
User avatar
Posts: 6274
Joined: Sat Feb 28, 2009 8:34 pm

Re: ABS Hacking

Postby antus » Fri Jul 03, 2020 4:26 pm

looking at that gives me a completely different idea. Maybe you could build a circuit to emulate the 4 wheel speed sensors then play around with scripting something that triggers ice mode. Then you could look at intercepting ice mode and disabling it outside of the module. With a bit of testing you might find its possible to disconnect one of the other sensors and still retain normal brake function but trigger some kind of error that disables ice mode which you can use on the track. Wouldnt it be nice if you found you could put a switch on the yaw sensor to disable it at the track and get the results that way, or similar.
Have you read the FAQ? For lots of information and links to significant threads see here: viewtopic.php?f=7&t=1396

Posts: 106
Joined: Mon Feb 11, 2019 12:48 pm
Location: DFW, Texas

Re: ABS Hacking

Postby jlvaldez » Mon Jul 06, 2020 11:58 am

antus wrote:looking at that gives me a completely different idea. Maybe you could build a circuit to emulate the 4 wheel speed sensors then play around with scripting something that triggers ice mode. Then you could look at intercepting ice mode and disabling it outside of the module. With a bit of testing you might find its possible to disconnect one of the other sensors and still retain normal brake function but trigger some kind of error that disables ice mode which you can use on the track. Wouldnt it be nice if you found you could put a switch on the yaw sensor to disable it at the track and get the results that way, or similar.



Actually, I had the exact same idea... I stuck a wheel hub on my bench scope (I have OEM ones since I just swapped out to the SKF hubs for track events), and looked at the waveform produced. 48 teeth/rev. Amplitude varies with speed significantly, but at roughly 1.5 rev/sec I was getting ~200 mv amplitude AC voltage. I dug through the wiring diagrams and found that the wheel sensors ONLY go to the ABS module. Now, I'm not sure how it's biased, but I believe I could probably tap the wires and sample them with my own hardware while doing an event since I've figured out fairly reliably how to get ice mode to activate (normally takes really rapid stabbing to the point where ABS also activates), and then feed the waveforms into a EBCM on my bench.

I talked to a speed shop that has extra corvette parts and he's going to give me some broken EBCM modules and some harnesses to them so that I can make a bench setup.

There's a few hurdles I see, though.

1) I'm told that the EBCM does NOT run by itself. It requires signals from the ECM in some way to do anything. This is why I was asking about bus sniffers in another post. I need to sniff this data to make ABS do its thing. I know that the TCS button in the C5 is connected to the BCM only, and the BCM relays a message to the EBCM to switch modes.
2) I need to design a board to sample all inputs into the EBCM, but I don't think I can put a male/female connector/splice in the center between the EBCM and the factory harness. I don't really want to hack up my factory harness to do this.

I started on schematics for a board to datalog this (mainly because I want to make a low cost board/diy method of getting good data (brake, throttle, yaw/pitch, steering, speed, etc) logged with a C5 while on track. Right now I'm just using Race Crono, and outside of looking at speed and accelerometer data, there's not much else. I've been working on this schematic a bit.

Site Admin
User avatar
Posts: 6274
Joined: Sat Feb 28, 2009 8:34 pm

Re: ABS Hacking

Postby antus » Mon Jul 06, 2020 4:50 pm

Hmm they are good points. You may be better off unplugging things and testing on the track :) Worst case I think you'd loose ABS, im sure you would not loose brake function. That'd be a lawsuit the OEM would never risk in their design. As for the signal, those types of systems are usually just a counter on the zero crossings with analog voltages above and below a threshold. The EBCM would only see the frequency of the waveform, so you would only need a static voltage in your simulation code.
Have you read the FAQ? For lots of information and links to significant threads see here: viewtopic.php?f=7&t=1396

Posts: 106
Joined: Mon Feb 11, 2019 12:48 pm
Location: DFW, Texas

Re: ABS Hacking

Postby jlvaldez » Mon Jul 06, 2020 5:31 pm

I really wanted to see if I could datalog ice mode, and see what it does to brake pressure and the exact inputs that occured when it happened. Hard to do confidently without the module. Worst case, I can just disconnect it.

Posts: 405
Joined: Thu May 03, 2012 10:50 pm
Location: Castlemaine, Vic

Re: ABS Hacking

Postby pman92 » Mon Jul 06, 2020 8:52 pm

I'm pretty confident if you unplugged something or a signal was missing the EBCM would turn the ABS light on and there would be no ABS or TC function at all.
That seems to be the way most manufacturers work (or so I'm taught/told) for safety critical systems. There isn't "limp modes" like there is for engine management, either the system is working properly or it's failed into a safe state.

What exactly is ice mode and what does it feel like?

My general knowledge of ABS is as follows:
If you stab the brake pedal hard enough for it to detect (or maybe predict) a wheel to start locking up, it will isolate the wheel from the master cylinder by closing a normally open inlet valve. At that point pressing the brake pedal harder will not increase pressure at the wheel.
If the wheel speed continues to decrease/lock up, it will open a normally closed outlet valve which will drain wheel pressure into a low pressure accumulator, decreasing pressure at the wheel. The accumulator is then pumped back to the master cylinder by an electric pump.
There is a check valve on the inlet valve that means if master cylinder pressure decreases, wheel pressure will flow back to the master cylinder even if the inlet valve is closed. This means wheel pressure cannot ever exceed the pressure you supply with your foot with ABS.

When traction control is fitted, there is a 3rd and sometimes 4th valve, which allow complete isolation of the wheel from the master cylinder, in such a way that the pump can operate the reverse direction and instead of pumping fluid back out to the master cylinder, instead pump fluid from the master cylinder to the wheel.

However it's very unlikely this is a traction control issue. It's almost certainly an ABS issue (the inlet valve is closed preventing your foot pressure reaching the wheel).

My suggest would be to log the wheel speed sensor signals with a scope, and compare the frequency of all of them when you make it happen, and see if either:
-A wheel is actually slowing more than the others (that wheel is actually begining to lock up)
-Or, the wheel speeds all remain consistent, and it's the module PREDICTING a lock up that never started happening
VR-VY Holden BCM Simulator: LINK
Ford Smartlock Bypass Module: LINK

User avatar
Posts: 331
Joined: Sun Jan 25, 2015 4:21 pm
Location: Sydney

Re: ABS Hacking

Postby j_ds_au » Mon Jul 06, 2020 11:59 pm

pman92 wrote:If you stab the brake pedal hard enough for it to detect (or maybe predict) a wheel to start locking up ...

Definitely detect.

Joe.

Posts: 106
Joined: Mon Feb 11, 2019 12:48 pm
Location: DFW, Texas

Re: ABS Hacking

Postby jlvaldez » Tue Jul 07, 2020 4:52 am

From what we have been told about ice mode, it's basically a scalar value of deceleration limit. IE: I'm on very sticky tires with very good brakes where the car can slow down faster than the module thinks is possible. EBCM assumes all 4 tires are starting to lock up and limits braking force, even though I have the traction to slow down that quickly

Seems it is a situation where all 4 slow down very quickly (I have a big brake kit and aggressive tires for track use, so this happens easily). I never feel what seems to be tires locking up.

Also, when this happens, your brake pedal goes hard as your braking force is very limited. There's a video of me encountering it (without realizing it at the time) trying to slow from 140 mph for a turn on track. I was braking very early and the car wouldn't slow, causing me to go off

PreviousNext

Return to GM LS1 512Kbyte and 1Mbyte

Who is online

Users browsing this forum: Google [Bot] and 1 guest