ABS Hacking

They go by many names, P01, P59, VPW, '0411 etc. Also covering E38 and newer here.
Post Reply
User avatar
NSFW
Posts: 679
Joined: Fri Feb 02, 2018 3:13 pm

Re: ABS Hacking

Post by NSFW »

jlvaldez wrote:I haven't made it beyond pulling it out of the housing yet, either. Looks like it "just" needs to be desoldered. I had some stuff happen as all this covid crap happened that required my effort elsewhere. So I had to shelf it. I'm trying frantically to get back on track now.

However, I was at a track here, talking to a guy that knows a few people in GM. I told him about how we're unable to get at the OS and need someone to reach out to. He is actually very interested in being able to remove or defeat ice mode. Turns out that he has 2 contacts he knows at GM. One was involved with the C4 electronics and knows all the people that worked on the C5 stuff.

So I had him reach out and start that dialog. I'll follow up with him soon, but want some confirmation. We need the OS binary. I'm surprised they're separate but that's the missing piece.

I was also told he may be able to get his hands on a C5R unit that could be given. However, I don't know if that would help, since I don't know if the C5R ABS unit is the same. If it truly just is a calibration tweak, then why can't we pull the calibration for a C5R and upload it to C5 (of course the means to upload is not yet determined).

I haven't forgotten, it's just been crazy the last few months but things are mostly back to normal.
I've exchanged a couple messages with an ex-GM guy on Linked In, and I'm waiting to hear back from the last one I sent. He's worked on ABS calibration in the past, but I have no idea whether he'll be able to help with flashing. We'll see.

I wasn't able to even get the lid off of the ABS unit. The electrical half and the valve/motor half came apart easily but the top plate with the connector on it is 100% glued to the case and I can't even get a knife in between the two. My next plan is to attack it with a chisel. :)
Please don't PM me with technical questions - start a thread instead, and send me a link to it. That way I can answer in public, and help other people who have the same question. Thanks!
jlvaldez
Posts: 155
Joined: Mon Feb 11, 2019 12:48 pm
cars: '01 - Corvette Z06
'20 - Sierra Denali
'03 - Volvo S80 T6
'16 - Accord V6
Location: DFW, Texas

Re: ABS Hacking

Post by jlvaldez »

It was someone at a speed ship I was talking to about this. He mentioned he had some bad units he'd be willing to give if I asked.

The hard part is pulling the binaries. I'll keep working on trying to get my hands on binaries.
jlvaldez
Posts: 155
Joined: Mon Feb 11, 2019 12:48 pm
cars: '01 - Corvette Z06
'20 - Sierra Denali
'03 - Volvo S80 T6
'16 - Accord V6
Location: DFW, Texas

Re: ABS Hacking

Post by jlvaldez »

ebcmwiring.jpg
I pulled some wiring diagrams. Looks like the datalink bus is a single bus on the entire system.

EBCM has access to some interesting stuff
Attachments
datalink.pdf
(413.45 KiB) Downloaded 184 times
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: ABS Hacking

Post by antus »

looking at that gives me a completely different idea. Maybe you could build a circuit to emulate the 4 wheel speed sensors then play around with scripting something that triggers ice mode. Then you could look at intercepting ice mode and disabling it outside of the module. With a bit of testing you might find its possible to disconnect one of the other sensors and still retain normal brake function but trigger some kind of error that disables ice mode which you can use on the track. Wouldnt it be nice if you found you could put a switch on the yaw sensor to disable it at the track and get the results that way, or similar.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
jlvaldez
Posts: 155
Joined: Mon Feb 11, 2019 12:48 pm
cars: '01 - Corvette Z06
'20 - Sierra Denali
'03 - Volvo S80 T6
'16 - Accord V6
Location: DFW, Texas

Re: ABS Hacking

Post by jlvaldez »

antus wrote:looking at that gives me a completely different idea. Maybe you could build a circuit to emulate the 4 wheel speed sensors then play around with scripting something that triggers ice mode. Then you could look at intercepting ice mode and disabling it outside of the module. With a bit of testing you might find its possible to disconnect one of the other sensors and still retain normal brake function but trigger some kind of error that disables ice mode which you can use on the track. Wouldnt it be nice if you found you could put a switch on the yaw sensor to disable it at the track and get the results that way, or similar.

Actually, I had the exact same idea... I stuck a wheel hub on my bench scope (I have OEM ones since I just swapped out to the SKF hubs for track events), and looked at the waveform produced. 48 teeth/rev. Amplitude varies with speed significantly, but at roughly 1.5 rev/sec I was getting ~200 mv amplitude AC voltage. I dug through the wiring diagrams and found that the wheel sensors ONLY go to the ABS module. Now, I'm not sure how it's biased, but I believe I could probably tap the wires and sample them with my own hardware while doing an event since I've figured out fairly reliably how to get ice mode to activate (normally takes really rapid stabbing to the point where ABS also activates), and then feed the waveforms into a EBCM on my bench.

I talked to a speed shop that has extra corvette parts and he's going to give me some broken EBCM modules and some harnesses to them so that I can make a bench setup.

There's a few hurdles I see, though.

1) I'm told that the EBCM does NOT run by itself. It requires signals from the ECM in some way to do anything. This is why I was asking about bus sniffers in another post. I need to sniff this data to make ABS do its thing. I know that the TCS button in the C5 is connected to the BCM only, and the BCM relays a message to the EBCM to switch modes.
2) I need to design a board to sample all inputs into the EBCM, but I don't think I can put a male/female connector/splice in the center between the EBCM and the factory harness. I don't really want to hack up my factory harness to do this.

I started on schematics for a board to datalog this (mainly because I want to make a low cost board/diy method of getting good data (brake, throttle, yaw/pitch, steering, speed, etc) logged with a C5 while on track. Right now I'm just using Race Crono, and outside of looking at speed and accelerometer data, there's not much else. I've been working on this schematic a bit.
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: ABS Hacking

Post by antus »

Hmm they are good points. You may be better off unplugging things and testing on the track :) Worst case I think you'd loose ABS, im sure you would not loose brake function. That'd be a lawsuit the OEM would never risk in their design. As for the signal, those types of systems are usually just a counter on the zero crossings with analog voltages above and below a threshold. The EBCM would only see the frequency of the waveform, so you would only need a static voltage in your simulation code.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
jlvaldez
Posts: 155
Joined: Mon Feb 11, 2019 12:48 pm
cars: '01 - Corvette Z06
'20 - Sierra Denali
'03 - Volvo S80 T6
'16 - Accord V6
Location: DFW, Texas

Re: ABS Hacking

Post by jlvaldez »

I really wanted to see if I could datalog ice mode, and see what it does to brake pressure and the exact inputs that occured when it happened. Hard to do confidently without the module. Worst case, I can just disconnect it.
pman92
Posts: 464
Joined: Thu May 03, 2012 10:50 pm
cars: HZ One Tonner
VE Ute
Location: Castlemaine, Vic

Re: ABS Hacking

Post by pman92 »

I'm pretty confident if you unplugged something or a signal was missing the EBCM would turn the ABS light on and there would be no ABS or TC function at all.
That seems to be the way most manufacturers work (or so I'm taught/told) for safety critical systems. There isn't "limp modes" like there is for engine management, either the system is working properly or it's failed into a safe state.

What exactly is ice mode and what does it feel like?

My general knowledge of ABS is as follows:
If you stab the brake pedal hard enough for it to detect (or maybe predict) a wheel to start locking up, it will isolate the wheel from the master cylinder by closing a normally open inlet valve. At that point pressing the brake pedal harder will not increase pressure at the wheel.
If the wheel speed continues to decrease/lock up, it will open a normally closed outlet valve which will drain wheel pressure into a low pressure accumulator, decreasing pressure at the wheel. The accumulator is then pumped back to the master cylinder by an electric pump.
There is a check valve on the inlet valve that means if master cylinder pressure decreases, wheel pressure will flow back to the master cylinder even if the inlet valve is closed. This means wheel pressure cannot ever exceed the pressure you supply with your foot with ABS.

When traction control is fitted, there is a 3rd and sometimes 4th valve, which allow complete isolation of the wheel from the master cylinder, in such a way that the pump can operate the reverse direction and instead of pumping fluid back out to the master cylinder, instead pump fluid from the master cylinder to the wheel.

However it's very unlikely this is a traction control issue. It's almost certainly an ABS issue (the inlet valve is closed preventing your foot pressure reaching the wheel).

My suggest would be to log the wheel speed sensor signals with a scope, and compare the frequency of all of them when you make it happen, and see if either:
-A wheel is actually slowing more than the others (that wheel is actually begining to lock up)
-Or, the wheel speeds all remain consistent, and it's the module PREDICTING a lock up that never started happening
VR-VY Holden BCM Simulator: View Post
MrModule.com.au
User avatar
j_ds_au
Posts: 384
Joined: Sun Jan 25, 2015 4:21 pm
Location: Sydney

Re: ABS Hacking

Post by j_ds_au »

pman92 wrote:If you stab the brake pedal hard enough for it to detect (or maybe predict) a wheel to start locking up ...
Definitely detect.

Joe.
jlvaldez
Posts: 155
Joined: Mon Feb 11, 2019 12:48 pm
cars: '01 - Corvette Z06
'20 - Sierra Denali
'03 - Volvo S80 T6
'16 - Accord V6
Location: DFW, Texas

Re: ABS Hacking

Post by jlvaldez »

From what we have been told about ice mode, it's basically a scalar value of deceleration limit. IE: I'm on very sticky tires with very good brakes where the car can slow down faster than the module thinks is possible. EBCM assumes all 4 tires are starting to lock up and limits braking force, even though I have the traction to slow down that quickly

Seems it is a situation where all 4 slow down very quickly (I have a big brake kit and aggressive tires for track use, so this happens easily). I never feel what seems to be tires locking up.

Also, when this happens, your brake pedal goes hard as your braking force is very limited. There's a video of me encountering it (without realizing it at the time) trying to slow from 140 mph for a turn on track. I was braking very early and the car wouldn't slow, causing me to go off
Post Reply