ALDL ECU's

160 And 8192 Baud Aldl
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ALDL ECU's

Post by Tazzi »

antus wrote:I think the BCM is a point though. You might need the right BCMs on the bus to get the tech2 to start talking. It'll probably listen for heartbeat before talking to the pcm and then fail if its not found.
Thats fine. Most of the chatter between VT,VX,VY bcms is kinda similar. Only need the heartbeat to be seen I think. :thumbup:
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Top
User avatar
The1
Posts: 4852
Joined: Mon Jan 04, 2010 12:23 am

Re: ALDL ECU's

Post by The1 »

they all practically output the same aldl pcm data, have a look at the adx's is the easier way.
Top
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ALDL ECU's

Post by Tazzi »

The1 wrote:they all practically output the same aldl pcm data, have a look at the adx's is the easier way.
Cheers mate, will do :thumbup:
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Top
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ALDL ECU's

Post by Tazzi »

Alright, started work on this. VX,VY Flash ecus are pretty well defined and sorted. Freeze frame data is nice and easy to display after allocating each fault to their corresponding specific parameter's routines.

Are freeze frames, and specific module details available on VR and VS commodores?

I will assume that the VT will have all the above, havent started working on it yet since my fleabay unit hasnt popped up.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Top
User avatar
VL400
Posts: 4991
Joined: Sun Mar 01, 2009 4:54 am
cars: VL Calais and Toyota Landcruiser. Plus some toys :)
Location: Perth, WA

Re: ALDL ECU's

Post by VL400 »

Yes, VR and VS have it also. From 11P if this helps (its what you get when asking for a mode 1 message 3 frame) ...

Code: Select all

; --------------------------------------------
	; -- Serial Data Transmit Message 3, Mode 1 --
	; --		 Address 0x7837		    --
	; --     Logged Malfunction Parameters      --
	; --------------------------------------------
L7837:	.word	0x0000
	.byte   0xF4
	.byte	0x80
	.byte	0x2C
	.word	L0811	
	.word	L0811
	.byte	0xF4			; Outgoing Message ID - ECM

	.word	L000F		; Counter for Succesive Engine Start-ups without a Logged Error
	.word	0xFFFF		; \
	.word	L00FD		; / Engine RunTime MSB
				; Operating Parameter Logging When Malfunction Occurs (40 Cells)
	.word	L0344		; Malfunction Code Number
	.word	L0344+1		; Byte 2
	.word	L0344+2		; Byte 3
	.word	L0344+3		; Byte 4
	.word	L0344+4		; Byte 5
	.word	L0344+5		; Byte 6
	.word	L0344+6		; Byte 7
	.word	L0344+7		; Byte 8	
	.word	0xFFFF
	.word	L0344+8		; Byte 9
	.word	L0344+10	; Byte 10
	.word	L0344+11	; Byte 11
	.word	L0344+12	; Byte 12
	.word	L0344+13	; Byte 13
	.word	L0344+14	; Byte 14
	.word	L0344+15	; Byte 15
	.word	L0344+16	; Byte 16
	.word	L0344+17	; Byte 17 
	.word	0xFFFF
	.word	L0344+18	; Byte 18 
	.word	L0344+20	; Byte 19 358
	.word	L0344+21	; Byte 20
	.word	L0344+22	; Byte 21
	.word	L0344+23	; Byte 22
	.word	L0344+24	; Byte 23
	.word	L0344+25	; Byte 24
	.word	L0344+26	; Byte 25
	.word	L0344+27	; Byte 26
	.word	0xFFFF
	.word	L0344+28	; Byte 27
	.word	L0344+30	; Byte 28
	.word	L0344+31	; Byte 29
	.word	L0344+32	; Byte 30
	.word	L0344+33	; Byte 31
	.word	L0344+34	; Byte 32
	.word	L0344+35	; Byte 33
	.word	L0344+36	; Byte 34
	.word	L0344+37	; Byte 35
	.word	0xFFFF
	.word	L0344+38	; Byte 36
And L0344 is a 40 cell RAM buffer of ...

Code: Select all

; *********************************************************************************
L0344	=	0x0344		; 0x0344 - 0x036B = Operating Parameter Logging When Malfunction Occurs (40 Cells)
				; 
				;    Address   BYTE
				;				First Malf Code Parameter Buffer 
				;	44	1		 - Malf Code Number
				;	45	2		 - Occurence Counter
				;	46	3		 - Ignition Cycles Since Code Last Logged
				;	47	4		 - 1ST Data Parameter
				;	48	5		 - 2ND Data Parameter
				;	49	6		 - 3RD Data Parameter
				;	4A	7		 - 4TH Data Parameter
				;	4B	8		 - Engine RPM Parameter
				;	4C	9		 - \ Engine Running Time Parameter (2 Bytes)
				;	4D	10		 - / 
				; 
				;				Second Malf Code Parameter Buffer
				;	4E	11		
				;	4F	12
				;	50	13
				;	51	14
				;	52	15
				;	53	16
				;	54	17
				;	55	18
				;	56	19
				;	57	20
				;	58	21		Third Malf Code Parameter Buffer
				;	59	22
				;	5A	23
				;	5B	24
				;	5C	25
				;	5D	26
				;	5E	27
				;	5F	28
				;	60	29
				;	61	30
				;	62	31		Fourth Malf Code Parameter Buffer
				;	63	32
				;	64	33
				;	65	34
				;	66	35
				;	67	36
				;	68	37
				;	69	38
				;	6A	39
				;	6B	40
				; *********************************************************************************
Top
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ALDL ECU's

Post by Tazzi »

VL400 wrote:Yes, VR and VS have it also
Wow.. just wow!
Just missing the important parameters:

Code: Select all

            ;   47   4       - 1ST Data Parameter
            ;   48   5       - 2ND Data Parameter
            ;   49   6       - 3RD Data Parameter
            ;   4A   7       - 4TH Data Parameter
Im guessing that info changes depending on the fault? Like the flash ecus? :thumbup:
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Top
User avatar
antus
Site Admin
Posts: 10014
Joined: Sat Feb 28, 2009 10:34 am
cars: TX Gemini 2L Twincam 8psi
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Subaru WRX 2007

Re: ALDL ECU's

Post by antus »

yeah thats the message thats sent. the computer will populate that data at runtime with what it needs to send then fire off the message from that location. Presumably standard DTC numbers?
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
Top
User avatar
VL400
Posts: 4991
Joined: Sun Mar 01, 2009 4:54 am
cars: VL Calais and Toyota Landcruiser. Plus some toys :)
Location: Perth, WA

Re: ALDL ECU's

Post by VL400 »

I didnt include the bytes as you should have most from the VT and later. Only the MAP errors wouldnt be included.

Here ya go...

Code: Select all

; -------------------------------------------------------------------
				; 
				; Lookup Table For Logging Operating Paramaters When A Malfunction Occurs
				; 
				; -------------------------------------------------------------------
	
	; -- Malfunction Byte 1 --
L8A4A:	.word	L8AF0		; Code 13 - Oxygen Sensor Open
	.word	L8AE8		; Code 14 - Engine Temperature High
	.word	L8AE8		; Code 15 - Engine temperature low
	.word   L8AE8		; Code 16 - Coolant sensor unstable
	.word	L8AE8		; Code 17 - Coolant pullup resistor failure
	.word	0x0000		; Code 18 - Not used
	.word	L8AF8		; Code 19 - TPS stuck
	.word   L8AF8		; Code 21 - Throttle position high
	; -- Malfunction Byte 2 --
	.word	L8AF8		; 22
	.word	L8AE8		; 23
	.word	L8B30		; 24
	.word   L8AE8		; 25
	.word	L8AE8		; 26
	.word	L8B28		; 27
	.word	L8B28		; 28
	.word   0x0000		; 29
	; -- Malfunction Byte 3 --
	.word	L8AE8		; 
	.word	0x0000		; 
	.word	L8AF8		; 
	.word   L8AF8		; 
	.word	L8B00		; 
	.word	L8B00		; 
	.word	0x0000		; 
	.word   0x0000		; 
	; -- Malfunction Byte 4 --
	.word	0x0000		; 
	.word	L8B08		; 
	.word	L8B08		; 
	.word   L8B10		; 
	.word	L8AF0		; 
	.word	L8AF0		; 
	.word	L8AE8		; 
	.word   L8B18		; 
	; -- Malfunction Byte 5 --
	.word	L8B18		; 
	.word	L8B18		; 
	.word	L8AF8		; 
	.word   L8AF8		; 
	.word	L8AF8		; 
	.word	L8AF8		; 
	.word	L8AF8		; 
	.word   L8B08		; 
	; -- Malfunction Byte 6 --
	.word	L8B20		; 57
	.word	L8B30		; 58
	.word	L8B30		; 59
	.word   L8AF8		; 61
	.word	0x0000		; 62
	.word	0x0000		; 63
	.word	0x0000		; 64
	.word   0x0000		; 65
	; -- Malfunction Byte 7 --
	.word	L8B38		; Code 66 - 3-2 QDM2/Solenoid failure
	.word	L8B38		; Code 67 - TCC Enable QDM2/Solenoid failure
	.word	L8B40		; Code 68 - Transmission Component Slipping
	.word   L8B40		; Code 69 - TCC On
	.word	L8B40		; Code 71 - Engine Speed Low
	.word	L8B30		; Code 72 - Output speed loss
	.word	L8B48		; Code 73 - Force motor current
	.word   0x0000		; Code 74 - Input Speed Sensor 
	; -- Malfunction Byte 8 --
	.word	L8AE8		; Code 75 - System voltage Low
	.word	0x0000		; -
	.word	L8B48		; Code 77 - MNP switch
	.word   0x0000		; -
	.word	L8B30		; Code 79 - Transmission Hot
	.word	L8B38		; Code 82 - QDM1 fault - Shift B fault
	.word	L8B38		; Code 82 - QDM1 fault - Shift A fault
	.word   L8B38		; Code 83 - QDM1 fault - TCC Solenoid failure
	; -- Malfunction Byte 9 --
	.word	0x0000		; 
	.word	0x0000		; 
	.word	0x0000		; 
	.word   0x0000		; 
	.word	0x0000		; 
	.word	0x8B50		; 
	.word	0x0000		; 
	; -- Malfunction Byte 10 --
	.word   0x0000		; 
	.word	0x0000		; 
	.word	0x0000		; 
	.word	0x0000		; 
	.word   0x0000		; 
	.word	0x0000		; 
	.word	0x0000		; 
	.word	L8B58		; 
	
	; -------------------------------------------------
	; -- Logged If CTS, MAT, VATS or Ref Pulse Fault --
	; -------------------------------------------------
L8AE8:	.word   L01D4		; CTS - CTS A/D	
	.word	L00AB		; Battery A/D Voltage
	.word	L01D9		; MAT - MAT A/D value
	.word	L0327		; KPH - Road Speed for Fault Analysis
	
	; -------------------------------
	; -- Logged If O2 Sensor Fault --
	; -------------------------------
L8AF0:	.word   L032A		; O2 - o2 A/D for Fault Analysis
	.word	L02BE		; C/L - Current BLM
	.word	L02BA		; C/L - Current INT
	.word	L0329		; TPS - TPS A/D for Fault Analysis
	
	; ---------------------------------------------------------
	; -- Logged If TPS, MAP, PROM, Batt Voltage or A/D Fault --
	; ---------------------------------------------------------
L8AF8:	.word   L0329		; TPS - TPS A/D for Fault Analysis
	.word	L0328		; MAP - MAP A/D for Fault Analysis
	.word	L00AB		; Battery A/D Voltage
	.word	L02BE		; C/L - Current BLM
	
	; ----------------------------------------
	; -- Logged If IAC Fault or Vacuum Leak --
	; ----------------------------------------
L8B00:	.word   L0329		; TPS - TPS A/D for Fault Analysis
	.word	L02CE		; IAC - Requested IAC Position
	.word	L0371		; IAC - Current IAC position
	.word	L0059		; Flags...
				;	Bit 0	1 = Idle Run-Away Flag, Set If Idle RPM Exceeds Desired and Upper Threshold 
				;	Bit 0	1 = Torque Management, gets set when trans is shifted into Drive
				;	Bit 0	2 = Trans in Park or Neutral when set
				;	Bit 0	3 =  Stall Recovery Mode    
				;	Bit 4	1 = Waiting For IAC Motor To Reset
				;	Bit 5	1 = A/C Status Change Bit
				;	Bit 6	1 = Throttle Crack Flag
				;	Bit 7	1 = Closed Loop Idle Control (Closed Throttle)
	
	; ----------------------------------------------------
	; -- Logged If EST, Bypass Or Fuel Starvation Fault --
	; ----------------------------------------------------
L8B08:	.word   L0327		; KPH - Road Speed for Fault Analysis
	.word	L005A		; EST Flags
	.word	L0328		; MAP - MAP A/D for Fault Analysis
	.word	L032A		; O2 - o2 A/D for Fault Analysis
	
	; --------------------------------------------------
	; -- Logged If Speed Sensor Or Knock Sensor Fault --
	; --------------------------------------------------
L8B10:	.word   L0328		; MAP - MAP A/D for Fault Analysis
	.word	L0327		; KPH - Road Speed for Fault Analysis
	.word	L01D4		; CTS - CTS A/D	
	.word	L01D9		; MAT - MAT A/D value
	
L8B18:	.word   L02D4		; Sync - Cylinder # Counter
	.word	L01D4		; CTS A/D Voltage
	.word	L0327		; KPH - Road Speed for Fault Analysis
	.word	L00AB		; Battery A/D Voltage
	
L8B20:	.word   L00AB		; Battery A/D Voltage
	.word	L00AB		; Battery A/D Voltage
	.word	L01DC		; A/D reference voltage	
	.word	L01DB		; Injector voltage
	
L8B28:	.word   L01D4		; CTS A/D Voltage
	.word	L00A4		; PRNDL flags
	.word	L0327		; KPH - Road Speed for Fault Analysis
	.word	L00D9		; Requested gear
	
L8B30:	.word   L0328		; MAP A/D for Fault Analysis
	.word	L0327		; KPH - Road Speed for Fault Analysis
	.word	L00A7		; Trans Temp A/D
	.word	L00D9		; Requested gear
	
L8B38:	.word   L00A0		; Status Word 5	
	.word	L00D9		; Requested gear
	.word	L008C		; TCC Mode Word Flags 
	.word	L008B		; 3-2 Downshift Flag Word
	
L8B40:	.word   L00D9		; Requested gear
	.word	L0327		; KPH - Road Speed for Fault Analysis
	.word	L032C		; Filtered Transmission Slip x4 For Fault Analysis
	.word	L0329		; TPS - TPS A/D for Fault Analysis
	
L8B48:	.word   L00A1		; Shift Pattern Word
	.word	L00D9		; Requested gear
	.word	L032D		; Commanded Force Motor Current
	.word	L032E		; Average Force Motor Current
	
L8B50:	.word   L037F		; 1-2 pressure ADAPT
	.word	L0390		; 2-3 pressure ADAPT
	.word	L03A1		; 3-4 pressure ADAPT
	.word	L00DC		; Time Of Latest Shift
	
	; ------------------------------
	; -- Logged If Engine Stalled --
	; ------------------------------
L8B58:	.word   L0327		; KPH - Road Speed for Fault Analysis
	.word	L0329		; TPS - TPS A/D for Fault Analysis
	.word	L0371		; IAC - Current IAC position
	.word	L0059		; Flags...
				;	Bit 0	1 = Idle Run-Away Flag, Set If Idle RPM Exceeds Desired and Upper Threshold 
				;	Bit 0	1 = Torque Management, gets set when trans is shifted into Drive
				;	Bit 0	2 = Trans in Park or Neutral when set
				;	Bit 0	3 =  Stall Recovery Mode    
				;	Bit 4	1 = Waiting For IAC Motor To Reset
				;	Bit 5	1 = A/C Status Change Bit
				;	Bit 6	1 = Throttle Crack Flag
				;	Bit 7	1 = Closed Loop Idle Control (Closed Throttle)
Top
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ALDL ECU's

Post by Tazzi »

Thats the one! Cheers VL.
Im still waiting for the VT ecu to rock up to start rversing it with the tech2. It will be interesting if it is very similar!
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Top
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ALDL ECU's

Post by Tazzi »

Shame, the VS V6 ecu communicates fine with the Tech2.. (although its horribly slow). It fires off a table 0 request (I think.. didnt double check) and checks to see if it is a VS V6 ecu. It brings up a prom ID or something like that.. 1488? I think I saw it flash on the screen before saying "communication error".

Its a shame Tech1's arent easily accessible. Although by the looks of it, they have been reverse engineered down to the bare bones for engine data. Would be good to pull any other information from other modules.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Top

Return to “ALDL, OBDII Logging and Scanning”