PCMTec Development Blog

Ford information and tools can be found here
User avatar
Tazzi
Posts: 3552
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: Ford MPC565 Tuning

Post by Tazzi »

Looks like this ECU doesnt wanna be a happy camper, doesnt like the tester present message apparently, see logged data below:

7E0 01 3E 00 00 00 00 00 00
7E8 03 7F 3E 12 00 00 00 00

Its getting back a subfunction not supported when clicking on detect vehicle on the flash toolbox page. This occurs when before and after putting power onto FEPs.

Rolls, I can see the app unlocks the ECU, but then pops up with an error saying:
"Error Detecting Vehicle Type due to UDS error: SUBFUNCTION_NOT_SUPPORTED"

Pretty sure thats due to the above issue.

Reads bin happily though :thumbup:

*Edit: The XR8 is out with the old man currently, will grab a read from that when its back.
Attachments
BA_6cyl_6FPAAAJGSW5P4858_HAANC_BLACKOAK_1472K.bin
(1.44 MiB) Downloaded 377 times
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
MeZmeriZe
Posts: 48
Joined: Thu Sep 29, 2016 7:21 pm
cars: 05 XR6T BA with Liquid LPG injection
76 XC Sundowner
91 Surf turbo diesel

Re: Ford MPC565 Tuning

Post by MeZmeriZe »

rolls wrote:What car is the VCX meant to work with? If it isn't Toyota or ford then it might be hooked up but I doubt it will be programmed to do anything. VCI has it hooked up to a gpio pin but the software isn't programmed to do anything.
The one I have is marketed as a Ford/Mazda.. near as I can tell, as much as possible of the functionality is software defined. because you can buy licences to add functionality. So it'd have to be a generic gpio.

I have the following listed as active in mine. Ford, Mazda, PDU and J2534-2 Passthrough, but I can buy and add a ton of other licences including Toyota TIS, honda HDS, JLR SDD, Subaru SSM, Volvo Vida, Porsche PT2, GM GD S2/T2W and VW ODIS. annoyingly the chips seem to have had the labels removed so I can't tell what the CPU is, but looks like an ARM of some sort.

Interestingly, the firmware on the device has had a lot of updates this year so it's clearly a going concern.. I just installed a new update now, so gonna see if it makes a difference. Here is the recent firmware updates

Code: Select all

## 2016.10.17	v1.2.3.1
1. Fix OPEL KW82 protocol for GM Tech2Win.

## 2016.10.13	v1.2.3.0
1. Fix ISO15765 recv error when RAW CAN message mixed.

## 2016.07.21	v1.2.2.9
1. Fix TP20 Channel request RX ID start from 0.

## 2016.07.08	v1.2.2.8
1. Add timer message PTIMER_FLAG_TX_INST.
2. Fix 29bit CAN ID filter.
3. Fix KW1281 protocol timer when idle.
4. Add TP20 can bus loopback message.
5. Fix some error.

## 2016.05.03	v1.2.2.4
1. Fix ISO15765 receive message as ISO15765 when Filter OFF.

## 2016.04.27	v1.2.2.3
1. Fix ISO15765 receive message as RAW when Filter do not set FlowControl.

## 2016.04.16	v1.2.2.2
1. Fix ISO15765 receive RX_START flag message.
2. Fix DeviceInfo.HwName to be correct with SerialNo.

## 2016.01.19	v1.2.2.1
1. Fix ISO14230 receive KWP frame length process without P1MAX.

## 2016.01.15	v1.2.2.0
1. Fix ISO15765 extend addr process (Toyota IMMO).

## 2016.01.12	v1.2.1.0
1. Fix Opel KW82 protocol.

## 2016.01.05	v1.2.1.0
1. Add protocol ISO14230, KW82.
2. Change protocol KW81 to KW1281.
3. A lot of optimize.
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

MeZmeriZe wrote: yeah, I know.. I thought at first that I had some driver loading issue due to having IDS and the mongoose setup on the same machine. (all the testman and other services for IDS were stopped though)

Probably better to do what BE and the drewtech tool do and just have a drop down with the reg entries listed and the one with the loaded driver selected.. that way you know at a glance what is there and what is active.
If you untick auto detect there is a dropdown box and you can choose the cable. I can't show which cable is chosen as it only chooses a cable when you press a button, eg it is only valid during the operation of which most are under a second. Eg if you press read VIN with your mongoose plugged in, then change to VCM2 and press read VIN it will just do it all automatically in the backgroud. It reports in the log which cable it is using eg:
2:06:46 PM Loaded J2534 Library Via: OpenPort 2.0 J2534 ISO/CAN/VPW/PWM
2:06:46 PM Successfully created OBD2 connection
2:06:46 PM Created ISO15765 connection
I remember asking some people to copy my shim dll over the top of VCM2 and other stuff to get IDS working. If you did that then its possible it would report a cable that isn't actually plugged in as working but I think it was only Tazzy and Antus that tried that.

The other possibility is the manufacturers implementations are so similar that each others driver will work with other cables, this should be highly repeatable though if it is the case. Would be interested to see if you can repeat it.

There may also be a bug where if you have no valid cable at all, then you click detect vehicle it will just use the last invalid cable it found. I tried a few things to see if I could get this to happen but couldn't repeat it.
Tazzi wrote:Looks like this ECU doesnt wanna be a happy camper, doesnt like the tester present message apparently, see logged data below:

7E0 01 3E 00 00 00 00 00 00
7E8 03 7F 3E 12 00 00 00 00

Its getting back a subfunction not supported when clicking on detect vehicle on the flash toolbox page. This occurs when before and after putting power onto FEPs.

Rolls, I can see the app unlocks the ECU, but then pops up with an error saying:
"Error Detecting Vehicle Type due to UDS error: SUBFUNCTION_NOT_SUPPORTED"

Pretty sure thats due to the above issue.

Reads bin happily though :thumbup:

*Edit: The XR8 is out with the old man currently, will grab a read from that when its back.
Can you send me the log?

Regarding the TESTER_PRESENT reply that is interesting. I don't parse any tester present replies so the 7F should not be of concern though. Eg I just pump the message and ignore all replies. From my testing I normally get no response at all to the tester_present message.

If you get SUBFUNCTION_NOT_SUPPORTED this error is most likely occurring at another stage, most likely the read memory command during the auto detect. I clear the RX buffer before any transmits so even if the cable has buffered a SUBFUNCTION_NOT_SUPPORTED packet from the tester_present command it should still get dropped. I guess there could be a race condition where it receives immediately after my clear and before my send, then I would interpret the reply as for my transmit command. I should probably do something more clever like iterate all replies (normally there is only 1-3 j2534 replies, TX, SOF, then NONE which contains the actual reply ) and ignore any with a subfunction other than the one I want. If there is a race condition I would suspect the behavior is not always the same though, as there is a 1 second delay between pumps depending on when you press the auto detect button I wouldn't expect the error to occur every time.

Is this fault reliable, eg does it happen every single time? Be good to see the log when it does occur as these sort of odd things would be good to iron out.

Thanks for the testing guys, much better to release small iterative alpha/beta builds like this to get a polished product. I have no idea how people have a "launch" day and release something that works. I suspect that most products don't.

edit: Tazzy I'm going to filter all replies and drop anything with a subfunction other than the one requested. it will be interesting to see if this fixes your issue as that will prove the tester_present response is causing a race condition.
User avatar
Tazzi
Posts: 3552
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: Ford MPC565 Tuning

Post by Tazzi »

No dramas! Ill grab the log in a moment! It did it multiple times in a row. Had to power off/on before it would let me try again though.

From what I can see while monitoring the bus.. I see the following occurring (In order):
- Periodic tester present request of 7E0 01 3E (Maybe change this to 101 FE 01 3E.. This is the global indicator to say tester is present.. no mofule should reply to that but all should see it.. well.. Holdens its like that anyways!)
- Tool the does security negotiation and unlocks ECU. (Which is successful)
- Fail on sub function not supported
Nothing else is sent, and doesnt attempt to read any other info/

If I attempt to read again, when watching the log, the ECU replies with a :7E8 03 7F 27 22
Or something like that.. which I think is because it has already been unlocked? Im not sure if these ecus timeout on the security.. might be once they unlocked.. there unlocked until next cycle.

So power ecu (Unclip from bench), back on, then can test again.. which repeats the successful unlocking ect. It does however read out all the details happily on a full normal read.

Will pop up the log shortly.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

I just added in some checks if I receive a response to packet other than the one I requested bomb out and fail indicating it is a bug.

Also made a tickbox for recovery mode. That way I only ever ignore a lack of OBD response in that mode.

Tried bricking a BA pcm a bunch of different ways, eg turning power off during erase, during flash etc and they all are recoverable.

Franky be good to see if you can recover the BA PCM now. I'll send this new version out to everyone shortly.
MeZmeriZe
Posts: 48
Joined: Thu Sep 29, 2016 7:21 pm
cars: 05 XR6T BA with Liquid LPG injection
76 XC Sundowner
91 Surf turbo diesel

Re: Ford MPC565 Tuning

Post by MeZmeriZe »

Hi Guys,

I was trolling the internet looking for interesting source code that utilised J2534 and found this: http://bedug.com/?q=node/56

It's GPL3 and it needs a polish, but it's actually kinda cool. It doesn't like my mongoose but it says it only supports the updated j2534, The VCX seems to work ok.. you can load Manufacturer PIDS and makes it human readable... not hard but a PITA anyway..

Source code is there too.. created with VS2010... http://www.bedug.com/subversion/CanApp2/

Thought it might be of use if you didn't already know of it. Since it's GPL its free to fork and extend. (called the can-bus-data-miner, which was what caught my attention)
Last edited by MeZmeriZe on Sun Oct 30, 2016 3:35 pm, edited 1 time in total.
MeZmeriZe
Posts: 48
Joined: Thu Sep 29, 2016 7:21 pm
cars: 05 XR6T BA with Liquid LPG injection
76 XC Sundowner
91 Surf turbo diesel

Re: Ford MPC565 Tuning

Post by MeZmeriZe »

rolls wrote:I just added in some checks if I receive a response to packet other than the one I requested bomb out and fail indicating it is a bug.

Also made a tickbox for recovery mode. That way I only ever ignore a lack of OBD response in that mode.

Tried bricking a BA pcm a bunch of different ways, eg turning power off during erase, during flash etc and they all are recoverable.

Franky be good to see if you can recover the BA PCM now. I'll send this new version out to everyone shortly.

Is that worth trying on the BA turbo one I have here?
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

MeZmeriZe wrote:
rolls wrote:I just added in some checks if I receive a response to packet other than the one I requested bomb out and fail indicating it is a bug.

Also made a tickbox for recovery mode. That way I only ever ignore a lack of OBD response in that mode.

Tried bricking a BA pcm a bunch of different ways, eg turning power off during erase, during flash etc and they all are recoverable.

Franky be good to see if you can recover the BA PCM now. I'll send this new version out to everyone shortly.
Is that worth trying on the BA turbo one I have here?
Yes. Hopefully it will fix it. I tried everythign I can to brick my two PCMs and I can't do it. Tried writing all zeros, the wrong file, pulling power, pulling the cable (both during the write and during the erase) and it always recovers.

It must be some difference in the mongoose and open port, I have no idea what though as if the auto detect works then everything else is done with the same commands. Same with timeouts etc.

When you ignition cycle what pins are you using on the PCM? Perhaps you are completely power cycling the PCM instead of just the ignition? Also are you wiring the ignition back to the mongoose? The mongoose might be resetting when you do the "ignition" cycle. I made that mistake when I first wired mine up.
User avatar
Tazzi
Posts: 3552
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: Ford MPC565 Tuning

Post by Tazzi »

Right.. think I found the issue Rolls.

I thought I took off the 12v to FEPs, but I was unclipping the wrong click!! ahahah.

Sooo.. it errors out when trying to detect with no voltage on FEPs pin.
Send a log using the application Rolls

*Edit
Take that back, failed to send
8:05:33 PM Failed to send debug log due to: The remote certificate is invalid according to the validation procedure.
Do note.. time and date are out.. running in a VM..
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

Tazzi wrote:Right.. think I found the issue Rolls.

I thought I took off the 12v to FEPs, but I was unclipping the wrong click!! ahahah.

Sooo.. it errors out when trying to detect with no voltage on FEPs pin.
Send a log using the application Rolls

*Edit
Take that back, failed to send
8:05:33 PM Failed to send debug log due to: The remote certificate is invalid according to the validation procedure.
Do note.. time and date are out.. running in a VM..
I'm using insecure gmail authentication to send the reports as I don't have a webserver. It works from windows 7 but may not from xp. If the time is out gmail probably rejects it as spam.

Lack of FEPS makes sense for that error! Good to know.

I removed the FEPS voltage read back as it doesn't work properly with most cables. Be nice if it did as I could detect that error properly.
Post Reply