G oog le BadWeB | Login/out | Topics | Search | Custodians | Register | Edit Profile

Buell Forum » Quick Board Archives » Archive 0210 (October 2002) » ECM Hacking? Grease Monkeys meet the Geeks! » Archive through June 10, 2002 « Previous Next »

Author Message
Top of pagePrevious messageNext messageBottom of page Link to this message

Sarodude
Posted on Friday, May 31, 2002 - 03:41 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Jeff-

Lemme see what my buddy comes up with first. I want to make sure I can have a qualified guy de-solder, read, and re-solder the stuff first. I REALLY don't want to fry anyone's stuff.

If I can get that first step done by someone good, I'll start hacking my way through the code.

Ya know, Honda did something really interesting - at least with their cars. They contracted OKI to make a special version of a microcontroller that has a totally unique instruction set. They REALLY didn't want anyone outside taking a peek at what they're doing.

Anyway, I'm waiting for some calls to be returned. With any luck, I'll have some good news and shipping info as well.

-Saro
Top of pagePrevious messageNext messageBottom of page Link to this message

Roadrunr
Posted on Friday, May 31, 2002 - 04:24 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

If ya want a stock ECM I can give one up to the cause.
Top of pagePrevious messageNext messageBottom of page Link to this message

Sarodude
Posted on Friday, May 31, 2002 - 04:36 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Too cool! Anyway, I'm waiting till I hear something before I ask for one of 'em...

-Saro
Top of pagePrevious messageNext messageBottom of page Link to this message

Snowdave
Posted on Tuesday, June 04, 2002 - 01:23 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

I now have the capability to spy on the traffic that goes across a serial port. This means that if anyone had a Scanalyzer, I could hook it up to an ECM, run through the various menus and capture all of the data. This would allow me to back into the protocol used. We still wouldn't know how to load a new map, only the menus on the scanalyzer, but it's a good first step. I'll go have a talk with my dealer.
Top of pagePrevious messageNext messageBottom of page Link to this message

Ymmot
Posted on Tuesday, June 04, 2002 - 10:22 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Snowdave, i've been lurking for a while on this one.

i've come to the same conclusion as you - that the interface is J1850 PWM.

were you going to invest in an J1850 PWM to RS232 converter? the cheapest i could find was in the high $200 range. i think that one could be homebrewed for about $20-40 - PIC microcontroller / MAX232 / voltage regulation / printed circuit board / connectors / and a whole bunch of "sweat equity" (as they say on this old house).

i think the higher level protocols may be the greatest obstacle, though.

Have you seen the documents available from SAE on J1850:

http://www.sae.org/servlets/productDetail?PROD_TYP=STD&PROD_CD=J1850_200105

http://www.sae.org/servlets/productDetail?PROD_TYP=STD&PROD_CD=J2178/1_199903

http://www.sae.org/servlets/productDetail?PROD_TYP=STD&PROD_CD=J2178/2_199903

http://www.sae.org/servlets/productDetail?PROD_TYP=STD&PROD_CD=J2178/3_199903

http://www.sae.org/servlets/productDetail?PROD_TYP=STD&PROD_CD=J2178/4_199903

i've got the 1st of the 5, but at $47 a piece, it could be an expensive wild goose chase...

let me know if you want to peruse the 1st one, and i'll get it to you somehow. tom.
Top of pagePrevious messageNext messageBottom of page Link to this message

Snowdave
Posted on Wednesday, June 05, 2002 - 01:20 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

I see two options for a converter:

1)B&B Electronics offers a converter for $200, but I would want to be sure about the protocol before I bought one.

2)Software conversion. If I can spy on some of the data transfer between the ECM and Scanalyzer, I should be able to duplicate it. I could hook up the receive, transmit, and ground wires from the datalink connector straight to my computers serial port. (If anyone knows why this wouldn't work, let me know.)

BTW, I would love to see the first SAE J1850 document to see if it looks like I am at least on the right track. Do you have it electronically?
Top of pagePrevious messageNext messageBottom of page Link to this message

Sarodude
Posted on Wednesday, June 05, 2002 - 01:22 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

How would you determine who was sending what? Might be an idea to hook each to a seperate serial port...

-Saro
Top of pagePrevious messageNext messageBottom of page Link to this message

Sarodude
Posted on Wednesday, June 05, 2002 - 01:37 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Simple interface circuit from J1850 VPW.
Simple interface circuit from J1850 PWM.

The ICs can be had for just a few bucks straight from ELM...

-Saro
Top of pagePrevious messageNext messageBottom of page Link to this message

Ymmot
Posted on Wednesday, June 05, 2002 - 06:18 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Snowdave, RS232 uses a bipolar voltage scheme that can have a voltage swing from -12v to +12v,
or more...

i think the Buell diagnostic interface expects +5v or so.

wouldn't hurt your PC, but you could possible overvoltage the ECM by connecting directly.

i's advise against it.

sent you a long private note with details.

tom.
Top of pagePrevious messageNext messageBottom of page Link to this message

Ymmot
Posted on Wednesday, June 05, 2002 - 09:54 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Saro, the ELM322 (J1850 VPW) looks real promising, thanks.

a number of sites seem to indicate that that is the correct protocol.

http://www.intrepidcs.com/neovi/net_over.htm being one of them.

text from their site:

SAE J1850 VPW - GM Class 2

This network is being used by General Motors, the Chrysler division of DaimlerChrysler, Harley Davidson, Toyota, and others.
Top of pagePrevious messageNext messageBottom of page Link to this message

Ymmot
Posted on Wednesday, June 05, 2002 - 10:36 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

of course, i could be wrong about frying your ecm.

some old posts:

http://www.diy-efi.org/gmecm/html_archives/archive_num_22/msg00204.html

http://www.diy-efi.org/gmecm/html_archives/archive_num_22/msg00217.html

http://sourceforge.net/projects/freediag/ (linux code)

seem to indicate it's doable...

it'd be great if the hardware interface could be eliminated.
Top of pagePrevious messageNext messageBottom of page Link to this message

Blake
Posted on Thursday, June 06, 2002 - 01:04 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

ECM on eBay...

http://cgi.ebay.com/ebaymotors/ws/eBayISAPI.dll?ViewItem&item=1834534462
Top of pagePrevious messageNext messageBottom of page Link to this message

Sarodude
Posted on Thursday, June 06, 2002 - 01:36 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Lemme know if you guys bid on it. Otherwise I'll bid...

-Saro
Top of pagePrevious messageNext messageBottom of page Link to this message

Mid_Ohio_Jeff
Posted on Thursday, June 06, 2002 - 08:14 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Forgive me for intruding, but I am a former Harley riding guy who still tinkers with them and a Blast for some guys and couldn't help reading some of these threads. Anyway, I have recently gone Guzzi and am tinkering with my FI. As it is a Marelli system, there are several folks out there who have had success dealing with them. You might want to contact either one of these companies and see if they would be interested in helping you with the ECU on your Buells. Here they are...

http://www.fuelinmoto.com.au/

www.technoresearch.com

The folks at technoresearch write the diagnostic software for Guzzi and Ducati and also updated there program to work with the Marelli Harley's and are currently working on a system to talk to the Delphi equipped Harley's. If there is enough interest, you guys might be able to talk them into working on a product to talk to your Warblo systems (is that right?) Buells. The folks down in Australia might be able to offer pointers on how to go about Flashing an ECU etc. as that is their speciallty. I know my Marelli system is different form yours, but a lot of the principkles remain the same. These companies mught be good ones to bounce questions off of. Have you guys tried Manley Cycle/Lofgren Racing up in Minnesotta? They do lots of FI work also (Ducs, MG, Augustas, etc) and did a dual carbed Buell that made like 120hp or so. Anyway, good luck...
Top of pagePrevious messageNext messageBottom of page Link to this message

Sarodude
Posted on Thursday, June 06, 2002 - 09:56 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Here's a caviat from the documentation I posted above...

"Most OBD commands to the vehicle are one or two bytes in length, but some can be three or more bytes long. As the ELM322 is considered an Experimenter's circuit, it will only accept a maximum of three command bytes (or six haxadecimal digits) per message. Attempts to send more will result in a syntax error, with the entire command being ignored and a single question mark being printed."

From what little I've been able to gather, most basic diagnostic and monitoring will be fine with this thing. SPECIAL stuff like (mode 09) might be how to do things like TPS resets and they may require more than 3 byte commands.

Anyway, still mostly conjecture. I've got more questions to ask an EE buddy now...

-Saro
Top of pagePrevious messageNext messageBottom of page Link to this message

Rempss
Posted on Thursday, June 06, 2002 - 10:06 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Saro,

Don't bid, let me know where to send you my ECM.

It has reqeuested to be used in all types of testing / programing.

It is willing to make the ultimate sacrifice for the cause if needed. Rub cosmetics in its eys, inject possibly cancer causing liquids in its veins subject it to mind games that may cause it to be mentally disturbed for the rest of its life, you know the typical lab monkey stuff.

Jeff
Top of pagePrevious messageNext messageBottom of page Link to this message

Sarodude
Posted on Thursday, June 06, 2002 - 10:43 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)



I just feel bad Frankensteining someones ECM. Since it's the ECM's free will, that's a different story!

Need to buy my buddy LUNCH and leach some more info from him. We've talked already and he's supposed to ask some of the right guys the right questions.

This is certainly getting interesting. A couple of different directions. Tres cool.

-Saro
Top of pagePrevious messageNext messageBottom of page Link to this message

Court
Posted on Thursday, June 06, 2002 - 10:46 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

May I suggest applying a "laboratory rat" sticker to the ECM prior to hacking....by the way.....I lack your guys' technical proclivity. I picked up the phone and called the folks who made it and downloaded the software 3 minutes later.

Let your fingers do the walking.





kidding :)
Top of pagePrevious messageNext messageBottom of page Link to this message

Sarodude
Posted on Thursday, June 06, 2002 - 11:29 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Something I just realized-

There's an EEPRON on the ECM and an AN87C196KD. My understanding of the AN prefix is that it means it's OTP (one time programmable?). Not saying that we don't need to read it. However, it gives us a bit of a clue...

-Saro

trying unsuccessfully to ignore Court's heart attack causing comment
Top of pagePrevious messageNext messageBottom of page Link to this message

Blake
Posted on Thursday, June 06, 2002 - 01:38 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Good one Court.
Top of pagePrevious messageNext messageBottom of page Link to this message

Snowdave
Posted on Friday, June 07, 2002 - 01:08 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Court - that's not funny

Saro, I am also watching the ECM on e-bay and was going to see what the final price ended up at to decide if I would buy it. Just let me know if you decide to bid and I will steer clear.
Top of pagePrevious messageNext messageBottom of page Link to this message

Court
Posted on Saturday, June 08, 2002 - 07:28 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Dave:

I know. I have a couple "experimental" ECM's and a couple good friends at the company who produced them. There are times I have to tell myself..."sit back, watch and let the world evolve as it may".

You guys are doing great :)
Top of pagePrevious messageNext messageBottom of page Link to this message

Pilot
Posted on Sunday, June 09, 2002 - 04:04 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

What I think Court is alluding to.Is to use the telephone and allow your ecm to "Phone Home"
Top of pagePrevious messageNext messageBottom of page Link to this message

Court
Posted on Sunday, June 09, 2002 - 08:01 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

............allow your ecm to "Phone Home"

Through a serial port, of course.

Thanks Doug !

Court
Top of pagePrevious messageNext messageBottom of page Link to this message

Anonymous
Posted on Monday, June 10, 2002 - 07:00 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

O.K. Guys why not speak to the manufacturer of the ecm."Phone Home" use the telephone.
Top of pagePrevious messageNext messageBottom of page Link to this message

Sarodude
Posted on Monday, June 10, 2002 - 10:13 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Anony-

I tried to email home a few weeks ago. No response. I guess I'll try the Bell method...

-Saro
Top of pagePrevious messageNext messageBottom of page Link to this message

Sarodude
Posted on Monday, June 10, 2002 - 11:44 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Do we need to talk to Walbro-tdd.com or Walbro.com? If TDD, any clues on which model we're talking about?

-Saro
Top of pagePrevious messageNext messageBottom of page Link to this message

Rempss
Posted on Monday, June 10, 2002 - 12:02 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Saro,

Somewhere I remember seeing VDO as the manufacturer / engineer for the Buell DDFI system. If I remember it was a Battle2Win article when the DDFI was introduced and also molded into my stock ECM before I cut it apart.

Walbro makes the throttle body & maybe the manifold.

Can someone with an ECM around them verify "VDO..." is molded into the case?

Jeff
Top of pagePrevious messageNext messageBottom of page Link to this message

Snowdave
Posted on Monday, June 10, 2002 - 01:10 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

I have tried to contact via e-mail: Walbro, VDO, Technoresearch, FuelInMoto, B&B Electronics, Innovative Motorcycle Research, etc. and not one person has responded. I also talked to a tech from Tilley's at the Road America race this weekend and he knew nothing other than the software's existence.

Oh, and Jeff, the ECM does indeed say VDO on it.

I guess I should also try Buell directly, at least to say that I tried.

Dave
Top of pagePrevious messageNext messageBottom of page Link to this message

Sarodude
Posted on Monday, June 10, 2002 - 06:17 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

I may have gotten a response which will yield a technical response from VDO. Stay tuned (lame pun totally unintended)...

-Saro
« Previous Next »

Topics | Last Day | Tree View | Search | User List | Help/Instructions | Rules | Program Credits Administration