Ducati Monster Forum

powered by:

March 28, 2024, 02:04:02 PM *
Welcome, Guest. Please login or register.

Login with username, password and session length
News: No Registration with MSN emails
 
   Home   Help Search Login Register  



Pages: 1 2 [3] 4   Go Down
  Print  
Author Topic: Ducati ECU Tuning Resources  (Read 57524 times)
HotIce
Hero Member
*****
Offline Offline

Posts: 812


« Reply #30 on: January 01, 2012, 03:40:10 PM »

I am looking at another problem ATM.
I am trying to have anything OBD2 hooked up to my Monster 1100 EVO, and everything I tried seems to fall flat.
The FIAT 3PIN (in my bike, there are actually two lead cables, not three) do not show any activity, both when using the KKL 409 cable and when using one of the ELM327 based ones.
I am using the FIAT 3PIN to OBD2 adapter with the two extra GND,+12V cables.
First thought, cables are junk (fine Made in China crapware).
The ELM327 talks to me using minicom on Linux, so at least the serial USB part of the circuit is fine.
But no matter how I tried (trying any kind of ELM327 protocol/initialization), the other side seemed dead.
I then remembered that my Camaro 2SS has an OBD2 port, so I plugged the ELM327 cable there, and I am indeed able to see traffic.
So cables should be fine IMHO.
A little bit of Google Fu revealed that the port where I plugged the FIAT 3PIN adapter under the seat, is not even supposed to be there.
I do not have the service manual for my 1100 EVO, but I have been told a recent 696 one is pretty similar from an electrical POV.
Here it is:

http://img26.imageshack.us/img26/9421/m696schemaelettrico.pdf

There is no mention of such port, and the way the 696 service manual talks about it, it seems that both DDA and DDS need to be plugged into the DDA port.
After a little bit of digging in Italian forums, I have found that the DDA adapter for 696/1100 EVO (at least) are FCI brand, with these codes:

Brand: FCI
Connector: 673-7789
Pin: 673-7868



Even though if the connector looks like to be a Tyco, no one seems to have been able to find the matching part, and the FCI has been reported to be matching.
Looking at the wiring diagram above, these are the connections from the DDA port to the power/ECU (looking at connector from front, latch on the upper side, left to right):

1) +12V
2) Ground
3) ECU B1 pin / CAN Hi
4) ECU C1 pin / CAN Lo

And this is the M3C ECU connector pin out as coming off the service manual:





Would be nice to know what these B1 and C1 pins map into the ECU, but looking at this sheet, it looks like these are CAN signals:

http://www.freescale.com/webapp/sps/site/taxonomy.jsp?code=S12S12X

So my next step is to try to get an FCI connector, and hook the pin #3 and #4 to my ELM327 to see if it sees anything.
Having an oscilloscope would help, but I do not have one (maybe it is time to buy one  Roll Eyes ).

« Last Edit: February 04, 2012, 11:13:07 PM by HotIce » Logged
HotIce
Hero Member
*****
Offline Offline

Posts: 812


« Reply #31 on: January 01, 2012, 03:42:00 PM »

So right now I am most interested in the last generation, IAW5AM.

It looks like from tools (DucatiDiag, TuneECU, TuneBoy, Rexx ECU)
reading and writing the flash can be done via OBD commands.

I am very curious if anyone knows how these guys (especially the free tools) figured out what OBD PIDs and formats to use for various things.

From what I can tell from DucatiDiag, the MM IAW uses a proprietary mode 21 for most of the behavior.
So besides just trying every number you can and trying to reverse engineer things, I am hoping there is something quicker.  
The Magneti Marelli should be easy, as they have been hacked by some time.
Ducati Diag already has all the bits figured out.
Logged
HotIce
Hero Member
*****
Offline Offline

Posts: 812


« Reply #32 on: January 01, 2012, 03:43:58 PM »

I have burned the stock bin to another chip, re-read that new chip to the computer, and then compared it against the original bin file and there were no conflicts. That's telling me no checksum. Again, this is for my 10+ year old ECU and the newer ones may be (and probably are) different.
Did you reboot your ECU (not in boot mode, but in operational mode - that is, attached to a bike)?
Did the bike work after the new image upload?
ECU might not fail the upload, but when the ECU boots up, it might puke if check-sum is not matching.
« Last Edit: January 01, 2012, 03:49:18 PM by HotIce » Logged
accludetuner
Jennifer Connelly's boobs give me a raging
Full Member
***
Offline Offline

Posts: 190


I AM NOT A MONSTER!


WWW
« Reply #33 on: January 01, 2012, 03:49:52 PM »

 [bang]I'll verify but I'm almost positive there's no checksum on mine.


This is starting to get more interest. I was trying to wait until I had DucTune filled with good content before I make it live, but perhaps I'll finish up the site functionality stuff and leave it be for now. You'd be more likely to get specific details and answers on a site designed specifically for technical ECU stuff.

I'll work on getting the site live soon but I may migrate to another server first.
Logged

I can fit massive amounts of meat in my mouth!

My 748/916/996/998 SBK parts for sale!
nicholasv
New Member
*
Offline Offline

Posts: 43


« Reply #34 on: January 02, 2012, 11:46:13 AM »

The Magneti Marelli should be easy, as they have been hacked by some time.
Ducati Diag already has all the bits figured out.


That works, and JP has done a great deal of work.  However he charges money to use the writer to flash new Maps.  I can't fault him for asking for money.  I can't help but wonder though if things would move faster (like with newer ECU's) if people shared their experiences with other ECU's.  (In the same way that HotIce was sharing his experience with car ECU's)

I think it would be nice to allow anyone to use an android of iphone app to reset the TPS and monitor their ECU.  Writing an app to do that is not that hard, *if* you are famliar with the Ducati specific use of ISO9141 (for example).
Logged
HotIce
Hero Member
*****
Offline Offline

Posts: 812


« Reply #35 on: January 02, 2012, 12:19:14 PM »

The TPS AFAIK is auto-reset on the Siemens M3C, and clearing the trouble-codes should be as simple as issuing a 0x04,0x00 on the bus. Which is OBD2 standard.
It is when you get into the internals of the ECU update, that you fall into the undefined (by the standard) territory.
Even if KWP2K/ISO14230 define data transfer protocol messages, there are a bunch of addresses and IDs, which are left by the standard as manufacturer specific.
Which means that you either have a Synerject/Ducati M3C spec (easy path, not likely), or you have a tool which is already able to do that, and you sniff and reverse engineer the traffic.
Logged
HotIce
Hero Member
*****
Offline Offline

Posts: 812


« Reply #36 on: January 03, 2012, 05:30:37 PM »

BTW, does anyone have an existing (as in, vanilla, unmodified) firmware binary file for the M3C ECU (696, 1100EVO, doesn't matter)?
Logged
HotIce
Hero Member
*****
Offline Offline

Posts: 812


« Reply #37 on: January 03, 2012, 06:21:34 PM »

GCC, Binutils (which has objdump, which is the disassembler - unfortunately IDA Pro does not have an S12X front end) for S12X:

https://github.com/seank/FreeScale-s12x-gcc
http://www.msextra.com/tools/

Freescale CW and related tools (eval versions available):

http://www.freescale.com/webapp/sps/site/prod_summary.jsp?code=CW-HCS12X#

Logged
HotIce
Hero Member
*****
Offline Offline

Posts: 812


« Reply #38 on: January 16, 2012, 06:54:56 PM »

There is a parallel thread on the Ducati Diag web site, with similar scope.
These information come form the Diurdac user on the DucatiDiag forum:

http://ducatidiag.xooit.com/t186-Siemens---Continental-ECU.htm





« Last Edit: January 18, 2012, 07:25:30 AM by HotIce » Logged
HotIce
Hero Member
*****
Offline Offline

Posts: 812


« Reply #39 on: January 17, 2012, 07:55:20 AM »

According to the information which came up in the DucatiDiag forum, it seems this is the pinout of the DDA connector:

1) +12V
2) Ground
3) CAN Hi / ECU B1 Pin
4) CAN Lo / ECU C1 Pin

Logged
HotIce
Hero Member
*****
Offline Offline

Posts: 812


« Reply #40 on: January 19, 2012, 07:56:48 AM »

Is there anyone which by any chance has a picture of the circuit board of the M3C ECU?
Or that has a fried/bricked one which can crack open to show the internals?
Logged
HotIce
Hero Member
*****
Offline Offline

Posts: 812


« Reply #41 on: January 21, 2012, 06:59:32 PM »

Here it is the ECU pinout and connector information (thanks to chrisw member in DucatiDiag forum):




This is the connector:

http://www.mouser.com/ProductDetail/Molex/98650-2002?qs=xc6tm2qnjABzyWASYfRASdrW2w9wbBWI

Mouser also lists the DDA connector in their web site, but it seems not stocked, and with 16 weeks lead time (which is same as they do not have it  Undecided ):

http://www.mouser.com/ProductDetail/FCI/211PL042S0011/?qs=HumNWfwekiGi%2fm%252b6TKSg%2fw%3d%3d

« Last Edit: January 22, 2012, 03:25:18 PM by HotIce » Logged
HotIce
Hero Member
*****
Offline Offline

Posts: 812


« Reply #42 on: January 25, 2012, 07:39:54 AM »

Is there anyone which by any chance has a picture of the circuit board of the M3C ECU?
Or that has a fried/bricked one which can crack open to show the internals?
Diurdac on the DucatiDiag forum has crack opened a 696 M3C ECU:




And FreeScale CPU manual:

http://cache.freescale.com/files/microcontrollers/doc/ref_manual/MC9S12XS256RMV1.pdf

« Last Edit: January 25, 2012, 07:54:25 AM by HotIce » Logged
HotIce
Hero Member
*****
Offline Offline

Posts: 812


« Reply #43 on: February 01, 2012, 04:29:34 PM »

An update on this. On the DucatiDiag Forum, Diurdac has plugged an oscilloscope  to the CAN Bus lines coming off the DDA port, and it seems it is a 500Kbps CAN Bus protocol.
Which means that IMO, with proper cable, it should be possible to plug a $20 ELM327 OBD2 tool to it, and reset the service light (plus look at the error codes, and other information published on the OBD2 layer).
Logged
HotIce
Hero Member
*****
Offline Offline

Posts: 812


« Reply #44 on: March 11, 2012, 10:42:07 PM »

There are a few more things happening here:

http://ducatidiag.xooit.com/t186-Siemens---Continental-ECU.htm?start=345#p9870

I was able, via an Arduino Uno plus a CAN bus shield, and custom software (which I will make available for everyone), to get CAN frames out of the DDA port.

Logged
Pages: 1 2 [3] 4   Go Up
  Print  
 
Jump to:  


Powered by MySQL Powered by PHP Powered by SMF 1.1.21 | SMF © 2015, Simple Machines
Simple Audio Video Embedder
Valid XHTML 1.0! Valid CSS!
SimplePortal 2.1.1