The big reveal!
https://youtu.be/gqfbOfd2MUM
2015 WRX
Accessport Installed (not sure if these requests work on a stock rom ECU)
The SSM3 was mapped by using the AP to poll the ECU's diagnostic channel.
ECU response comes on CAN ID 2024 or 0x7E8.
AP/RC requests must be done sent on CAN ID 2016 or 0x7E0
I also think that a one time packet must be sent to the ECU on 2015 or 0x7DF.
txCAN(0,2015,0,{2,16,3,0,0,0,0,0});
**************
Requesting Data
**************
The accessport has multiple parameters it can requests, because of this multiple can packets are sent to the ECU. The number of packets changes depending on how many parameters you wish to log. I have not decoded every single parameter. Instead I selected the ones I wanted, used the AP to poll the ECU, and sniffed which packets were being send on 0x7E0.
For the following parameters:
Air/Fuel Correction
Air/Fuel Learning
Air/Fuel Ratio
Dynamic Advance Multiplier
Ethanol Raw
Feedback Knock Correction
Fine Knock Learning
Fuel Pressure
Gear Position
Ignition Timing
Intake Temp
Intake Manifold Temp
RPM
Each of the above parameters has a specific address it calls on. The sum of the address adds up to the overall request to the ecu. See below.
txCAN(0,2016,0,{16,53,168,0,0,0,9,0})
txCAN(0,2016,0,{33,0,10,248,138,248,248,138})
txCAN(0,2016,0,{34,249,248,17,174,248,60,62})
txCAN(0,2016,0,{35,248,60,63,248,167,170,248})
txCAN(0,2016,0,{36,167,183,248,136,132,248,136})
txCAN(0,2016,0,{37,133,248,166,49,0,0,17})
txCAN(0,2016,0,{38,0,0,18,248,136,212,248})
txCAN(0,2016,0,{39,205,100,248,205,101,0,0})
txCAN(0,2016,0,{48,0,0,0,0,0,0,0})
A few things to note here:
1. The second byte of the first packet tells the ECU the length of the request. From here it knows how many packets to expect.
2. The third byte of the first packet tells the ECU this is a read request. It will never change.
3. The first byte of each packet represents the packet number. There will always be a 16 or 0x10 and a 48 or 0x30. They represent the start and end packets. 33,34,35,36,37, / 0x21, 0x22, 0x23, 0x24, 0x25, etc represents the rest of the packets in the request and tell the ecu how to organize the total request.
Code: Select all
txCAN(0,2015,0,{2,16,3,0,0,0,0,0});
setTickRate(25)
function onTick()
txCAN(0,2016,0,{16,53,168,0,0,0,9,0})
txCAN(0,2016,0,{33,0,10,248,138,248,248,138})
txCAN(0,2016,0,{34,249,248,17,174,248,60,62})
txCAN(0,2016,0,{35,248,60,63,248,167,170,248})
txCAN(0,2016,0,{36,167,183,248,136,132,248,136})
txCAN(0,2016,0,{37,133,248,166,49,0,0,17})
txCAN(0,2016,0,{38,0,0,18,248,136,212,248})
txCAN(0,2016,0,{39,205,100,248,205,101,0,0})
txCAN(0,2016,0,{48,0,0,0,0,0,0,0})
end
********************
Decoding ECU Response
********************
The response from the ECU will be in multiple packets. Depending on how many parameters you log the number of packets required to respond will change. For the above parameters, the response will include 4 packets. Here is the ECU response:
0x10 0x0B 0xE8 0x7D 0x7B 0x20 0x07 0x10
0x21 0x20 0x4C 0x00 0x1A 0x96 0x00 0x00
0x22 0xA1 0x50 0x57 0x1A 0x84 0x00 0x00
0x30 0x00 0x00 0x00 0x00 0x00 0x00 0x00
A few things to note:
1. Again the first byte represents the position of the packet within the entire response.
2. Byte two of the first packet represents the length of the response.
3. Byte three of the first packet is the ECU's acknowledgement of the read request and is 0xA8+0x08.
Here is how you decode the response packets:
Air/Fuel Correction
Can ID: 2024 (0x7E8)
Sub ID: 16 (0x10)
Offset: 3
Length: 1
Formula: (x-128)*100/128
Air/Fuel Learning
Can ID: 2024 (0x7E8)
Sub ID: 16 (0x10)
Offset: 4
Length: 1
Formula: (x-128)*100/128
Air/Fuel Ratio
Can ID: 2024 (0x7E8)
Sub ID: 16 (0x10)
Offset: 5
Length: 2
Big Endian
Formula: (x**0.00179443359375)
Dynamic Advance Multiplier
Can ID: 2024 (0x7E8)
Sub ID: 16 (0x10)
Offset: 7
Length: 1
Formula: (x/16)
Ethanol Raw
Can ID: 2024 (0x7E8)
Sub ID: 33 (0x21)
Offset: 1
Length: 2
Big Endian
Formula: (x/656)
Feedback Knock Correction (Formula is still under testing)
Can ID: 2024 (0x7E8)
Sub ID: 33 / 0x21
Offset: 3
Length: 1
Formula: ??
Under normal running conditions this should be 0. The AP reports knock in increments of -1.41. (-1.41, -2.81, -4.2, etc) There is only one byte that returns a result. Thus far I've seen -1.41 and a byte value of 255 / 0xFF. Still working on this, but I know that anything greater than 0 equals knock.
Fine Knock Learning (Formula is still under testing)
Can ID: 2024 (0x7E8)
Sub ID: 33 / 0x21
Offset: 4
Length: 1
Formula: ?? (see my answer for Feedback Knock Correction)
Fuel Pressure
Can ID: 2024 (0x7E8)
Sub ID: 33 (0x21)
Offset: 5
Length: 2
Formula: (x/10)
Gear Position
Can ID: 2024 (0x7E8)
Sub ID: 33 (0x21)
Offset: 7
Length: 1
Formula: X
Ignition Timing
Can ID: 2024 (0x7E8)
Sub ID: 34 (0x22)
Offset: 1
Length: 1
Formula: (x-128)/2
Intake Temp
Can ID: 2024 (0x7E8)
Sub ID: 34 (0x22)
Offset: 2
Length: 1
Formula: 32+9(x-40)/5
(formula includes C->F conversion)
Intake Manifold Temp
Can ID: 2024 (0x7E8)
Sub ID: 34 (0x22)
Offset: 3
Length: 1
Formula: 32+9(x-50)/5
(formula includes C->F conversion)
RPM
Can ID: 2024 (0x7E8)
Sub ID: 34 (0x22)
Offset: 4
Length: 2
Big Endian
Formula: (x/5)
Please note, if you change the request packets, the responses will SHIFT. That means the above mappings will no longer work. For now, you will absolutely need to use the requests packets I provided, to ensure the mappings are correct.
***********************************************
Additional can maps that don't require requests to the ECU
***********************************************
Throttle
Can ID: 320
Offset: 0
Length: 1
Brake (sweep not PSI)
Can ID: 209
Offset: 2
Length: 1
Steering
Can ID: 2
Offset: 0
Length: 2
Big Endian
Source Type: Sign
Coolant Temp
Can ID: 864
Offset: 3
Length: 1
Formula: 32+9(x-40)/5
(Formula includes C->F conversion)
Oil Temp
Can ID: 864
Offset: 2
Length: 1
Formula: 32+9(x-40)/5
(Formula includes C->F conversion)
****************************
Extra Credit - A request to help me
****************************
I'm working to confirm my formula for Ethanol Raw for a Flex Fuel setup. I need more data points and will test more. The same applies to feedback knock correction and fine knock learning.
However, I need help with Boost!
Here is the response packet from the ECU in Hex (Engine Off)
0x06 0xE8 0x55 0xD1 0x65 0x00 0x00 0x00
For the above, boost is at -0.26 ish.
Here is the reponse packet from the ECU in Hex. (Engine Idle)
0x06 0xE8 0x0A 0x9F 0x65 0x1E 0x46 0x00
For the above, boost is at -11.1 ish
For payload equals byte 1-8, I think the bytes of interests are 3 (0x55), 4 (0xD1), 6 (0x00) and 7 (0x00). 6 and 7 are of interest because they change when the engine is on. But really I think it is 3 or 4.
I also have a set of packets for 26+ parameter requests. For some reason, when I send this set of packets, the ecu ignores my requests. If someone wants to help me understand what is happening, it would be awesome. I think it has something to do with the timing of how the packets are sent because if I set the can mappings, then use my Accessport to request the data, everything works fine. The send packets are below:
0x10 0x74 0xA8 0x00 0x00 0x00 0x09 0x00
0x20 0x00 0x15 0x00 0x00 0x30 0x00 0x00
0x21 0x00 0x0A 0xF8 0x8A 0xF8 0xF8 0x8A
0x22 0xF9 0x00 0x01 0x19 0x00 0x01 0x18
0x23 0x00 0x00 0x3D 0x00 0x00 0x3C 0xF8
0x24 0x92 0x64 0xF8 0x92 0x65 0x00 0x00
0x25 0x23 0xF8 0xA6 0x26 0xF8 0xAB 0x7F
0x26 0x00 0x00 0x08 0xF8 0x11 0xAE 0xF8
0x27 0x3C 0x3E 0xF8 0x3C 0x3F 0xF8 0xA7
0x28 0xAA 0xF8 0xA7 0xB7 0xF8 0x88 0x84
0x29 0xF8 0x88 0x85 0xF8 0xA6 0x31 0x00
0x2A 0x00 0x11 0x00 0x00 0x20 0x00 0x00
0x2B 0x0E 0x00 0x00 0x0F 0x00 0x00 0x12
0x2C 0xF8 0x88 0xD4 0x00 0x00 0x1D 0xF8
0x2D 0xCD 0x64 0xF8 0xCD 0x65 0xF8 0xAE
0x2E 0xDA 0xF8 0xAE 0xDB 0xF8 0xB3 0xC0
0x2F 0xF8 0xB3 0xC1 0x00 0x00 0x23 0x00
0x30 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Parameters requested:
Air/Fuel Correction
Air/Fuel Learning
Air/Fuel Ration
AVCS Exhaust Left
AVCS Exhaust Right
AVCS Intake Left
AVCS Intake Right
Boost
Calculated Load
Cloosed Loop
Coolant T
Dynamic Advance Multiplier
Ethanol Raw
Feedback Knock Correction
Fine Knock Learning
Fuel Pressure
Gear Pos
Ignition Timing
Injector Duty
Intake Temp
Intake Manifold
MAF Voltage
RPM
Requested Torque
Target Boost
Throttle Position
Wastegate Duty