Engine Diagnostics
Discussion
Sorry to bring this thread up from the grave during my first post, but I have spent quite a bit of time searching for any information on diagnostics and tuning for the 14cux. There are many large grassroots projects on dissasembling and hacking/tuning the ecm's for just about every mid 80's to mid 90's Chevrolet and Ford vehicles sold here in America. I've been involved in tuning these for some time and have written my own tuning and diagnostic software for them using some very well documented dissasemblies from other enthusiasts. I find it hard to believe that a vehicle as popular around the world as Land Rover has such little publicly available information on the engine management systems.
I saw Mark Adams mention he has the diagnostic protocol for the 14cux. I realize he is in the business of tuning these engines and may not want to release it, but does anyone know of a source for this information? So far all I have done in my tuning efforts is read the chip from a 4.2 and a 3.9 and successfuly used a ROM emulator (Craig Moates Ostrich from www.moates.net) to run the vehicle. I know its a very insignificant step, but proper tuning is almost impossible without diagnostic feedback from the ECU.
I realize these aren't racecars so I don't expect much interest from others in tuning these, but a free publicly available diagnostic utility should interest anyone with a V8 Range Rover classic or older disco/defender.
Is a "black box" even necessary for communication on these? One of the applications I wrote was a JAVA based diagnostic scan tool for GM fuel injected vehicles. It ran at 160 baud using some software trickery. It was unidirectional though, and I suspect bidirectional at a non standard baud rate might be difficult, though 8192 bps is another common automotive speed that is frequently done with bidirectional communication without the use of any additional hardware.
I saw Mark Adams mention he has the diagnostic protocol for the 14cux. I realize he is in the business of tuning these engines and may not want to release it, but does anyone know of a source for this information? So far all I have done in my tuning efforts is read the chip from a 4.2 and a 3.9 and successfuly used a ROM emulator (Craig Moates Ostrich from www.moates.net) to run the vehicle. I know its a very insignificant step, but proper tuning is almost impossible without diagnostic feedback from the ECU.
I realize these aren't racecars so I don't expect much interest from others in tuning these, but a free publicly available diagnostic utility should interest anyone with a V8 Range Rover classic or older disco/defender.
Is a "black box" even necessary for communication on these? One of the applications I wrote was a JAVA based diagnostic scan tool for GM fuel injected vehicles. It ran at 160 baud using some software trickery. It was unidirectional though, and I suspect bidirectional at a non standard baud rate might be difficult, though 8192 bps is another common automotive speed that is frequently done with bidirectional communication without the use of any additional hardware.
Yes, this seems to have gone quiet since last year....To my way of thinking, the live data is what is most valuable and I cant see why you don't just need a Break-out-box which is wired into a proprietry A/D converter which slots into your PC or laptop and the software to drive the A/D converter. I wonder if all the inputs can be dealt with this way like the road speed sensor input or injector output for example, which are pulsed signals. The clever bit that experienced guys like Mark could bring is in making the whole thing work together and including specification limits on the I/O and a help section.
Please be gentle with me as I'm a humble Mechanical Engineer etc.
Please be gentle with me as I'm a humble Mechanical Engineer etc.
breakout boxes are nice for diagnosing the harness, but the data from the diagnostic port is better, it lets you see what the ECM sees. I don't know what outputs the 14cux has, but most OEM ECU's have the ability to display things such as target Air/Fuel ratio, engine temp (thermistors are not linear, the ecu has the lookup table and interpolates accordingly), mass air flow readings, and being able to see more than one error code at a time. (the lucas display that my NAS Discovery has is very limited).
I often hear of people (usually uneducated shade tree meechanics) blaming the ECU at the first sign of EFI trouble. A breakout box wouldn't eliminate that as a possibility, communicating with the ECU would.
I often hear of people (usually uneducated shade tree meechanics) blaming the ECU at the first sign of EFI trouble. A breakout box wouldn't eliminate that as a possibility, communicating with the ECU would.
I'm afraid I abandoned my plans on this 18 months ago when I went for an aftermarket ECU. If you're serious about tuning a Rover v8 car, then I suspect this is the most cost effective way in terms of cost vs time vs attaining results.
As my original post says, I have Windows software for the Subarus - this included bi-directional non-standard baud RS232 comms and a very simple packet based protocol. I used a simple level converter IC as an interface between the ECU and the laptop.
I imagine the Rover isn't much different to this.
I still have a 14CUX ECU sat doing nothing much, so if I find myself with nothing to do, I could be persuaded to help in an effort to crack the protocol however I do think there are better ways to tune cars these days...
As my original post says, I have Windows software for the Subarus - this included bi-directional non-standard baud RS232 comms and a very simple packet based protocol. I used a simple level converter IC as an interface between the ECU and the laptop.
I imagine the Rover isn't much different to this.
I still have a 14CUX ECU sat doing nothing much, so if I find myself with nothing to do, I could be persuaded to help in an effort to crack the protocol however I do think there are better ways to tune cars these days...
were you able to discover the suburu serial protocol yourself or was this already documented?
From little I have found, I think the 14cux uses the very early ISO 9141 format. It's got two diagnostic lines that I assume are a k-line and l-line, but not sure which one is which.
Theres only 3 or 4 ways of initiating communication if its bidirectional, if it is streaming unidirectional data then this project should be very simple
i guess step one would be to hook up a scope to the diagnostic ports and see if there is anything active, if not then I guess the usual 9141 initialization types should be tried on both lines, and both of them monitored to see if anything is spit back out.
then its on to determining frames and headers and other fun stuff.
From little I have found, I think the 14cux uses the very early ISO 9141 format. It's got two diagnostic lines that I assume are a k-line and l-line, but not sure which one is which.
Theres only 3 or 4 ways of initiating communication if its bidirectional, if it is streaming unidirectional data then this project should be very simple
i guess step one would be to hook up a scope to the diagnostic ports and see if there is anything active, if not then I guess the usual 9141 initialization types should be tried on both lines, and both of them monitored to see if anything is spit back out.
then its on to determining frames and headers and other fun stuff.
I have noticed on both chips I have read that they repeat themselves at 0x4000. Is this because rover should have used a 27c128 but got a smoking deal on a bunch of of 27c256, or is this where alternate "tunes" are located? In North America there is no "tune resistor" used on these trucks, the pin is not there in the harness so it would seem possible that instead of burning two different tunes to one chip, the one certified for NAS emissions would occupy all of the spaces available.
Anyone know how many different tunes a single chip is capable of holding? There are more than 2 resistances listed on the websites that document it but no mention of a limited selection based on the chip used.
Anyone know how many different tunes a single chip is capable of holding? There are more than 2 resistances listed on the websites that document it but no mention of a limited selection based on the chip used.
It seems as though interest may have died down, but heres my findings so far...
it appears there are fuel tables 16x8 bytes at the following addresses
0x0000-0x007F
0x0267-0x2E6
0x0379-0x03F9
0x048B-0x050B
0x059D-0x061D
0x06AF-0x072F
it turns out that both chips I have are for 3.9 v8s, one is a 92, the other is a 95.
tables 2,3,4,5 are the same for both chips. Tables 1 and 6 are the only ones that differ.
on each chip, tables 2,3,4 are identical, tables 1 and 6 are identical, and table 5 is
different that the rest.
I'm still thinking these are different tables for tune resistors. My next step will be to
get an emulator with trace function and see if it is reading only one of these and go from
there. Possibly check AFR with a wideband and see how it correlates to the cell being
read. Anyone input or suggestions are welcome, I might be in over my head on this project.
it appears there are fuel tables 16x8 bytes at the following addresses
0x0000-0x007F
0x0267-0x2E6
0x0379-0x03F9
0x048B-0x050B
0x059D-0x061D
0x06AF-0x072F
it turns out that both chips I have are for 3.9 v8s, one is a 92, the other is a 95.
tables 2,3,4,5 are the same for both chips. Tables 1 and 6 are the only ones that differ.
on each chip, tables 2,3,4 are identical, tables 1 and 6 are identical, and table 5 is
different that the rest.
I'm still thinking these are different tables for tune resistors. My next step will be to
get an emulator with trace function and see if it is reading only one of these and go from
there. Possibly check AFR with a wideband and see how it correlates to the cell being
read. Anyone input or suggestions are welcome, I might be in over my head on this project.
Do you think the tables are in pulsewidths or approximate AFRs?
Based on your results, I'll venture the suggestion that the tune resistor connects to an A to D. The resistor values seem to line up with setting individual bits in a one-hot encoding strategy to select the appropriate table.
Doing the trace sounds like a fine idea. Would some more source maps help you? I have a couple.
Based on your results, I'll venture the suggestion that the tune resistor connects to an A to D. The resistor values seem to line up with setting individual bits in a one-hot encoding strategy to select the appropriate table.
Doing the trace sounds like a fine idea. Would some more source maps help you? I have a couple.
I'm not sure yet, but there is such a range in value from one corner to the other that I don't think its going to be AFR.
It resembles a VE table more than anything, but that wouldn't make sense on a mass air flow setup.
maybe its a percentage of maximum injector duty cycle or time between ignition events.
I might need to find a way to disable closed loop fuel control for this project.
Those source maps would be great. Could you email them to robertf2003@tamu.edu ?
It resembles a VE table more than anything, but that wouldn't make sense on a mass air flow setup.
maybe its a percentage of maximum injector duty cycle or time between ignition events.
I might need to find a way to disable closed loop fuel control for this project.
Those source maps would be great. Could you email them to robertf2003@tamu.edu ?
Edited by robertf03 on Wednesday 25th July 14:50
I have the new recently released Fault Code Reader from Steve Heath. Unfortunately for me I fixed the fault I was trying to track before I got the unit, however, I have tested that it works and given the amount of time I have spent wondering about different sensors being the cause of misfires & lumpy tickover over the past nine years it is well worth the <40 quid ish to have it in the tool box.
Would certainly be interested in any PC app that gave me additional data.
Would certainly be interested in any PC app that gave me additional data.
Edited by mattrosersv on Friday 25th December 00:52
I have an original range rover fault code reader but as they are about £70 get yourself a steve heath one. I just leave mine permanently plugged in so if any faults flash up they are immediately obvious.
Paranoid ? perhaps , but it always good to see there are no codes if there is any odd behaviour so at least you know the ECU is happy so its probably something basic.
Paranoid ? perhaps , but it always good to see there are no codes if there is any odd behaviour so at least you know the ECU is happy so its probably something basic.
Gassing Station | Griffith | Top of Page | What's New | My Stuff