Engine Diagnostics

Engine Diagnostics

Author
Discussion

edhorne

423 posts

249 months

Monday 14th November 2005
quotequote all
Hello Chaps

Mark (if you are there....)

I would really be interested in one of your interface boxes and software.

Have you got any further with plans to produce one?

I would happily be a gineau pig!

Cheers

Ed Horne

robertf03

59 posts

166 months

Thursday 12th July 2007
quotequote all
Sorry to bring this thread up from the grave during my first post, but I have spent quite a bit of time searching for any information on diagnostics and tuning for the 14cux. There are many large grassroots projects on dissasembling and hacking/tuning the ecm's for just about every mid 80's to mid 90's Chevrolet and Ford vehicles sold here in America. I've been involved in tuning these for some time and have written my own tuning and diagnostic software for them using some very well documented dissasemblies from other enthusiasts. I find it hard to believe that a vehicle as popular around the world as Land Rover has such little publicly available information on the engine management systems.

I saw Mark Adams mention he has the diagnostic protocol for the 14cux. I realize he is in the business of tuning these engines and may not want to release it, but does anyone know of a source for this information? So far all I have done in my tuning efforts is read the chip from a 4.2 and a 3.9 and successfuly used a ROM emulator (Craig Moates Ostrich from www.moates.net) to run the vehicle. I know its a very insignificant step, but proper tuning is almost impossible without diagnostic feedback from the ECU.

I realize these aren't racecars so I don't expect much interest from others in tuning these, but a free publicly available diagnostic utility should interest anyone with a V8 Range Rover classic or older disco/defender.

Is a "black box" even necessary for communication on these? One of the applications I wrote was a JAVA based diagnostic scan tool for GM fuel injected vehicles. It ran at 160 baud using some software trickery. It was unidirectional though, and I suspect bidirectional at a non standard baud rate might be difficult, though 8192 bps is another common automotive speed that is frequently done with bidirectional communication without the use of any additional hardware.


red griff 500

280 posts

207 months

Thursday 12th July 2007
quotequote all
Yes, this seems to have gone quiet since last year....To my way of thinking, the live data is what is most valuable and I cant see why you don't just need a Break-out-box which is wired into a proprietry A/D converter which slots into your PC or laptop and the software to drive the A/D converter. I wonder if all the inputs can be dealt with this way like the road speed sensor input or injector output for example, which are pulsed signals. The clever bit that experienced guys like Mark could bring is in making the whole thing work together and including specification limits on the I/O and a help section.
Please be gentle with me as I'm a humble Mechanical Engineer etc.

robertf03

59 posts

166 months

Thursday 12th July 2007
quotequote all
breakout boxes are nice for diagnosing the harness, but the data from the diagnostic port is better, it lets you see what the ECM sees. I don't know what outputs the 14cux has, but most OEM ECU's have the ability to display things such as target Air/Fuel ratio, engine temp (thermistors are not linear, the ecu has the lookup table and interpolates accordingly), mass air flow readings, and being able to see more than one error code at a time. (the lucas display that my NAS Discovery has is very limited).

I often hear of people (usually uneducated shade tree meechanics) blaming the ECU at the first sign of EFI trouble. A breakout box wouldn't eliminate that as a possibility, communicating with the ECU would.


dnb

3,330 posts

207 months

Thursday 12th July 2007
quotequote all
I'm afraid I abandoned my plans on this 18 months ago when I went for an aftermarket ECU. If you're serious about tuning a Rover v8 car, then I suspect this is the most cost effective way in terms of cost vs time vs attaining results.

As my original post says, I have Windows software for the Subarus - this included bi-directional non-standard baud RS232 comms and a very simple packet based protocol. I used a simple level converter IC as an interface between the ECU and the laptop.

I imagine the Rover isn't much different to this.

I still have a 14CUX ECU sat doing nothing much, so if I find myself with nothing to do, I could be persuaded to help in an effort to crack the protocol however I do think there are better ways to tune cars these days...


robertf03

59 posts

166 months

Thursday 12th July 2007
quotequote all
were you able to discover the suburu serial protocol yourself or was this already documented?

From little I have found, I think the 14cux uses the very early ISO 9141 format. It's got two diagnostic lines that I assume are a k-line and l-line, but not sure which one is which.

Theres only 3 or 4 ways of initiating communication if its bidirectional, if it is streaming unidirectional data then this project should be very simple

i guess step one would be to hook up a scope to the diagnostic ports and see if there is anything active, if not then I guess the usual 9141 initialization types should be tried on both lines, and both of them monitored to see if anything is spit back out.

then its on to determining frames and headers and other fun stuff.

dnb

3,330 posts

207 months

Thursday 12th July 2007
quotequote all
I had a couple of clues, but I figured most of it out myself. (Back then I had access to scopes and logic analysers, but it's not so easy now.)

clive f

7,244 posts

198 months

Thursday 12th July 2007
quotequote all
I dnb says its so then it is in my book.bow




basically its because I`m thick thoughhehe

Pasco

6,648 posts

193 months

Thursday 12th July 2007
quotequote all
Thick and Stupid infact yes

clive f

7,244 posts

198 months

Thursday 12th July 2007
quotequote all
stupid eh?

at least I know where the fuel pump is!

roflroflheheheheroflrofl

Pasco

6,648 posts

193 months

Thursday 12th July 2007
quotequote all
clive f said:
stupid eh?

at least I know where the fuel pump is!

roflroflheheheheroflrofl
I know you have difficulty reading but take a look at that thread again Smart Ass !

loser


robertf03

59 posts

166 months

Thursday 12th July 2007
quotequote all
I have noticed on both chips I have read that they repeat themselves at 0x4000. Is this because rover should have used a 27c128 but got a smoking deal on a bunch of of 27c256, or is this where alternate "tunes" are located? In North America there is no "tune resistor" used on these trucks, the pin is not there in the harness so it would seem possible that instead of burning two different tunes to one chip, the one certified for NAS emissions would occupy all of the spaces available.

Anyone know how many different tunes a single chip is capable of holding? There are more than 2 resistances listed on the websites that document it but no mention of a limited selection based on the chip used.


robertf03

59 posts

166 months

Wednesday 25th July 2007
quotequote all
It seems as though interest may have died down, but heres my findings so far...

it appears there are fuel tables 16x8 bytes at the following addresses

0x0000-0x007F
0x0267-0x2E6
0x0379-0x03F9
0x048B-0x050B
0x059D-0x061D
0x06AF-0x072F

it turns out that both chips I have are for 3.9 v8s, one is a 92, the other is a 95.

tables 2,3,4,5 are the same for both chips. Tables 1 and 6 are the only ones that differ.

on each chip, tables 2,3,4 are identical, tables 1 and 6 are identical, and table 5 is

different that the rest.

I'm still thinking these are different tables for tune resistors. My next step will be to

get an emulator with trace function and see if it is reading only one of these and go from

there. Possibly check AFR with a wideband and see how it correlates to the cell being

read. Anyone input or suggestions are welcome, I might be in over my head on this project.

dnb

3,330 posts

207 months

Wednesday 25th July 2007
quotequote all
Do you think the tables are in pulsewidths or approximate AFRs?

Based on your results, I'll venture the suggestion that the tune resistor connects to an A to D. The resistor values seem to line up with setting individual bits in a one-hot encoding strategy to select the appropriate table.

Doing the trace sounds like a fine idea. Would some more source maps help you? I have a couple.

robertf03

59 posts

166 months

Wednesday 25th July 2007
quotequote all
I'm not sure yet, but there is such a range in value from one corner to the other that I don't think its going to be AFR.

It resembles a VE table more than anything, but that wouldn't make sense on a mass air flow setup.

maybe its a percentage of maximum injector duty cycle or time between ignition events.

I might need to find a way to disable closed loop fuel control for this project.

Those source maps would be great. Could you email them to robertf2003@tamu.edu ?






Edited by robertf03 on Wednesday 25th July 14:50

dnb

3,330 posts

207 months

Wednesday 25th July 2007
quotequote all
Yes. Probably won't happen until Friday though...

I'll have a think about things. The Subaru ECU I helped reverse engineer had fuel tables with huge ranges too. They were still AFRs but had some crazy transform done on them...

robertf03

59 posts

166 months

Wednesday 25th July 2007
quotequote all
I hope thats the case, AFR would make the most sense with a MAF setup.


hkchim

5 posts

137 months

Thursday 24th December 2009
quotequote all
Hi there,

I have decatted 96 chim 5.0l . Does the 14 CUX fault reader work well with it? pls advise

mattrosersv

552 posts

195 months

Friday 25th December 2009
quotequote all
I have the new recently released Fault Code Reader from Steve Heath. Unfortunately for me I fixed the fault I was trying to track before I got the unit, however, I have tested that it works and given the amount of time I have spent wondering about different sensors being the cause of misfires & lumpy tickover over the past nine years it is well worth the <40 quid ish to have it in the tool box.

Would certainly be interested in any PC app that gave me additional data.

Edited by mattrosersv on Friday 25th December 00:52

bigdods

7,022 posts

192 months

Friday 25th December 2009
quotequote all
I have an original range rover fault code reader but as they are about £70 get yourself a steve heath one. I just leave mine permanently plugged in so if any faults flash up they are immediately obvious.

Paranoid ? perhaps , but it always good to see there are no codes if there is any odd behaviour so at least you know the ECU is happy so its probably something basic.