User Tag List

+ Reply to Thread
Page 1 of 3 1 2 3 LastLast
Results 1 to 40 of 84

Thread: IAW P8 048/P8 reverse engineering

  1. #1
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    IAW P8 048/P8 reverse engineering

    For those who are interested....think now its time to publish secrets about cossie ECU code.

    Is not much people in the world who are able share their work about this stuff. but its almost 20 years old..... never mind.

    Small community of people is willing to share their work.


    Our work is still in progress...so we share what we have.

    I note that you need little knoweledge to understand it (or need to learn). Maybe later in time I will translate all to "normal" language.

    all you can find here:




    Code:
    https://mega.nz/#F!4ll3SBwA!zdLyx6JT8-_PHer_k7CiHQ

    - IDA diassembler...software for import .idb file (better to work with it)
    - P8 html file, diassembled output in html format.
    - IAW research docs (documents from early 90s, for 048/P8 memory, very interesting reading..now giving for free.)

    Every help is welcome

  2. #2
    World Champion Decade Plus User alladdin's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    May 2005
    Location
    s.wales
    Age
    60
    Posts
    9,200
    Thanks
    167
    Thanked 446 Times in 432 Posts

    Re: IAW P8 048/P8 reverse engineering

    sharing is good

  3. #3
    TURBOSPORT SPONSOR Turbosport Subscriber
    Turbosport Moderator
    Turbosport Administrator
    Graham's Avatar
    My Race Car
    My 1st Project
    Join Date
    Feb 2006
    Location
    Ely, Cambs
    Age
    56
    Posts
    25,110
    Thanks
    310
    Thanked 2,476 Times in 2,250 Posts

    Re: IAW P8 048/P8 reverse engineering

    its all double dutch to me, but i agree, sharing is good

    Quote Originally Posted by alladdin View Post
    sharing is good

  4. #4
    World Champion Decade Plus User alladdin's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    May 2005
    Location
    s.wales
    Age
    60
    Posts
    9,200
    Thanks
    167
    Thanked 446 Times in 432 Posts

    IAW P8 048/P8 reverse engineering

    Quote Originally Posted by Graham View Post
    its all double dutch to me,:
    Me too 😄



    Sent from my iPhone using Tapatalk

  5. #5
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Does anyone have access to docs relating to the Pectel P8 (or modified L8) datastream?

    I have the MSD Evo chip which enables the datastream, an interface cable, and the RP Labs IAW monitor which works nicely for static monitoring in the garage. However, it would be nice to have an embedded device in the car, constantly recording, as well as having various display options for the driver.

    I'm more than capable of putting the hardware and software side of things together, but without access to datastream specs it would seem quite a task to reverse engineering the serial interface. I would have thought that after some 25-30 years, someone would have released the specs.

  6. #6
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Does anyone have access to docs relating to the Pectel P8 (or modified L8) datastream?

    I have the MSD Evo chip which enables the datastream, an interface cable, and the RP Labs IAW monitor which works nicely for static monitoring in the garage. However, it would be nice to have an embedded device in the car, constantly recording, as well as having various display options for the driver.

    I'm more than capable of putting the hardware and software side of things together, but without access to datastream specs it would seem quite a task to reverse engineering the serial interface. I would have thought that after some 25-30 years, someone would have released the specs, but it seems to be a closely guarded secret still!

  7. #7
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    dont think that somebody will tell you this...

    its still top secret....

    but in fact its not so hard to watch on serial interface

  8. #8
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Is it by any chance the same as the serial protocol in use on the Fiat/Lancia Magneti Marelli P8 ecu as used in the Fiat Coupe Turbo, Lancia Delta Evo etc?

    If it is, then the following (taken from http://www.nailed-barnacle.co.uk/cou.../startrek.html) is how it is described:

    Initialisation

    All MM ECUs (of this type) send a data stream of a six bytes at 1200 Baud - the ISO code - when first powered. This can be safely ignored, but can take up to eight seconds to complete, so you should wait for at least that time after the ECU powers up before trying to talk to it.

    Some, but not all, MM ECUs require a formal initialisation before they will communicate. The IAW P8 does not, the IAW16 and most others, do. This initialisation takes place at 1200 baud and requires you to send three bytes - 0x0f, 0xaa, and 0xcc separated by 110ms. There is no response from the ECU.

    Reading the data

    Now you change the baud rate to 7812.5 baud, whether you had to initialise or not.

    Thereafter, all communications involve the tester sending a single byte, and the ECU responding with a single byte. Where a two byte answer is required, two separate send/receive byte processes are used.

    After receiving a byte (or two) you then apply some fairly obscure transforms to turn the answer into something you can understand and display.

  9. #9
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    you can use it as example..but its not same!

  10. #10
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    I guess I just don't understand the secrecy. At the end of the day it's a comms protocol, nothing more. It's not as if anyone is going to clone the IAW series of ecu's and start making their own - they're totally obsolete now.

    Anyway, the guy who wrote the Fiat/Alfa/Lancia tool has given me his documentation for the protocol and the byte codes to request the sensor data. It's a good start, and I intend to make the software freely available to all when I get it up and running - it's targeted for Python on Linux right now; be it a laptop for in-car diagnostics, or a Pi, Beagleboard or something similar for on-the-go data logging and monitoring via something a bit more suitable than a laptop and big LCD screen (thinking character mode LCD mounted in the dash pod with buttons on the column/wheel to control data logging start/stop and scrolling through sensor data).

    Someone else seems to have had a go for the Cossie, and I've got a copy of the utility (it works - but again, it's closed source) but he seems to have dropped off the face of the earth after a spat on Passionford.

  11. #11
    Pit Crew Decade Plus User

    Join Date
    Mar 2008
    Location
    west bromwich
    Posts
    1,861
    Thanks
    3
    Thanked 141 Times in 135 Posts

    Re: IAW P8 048/P8 reverse engineering

    Your on about the guy off passionford s.e.c.s he made own ecu and that secs monitor before bowky did them again , I've got the software off him and got it runing on usb and serail cable on any laptop ,even had some cables made to the dionostic, what do you need to know , I have 2 pectel monitor , one you can change fuel and timing , the other ones a wrc monitor, you can datalog with both , just need the dart software I've got but will only work with xp laptop

  12. #12
    Pit Crew Decade Plus User

    Join Date
    Mar 2008
    Location
    west bromwich
    Posts
    1,861
    Thanks
    3
    Thanked 141 Times in 135 Posts

    Re: IAW P8 048/P8 reverse engineering


  13. #13
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Yep, I've found a copy and tried FPM, I also have a licensed copy of the RPLabs IAW monitor that I bought from MSD, it's a great piece of kit.

    However what I'm looking to do is have an embedded computer constantly datalogging and visualising sensor data - not on a laptop.

    It's really a definition of the serial datastream protocol that I'm looking for - the Fiat/Lancia docs seem like a good place to start, as I can't imagine that Weber/Marelli would change the protocol substantially between the Ford L8/P8 and the Fiat P8 modules.

    So far since writing the original message I've sourced some LCD character displays and some nice clear OLED screens and have got some demo data running on a stripped-out Raspberry Pi (boot time 5 seconds) as well as emulating those display devices on-screen (a desktop Linux system needed for that). I can start/stop data capture, change sensor visualisation (bar chart, line graph, waveform, etc) as well as start/stop capture to SD card at will. I need to integrate some controls for in-car use, probably a mini thumbstick for navigating menus (mounted on the column or something).

    However I'm now approaching the point where I need to integrate the serial datastream... so that's going to be the next challenge. Worst case scenario I run the IAW software and do a bulk capture of the usb device and then put it back, piece by piece. Though a document that describes the protocol would be a much easier starting point

    I'll try and get some images and video clips up of what I've done so far.

  14. #14
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Plotting MAP sensor values in waveform display mode on a miniature OLED graphic display, with TPS values in both horizontal bar chart and numeric value on a LCD character mode display:



    Plotting RPM speed in LED-segment style logarithm vertical bars on the OLED, with RPM speed in bar chart and TPS values in numeric value on a LCD character mode display:



    All the screens are configurable, so any screen can switch to another sensor at the touch of a button, or after a pre-determined amount of time. The character mode LCD display is nice, easy to use and simple to connect up, but the one big limitation is refresh speed, as you can see, so it's not great for sensors with rapidly changing values: RPM, MAP, TPS, injector duration etc. Better to plot those on the OLED displays (and I have my eye on a cool 256x64 widescreen one as a 'master' display). The OLED displays are about 2/3 the size of a typical 52mm gauge but are incredibly clear.

    The Raspberry Pi has both an SPI and I2C bus available on the GPIO pins, so can accomodate either type of display - my OLED screen is I2C, which means that its possible to daisy-chain them in sequence. The only limit for how many you can have at once (all with different displays showing) is the processing power of the Pi to generate the data for all of them and send it fast enough. I've got two at the moment and can drive them at a solid 20fps - which seems to be the limit of the bus.

    At the moment demo data is being generated for each sensor, which results in the steady rise/fall of the visualisation modes.
    Last edited by MegatronUK; 15-01-2018 at 23:39.

  15. #15
    Pit Crew Decade Plus User

    Join Date
    Mar 2008
    Location
    west bromwich
    Posts
    1,861
    Thanks
    3
    Thanked 141 Times in 135 Posts

    Re: IAW P8 048/P8 reverse engineering

    Looking good , I tryed for ages to get the pectel protical, and couldn't get it and autodynix are doing a monitor with the pectel protical , will put a link to them

  16. #16
    Pit Crew Decade Plus User

    Join Date
    Mar 2008
    Location
    west bromwich
    Posts
    1,861
    Thanks
    3
    Thanked 141 Times in 135 Posts

    Re: IAW P8 048/P8 reverse engineering

    www.autodynamix.co.uk%2Fauto-dynamix-tuning%2Fdtm-monitor%2Fcosworth-dtm-monitor%2F&usg=AOvVaw3ND0sm3R-jWuLZLzsH2eJ0[/url]
    Last edited by xpackboy; 16-01-2018 at 18:39.

  17. #17
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    https://www.autodynamix.co.uk/auto-d...h-dtm-monitor/

    Yep, that looks like they're doing the same as RP Labs, the FPM monitor we've both tried and generally what I'm trying to do. I guess the only option I've got is to dump the comms and try to reverse engineer it.

  18. #18
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    FPM is good but its only for pectel L8 because L8 from OE specs doesnt have serial protocol inside!!!! you cant read...

    Now we done some reverse engineering on these ecus and by this as spare product we find that P8 ecu have standard serial protocol interface.

    So guys buy USB-TTL or any other 5V serial interface....plug RX/TX (pin 8 = RX / pin 27 = TX) GND and +5V from ecu...
    and you can talk with your P8.


    it can accept about 12 orders + - (dont have all) and as result it will active component or send you some data.

    understand that it accept and send only 8bit string! in hex...

    so send "0A" or "07" it will send you some data back...

    When we will have a time, will identify exactly what order is what value...but its nothing hard...
    then you can visualise your data..

    at the end I want to programm some PC based software to diagnose your cosworth P8 car.




    ----------------------------------------------------------------------------------------------------

    FIAT /LANCIA /ALFA P8 ecus (not ecus exactly...ecus are same, so....bin files inside ecus) need to send some data at start..to activate comm mode.
    these ecus you can normmaly read via multiecuscan software. it will show you error codes...values...etc.

    ford .bin software is differend .....

    for L8 pectel stream... it cant be so hard...as you said.. just send some data... what happend
    need to check if it needs any "initialization" sequence?

    pectel allow you to change working values inside ram LIVE....but this can be hard to find out what orders need to send.

    I have here L8 with pectel...will try.
    Last edited by midnightman; 18-01-2018 at 00:32.

  19. #19
    Pit Crew Decade Plus User

    Join Date
    Mar 2008
    Location
    west bromwich
    Posts
    1,861
    Thanks
    3
    Thanked 141 Times in 135 Posts

    Re: IAW P8 048/P8 reverse engineering

    Good work midnightman

  20. #20
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    If we start with the sequences that Fiat/Alfa have listed, it will be a start. I'll type up the list tonight. My info is that the L8 doesn't have Comms by default but most tuners just enable it so that it functions identically to the P8, minus the extra functions like iscv purge etc, which depends on extra hardware.

  21. #21
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Also, I'm sure I heard somewhere that it was wasn't actually a feature of the software as such, but more a feature built in to the Motorola processor that enables serial Comms. Hence why it works on both L8 and P8 as they share the same according to bigturbo.co.uk.

  22. #22
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Taken from the FIAT documentation, here are the byte codes that are listed that seem to match the L8/P8 functionality:

    RPM (most significant byte), 0x01, 30000000 / DATUM = RPM
    RPM (lest significant byte), 0x02, 30000000 / DATUM = RPM
    Injection duration (msb), 0x03, 4 * DATUM / 10^3 = milliseconds
    Injection duration (msb), 0x04, 4 * DATUM / 10^3 = milliseconds
    Ignition advance, 0x05, DATUM 1L/4 = degrees (don't understand this one!)
    Intake pressure, 0x06, DATUM * 6.4161 + 45.63 = mmHg
    Air temp, 0x07, (see lookup tables)
    Water temp, 0x08, (see lookup tables)
    TPS, 0x09, if < 30 (DATUM * 0.1848) - 1.41 = Degrees, if >= 30 (DATUM * 0.7058) - 90 = degrees
    Voltage, 0x0A, DATUM * 0.0628 = volts
    Fuel trimmer, 0x0B, DATUM - 128
    Injection timing angle, 0x0C, 720 - (DATUM * 90) / 4 = Degrees

    Most sensors need two reads (lower 8 bits and upper 8 bits) to get the data, you then consult a conversion table to transform the value into an actual human readable number. There's also a standard value that is used as a reference to aid in the transforms. There's a value for FIAT/Alfa, my guess is there is something similar for the Cosworth implementation.

    Fortunately, with the RPLabs software, the individual sensors can be toggled on or off. What I plan to do this weekend is run the software for each sensor in turn, but grab all of the traffic each time I do so. I should be able to work out if the byte codes are the same for the Cosworth sensor readings as per the Fiat/Alfa docs.

  23. #23
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    L8 use differend MCU...not 68HC11... pectel board have their own software and additional HW for this comm..
    I heard time ago that last L8 ecus with lambda have some kind of datastream...only when car is running? maybe due to EOBD? who knows?
    I have this ecu on desk...and there is no any comm....but for now dont have working car to test

    For pectel datastream decode you need to "watch" how it communicate...it needs sequence to send and active diag? (like P8 FIAT software) ? or just send some "0A" command and wait for answer?
    Who has IAW monitor....you can watch on oscilo..what is going on lines... then based on live measure find out what order give what value.

    Pectel datastream is able to read "whole" eeprom...and change live working values inside RAM... but this can be hard to find out what commands you need to use...
    As I know, this datastream must be "allowed" inside software.... and I am sure that nobody will tell you where the "switch" is...

    for STANDARD P8 bin software is very very easy.... just send to ecu every possible command from 00 to - FF and watch for answer....
    as I know if you send command which is unknown for ecu, next command you need to send twice..to show data (if next command is good) but..maybe its comm. issue in my case.

    you need a working car...and lot of hours of reading..to find what value is what.
    In this case FIAT working document is wrong...almost nothing is same!!!!

    but you can use calculations for values..how to build rpm, lambda..temps...etc.
    its same as in mapping (tunerpro XDFs for P8 on tunerpro site) calculation for values.

    every cosworth monitor for P8 is based on this

  24. #24
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    Quote Originally Posted by MegatronUK View Post
    Taken from the FIAT documentation, here are the byte codes that are listed that seem to match the L8/P8 functionality:

    RPM (most significant byte), 0x01, 30000000 / DATUM = RPM
    RPM (lest significant byte), 0x02, 30000000 / DATUM = RPM
    Injection duration (msb), 0x03, 4 * DATUM / 10^3 = milliseconds
    Injection duration (msb), 0x04, 4 * DATUM / 10^3 = milliseconds
    Ignition advance, 0x05, DATUM 1L/4 = degrees (don't understand this one!)
    Intake pressure, 0x06, DATUM * 6.4161 + 45.63 = mmHg
    Air temp, 0x07, (see lookup tables)
    Water temp, 0x08, (see lookup tables)
    TPS, 0x09, if < 30 (DATUM * 0.1848) - 1.41 = Degrees, if >= 30 (DATUM * 0.7058) - 90 = degrees
    Voltage, 0x0A, DATUM * 0.0628 = volts
    Fuel trimmer, 0x0B, DATUM - 128
    Injection timing angle, 0x0C, 720 - (DATUM * 90) / 4 = Degrees

    Most sensors need two reads (lower 8 bits and upper 8 bits) to get the data, you then consult a conversion table to transform the value into an actual human readable number. There's also a standard value that is used as a reference to aid in the transforms. There's a value for FIAT/Alfa, my guess is there is something similar for the Cosworth implementation.

    Fortunately, with the RPLabs software, the individual sensors can be toggled on or off. What I plan to do this weekend is run the software for each sensor in turn, but grab all of the traffic each time I do so. I should be able to work out if the byte codes are the same for the Cosworth sensor readings as per the Fiat/Alfa docs.
    this calculations are on 90% same...because in core, every P8 software is same....cosworth can run on fiat software, fiat can run on cosworth software... because ecus are same too...only have little difference in pickups...injectors...etc..

  25. #25
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    My L8 definitely works, I've a whole heap of logs that I've collected from it with the RPLabs software. The software specifically terms it "IAW048.L8 PECTEL" mode.

    I've added a wasted spark driver and a chip from Motorsports Developments (with closed loop and wasted spark enabled), but no additional hardware was installed to enable comms. I'm almost certain that it's a software only change between L8 and P8 to enable comms by default.

  26. #26
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    what baby board is used for that L8?

  27. #27
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    My RPLabs software runs in a Windows virtual machine (Virtualbox), so that I can move it between systems when needed. That means I can also run libpcap and wireshark to capture all the raw comms sent and received from the USB<->Serial device that is connected to the L8 ecu.

    If I do this in turn, for each single sensor only, then I should be able to get a good grasp of how it communicates, and how similar the comms protocol matches Fiat -like you say, do we need to do any extra initialisation, for example.

  28. #28
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    read pm mate

  29. #29
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    It's a completely standard L8 expansion board as far as I'm aware, no mention of Pectel anywhere on the sub-board, and just the standard single socket and 3 soldered IC's:

    Click image for larger version Name:	P1070354-.JPG Views:	224 Size:	79.9 KB ID:	82134

    Click image for larger version Name:	P1070355-.JPG Views:	222 Size:	114.8 KB ID:	82135

    Click image for larger version Name:	P1070356-.JPG Views:	223 Size:	117.1 KB ID:	82136

    Click image for larger version Name:	P1070359-.JPG Views:	221 Size:	116.9 KB ID:	82137

    Click image for larger version Name:	P1070360-.JPG Views:	226 Size:	116.9 KB ID:	82138

    Click image for larger version Name:	P1070368-.JPG Views:	226 Size:	116.9 KB ID:	82139

    Click image for larger version Name:	P1070372-.JPG Views:	229 Size:	116.8 KB ID:	82140

  30. #30
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    so yes...its stadnard BB....

    in this case....that comm is only about software...but ...this will be some hacked pectel....give .bin file

  31. #31
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    I will try to discous with owner of IAW-SCAN 2 utility... to add support for cosworth P8 engine.

    this program is what we need but now..it wants to initialize ecu..and values are bad...

    its a easyiet way.

  32. #32
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    I've been doing some diagnostics this morning with a serial port monitor running in the background. Some interesting findings so far:

    The baud rate that the IAW tool uses is an odd speed - only around 1900baud. So it doesn't correspond with the Fiat docs,or anything else I've found - it also means that will also limit overall sample rate.

    No initialisation sequence that I can see, so the ECU serial port must be free-running at power-on.

    So far I've got the byte codes for TPS and CTS (0x80 and 0x84, if I recall). I'll go through each sensor on the IAW logger in turn and record them.

    Interestingly I don't get any data back from the ECU when I use the IAW logger 'retrieve status codes/errors' button - it writes to the ECU, but the data returned is null.

  33. #33
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Here's the serial port monitor showing multiple sensors being sampled in turn:

    Click image for larger version Name:	IMG_20180121_113417-.jpg Views:	217 Size:	115.9 KB ID:	82150

    ... and here's only coolant temp, so we now know for definite that 0x84 is the byte code to retrieve CTS data:

    Click image for larger version Name:	IMG_20180121_114441-.jpg Views:	220 Size:	109.8 KB ID:	82151

    This afternoon, assuming my fingers don't fall off due to frostbite, I'll make a table of the byte codes for the Cossie ecu. With no initialisation sequence that I've observed so far, it should be fairly simple to get data out of this. The only oddity so far is the baud rate. We do need to know the datum number though, which if the Fiat docs are to be believed, is used in almost all data translation to get read-world numbers.

  34. #34
    Management Team Decade Plus User
    Turbosport Subscriber
    Turbosport Moderator
    Clint's Avatar
    My Race Car
    My 1st Project
    My 2nd Project
    My 3rd Project
    Join Date
    Jul 2001
    Location
    Sevenoaks, Kent, United Kingdom
    Age
    54
    Posts
    925,744
    Thanks
    59
    Thanked 279 Times in 179 Posts

    Re: IAW P8 048/P8 reverse engineering

    For the P8 why not throw away the buggy Pectel code and just use the later and better Fiat software then all the work Barnacle has done also works, this is what I did many years ago.
    Cosworth Electronics / Pectel Dealer, Syvecs Dealer.
    Europes Largest Link ECU Dealer - Aim Sportline Dash and Datalogger Dealer, ECU Master for South East UK
    UK Mahle and Reinz Distributor - 3J Driveline Dealer - Corbeau Seat Dealer
    ECU & Dash packages preconfigured and custom looms made to order.
    Professional conversions - Engine Swaps - Complete Project Design
    0% Finance Available on all products and services.
    [B]Engine Parts for most makes, all Ford parts kept in stock, Pinto, Xflow, YB, V4, V6, Zetec, Dratec, Wiring Looms Plugs, Plug Kits and Loom Products, Head Refurbishment and Porting, Engine Rebuilding Services.
    w: www.shopbhp.com e: sales@shopbhp.com
    Like us on Facebook: https://www.facebook.com/brandshatchperformance

  35. #35
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    you are mixing 2 ecus...

    for L8 there is no serial protocol without pectel board/software.

    for P8 you dont need any pectel...P8 has serial procotol in standard.

    thats all....

  36. #36
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Okay, here we go. Here's how to access all of the available Cosworth sensors in the L8 (with serial comms activated) or P8 ECU.

    Port settings are:
    • Baud rate: 1952
    • Byte size: 8
    • Parity: 'N'
    • Stop bits: 1 (i.e. standard 8N1 comms)
    • XON/XOFF: Off
    • RTS/CTS: Off
    • DSR/DTR: On

    Unlike FIAT/Alfa/Lancia P8 code, there is no initialisation sequence. As soon as the ECU has power and is running, the serial comms is active. Just connect up your serial cable and start writing and reading from it.

    To read any of the sensors you write a single byte, then read a single byte back again. Some sensors are stored as a 16bit value and must be accessed as the lower and upper bytes - write and then read one byte, then write and read the other.

    Here is a full list of all the sensor byte codes that work on my L8 ECU:

    0x80 RPM (upper byte)
    0x81 RPM (lower byte)
    0x82 Inlet manifold pressure
    0x83 Intake temperature sensor
    0x84 Coolant temperature sensor
    0x85 Throttle position sensor
    0x86 Ignition advance
    0x87 Injector duration (upper byte)
    0x88 Injector duration (lower byte)
    0x89 Battery voltage
    0x8b Status code 1
    0x8c Status code 2
    0x90 Boost control valve

    I need to work out the status codes / fault diagnosis data, as I don't seem to get anything back when monitoring the IAW logger showing that information. Other than that, use the information as you see fit. Certainly anyone with an unlocked L8 with the software enabled serial comms can do everything that I've done so far. If someone would like to loan me an Escort Cosworth for a few months to test, I'm more than happy to oblige

    Even better, the FIAT documentation that I've got which explains how to turn the returned data back in to human readable format appears to work. For example, whilst testing battery voltage, the IAW logger was returning hex 0xd0 (208 in decimal), and showing 13.0v. The FIAT docs say to multiply the data byte for the battery voltage by 0.0628. in this case that gives 13.0624 - which means that those transforms seem to hold for the Cosworth as well as they do for the FIAT.

  37. #37
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Here's a very simple example in action - continually reading the value of the throttle position sensor in about 6 lines of Python code:


  38. #38
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    you need to have pectel datastream enabled in ECU...thats the problem no-one L8 software has it enabled!

    calculations are not problem, you can find xdf on tunerpro site for L8 ecu...calculations are same (for mapping, and for live stream).



    for P8.... its starting at 0x01,,,rpm,act,ect..fault code, without possibility to change RAM or read chip.

    you dont need to get P8 cosworth car mate....get IAW 4Q4/4WF/4WB/4WG, put pure cosworth .bin inside (I have, ask).
    and connect it to your cosworth sierra car

    you will start you car, engine will run.

    but dont run for a long time as this ecus are designed for high impedance injectors...and you have LOW.

    but for serial protocol testing...its more than enough


    can you post your bin file? its MSD coded I know...
    Last edited by midnightman; 21-01-2018 at 17:41.

  39. #39
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Quote Originally Posted by midnightman View Post
    these values are from IAW pectel L8 board.... you need to have pectel datastream enabled in ECU...thats the problem Think not every pectel board L8 software has it enabled!
    That's fine. Although I think we're talking about the same thing, but using two different terminologies: the babyboard in the L8 is a RAM expansion and some address decoders - there's nothing related to any Pectel hardware. It's purely a software mod that enables it... and P8 owners get the functionality for free. So now anyone with either a Escort Cosworth or one of those software enabled L8 ecu's can benefit from this information and start doing DIY monitoring/logging if they choose to.

    calculations are not problem, you can find xdf on tunerpro site for L8 ecu...calculations are same (for mapping, and for live stream).
    Already got all of the calculations - they appear to match the FIAT docs:

    Click image for larger version Name:	ecu_transforms.jpg Views:	215 Size:	75.8 KB ID:	82153

    This Pectel software can do chip read over this serial protocol and live data change inside RAM...

    and activate commands

    for P8.... its starting at 0x01,,,rpm,act,ect..fault code, without possibility to change RAM or read chip.

    you dont need to get cosworth car mate....get IAW 4Q4/4WF/4WB/4WG, put pure cosworth .bin inside (I have, ask).
    and connect it to your cosworth sierra car

    you will start you car, engine will run.

    but dont run for a long time as this ecus are designed for high impedance injectors...and you have LOW.

    but for serial protocol testing...its more than enough

  40. #40
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    that document you have is for P8 software.... double check if its ok for L8...I am not sure..

    ///

    sorry I think that you have L8 with pectel....my mistake, you have pure L8 with standard BB, you have "hacked" pectel sofware with enabled comm.
    Post your bin file

+ Reply to Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts