User Tag List

+ Reply to Thread
Page 2 of 3 FirstFirst 1 2 3 LastLast
Results 41 to 80 of 84

Thread: IAW P8 048/P8 reverse engineering

  1. #41
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    sorry I think that you have L8 with pectel....my mistake, you have pure L8 with standard BB, you have "hacked" pectel sofware with enabled comm.
    Post your bin file
    Ah, sorry, I can't do that - I'm a happy customer of Motorsport Developments and would rather not post up one of their maps.

  2. #42
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    All of my code and documentation is currently in a private repository at work, I am going to move it to a public one on github.com tomorrow so that everyone can benefit.

    It will appear at https://github.com/megatron-uk

    This includes all of the source code for the digital instrumentation as well as the serial Comms I listed today.

  3. #43
    Pit Crew Decade Plus User

    Join Date
    Mar 2008
    Location
    west bromwich
    Posts
    1,861
    Thanks
    3
    Thanked 141 Times in 135 Posts

    Re: IAW P8 048/P8 reverse engineering

    Been on there some good info , even though I don't understand some of it lol

  4. #44
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Quote Originally Posted by xpackboy View Post
    Been on there some good info , even though I don't understand some of it lol
    Ha! I understand; some of the engine building stuff on here goes way over my head . At the very least the data stream protocol is now publicly documented, at least partially, and available to all.

  5. #45
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering - Pectel serial datastream logging

    Little bit more work on decoding and testing the Pectel datastream today.

    I've run some performance analysis on the serial datastream - it's fast enough to return, on average, around 62 sensor datapoints a second. Not a massive amount, but better than I thought we would get, based on the baud rate.

    On average, each sensor requires 25-27ms to query and return a value. But that assumes all sensors only take a single byte to query and a return a single byte result (this a value in a range from 0-255), unfortunately injector duration and RPM, at the very least, require two writes and two reads (with a result in the range 0-65535). For those sensors, time increases to 43ms.

    There doesn't appear to be any statistically significant difference in the time taken to query each type of sensor.

    I put together a simple test routine, outside of my digital dashboard code, to run the numbers and this is what I see:

    Test run 1 - all sensors, then performance test against TPS (a single byte sensor value)
    Code:
    $ ./SensorReader
    [2018-01-27 12:35:07,835] [    INFO] (     Cosworth.py: 126) | MainProcess | Starting Cosworth ECU sensor module
    L8 Pectel None
    [2018-01-27 12:35:07,835] [    INFO] (     Cosworth.py: 179) | MainProcess | Bringing up serial interface
    Serial<id=0x7f736d41b860, open=True>(port='/dev/ttyUSB0', baudrate=1952, bytesize=8, parity='N', stopbits=1, timeout=0.1, xonxoff=0, rtscts=0, dsrdtr=0)
    [2018-01-27 12:35:07,837] [    INFO] (     Cosworth.py: 289) | MainProcess | Serial interface up
    ##########################################
    
    Test 1. We are going to attempt to read every sensor in turn...
    Sensor: [  AMAL] Value: [185.000] Sample Speed: [17.922ms] Description: [Duty cycle of boost control valve]
    Sensor: [IGNADV] Value: [0.000] Sample Speed: [27.345ms] Description: [Ignition timing in degrees before top dead centre]
    Sensor: [   TPS] Value: [-0.116] Sample Speed: [27.223ms] Description: [Open angle of throttle plate in degrees ]
    Sensor: [   MAP] Value: [390.348] Sample Speed: [27.328ms] Description: [Inlet manifold pressure in milibars]
    Sensor: [   RPM] Value: [7326.000] Sample Speed: [43.284ms] Description: [Engine speed]
    Sensor: [   BAT] Value: [12.183] Sample Speed: [27.351ms] Description: [Battery or supply circuit voltage]
    Sensor: [   IAT] Value: [78.000] Sample Speed: [27.354ms] Description: [Inlet manifold air temperature in degrees Celsius]
    Sensor: [   ECT] Value: [80.000] Sample Speed: [27.433ms] Description: [Engine coolant temperature in degrees Celsius]
    Sensor: [INJDUR] Value: [16.000] Sample Speed: [43.160ms] Description: [Injector pulse width duration in milliseconds]
    Check the above values!
    
    Test 2. Now testing how fast we can read all sensors
    All sensors read in 180.419ms
    
    Test 3. Sampling one sensor [TPS] as fast as possible
    256 samples read in 4113.454ms = 62.23 samples/second
    Maximum sample time: 43.160ms
    Minimum sample time: 31.851ms
    Average sample time: 37.505ms
    
    Test 4. Interactive display - Activate/move or update the [TPS] sensor (Control+C to exit)
    Running...
    Sensor: [   TPS] Value: [    -54.71] Sample Speed: [17.255ms]
    Sensor: [   TPS] Value: [31.397599999999997] Sample Speed: [20.691ms]
    Sensor: [   TPS] Value: [    68.805] Sample Speed: [20.845ms]
    Sensor: [   TPS] Value: [31.397599999999997] Sample Speed: [20.747ms]
    Sensor: [   TPS] Value: [  -51.8868] Sample Speed: [20.756ms]
    Sensor: [   TPS] Value: [58.21799999999999] Sample Speed: [20.628ms]
    Sensor: [   TPS] Value: [44.102000000000004] Sample Speed: [20.757ms]
    Sensor: [   TPS] Value: [-0.11640000000000006] Sample Speed: [20.798ms]
    ...
    ...
    Test 2 - performance testing RPM - a 16bit sensor:
    Code:
    [2018-01-27 12:45:13,888] [    INFO] (     Cosworth.py: 126) | MainProcess | Starting Cosworth ECU sensor module
    L8 Pectel None
    [2018-01-27 12:45:13,888] [    INFO] (     Cosworth.py: 179) | MainProcess | Bringing up serial interface
    Serial<id=0x7f6053eb6860, open=True>(port='/dev/ttyUSB0', baudrate=1952, bytesize=8, parity='N', stopbits=1, timeout=0.1, xonxoff=0, rtscts=0, dsrdtr=0)
    [2018-01-27 12:45:13,890] [    INFO] (     Cosworth.py: 289) | MainProcess | Serial interface up
    ##########################################
    
    Test 1. We are going to attempt to read every sensor in turn...
    Sensor: [   TPS] Value: [-0.116] Sample Speed: [14.481ms] Description: [Open angle of throttle plate in degrees ]
    Sensor: [IGNADV] Value: [70.000] Sample Speed: [27.337ms] Description: [Ignition timing in degrees before top dead centre]
    Sensor: [   ECT] Value: [105.000] Sample Speed: [27.246ms] Description: [Engine coolant temperature in degrees Celsius]
    Sensor: [  AMAL] Value: [185.000] Sample Speed: [27.323ms] Description: [Duty cycle of boost control valve]
    Sensor: [   MAP] Value: [140.100] Sample Speed: [27.236ms] Description: [Inlet manifold pressure in milibars]
    Sensor: [   IAT] Value: [82.000] Sample Speed: [27.402ms] Description: [Inlet manifold air temperature in degrees Celsius]
    Sensor: [   BAT] Value: [11.744] Sample Speed: [27.439ms] Description: [Battery or supply circuit voltage]
    Sensor: [INJDUR] Value: [2.000] Sample Speed: [43.219ms] Description: [Injector pulse width duration in milliseconds]
    Sensor: [   RPM] Value: [15511.000] Sample Speed: [43.395ms] Description: [Engine speed]
    Check the above values!
    
    Test 2. Now testing how fast we can read all sensors
    All sensors read in 180.388ms
    
    Test 3. Sampling one sensor [RPM] as fast as possible
    256 samples read in 8221.024ms = 31.14 samples/second
    Maximum sample time: 32.123ms
    Minimum sample time: 31.673ms
    Average sample time: 31.917ms
    
    Test 4. Interactive display - Activate/move or update the [RPM] sensor (Control+C to exit)
    Running...
    Sensor: [   RPM] Value: [     16207] Sample Speed: [31.078ms]
    Sensor: [   RPM] Value: [     16068] Sample Speed: [37.105ms]
    Sensor: [   RPM] Value: [     16348] Sample Speed: [36.626ms]
    Sensor: [   RPM] Value: [     16277] Sample Speed: [37.263ms]
    Sensor: [   RPM] Value: [     16492] Sample Speed: [36.823ms]
    Sensor: [   RPM] Value: [     16268] Sample Speed: [36.609ms]
    ...
    ...
    Ignore the actual values - some of the data translation routines are not in place yet, so you're seeing raw values, rather than translated to real number with some of those sensors. TPS works, and you're seeing the angle open. Many of the others are raw values and other than seeing them go up or down based on engine speed, don't correspond to a real number... yet.

    Here's a video of test run 2, above, which shows the engine running and the RPM sensor data increasing and decreasing with engine speed:


    What does this all mean? Well, the serial datastream seems plenty fast enough to run a digital dashboard, but, I'll have to be fairly careful about which sensors are refreshed on a regular basis. For example, I can refresh RPM up to 15 times a second (which should be more than fast enough for most people), but that leaves only around 50% of the remaining time for all other sensors but we can mitigate that to a degree by having a very slow refresh for slower-changing sensors; coolant and air charge, perhaps only twice a second, for instance.

  6. #46
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Oh, and I didn't get time to decode the byte code for CO mixture enhancement or Lambda today. But they should be in there. I'll try and get those deciphered next, and add them to the table of byte code values on Github: https://github.com/megatron-uk/PyCos...docs/Pectel.md

  7. #47
    Tyre Kicker

    Join Date
    Jul 2016
    Location
    Spain
    Posts
    12
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: IAW P8 048/P8 reverse engineering

    Great info!!

    It's a pity that I have no idea how to execute this files. lol

  8. #48
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Okay, so the CO trim pot value can be read via the byte code 0xba. One thing I haven't been able to find yet is a way of getting the lambda sensor reading or closed/open loop mode. Not sure if the IAW logger supports reading it, at least on L8 (the option is there but it reports as NA when you try to get a reading).

    Some of the Fiat translations for the raw sensor data work (tps, battery, injector duration... I think), but others... Erm... Not so much.

  9. #49
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    As an example of some of the raw byte values to real-world figures:

    CO
    The raw value 0x80 is displayed as 0.00 in the IAW logger, and here are some other values I observed in the serial comms and their on-screen display version:
    0x76 = -3.91
    0x80 = 0.00
    0x8d = 5.08
    0x95 = 8.20
    0x9a = 10.16
    0xb4 = 20.31 (no, I don't run the car this rich; just fiddling with the trim pot with the engine off!)

    The Fiat calculation states to convert the hex value of the single byte value to decimal, then minus 128.

    Unfortunately, that gets us:

    0x76 = 118 - 128 = -10 (wrong)
    0x80 = 128 - 128 = 0 (correct)
    0x8d = 141 - 128 = 13 (wrong)
    0x95 = 149 - 128 = 21 (wrong)
    0x9a = 154 - 128 = 26 (wrong)
    0xb4 = 180 - 128 = 52 (wrong)

    RPM
    RPM is another one where the Fiat translation doesn't match what I see in the Cossie data.
    Idling at ~900 rpm on the clock, and remembering that RPM is presented as two values (a 16bit integer) I see the following in the IAW logger:

    byte 1: 0x07
    byte 2: 0xe0

    This showed as 895rpm in the IAW logger. Unfortunately, again the Fiat docs state to get the actual value, your divide 30000000 by the value returned. If we do that:

    Shift 0x07 left by 2 places as it's the upper byte and add on the lower byte 0xe0 we get 0x07e0 (decimal value 2016). However, 30000000 / 2016 does not equal 895, of course, but a more motorcycle-like 14880 rpm.

    Even if I've cocked up massively and swapped the high and low bytes around, and it should instead be 0xe007 (52351 in decimal), thats 30000000 / 52351 = 523rpm. Still completely wrong compared to what both the clocks and the IAW graphical interface was saying.

    All of the other values need a similar process running so that we can find out what the translation actually is.

    It's funny that Battery voltage, TPS and, somewhat unbelievably to me, Injector duration, seem to match the Fiat docs, but many others don't.

    Out of interest, what should injection duration at idle-ish type speeds be?

  10. #50
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Long shot, but I've asked RP Labs if they are willing to share the translation formulae for the raw values for the sensors. Highly unlikely they'll be willing to do so, but it doesn't hurt to ask.

    Also the other thing I'm interested in is monitoring Lambda control - i.e. is there any way of detecting if the system is in closed or open-loop mode? Even better, can the ecu actually return AFR data for the standard narrowband sensor?

  11. #51
    Tyre Kicker

    Join Date
    Jan 2009
    Location
    italy
    Age
    39
    Posts
    6
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: IAW P8 048/P8 reverse engineering

    hi sorry for my english ... the calculation for the rpm for pectel P8 is different from the fiat P8... 30000000 / X fiat 1875000 / X pectel ..

  12. #52
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Quote Originally Posted by foxy44 View Post
    hi sorry for my english ... the calculation for the rpm for pectel P8 is different from the fiat P8... 30000000 / X fiat 1875000 / X pectel ..
    That's great, thank you for that information. You don't happen to have a list of the calculations for the other Pectel sensors do you?

  13. #53
    Tyre Kicker

    Join Date
    Jan 2009
    Location
    italy
    Age
    39
    Posts
    6
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: IAW P8 048/P8 reverse engineering

    no, however, that the other values ​​are the same as in the fiat file.

  14. #54
    Tyre Kicker

    Join Date
    Jan 2009
    Location
    italy
    Age
    39
    Posts
    6
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: IAW P8 048/P8 reverse engineering

    does anyone know how to enable the wasted spark on the pectel p8 software?

  15. #55
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    RP Labs have provided a number of the missing calculations to transform the raw data from the P8 data stream to real numbers.

    Updated Pectel data stream document is here: https://github.com/megatron-uk/PyCos...docs/Pectel.md

    There are a few more to get, such as error codes, as well as lambda information, but I was pushing my luck as it was and I'm very grateful for their assistance already.
    Last edited by MegatronUK; 01-02-2018 at 20:10.

  16. #56
    Tyre Kicker

    Join Date
    Jul 2016
    Location
    Spain
    Posts
    12
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: IAW P8 048/P8 reverse engineering

    Quote Originally Posted by MegatronUK View Post
    Out of interest, what should injection duration at idle-ish type speeds be?
    Between 10 - 18 degrees, depends on chip spec

  17. #57
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Demo of the main system in action - running from my desk at the moment with a demo datastream. Will transfer it to the car shortly for a full run-through.

    The main control screen, showing selection of multiple sensors, system info, etc:


    Showing the data logging functions:


    All modes allow section of different types of visualistion: waveform, 'LED' bar graph, line graph, analogue clock. I'm also going to put together some custom modes for the main screen - probably a 'track' mode that has RPM, MAP, TPS in a more compact layout - with space for gear indicator in the centre.

    Made a little breakout board for the Raspberry Pi, so that all of the display modules and sensors can plug in - with the little 1.5" square screens you can cascade a whole load of them together, so I made the board so I can have up to 5 of them. The bit screen connects via a different protocol (SPI, rather than I2C), and only 2 of those devices can be connected on the Pi - one is this screen, the other is an 8-channel analogue to digital convertor, so I can sample some other data (probably a hall sensor on the gearbox or wheel hub).

    Click image for larger version Name:	IMG_20180203_215851-.jpg Views:	210 Size:	116.8 KB ID:	82200

    Keyboard is also getting a little awkward to navigate all the menus, so I've built up a little joystick that will sit on the centre console.

    The whole system is completely configurable, so you actually don't have to have any of the screens - it could run with just a single button to start/stop datalogger mode. If you wanted it kept simple you could use one of the or 4 line lcd screens and just have text. Or any combination of the above.

  18. #58
    Pit Crew Decade Plus User

    Join Date
    Mar 2008
    Location
    west bromwich
    Posts
    1,861
    Thanks
    3
    Thanked 141 Times in 135 Posts

    Re: IAW P8 048/P8 reverse engineering

    Looking great , keep up the good work

  19. #59
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Had a chance to test the latest code on the car this weekend. Most of the sensors are showing correct values now, and the visuals are looking reasonably good..



    Got a full CSV log of the session too, so that aspect is working perfectly.

    My TPS is playing up, by the looks of things. At least it seems to go out of spec part way through the travel, but the beginning and end of the throttle travel seem to give accurate readings. I guess part throttle is where they fail though, since most of their life is spent there.

    My MAP sensor readings don't match the boost gauge, so that's one other thing to check. Next is to package up the Pi and other hardware and test the same code on them in-car.
    Last edited by MegatronUK; 11-02-2018 at 20:31.

  20. #60
    Bodger

    Join Date
    Jun 2002
    Location
    Blackpool
    Age
    52
    Posts
    119
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    Awesome work!
    If you ever decide to put that in production, give me first refusal. I could still sell those.
    Best Regards,
    Stu

    www.motorsport-developments.co.uk
    01253 508400 (7 lines)

  21. #61
    Racer Decade Plus User wildo105e's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Oct 2006
    Location
    Manchester
    Age
    53
    Posts
    3,150
    Thanks
    131
    Thanked 237 Times in 230 Posts

    Re: IAW P8 048/P8 reverse engineering

    It's certainly an interesting read, well done so far.

  22. #62
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Thanks guys, all the info and code is open source, so feel free to build on anything I've done

    https://github.com/megatron-uk/PyCosworth

  23. #63
    Bodger

    Join Date
    Jun 2014
    Location
    leeds
    Age
    58
    Posts
    127
    Thanks
    0
    Thanked 12 Times in 12 Posts

    Re: IAW P8 048/P8 reverse engineering

    this is absolutely fascinating, unfortunately its so far above my head its on oxygen. oh well back to cleaning up my points with wet and dry

  24. #64
    Tyre Kicker

    Join Date
    Aug 2012
    Location
    Sweden
    Age
    39
    Posts
    12
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: IAW P8 048/P8 reverse engineering

    Where did you find C0 trimpot bit? 0x???

    nevermind it was 0x8a ... found on your github
    Last edited by Big_Al; 23-06-2018 at 10:10. Reason: found

  25. #65
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    cosworth P8 doesnt have co trim...

    https://www.scribd.com/document/31527116/300608-IAW-P8

    there are more variables in P8 software (FIAT).

    good work at that variables for Cosworth But we are still missing error flags, adaptation flag...etc.

  26. #66
    Tyre Kicker

    Join Date
    Aug 2012
    Location
    Sweden
    Age
    39
    Posts
    12
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: IAW P8 048/P8 reverse engineering

    If you can read out highbits inside the CPU... could you also read the ROM? Like the whole ROM in a go? That am I interested in

  27. #67
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    this is "standard" diagnostic protocol which is included inside cosworth software. you can only read ram values which are supported in this protocol.
    + do some active tests..

    you cannot read ROM memory....maybe you can...after some diagnostic routines mod inside software.

  28. #68
    Tyre Kicker

    Join Date
    Jun 2014
    Location
    Galicia,Spain
    Age
    35
    Posts
    10
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: IAW P8 048/P8 reverse engineering

    Quote Originally Posted by MegatronUK View Post
    Thanks guys, all the info and code is open source, so feel free to build on anything I've done

    https://github.com/megatron-uk/PyCosworth
    Hi

    I'm making some tests with no success. Which kind of USB to serial converter are you using? One with 5v TTL levels or common rs232? I tried with one usb-rs232.
    I hope i didnt broke anything as this uses higher voltages

  29. #69
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Quote Originally Posted by AiToR51 View Post
    Hi

    I'm making some tests with no success. Which kind of USB to serial converter are you using? One with 5v TTL levels or common rs232? I tried with one usb-rs232.
    I hope i didnt broke anything as this uses higher voltages
    It's standard RS232 signalling - just via a cheap ebay USB/9-pin serial dongle. What are you using on the ecu side of things to interface the 3 wire diagnostic output? A homebrew interface or something from RPLabs/MSD or similar? I think there is some logic or level shifters needed in the circuit if I recall?

  30. #70
    Tyre Kicker

    Join Date
    Jun 2014
    Location
    Galicia,Spain
    Age
    35
    Posts
    10
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: IAW P8 048/P8 reverse engineering

    Quote Originally Posted by MegatronUK View Post
    It's standard RS232 signalling - just via a cheap ebay USB/9-pin serial dongle. What are you using on the ecu side of things to interface the 3 wire diagnostic output? A homebrew interface or something from RPLabs/MSD or similar? I think there is some logic or level shifters needed in the circuit if I recall?
    I'm using a dongle like one you say. I have it for another devices like megasquirt ecu I've on another cars.
    Just wired 3 wires to pins of rx, tx and gnd of the rs232 and tried that way.

    I will study pcb later and MCU datasheet to check voltages.

  31. #71
    Pit Crew Decade Plus User MegatronUK's Avatar

    My 1st Project
    My 2nd Project
    Join Date
    Jun 2006
    Location
    Durham, UK
    Age
    45
    Posts
    1,494
    Thanks
    55
    Thanked 100 Times in 95 Posts

    Re: IAW P8 048/P8 reverse engineering

    Yeah, don't think that will work. Have a look on passionford.co.uk; I'm sure someone posted the circuit diagram to connect the 3 wires to RS232.

  32. #72
    Tyre Kicker

    Join Date
    Jun 2014
    Location
    Galicia,Spain
    Age
    35
    Posts
    10
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: IAW P8 048/P8 reverse engineering

    Quote Originally Posted by MegatronUK View Post
    Yeah, don't think that will work. Have a look on passionford.co.uk; I'm sure someone posted the circuit diagram to connect the 3 wires to RS232.

    I remember to have seen it but didn't found it. I think one of those big threads with info about this got deleted.
    Anyway, just for reference I've found how to make it work. It uses inverted logic on input and normal on output. 12V and 0V levels. I made a fast test with an arduino getting data. I will play more tomorrow



  33. #73
    Tyre Kicker

    Join Date
    Feb 2019
    Location
    italy
    Posts
    6
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: IAW P8 048/P8 reverse engineering

    Hello I'm new to the forum (I'm a cousin coswort as I own a delta evo launch and have friends with sierra and CW escort) in Italy we have a delta forum where friends with coswort, coupe fiat, 155 q4 participate, and they are welcome so I hope that here too I will be accepted .....
    Meanwhile, I want to fulfill my accomplishments for all the work that has been done here ... and if it is not too much trouble I would like to ask if someone has the patience and want to explain how you did to discover all this .....
    I state that I am a mechanic and I had some experience of mapping with ostrich but nothing more ....
    I would like to learn so much but here where I am I can not, who knows speaks in code and I can not understand .....
    I imagine that in practice all the messages pass from the 2 wires of the diagnosis in pwm ???
    and especially if it were so I can not understand the relevance between a hexadecimal string of the eprom and the messages in pwm ???
    or I thought you have some device to interpose between ecu and eprom ????
    I thank everyone and I hope someone has the will to make me understand ...
    a big hello

  34. #74
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    no

    this is diagnostic feauture of P8/L8 ecus.. (if activated in software).

    you can communicate with ecu via diagnostic pins....

    its simple 0-5V TTL logic but you need to have good USB-TTL converter with good BAUD RATE!!! Not every usb-TTL is working because of wrong baud rate settings.

    communication looks like on previous picture in thread...simple hex commands and answers in 8bits

  35. #75
    Tyre Kicker

    Join Date
    Feb 2019
    Location
    italy
    Posts
    6
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: IAW P8 048/P8 reverse engineering

    hello to make a diagnosis I have no problems, because at work I have an examiner and for my car I have a very efficient DTM that allows me to record all the necessary parameters, but I would like to understand how it works and above all how you managed to do reverse engenering

  36. #76
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    its simple there is code inside eprom...

    you send command to ECU via diagnostic link..

    ecu will response

    if you want to see raw ecu code think there is link at first page there is diassembler software IDA and P8 ecu file...you can see how it works. or you can write me, when I have time we can talk about it.
    Last edited by midnightman; 24-02-2019 at 19:45. Reason: none

  37. #77
    Tyre Kicker

    Join Date
    Feb 2019
    Location
    italy
    Posts
    6
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: IAW P8 048/P8 reverse engineering

    good morning
    if when you have time you want to talk about it I would be grateful, this is a topic that fascinates me but I think it's difficult ....
    I think that everything you talk about using a pwm is the diagnosis that the ecu, then I think 1 of the connecting cables is to send messages in one verse and the other and vice versa ....
    I do not know what a software diassembler is, but I think it helps to re-understand what function the various parts of the file inside the eprom have.
    maybe I thought wrong, in any case a good explanation is much appreciated even better if detailed
    thanks a lot, greetings

  38. #78
    Tyre Kicker

    Join Date
    Dec 2013
    Location
    spain
    Age
    44
    Posts
    17
    Thanks
    1
    Thanked 0 Times in 0 Posts

    Re: IAW P8 048/P8 reverse engineering

    great info!

  39. #79
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    who is able to build that monitor based on this PY cosworth?

  40. #80
    Bodger

    Join Date
    Jun 2012
    Location
    Slovakia
    Posts
    50
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: IAW P8 048/P8 reverse engineering

    So finally.....new info on that serial stream secrets....There is difference betwen old and new sw for OE P8 cosworth.

    if you will use TX13-14 or 14-16 version, it has fiat diagnostic protocol included and you can use simple usb-serial adapter to read ECU data. I am working on Tunerpro lancia.adx rebuild to 100% fit on cosworth P8 SW...because not all values are same....thats just for start

    https://www.youtube.com/watch?v=MA28Qt_k31M
    Last edited by midnightman; 18-04-2021 at 15:22. Reason: need to add link

+ Reply to Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts