Hi Guys,

Graphical HOWTO here

UPDATE: Evoscan 2.6b14 (and now b15) have Mode23 support integrated - You only need this thread for the XML modifications you must do for Mode23 to work

I have spent a fair bit of time looking at the ECU code and I have found a very nice function that we didn't have access to in CT9A-land.

OBD-Mode23 allows you to request ANY memory address and the ECU will fetch the current stored value.

I have tested this on my car - and it *sorta works*.

Hamish is currently integrating this into EvoScan so we should have support very soon.

Now when I say it *sorta works* the ROM needs a slight modification before you can access Mode23.

My preference for logging is that the ROM should be stock and everything should just work - but given our woeful logging experience thus far we are running out of options.

One downside with Mode23 is that every RAM address is unique to a ROMID, so the RAM addresses for 53040010 will be different to 52680018 - This isn't too bad, it will just mean someone needs to post up the relevant addresses for the ROMID in question.

HOWTO:
1) Apply the XML changes to your EcuFlash definition file, if you don't know what ROMID you are dealing with just ask. Modifications to ROM's can cause catastrophic results if you don't know what your doing
2) Download the application zip - in it will be an .exe and a config.txt
3) Edit the config.txt to suit your ROMID - We will be posting up config.txt's for common ROMID's so you can probably just download that.
4) Run the application.

Notes:
1) It's only a console application - so there is no fancy GUI.
2) It records every 5th row to screen, but EVERY row to the log.csv file
3) There isn't much error checking, so don't put anything stupid into the config.txt
4) In the config.txt file the evaluation expression is in RPN notation.

Application:
V1.1 - Is an attachment down here....
you also need a config.txt - I have included the one from my car 53040010 ... ENSURE YOU CALL IT config.txt and put it in the same directory as the .exe.

XML's:
NOTE: The name in EcuFlash describes what changes you need to make (ie 0x05 -> 0x23). IF the CURRENT value doesn't match here STOP AND ASK!!!

52690019
<table name="IFMode 0x05 -> 0x23 #1" category="Misc" type="1D" address="0x7f121" scaling="Hex8"/>
<table name="IFMode 0x05 -> 0x23 #2" category="Misc" type="1D" address="0x8aafd" scaling="Hex8"/>
<table name="DoMode 0x42 -> 0x52" category="Misc" type="1D" address="0x8ab02" scaling="Hex16"/>

53040007 -> 53040010
<table name="IFMode 0x05 -> 0x23 #1" category="Misc" type="1D" address="0x7f145" scaling="Hex8"/>
<table name="IFMode 0x05 -> 0x23 #2" category="Misc" type="1D" address="0x8aa59" scaling="Hex8"/>
<table name="DoMode 0x42 -> 0x52" category="Misc" type="1D" address="0x8aa5e" scaling="Hex16"/>

52680015 -> 52680020
<table name="IFMode 0x05 -> 0x23 #1" category="Misc" type="1D" address="0x7f121" scaling="Hex8"/>
<table name="IFMode 0x05 -> 0x23 #2" category="Misc" type="1D" address="0x8ab11" scaling="Hex8"/>
<table name="DoMode 0x42 -> 0x52" category="Misc" type="1D" address="0x8ab16" scaling="Hex16"/>

52360018
<table name="IFMode 0x05 -> 0x23 #1" category="Misc" type="1D" address="0x7f58d" scaling="Hex8"/>
<table name="IFMode 0x05 -> 0x23 #2" category="Misc" type="1D" address="0x8ada5" scaling="Hex8"/>
<table name="DoMode 0x42 -> 0x52" category="Misc" type="1D" address="0x8adaa" scaling="Hex16"/>

53600010
<table name="IFMode 0x05 -> 0x23 #1" category="Misc" type="1D" address="0x7efbd" scaling="Hex8"/>
<table name="IFMode 0x05 -> 0x23 #2" category="Misc" type="1D" address="0x8aa61" scaling="Hex8"/>
<table name="DoMode 0x42 -> 0x52" category="Misc" type="1D" address="0x8aa66" scaling="Hex16"/>

53050006 -> 53050009
<table name="IFMode 0x05 -> 0x23 #1" category="Misc" address="7f145" type="1D" scaling="Hex8"/>
<table name="IFMode 0x05 -> 0x23 #2" category="Misc" address="8a9f1" type="1D" scaling="Hex8"/>
<table name="DoMode 0x42 -> 0x52" category="Misc" address="8a9f6" type="1D" scaling="Hex16"/>

54060007
<table name="IFMode 0x05 -> 0x23 #1" category="Misc" address="7efc1" type="1D" scaling="Hex8"/>
<table name="IFMode 0x05 -> 0x23 #2" category="Misc" address="8aa7d" type="1D" scaling="Hex8"/>
<table name="DoMode 0x42 -> 0x52" category="Misc" address="8aa82" type="1D" scaling="Hex16"/>

54070007
<table name="IFMode 0x05 -> 0x23 #1" category="Misc" address="7efc1" type="1D" scaling="Hex8"/>
<table name="IFMode 0x05 -> 0x23 #2" category="Misc" address="8aa69" type="1D" scaling="Hex8"/>
<table name="DoMode 0x42 -> 0x52" category="Misc" address="8aa6e" type="1D" scaling="Hex16"/>

55570005
<table name="IFMode 0x05 -> 0x23 #1" category="Misc" address="7f10b" type="1D" scaling="Hex8"/>
<table name="IFMode 0x05 -> 0x23 #2" category="Misc" address="8ad5f" type="1D" scaling="Hex8"/>
<table name="DoMode 0x4D -> 0x5D" category="Misc" address="8ad66" type="1D" scaling="Hex16"/>

53610010
<table name="IFMode 0x05 -> 0x23 #1" category="Misc" address="7efb1" type="1D" scaling="Hex8"/>
<table name="IFMode 0x05 -> 0x23 #2" category="Misc" address="8a919" type="1D" scaling="Hex8"/>
<table name="DoMode 0x42 -> 0x52" category="Misc" address="8a91e" type="1D" scaling="Hex16"/>

55580005 -> 55580006
<table name="IFMode 0x05 -> 0x23 #1" category="Misc" type="1D" address="0x7f10b" scaling="Hex8"/>
<table name="IFMode 0x05 -> 0x23 #2" category="Misc" type="1D" address="0x8ad4b" scaling="Hex8"/>
<table name="DoMode 0x4D -> 0x5D" category="Misc" type="1D" address="0x8ad52" scaling="Hex16"/>

55590006 -> 55590007
<table name="IFMode 0x05 -> 0x23 #1" category="Misc" address="7f107" type="1D" scaling="Hex8"/>
<table name="IFMode 0x05 -> 0x23 #2" category="Misc" address="8ad43" type="1D" scaling="Hex8"/>
<table name="DoMode 0x4D -> 0x5D" category="Misc" address="8ad4a" type="1D" scaling="Hex16"/>

Cheers
Dave

 

I want to test Mode23 on EDM evo

 

Well if everyone is agreeable to the minor change (to enable Mode23) - I will post up some instructions on how to change your rom.

I tested it out tonight, and it works a treat - once I get a EvoScan version from Hamish which fully supports it then i'll post up a log or 3. I will also test the speed as well.

For the technically minded - I am overloading Mode0x05 which on CAN ECU's is unused. Mode05 seems to be a NULL subroutine anyways so I don't think its inuse.

 

Sounds like it is worth at least testing, assuming it doesn't break any critical operation of the ECU!

 

nah...

yeah im working on a basic logger right now...

 

Tephra, this sounds like it's definitely worth exploring. My only concern is with having to find the proper RAM addresses for each unique ROM ID. I have no ability to do this (I wish I could help out). Are there enough people (or are you willing ) to figure this out for the most popular ROMs out there? Or at least for 52680018

Also, do you know how far Hamish is from being able to log 2 byte CAN? Specifically, for boost and load? It seems we are pretty close on getting useful CAN-ID based logging as well, except for the 2 byte values. What's your opinion on this?

 

i just wanna log

 

I'm not familiar with this Mode23, what parameters can you log/recall with this?

 

NMX - well the good thing is there is still a MUT_TABLE, so once you find that then you can look up memory addresses REALLY easy.

but yes, the main ROMID's will be covered.

SiC - you can LOG memory address you like, you just send the memory address you want to log and the number of bytes and Mode23 returns it.

 

Nice, count me in

 

guys , i know its off topic, but can some one find out how you can turn off the Airbag warning and a TPMS waring ??
Its killing me.

Thanks

 

This is amazing find, maybe for the start it would be better to write a patch for retrieving values from MUT table as in CT9A, we have better understanding of what these values mean. But getting any memory value is really awesome.

 

Yeah I thought about doing that - but then it would be a complicated patch.

To enable MODE23 - it's 3 bytes worth of changes ... very very simple.

ok my program seems to be working well - here is a log I just took:


It's a STOCK 3rd gear pull - I got about 160rows of data during the pull - so HEAPS of data

edit - spelling + log upload (rename to csv)

edit2 - your seeing 2byte load, 2byte IPW, 2byte ADC_MAP, 1byte timingadv, 1byte knocksum, 1byte RPM

 

That's awesome! So, how do I enable it

 

well let me finish the app first.. its real basic - but I need to make the memory addresses changeable by the user ...

also does anyone know if the scaling for the MAP sensor is the same as the JDM 3bar that is used as a replacement in CT9A? (ie 0.19374*x - 14.5)