blk-majik

iTrader: (6)

Is it possible to log arbitrary CAN ID's from the CANBUS using EvoScan? I know theres some limitations, but I'm a little rusty as to what they are. Either way, this might be helpful:

http://www.video-logging.com/pdf/bro...cification.pdf

The TPMS control unit outputs the following CAN messages:
Byte0 Byte1 Byte2 Byte3 Byte4 Byte5 Byte6 Byte7
Corner CAN ID Rate (ms) SensorID Pressure (0.001BAR/bit) Temp (0.01DegC/bit) System Status
FL 0x5A0 1000/200/100 0-65535 e.g. 2094 = 2.094bar e.g. 2094 = 20.94DegC Bit0 = 1 = No Sensor
FR 0x5A1 1000/200/100 0-65535 e.g. 2094 = 2.094bar e.g. 2094 = 20.94DegC Bit0 = 1 = No Sensor
RL 0x5A2 1000/200/100 0-65535 e.g. 2094 = 2.094bar e.g. 2094 = 20.94DegC Bit0 = 1 = No Sensor
RR 0x5A3 1000/200/100 0-65535 e.g. 2094 = 2.094bar e.g. 2094 = 20.94DegC Bit0 = 1 = No Sensor

Mike Jones

So maybe there's some hope of....turning...it....OFF?!...eventually.

blk-majik

iTrader: (6)

that's my hope. if the CAN ID's can be used to log, then at least we have an ID to look for in the rom. my guess is that it's in the rom of something on the CAN bus other than the EFI ECU, and it won't be reprogramming via J2534.

If that's the case, would it be possible to patch the EFI rom to send raw messages out to the CAN bus spoofing the TPMS output? Just keep sending a constant '2.9 bar' message from all 4 sensors or something

Shirokaze

iTrader: (4)

if someone can pull that off... tpms warning on X is so annoyingg

Mike Jones

It really is. I just pulled a nice set of work wheels off my car because of that. The stock tpms didn't seem to fit real well.

SilverJesterGSX

Those CAN ID's are specifically for the stack system, not for the evo. It should however be possible to find the correct CAN ID's for the evo, and it should be possible to have the EFI ECU spoof the TPMS CAN messages. However, I have a feeling it wouldn't work because the original messages would still be transmitted so the CAN BUS would have alternating conflicting values for the tire pressure.

hpd_wally

I have been batting away trying to figure out more of the can messaging system. I know there is a dbc file out there that will have this all described, ( the 5557 stock rom has a text string entry from a 25hoursomething.dbc file.......)

I have some of this decoded , like 15 measruments only, but nothing from the tpms. Maybee I should isolate it on the bench tomorrow and see what packets it specifically sends.


TX From ECU
Can ID Hex ID In rom TX Slot DLC Ret Func TX Store
100 400 81d1e 18 4 C 811674 0 0
101 401 81d1c 17 1 C 811673 1 4
210 810 81d1a 16 8 C 81166B 2 5
212 812 81d18 15 8 C 811663 3 13
255 915 81d16 14 8 C 81165B 4 21
308 C08 81d14 13 8 C 811653 5 29
309 C09 81d12 12 7 C 81164C 6 37
312 C12 81d10 11 8 C 811644 7 44
356 D16 81d0e 10 7 C 81163D 8 52
380 E00 81d0c 9 2 C 81163B 9 59
415 1015 81d0a 8 7 C 811634 10 61
4a0 1220 81d08 7 8 C 81162C 11 68
590 1610 81d06 6 4 C 811628 12 76
608 1808 81d04 5 8 C 811620 13 80
6fa 1B3A 81d02 4 8 C 811618 14 88
6fe 1B3E 81d00 3 8 C 811610 15 96
7bc 1E3C 81cfe 2 8 C 811608 16 104
631 1831 81cfc 1 8 B 811BD4
7e8 1F28 81fca 0 8 A 811Bcc

[RX to ECU, tx from rest of the nodes...]
Can ID Hex ID In rom Rx DLC
110 410 82a4e 27 4
111 411 82a4c 26 8
208 808 82a4a 25 8
215 815 82a48 24 8
218 818 82a46 23 4
248 908 82a44 22 4
265 925 82a42 21 7
2f1 B31 82a40 20 7
300 C00 82a3e 19 6
315 C15 82a3c 18 5
316 C16 82a3a 17 8
318 C18 82a38 16 8
325 C25 82a36 15 6
338 C38 82a34 14 6
365 D25 82a32 13 7
408 1008 82a30 12 6
412 1012 82a2e 11 6
418 1018 82a2c 10 1
428 1028 82a2a 9 8
520 1420 82a28 8 7
591 1611 82a26 7 8
5fe 173E 82a24 6 7
6fb 1B3B 82a22 5 2
6fd 1B3D 82a20 4 3
6ff 1B3F 82a1e 3 1
7df 1F1F 82a1c 2 8
7e0 1F20 82a1a 1 0
630 1830 82a18 0 8

Badhazard

FYI. It is illegal to disable it in anyway.
if the batteries go dead or the sensor breaks, You choose not to replace it. Thats fine.

Hiboost

iTrader: (9)

So the market for broken replacement sensors should be hot soon then.

TheBlade

iTrader: (1)

illegal? I'd like to see the law for that.

RazorLab

iTrader: (8)

It's a federal law.

http://www.nhtsa.gov/cars/rules/ruli...nalrule.6.html

http://www.nhtsa.gov/cars/rules/ruli...mpost2cir.html

http://www.nhtsa.gov/DOT/NHTSA/Rulem...-fmvss-138.pdf

It's amazing what people can find on the internet isn't it? Try it some time.

Golden

iTrader: (1)

OMG, it's illegal to modify our cars? Crap, I'd better go put my cats back on, take that ethanol out of the gas tank, put the stock turbo back on and get me a stock intake. I'd sure hate for the feds to come bust me over some wheel sensors.

richardjh

Your NHTSA slogan - "People Saving People" ... aaaare the loveliest peeeeeple.... in the worrrrrld....



Rich

vadimus_ca

iTrader: (1)

How did you sniff this data? I tried ELM327 but did no succeed.


BTW I am the guy who first brought Actia XS Evo to Northern America. And yes, TPMS can be disabled and re-enabled in a couple of minutes, just did it

vadimus_ca

iTrader: (1)

Before:


After: