ECU hack

I've started documenting details on the 81A11 ECU that I'm currently working on. I have already managed to talk to this ECU using my OBD1 interface and software and this evening I pulled the binary image (raw software) from the processor.

www.rhinopower.org/ECUs/81A11/81A11.html

James,

I assume my current (OBD2) tool reads the Serial Data Line (K) and only decodes the generic OBD2 data, the Suzuki specific information (TCM, Air Bag SDM and ABS control module) detailed below as being on the K line is only decoded by Suzuki tools. Equally, the immobiliser on the Suzuki Serial Data Line is only read be Suzuki tools. If I build your interface, does your software expand on the generic OBD2 data to cover the more specific Suzuki areas?

Data Link Connector (DLC)
DLC (1) is in compliance with SAEJ1962 in its installation position,
the shape of connector and pin assignment.
Serial data line (K line of ISO 9141) is used for SUZUKI scan tool
(Tech-1) or generic scan tool to communicate with ECM, TCM, Air
Bag SDM and ABS control module.
SUZUKI serial data line is used for SUZUKI scan tool to communicate
with immobilizer control module.

Martin

On an early OBD2 ECU the OBD1 data link allows you talk to the immobiliser and air bag computers when fitted. I don't believe that there will be any additional diagnostic information available on the OBD1 interface. On the Jimny there doesn't appear to be any capability for communicating with the TCM, immobiliser or air bag computers using an OBD2 tool. The ECU simply receives an error signal from the module and sets a code.
On OBD1 ECUs the interface can be used to read and reset fault codes and examine live data. I haven't as yet implemented fault codes in my software as these can be easily read using the jumper method. I will add the ability to clear codes to avoid having to disconnect the battery.
I'm currently working on implementing remapping on OBD1 ECUs using the serial data link. I am also going to hack an early OBD2 ECU to see if remapping on those is done via the OBD1 link or via the OBD2 link.
I'm away on business next week so not much progress will be made for a while.

This is getting interesting, it seems that the Suzuki protocol is the same as a number of other Japanese vehicles, although there are a few things that are either different or have not been published.
To reprogramme the ECU the VFP pad must be connected to 12V and the FCCP pad must be connected to 0V, on some ECUs these pins are brought out to the front connector. The ECU is then powered up and it waits for a short programme (the bootloader kernel) to be uploaded. This kernel is loaded into RAM and then run and this is the programme that does the actual upload of the new software and handles erase and write functions.
I have the protocol to upload the programmer and am now working on modifying a Subaru kernel to work with the Suzuki.
I can also use the bootloader to load a test programme into RAM which will allow me to read and write the processor pins to test the ECU hardware

I've now been able to read the code form an 81A20, this is a Spanish, OBD2 ECU. I've only just started looking at it but I found this almost straight away. This is a list of all supported OBD2 protocols.

If you have a scanner that doesn't work then I suggest that you send this to the manufacturer and ask them what the problem is. Note that headers 31, 34, 36 and 37 are recognised but will reset the ECU

I've been able to erase and reflash an OBD1 Jimny ECU using the background debug mode.
The OBD2 ECU appears to have some custom processor that doesn't have this facility but it has a seperate flash chip which I've removed and read. I'm now going to modify that ECU as a hack to develop the code to reprogramme these ECUs using the diagnostic link.

I already have the mapping for the 1.6 Baleno ECU so it would be possible to reflash the OBD1 Jimny ECU with the correct mapping for the 1.6 conversion. Analysis of the mapping seems to indicate that the 1.6 will run very rich at around 4000rpm when using the 1.3 ECU