FORScan PCM reprogramming (as-built) RX-8 (+other Mazdas...)

Any issues related to FORScan application
JamieM
Posts: 29
Joined: Sat Jun 11, 2016 9:53 pm
Vehicle: Mazda RX-8, 2005, 13B-MSP Renesis High Power (231)
Location: Cambridgeshire, UK

Re: FORScan PCM reprogramming (as-built) RX-8 (+other Mazdas

Post by JamieM » Fri Sep 29, 2017 9:15 am

Hmmm, it's possible that 2100 is the correct command, but you just aren't entering the commands as fast as a computer would, so the session times out or something. Does the response to 2100 you get start with 7F by chance? It should start with 6100 for a valid response. (positive responses to OBD UDS commands always start with the original command echo'd back, except with 0x40 added to the command ID, then the data). 7F is an error response, so you'll get something like 7F21##, 7F followed by the command ID without 0x40 added and an error code, where the error code (##) is one of the following:

Code: Select all

10      GR      General reject
11      SNS     Service not supported
12      SFNS    Sub-Function not supported
13      IMLOIF  Incorrect message length or invalid format
14      RTL     Response too long
21      BRR     Busy repeat request
22      CNC     Conditions not correct
24      RSE     Request sequence error
25      NRFSC   No response from sub-net component
26      FPEORA  Failure prevents execution of requested action
31      ROOR    Request out of range
33      SAD     Security access denied
35      IK      Invalid key
36      ENOA    Exceeded number of attempts
37      RTDNE   Required time delay not expired
38-4F   RBEDLSD Reserved by Extended Data Link Security Document
70      UDNA    Upload/Download not accepted
71      TDS     Transfer data suspended
72      GPF     General programming failure
73      WBSC    Wrong Block Sequence Counter
78      RCRRP   Request correctly received, but response is pending
7E      SFNSIAS Sub-Function not supported in active session
7F      SNSIAS  Service not supported in active session
If it still doesn't work try some variations on 2100 - so see what you get when you do 2101, 2102 etc. '21' is the Mazda "read data by local ID command", and the 00, 01, 02 etc is the data ID. On the RX-8, ID '00' is the VIN block, ID '01' is 720-01-01, ID '02' is 720-02-01, etc. Might be different for you. There are also some other read commands you could try, 22 is "Read Memory By ID", 23 is "Read Memory By Address".

I wouldn't run RX8CC for the reason above - it might run the commands fast enough to actually get to the point where it does try to write some data - and it might be the incorrect data for your car. More likely it will probably just fail with an error message, or crash with an unhandled exception. If the 2100 command isn't the right one, then it will likely, like you, get to the 2100 stage but when it tries to parse the reply it won't be long enough, so likely fail at that point. It should never then get to the point were it actually writes anything, but if it does that might cause problems... hard to say without trying it tbh. But it likely won't help you much anyway, since if it crashes it's not going to display the ABD to you ;)

This is a very useful resource: http://illmatics.com/car_hacking.pdf
Also this (though a couple of the Mazda-specific UDS commands are missing, e.g. 21 and 3B): https://en.wikipedia.org/wiki/Unified_D ... c_Services

bretman
Posts: 13
Joined: Sun Aug 20, 2017 7:01 am
Vehicle: Mazdaspeed Axela 2009 2.3L Turbo 190Kw

Re: FORScan PCM reprogramming (as-built) RX-8 (+other Mazdas

Post by bretman » Fri Sep 29, 2017 5:36 pm

Thanks for the info. I will have a read.

Yes, I am getting the 7F error as the response so that may well explain it.

The PCM data itself is very similar to the rx-8 - it just looks like a few extra setting bytes have pushed the cruise bit into line 3.

I’ll have a go at scripting the commands to at least verify the correct data is there in the PCM before doing any further hardware troubleshooting.

bretman
Posts: 13
Joined: Sun Aug 20, 2017 7:01 am
Vehicle: Mazdaspeed Axela 2009 2.3L Turbo 190Kw

Re: FORScan PCM reprogramming (as-built) RX-8 (+other Mazdas

Post by bretman » Sun Oct 01, 2017 7:28 am

Been doing lots of reading of the protocol specs and so on. What I’m getting is an error setting the diagnostic mode:

1085 -> returns 7F1012 -> Error 12 - sub function not supported
1003 -> does work -> returns 50 03 00 32 01 F4

When I then send:

2100 -> returns 7F 21 11 -> Error 11 - Service not supported. If I try other addresses, 2101, 2102, I still get error 11.

Experimenting randomly (before reading the addressing specs and finding out the module addresses aree 7Ex), I do manage to get valid data. For example:
ATSH730 followed by 2100 returns valid data from the 730-01-01 of the as-built.

I’m now reading up on the diagnostic modes to work out why it doesn’t take 1085 and whether 1003 limits data access.

Kind of painful narrowing down the options. All I need to do is read PCM1-9 so I can verify the dealer write.... grrrr....

bretman
Posts: 13
Joined: Sun Aug 20, 2017 7:01 am
Vehicle: Mazdaspeed Axela 2009 2.3L Turbo 190Kw

Re: FORScan PCM reprogramming (as-built) RX-8 (+other Mazdas

Post by bretman » Fri Oct 06, 2017 3:36 am

So, headway at last... After putting a serial sniffer behind Forscan, I managed to get enough information on the protocol commands to be able to work out how to display the PCM data from a terminal onto the ELM327.

Although 21 00 didn't work, I managed to get the VIN data block back using 22 DE 00 (Read by address from DE 00). This gives me the response 62 DE 00 and then the same data format that was obtained from the RX-8.

The good news is that it confirmed that the PCM data HAS been written successfully to my vehicle. My PCM 1-9 match exactly to the PCM 1-9 from the equivalent car with cruise control.

The bad news is that cruise still doesn't work.

I got hold of a used US cluster which does have a cruise control light. With this in place it shows the cruise light operates on self test, but not when I hit the cruise on button.

Summary, then:

- PCM data confirmed as same as cruise enabled car.
- Steering wheel buttons are checked at the PCM and show correct voltage.
- Brake switch confirmed as 4 wire and replaced.

Remaining things I'm going to check:

- Maybe other changes in as-built data. (e.g. IC) - replace with Forscan and test.
- Work out why the BOO (Brake On Off) PID works, but the BPA (Brake pressure applied) doesn't (although I don't think this would affect the overall switching on of the cruise)...

Any other suggestions or ideas appreciated...

bretman
Posts: 13
Joined: Sun Aug 20, 2017 7:01 am
Vehicle: Mazdaspeed Axela 2009 2.3L Turbo 190Kw

Re: FORScan PCM reprogramming (as-built) RX-8 (+other Mazdas

Post by bretman » Fri Oct 06, 2017 10:16 pm

... and with the replacement cluster, the BPA PID is now working.

We're close, I can feel it.

JamieM
Posts: 29
Joined: Sat Jun 11, 2016 9:53 pm
Vehicle: Mazda RX-8, 2005, 13B-MSP Renesis High Power (231)
Location: Cambridgeshire, UK

Re: FORScan PCM reprogramming (as-built) RX-8 (+other Mazdas

Post by JamieM » Sat Oct 07, 2017 9:07 am

This is good news :)

I was going to suggest trying 1087 re diagnostic modes, but it sounds like you've got it figured out anyway ;)

bretman
Posts: 13
Joined: Sun Aug 20, 2017 7:01 am
Vehicle: Mazdaspeed Axela 2009 2.3L Turbo 190Kw

Re: FORScan PCM reprogramming (as-built) RX-8 (+other Mazdas

Post by bretman » Mon Oct 09, 2017 8:18 am

So, just to share findings in case it is of use for others:

I'm now pretty confident that the PCM change required to activate cruise on a BL Mazdaspeed 3/Axela 3 is PCM3 as set out above. This is the change that the dealer software makes when the "speed options->cruise control" option is enabled.

Turns out though that there are two other variables to consider in the case of a JDM Axela model:

- Japanese domestic models appear to have a different ECU firmware version that does not support cruise control.
- The JDM instrument cluster does not have a cruise on/off light or the supporting circuitry included.
- Furthermore the M-MDS software restricts the options available in the dealer UI based on the firmware version.

All of this means that the dealer is unable to activate cruise on a JDM model by just using menu options in the M-MDS.

Most sane people would stop there, and give up, HOWEVER...

In talking to Mazda Techs locally, it appears that it may be possible to force the M-MDS to reflash the ECU with different firmware, so that is what we are currently working on...

This could, of course, totally brick the PCM, but hey... we've gone this far, why stop now...

...
...

bretman
Posts: 13
Joined: Sun Aug 20, 2017 7:01 am
Vehicle: Mazdaspeed Axela 2009 2.3L Turbo 190Kw

Re: FORScan PCM reprogramming (as-built) RX-8 (+other Mazdas

Post by bretman » Tue Oct 10, 2017 12:41 am

OK, success!

We managed to force a flash update of the PCM via the M-MDS. Essentially changed my Axela JDM PCM into a domestic market NZ MPS one. Cruise all working, and no ill effects to the vehicle, so it looks like the cruise option was actually disabled in the PCM firmware.

The good news is that for the US market, you shouldn't have to go to these extremes as the local model PCM firmwares all seem to have the capability.

We have also verified that the Mazda 3 BL models can be upgraded to cruise control via PCM changes as per the rx-8.

I think I'll leave it there, but if anyone is interested in future, based on what we have learned it should be possible to write a variant of the rx8cc.exe software to flip the bit without use of the dealer software.

JamieM
Posts: 29
Joined: Sat Jun 11, 2016 9:53 pm
Vehicle: Mazda RX-8, 2005, 13B-MSP Renesis High Power (231)
Location: Cambridgeshire, UK

Re: FORScan PCM reprogramming (as-built) RX-8 (+other Mazdas

Post by JamieM » Tue Oct 10, 2017 5:51 pm

Nice work! ;)

Interesting that the JDM firmware is actually different. Up until now I had assumed all markets got the same firmware just with different as-built data customisations. Perhaps it's one build for Japan, and one build for the rest of the world so they can do special stuff for their own market :roll:

This ties in with other findings in the RX-8 world that we have thus far been unable to work out - the cruise control in JDM RX-8s can be enabled with my program but is limited to 62mph (100kmph) no matter how the as-built data is changed. Perhaps that's hard-coded into the JDM ROM too! There's also an additional (non-cruise) top speed limiter, and JDM PCMs reject ignition coils that aren't Mazda OEM. How they can tell the difference I've no idea, but you can't upgrade the coils on JDM RX-8s. Probably some other differences I've forgotten too.

Thing is, the JDM ROM also has some nice things that we don't have - e.g. a slightly more aggressive map from the factory that supposedly makes more power. So I doubt anybody would do the same procedure you've done on an RX-8, unless they were happy to lose some features in exchange. Not really relevant to you but I thought it was interesting :)

EDIT: I've now written a version of the program that can change arbitrary lines of the as-built data (not just PCM2), as suggested in bretman's post above, so it should now be possible to enable cruise on other cars (e.g. PCM3, or anywhere else in fact) without the use of the dealer software - see here: http://forscan.org/forum/viewtopic.php? ... =60#p20345
Last edited by JamieM on Wed Mar 28, 2018 8:25 pm, edited 2 times in total.

bretman
Posts: 13
Joined: Sun Aug 20, 2017 7:01 am
Vehicle: Mazdaspeed Axela 2009 2.3L Turbo 190Kw

Re: FORScan PCM reprogramming (as-built) RX-8 (+other Mazdas

Post by bretman » Wed Oct 11, 2017 9:27 am

Interesting...

I do know that the JDM domestic vehicles are usually mapped for 100 RON fuel, whereas the NZ domestic market ones are mapped for 95 RON. As I understand it the 100 RON mapping may be more aggressive, but the timing gets pulled back based on the knock sensor limits, so whether it would actually make more power is questionable. It would if you used octane booster I suppose.

Based on my experience with the change on my Mazdaspeed 3, I haven't noticed any lesser performance - if anything it holds a bit more boost, which might make sense if it isn't hitting the knock limits.

The main thing that is needed to do this is to have access to a dealer laptop and use this process:

http://blog.obdii365.com/2016/03/22/pcm ... p-by-step/

It allows fooling the software to think the PCM is dead/unknown and you can then tell it it is any model of PCM. It will then download the most recent firmware for any PCM model you care to enter. Probably best to be careful that the hardware is the same though! - although it *should* allow recovery of a dead PCM, I've not tried it.

Nice cars, BTW - I had a RX-8 until trading across to the 3. I needed room for a bike.

Post Reply