Looking for help with MPSCAN and ECU identification

[dnsdr]

I have a 1994 Dodge RAM B150 and I dont know what ECU I have
(LM, SMEC T1, SMEC T2, SBEC T1, SBEC TIII, SBECII T1, SBECII TIII, FCC, ???)
I don't know how to determine my ECU type

I have tried serveral types in MPSCAN and can often get valid data back within Sensor Diagnostics
But keep getting unable to open port when running a Profile/Display

I think I need to start by making sure I have the correct ECU type selected

[dnsdr]

I got a little better results today
I was originally using a fairly long RS232 cable to the RS232 port on my laptop
I have now switched to a short cable using USB to RS232 (FT232RL) and switched to a Microsoft Surface tablet
Now, most of the ECU selections seem to run OK without getting error opening port

I think I have now tried all the possible ECU types and am not getting accurate data
Perhaps my ECU is not one of the ones in the list
I'm still not sure which ECU I have

[wowzer]

calling rob L? what is the size of engine? any numbers off the ecu box to try to help id it? i'm surprised the sensor diags work!!! do the values look reasonable! i've only ever tested them on a smec and i would assume you have at least a sbec2 or fcc. i'll look to see if there is a diag code that can retrieve the ecu info.

there are a couple of log files you could post up. if you go to the help screen and bring up the computer info it will show the user directory. in that directory should be two log files of interest - mpscanport.txt and mpt2coms.txt. post those up.

*****edit*****
i do see that there is a code to return 2 bytes for the ecu id. i would need to add that feature into mpscan.

[dnsdr]

Thanks for jumping in
a return code for ECU ID sounds very promising

I originally started with FCC as an uneducated guess, but that's on of the few that still returns an error unable to open port
I have tried many ECU types today and most do not report errors any more, but they all return values that are no where near reality
For the moment I am working with SBECII TIII
What I set for Port settings dos not seem to matter when I go to Sensor Diags, but I guess that option ignores what is set in ports

The engine is 318(aka 5.2L Magnum)
The numbers on the tag on the outer plastic casing are all worn away with time, I have not pulled the plastic cover off yet
The numbers reported from sensor diags do seem reasonable, so far I mostly just looked at Coolant Temp and Batt Volt
so for my Display I am starting with the same sensors, battv and cool
but what comes back is way off and not the same as in sensor diags
I did also try a smec dispaly/profile, but that too did not display reasonable values

I don't know how to attach a file to this post, so I will just paste in the text here for the logs
This was taken while port settings, Display, and Profile were all set to SBECII TIII
***** mpt2coms.txt *****
-Comport analysis for mpscan version 2.0.3.3 (2/28/2016 4:15:32 PM)
-Locating ports on computer-
name:USB Serial Port (COM3) deviceid:FTDIBUS\VID_0403+PID_6001+A603XIJXA\0000
number of ftdi devices found - 1
ftdi port num:COM3 serial num:A603XIJX
Inverted tx:False Inverted rx:False
Vcp driver loaded:False
Latency is set to:2
checking to see if usb port number COM3 is a moates device
Moates device not located on this port
default com port set to:COM3
***** MPScanPort.txt *****
mpscan ver - 2.0.3.3 (2/28/2016 4:15:02 PM)
Microsoft Windows 10 Enterprise - Win32NT
trying to open port COM3 - ctlrecord_click
got a good port back - ctlrecord_click
try to open port COM3 -initport
COM3 is a legit port -initport
usb is available on COM3 -initport
usb ftdi serial number A603XIJX is available - initport
[usbportinit] setting port baud rate to 7812
ftdi open successful on COM3 -usbportinit
using protocol SBECII TIII:6
attempt to change ecu baud rate to 62500
Sending byte 18
Received 1 byte(s): 18
Changing mpscan baud rate to 62500
Sending byte 242
Received 1 byte(s): 242
Byte 242 was sent 1 times to make the change.
usb ftdi
Successfully opened port - ctlrecord_click



If you need me to get any more low level info, I do have access to an OTC 4000 that works with this car
and i have an oscilloscope, but its not a DSO
Is this two byte code request/return for ECU ID something that could be done from a terminal emulator, or is more complicated then that

On a side note:
I really appreciate all the work you have put into this project and for sharing
Even though is not working for me yet, Im sure it will be soon
I am also very interested in your project with MPSciLink

[sdac guy]

Your 1994 truck should be an SBEC-II. SBEC-III didn't come out until the 95-96 model year (even though some 95 & 96's still used the SBEC-II).

In the Knowledge Center, we used to have a good guide to what modules were used in what year (with part numbers) but I just looked for it and couldn't find it. So I looked at my copy here at home.


Barry

[dnsdr]

Thank you

I just tried again
choices for SBECII are "SBECII T1" or "SBECII TIII"
SBECII T1 comes back with unable to open/setup port(just like FCC)
SBECII TIII acts like its working, but returned data for cool, battv, and barro are way out of reality

I am assuming the cool means coolant temperature and that battv means battery voltage
If I am wrong about that, it would explain alot

The only reference in my service manual is that I have PCM, formerly referred to as SBEC

[wowzer]

looks like you can successfully connect with the sbec2 t3 settings. actually, most of the ecu types use the same codes to connect so really no surprise. obviously, then, the gauge locations do not line up. without a bin file to look at i can only make a suggestion at this point. maybe rob or someone else has disassembled the 94 v8 bin already. if so then it will be relatively easy to find the major gauge locations. if not here is what i would do. i have looked in the past at a 5.9 as well as a jeep setup. they all use different locations. so, worst case - in the sbec2 t3 gauge choices, i would add 6 to 8 gauges, select consecutive ram locations for each and try logging. hopefully one of the gauges will respond to rpm and/or tps.

so, to do this:
1) in settings/layout files/xref - click on the "long name" header so it sorts. you will see at the top alot of "-1" in the sbec2 t3 column which means no location has been setup for that gauge.
2) start with "bitflags62" and change the "-1" to different locations, i would start with 70, 90, 92, 115, 118 - or you could just start with whatever and go consecutively.
3) save the xref file
4) go into the display layout and add 5 or 6 gauges and then set the locations to the bitflags that you changed.
5) save the layout and try logging. hopefully you will find a location that corresponds to the rpm or tps position.
6) if it doesn't work, repeat the process by changing to new locations. you should create a new layout and add the gauges again.

i know this will be terribly time consuming but without a bin or a way to monitor your otc 4000 transmissions it's kinda tough. lmk if you have any luck.


***edit****
once you have any luck let me know and i'll look to see if there is anything i have that may match up.

[ShelGame]

I don't have any more RAM locations that what you have, Morris. I think we both got the same info.

[dnsdr]

Sounds like a reasonable approach for now
I started with the specific numbers you suggested
So far I have identified 118 as related to Throttle Position
Two others where getting data, but not sure yet what they relate to

I have to go to work
I will do more testing later and try some different addresses

I think you mentioned that the Sensor Diags may have been based on SMEC
and since several of those seem to give me valid data, I might be able to copy a few of those to start a base line
at least those seemed correct for Batt volt, Coolant Temp, and RPM

Thanks again for your help

[wowzer]

good info, i'll do some checking to try to figure out a ram map for you to use. the sensor diags use a "relative" code in the program which is used by the ecu to look up the address so you probably won't gain much using that info. stay tuned!

****edit****
these are some ram locations that i got from a 5.9L magnum setup. i'ld start with this. you'll notice that the tps in this list is 0x76 (dec 118). the list is in hex so you'll need to convert it to decimal to put it in the list. actually, as you "prove" these up i'ld go and put the address in the actual gauge line, so if 118 ends up being the tps, go to the tps gauge and change that address. there is also a number of ram locations in higher regions of the ram addresses, unfortunately, mpscan is not set up to handle anything above 0xff. if there ends up being a bigger demand for these cals i'll look at changing that.

MINTHR_LowestSessionTPS                            == 0x0003
BitFlags_AIS                                       == 0x0004
CurrentAisPosition                                 == 0x0005
BaroPressure                                       == 0x0008
Counter_SpeedSensorInterrupt_HB                    == 0x000B
Counter_SpeedSensorInterrupt_LB                    == 0x000C
Ram_0D                                             == 0x000D
AutoCalCell0                                       == 0x000E
AutoCalCell1                                       == 0x000F
AutoCalCell2                                       == 0x0010
AutoCalCell3                                       == 0x0011
AutoCalCell4                                       == 0x0012
AutoCalCell5                                       == 0x0013
AutoCalCell6                                       == 0x0014
AutoCalCell7                                       == 0x0015
AutoCalCell8                                       == 0x0016
AutoCalCell9                                       == 0x0017
AutoCalCellA                                       == 0x0018
AutoCalCellB                                       == 0x0019
AutoCalCellC                                       == 0x001A
AutoCalCellD                                       == 0x001B
Cyl2_InjPWTrimA                                    == 0x001F
Cyl1_InjPWTrimA                                    == 0x0020
Cyl3_InjPWTrimA                                    == 0x0021
Cyl4_InjPWTrimA                                    == 0x0022
CylTrimFlagsA                                      == 0x0023
Cyl2_InjPWTrimB                                    == 0x0036
Cyl1_InjPWTrimB                                    == 0x0037
Cyl3_InjPWTrimB                                    == 0x0038
Cyl4_InjPWTrimB                                    == 0x0039
CylTrimFlagsB                                      == 0x003A
ErrorBitRegister0                                  == 0x003F
ErrorBitRegister1                                  == 0x0040
ErrorBitRegister2                                  == 0x0041
ErrorBitRegister3                                  == 0x0042
ErrorBitRegisterStored0                            == 0x0043
ErrorBitRegisterStored1                            == 0x0044
ErrorBitRegisterStored2                            == 0x0045
ErrorBitRegisterStored3                            == 0x0046
ErrorCodeUpdateKeyOnCount                          == 0x0047
ErrorCodeUpdateKeyOnCount2                         == 0x0048
ErrorCodeUpdateKeyOnCount3                         == 0x0049
BitFlasg6F                                         == 0x004E
BitFlags70                                         == 0x004F
BitFlags66                                         == 0x0050
BitFlags6B                                         == 0x0051
BitFlags71                                         == 0x0052
BitFlags70b                                        == 0x0054
BitFlags6c                                         == 0x0056
BitFlags70c                                        == 0x0064
CruiseStatus_1                                     == 0x0067
CruiseStatus_2                                     == 0x0068
Counter_Cruise_1                                   == 0x0069
KeyOnOrEngineRunningTime                           == 0x006C
Counter_MainLoop                                   == 0x006D
CalculatedSparkAdvance                             == 0x0072
EngineRpm_HB                                       == 0x0073
EngineRpm_LB                                       == 0x0074
MapValue                                           == 0x0075
TPSVolts                                           == 0x0076
ChargeTempVolts                                    == 0x0077
O2SensorVolts                                      == 0x0078
CoolantTemp                                        == 0x007A
LastChargeTempVolts                                == 0x007B
LastCoolantTempVolts                               == 0x007C
TempVoltsA2DResult3                                == 0x007E
LastTpsVolts                                       == 0x007F
BatteryVolts                                       == 0x0080
TpsVoltsOverMINTHR                                 == 0x0081
VehicleSpeed_HB                                    == 0x0082
VehicleSpeed_LB                                    == 0x0083
VehicleSpeedScaled                                 == 0x0084
StartupSwitchMirror1                               == 0x0085
TargetBatteryVolts                                 == 0x0087
AmbientAirTempVolts                                == 0x0089
TargetIdleSpeed_HB                                 == 0x008A
TargetIdleSpeed_LB                                 == 0x008B
Timer_OutOfClosedLoopMode                          == 0x0098
CylTrim_Adaptive_Var1                              == 0x00A0
CylTrim_FlagsEF                                    == 0x00A1
CylTrim_FlagsF0                                    == 0x00B6
MapValueAltBf                                      == 0x00BF
MapValueAltC1                                      == 0x00C1
MapVoltsToMapValue                                 == 0x00C3
TPSVoltsAltC8                                      == 0x00C8
TPSVoltsAltCa                                      == 0x00CA
PIA1_Buffer                                        == 0x00ED
PIA2_Buffer                                        == 0x00EE
PIA3_Buffer                                        == 0x00EF
b5C_IPL1                                           == 0x00F0
b5D_IPL2                                           == 0x00F1
ErrorCodeUpdateKeyOnCounta                         == 0x00F2
ErrorCodeUpdateKeyOnCount2a                        == 0x00F3
ErrorCodeUpdateKeyOnCount3a                        == 0x00F4
DRBPointer1                                        == 0x00F5
DRBPointer2                                        == 0x00F6
DRBPointer3                                        == 0x00F7
DRBSerialMode                                      == 0x00F8
CCDFlags5                                          == 0x00FB
CCDFlags6                                          == 0x00FC
CCDVar0                                            == 0x00FD
CCDFlags4                                          == 0x00FE
CruiseSpeedSetpoint                                == 0x00FF

[dnsdr]

wowzer,

I did try some more random addresses plus a few from the above table and a few from the SMEC T1 table
But still dont have anything more than 118(0x76) seems to be about TPS, ranges from 35 to 195 as throttle is applied
I was thinking about using the OTC 4000 and monitoring communications
since I dont have a DSO I was thinking about trying a program called Realterm for monitoring
It is a Terminal Emulator that supports binary mode, hex display, customized baud rate
and it also has modes for just monitoring serial communications of an App and the port and also ability to monitor external serial communications
realterm.sourceforge.net

can you give my any tips on settings?
I see you have listed 2 baud rates in your logs 7812 and 62500
is one a send and one receive, one a handshake and then change for data?

[wowzer]

the "problem" you may have is the two rates that are supported are 7812 and 62500. usually after a good connection is made the drb2/otc unit will switch to the high baud rate. i don't know if realterm will support those rates. you would need to be able to tap into the tx/rx lines going from the otc to the ecu and seeing what bytes are being sent. use the 62500 baud rate first. you might be able to use your ftdi cable and tie it's rx/tx lines into the sci connector rx/tx lines along with the otc and then monitor on your pc using realterm while running the otc stuff. ftdi cable supports the odd baud rates. (make sure you have the ftdi rx/tx inverted setting turned on).


***edit***
if i get time in the next day or two i'll hook my ftdi cable up and see if i can monitor my drb2 the same way.

[dnsdr]

Thank you,
I didn't have much luck last night, but it was getting dark and I am getting sick
I may give this a rest for a couple of days, unless I go stir crazy after a day in bed

I was just rereading your last post and may have misinterpreted you statement "make sure you have the ftdi rx/tx inverted setting turned on"
I thought your where suggesting swapping the Rx and Tx lines
But now I'm thinking you are talking about changing the logic/voltage levels for what is a 1 and a 0
I think I remember reading about this in some of the many long treads I read through
Can you remind me what the utility name is to do this inversion on the FTDI chip?

One of these days I will need to spend the money and get myself a DSO
this is not the first project where a DSO would have saved me a lot of guess work

[wowzer]

ft_prog on the ftdichip website. the tx/rx lines need to be inverted. also, the vcp option needs to be turned on. the weird thing is that it looks like it already is communicating properly!?!?

[dnsdr]

I didnt have much luck with the Realterm in Spy mode (monitoring of the port with in windows).
Seems that requires an extra driver that requires a donation and I saw several post from people that said they made the donations and never got the key to download/install the spy mode driver.
I was hoping to just spy on MPSACN while running Sensor Diags, since most of those seem to report accurate values.

Do you have a list of RAM address locations for those Sensor Diag tests, or did that just come over from a library somewhere else? It dosnt seem to match very well any of the columns in MprXRef.csv.

Next I will have to make a serial cable to tap into the Tx/Rx lines either between ECU and MPSCAN while running Sensor Diags and using a second FTDI cable
or between ECU and OTC 4000
Then I can try using Realterm in Monitor mode from the external cable

If that dosnt work either, I did order a PC based Oscilloscope that would hopefully be good enough to capture the bits and bytes as they flow in and out of the SCI connector
I think I found a good post here on the bit order use on the SCI
http://www.boostbutton.com/turbonato...=sci_tech_info

[wowzer]

don't know how much you spent on the oscilloscope but i use the basic saleae logic converter which works well. i'll try to get my ftdi cable hooked up again and tap into the drb transmit/receive lines to see if that will work.

[dnsdr]

That looks interesting.
I didn't see that one when I was looking around.

I spent about $230 on a LabNation SMARTSCOPE
http://www.amazon.com/gp/product/B00..._detailpages00
I don't know how good it will be, but I liked the portability and that it works on multiple platforms including Android.
I will find out later this week when it comes in.

[wowzer]

good luck - i'll be interested to see what you discover.

[adamsys]

Hi all,

First, let me introduce myself since this my first post. I make my living as an engineer/ designer in an innovation lab so I'm pretty savvy with technology. Second, I have an old truck that I just love that isn't running right. It's a 1993 4WD 250 with the first MPI 360 Magnum engine.

So far, I have put together a 5VDC FTDI cable and reprogrammed it for the weird baud rate and inverted logic. My first attempt to connect it to my truck was unsuccessful. So I have some questions.

1) How do I know what version MPC I have?

2) I don't understand the various file formats and what their purpose is. Can you help me understand?

3) Can MPSCAN download the bin? Can I learn how to make changes to it?

Thanks in advance.

[wheming]

Hi all,

First, let me introduce myself since this my first post. I make my living as an engineer/ designer in an innovation lab so I'm pretty savvy with technology. Second, I have an old truck that I just love that isn't running right. It's a 1993 4WD 250 with the first MPI 360 Magnum engine.

So far, I have put together a 5VDC FTDI cable and reprogrammed it for the weird baud rate and inverted logic. My first attempt to connect it to my truck was unsuccessful. So I have some questions.

1) How do I know what version MPC I have?

2) I don't understand the various file formats and what their purpose is. Can you help me understand?

3) Can MPSCAN download the bin? Can I learn how to make changes to it?

Thanks in advance.

Hi Adam.
I'll try to help, as I've used the entire MPSuite line of software tools. But, the software developer might be needed for some of your questions. I'm not sure a MPI 360 cal has ever been disassembled.

To start, you have downloaded all of the drivers for the FTDI and your operating system?
When you plug your cable int your PC and start MPScan it should say something like Serial USB on ComX (X = some number). In Device Manager under Ports you should see that same com port and the Properties should say FTDI.
If it doesn't, then you still have a driver issue.
(Also, be sure to check Setup/Com port from the top toolbar. But if you are using Windows10 if seems to auto default to your FTDI cable when plugged in, as long as you don't have any other comp peripherals plugged in.)

Now for your questions.
1. Sorry have to answer with a question. A ".mpc" is the configuration file for setting up a log. But i think you mean something different what do you mean by MPC?

2. The two programs you will need are MPScan ( the logging software, and also has some diagnostic testing capabilities ) & MPTune (the tuning software that reads bin and allows changes to cals).
Morris (wowzer), the software developer has some videos linked in his first posts of each i believe.
MPScan:
- Configuration (logging layout, or "dashboard") files are ".mpc"
- Saved log files are ".mpl"
- There are several table files ".mpr" used for ecu gauge information (these only need changed under certain circumstances )
- There's also Profile file which you select which configuration file you use, so you can set up different profiles with different gauge configurations.

MPTune: (is the confusing one, and i might need Morris to fill in my gaps)
- ".bin" = your ecu bin file
- ".mpt" = mptune file *
- ".tbl" = table files *
- ".tpl" = cal template files
- ".lbr" = library files
- ".lst" = list files *

* these files are created by mptune when you compile the cal template you are working with.

3. No. You'll need MPTune in order to try downloading your bin. But, you may not be able to open it on mptune without another file, a table file. The table file is needed in order to reference what info is what.

Even if you can open it, and edit anything, not sure you'll be able to reflash it? That is what SBECII?
Can those be flashed without modifying the ecu itself?

Hope that helps a little. The smarter folks can chime in to fill in some gaps.