MR2 SpyderChat banner
101 - 120 of 160 Posts

·
Registered
Joined
·
5,007 Posts
Here you go, sniff away. I can't believe that someone actually went into a library and laid the journal down against the glass page by page. That's what we did with my girlfriends thorax, back in 1976. Cost a nickel per copy, at the time.

PS. I can point you to a cleaner digital version. Contact me.
Font Screenshot Publication Circle Parallel



Note there are two additional relevant descriptions of BEAN,

SAE 1999-01-1278 Gateway Application for Automotive Network System “BEAN”
This one has been pirated elsewhere also.
Font Publication Screenshot Document Electric blue



SAE 920231 A Low-Speed In-Vehicle Network for Body Electronics
This one mainly historical interest - also available from other sources.
Font Publication Material property Screenshot Document


BEAN - the Betamax of vehicle serial communication.
 

Attachments

·
Registered
Joined
·
70 Posts
Discussion Starter · #102 ·
Yes, it puzzles me. Trying to make money out of old weird Toyota. If you want to make money (here in Europe) you are best fixing crappy expensive German cars! People love spending money on that scrap.

I'm not in this for the money. If I put the ground in to make the MR2 easily reflashable for small beer change, then maybe other people will put time in to develop some WinOLS definition files etc.

I've read those documents, I was hoping to find a document with all the definitions for the Device , Module ID's and values like this:-

Code:
// Messages           {DID,  MID,  DAT0, DAT1, DAT2}
uint8_t fuel[] =      {0x62, 0xA4, 0x3C}; // Fuel D0 153-40
uint8_t engTemp[]  =  {0x62, 0x2C, 0xA5}; // Engine Temp D0 90-255
uint8_t gear[] =      {0x62, 0x40, 0x08, 0x10}; // P,R,N,D,M,3,2,L D0 11111111 (128, 64, 32, 16, 8, 4, 2, 1); Manual mode: 5,4,3,2,L D1 ---11111 (16, 8, 4, 2, 1)
uint8_t ect[] =       {0x62, 0xD2, 0x08, 0x10, 0x00}; // ECT PWR, SNOW, CRUISE D0 --11--1- (32,16,2); CRUISE-FLASH, ECT PWR-FLASH D1 -11----- (64,32); Beep D2 ----1--- (8) toggle on/off
uint8_t seatBelt[] =  {0x62, 0xDF, 0x10, 0x80}; // DOOR D0 ---1---- (16);  SEAT BELT D1 1------- (128)

// DOOR-FLASH
uint8_t batt[] = {0x62, 0xD4, 0x28}; // DOOR-FLASH, BATT, OIL D0 -111---- (64, 32, 16)
uint8_t door[] = {0x62, 0xFA, 0xff}; // DOOR-FLASH D0 11111111 (255); *important mid:0xD4 D0:0x28 D0 -1------ must be set first //
But this really is all a go'er at this stage. We have original 1ZZ-FE files, an ECU that'll program via the ODB2 port, a relatively compatible ECU, and a solution to fix the incompatible bits.
 

·
Registered
Joined
·
5,007 Posts


 

·
Registered
Joined
·
70 Posts
Discussion Starter · #108 ·
So here is done bean sniffed logs.

I've used that guys open source Arduino thing. His example sends some bytes to move the gear change indicator. I've just commented out the send bit on his code. So now all it does is receive and post it out via the serial monitor.

Attached is some logs.

One with just the engine ECU - running
One with just the engine ECU - rnot running.
One with just the cluster alone plugged in.
One where I fool the oil pressure sensor on and off.
One where I fool the charge light on and off.
One where I fool the temp sensor go up and down with a variable resistor.

Now its just to make sense of this stuff.
 

Attachments

·
Registered
Joined
·
70 Posts
Discussion Starter · #109 ·
This is important!

0 - SOF // start of message ( 1 bit: 1 )
1 - PRI ML // priority, message length ( PRI 4 bit: XXXX; ML 4 bits: XXXX )
2 - DST-ID MES-ID DATA // destination id, message id, data
3 - CRC // cyclic redundancy check
4 - EOM // end of message ( 8 bits: 0111 1110 )
5 - RSP // response ( 2 bits: 10 ACK[Acknowledgement], 01 NAK[Non-Acknowledgement )
6 - EOF // end of frame ( 6 bits: 000000 )
 

·
Registered
Joined
·
70 Posts
Discussion Starter · #110 · (Edited)
DST-ID = Destination ID...... Cluster = 62 / Engine ECU = 13


Charge Light turn on =
1 A3 62 D4 30 1C 7E 40
1 63 62 D4 30 7A 7E 40

Charge light turn off =
1 63 62 D4 10 3C 7E 40
1 A3 62 D4 10 5A 7E 40

1 = start of message
63 or A3 = Priority 6 or A / Length 3 bytes
62 = Destination = cluster
D4 = Warning lights
30 or 10 = On or off (possibly some bytes do different lights?
Then a checksum byte
And end of line bytes

Oil pressure lights =
D4 00
D4 10
Thus D4 is definately for the lights and the bytes after are picking the different lights.

00110000 = 30 = Charge + Oil
00010000 = 10 = Oil
00000000 = 00 = Neither
 

·
Registered
Joined
·
70 Posts
Discussion Starter · #112 ·
Really I am just an idiot, I have no clue really of doing data bus stuff, and I'm certainly no programmer. I might be able to NOP out some assembly to get me past the password screen or something, but this sort of development is way above my pay grade!
I can analyse logic to figure out what is doing what, but writing the Arduino code to actually do it is something I'm hoping where some one else steps up to the stage.

What I can do though is design a circuit board that anyone can print on PCBWAY /JLBPCB online which will get all the inputs and output sorted via the ecu and Arduino etc. I will include all the Aircon stuff too as I can see folk in warmer places than the UK would like all that to work too.
 

·
Registered
Joined
·
70 Posts
Discussion Starter · #113 ·
Temp gauge is 2C - same as what the arduino dev guy found.
Minimum = 39h
Max = FEh
DESTINATION​
TEMP GAUGE​
VALUE​
CRC​
1​
63​
62​
2C​
39​
A6​
7E​
40​
1​
63​
62​
2C​
43​
F1​
7E​
40​
1​
63​
62​
2C​
51​
F4​
7E​
40​
1​
63​
62​
2C​
56​
8D​
7E​
40​
1​
63​
62​
2C​
95​
3F​
7E​
40​
1​
63​
62​
2C​
4C​
10​
7E​
40​
1​
63​
62​
2C​
4F​
25​
7E​
40​
1​
63​
62​
2C​
5D​
20​
BF​
20​
1​
63​
62​
2C​
6B​
2F​
7E​
40​
1​
63​
62​
2C​
6D​
45​
7E​
40​
1​
63​
62​
2C​
F4​
E6​
7E​
40​
1​
63​
62​
2C​
FE​
58​
7E​
40​
 

·
Registered
Joined
·
70 Posts
Discussion Starter · #117 ·
Another small piece in the puzzle.... proof that this type of 1zz-fe ECU can be reflashed/reprogrammed by OBD2 port

Rectangle Personal computer Font Tints and shades Gadget

Blue Font Line Car Wheel

Rectangle Font Gadget Personal computer Display device


So that was via Toyota Techstream....
Then I tried it with PCMFlash which also calculates the checksum if data has been modified:-

Rectangle Font Electronic instrument Mesh Grille
Rectangle Font Parallel Electronic device Pattern
 

·
Registered
Joined
·
5,007 Posts
If only someone would write a little flasher (simple version of PCMflash) that works with the Chiniese bootleg mini-vci J2534 cable. This would be a huge hit. Even at just $5 a pop in the app store, the development cost would be recovered in very short order. Since you are able to sniff the packet traffic, you should be able to detect the packets that initiate the J2534 connection and handshake and deliver the payload then confirmation.
 
101 - 120 of 160 Posts
Top