Category Archives: Euro5

Updated Extended OBD-II definitions

Added 7 PIDs (0x10A1, 0x10A3..0x10A7, 0x1137), some are petrol-only, some diesel-only, some mixed.
See Extended OBD-II definitions page.
Downloads (spreadsheet, CSV) as well as ParsePID project are up to date.
Note that some PIDs have not been tested on actual cars yet – feedback is appreciated!

Mode 23 – Read Memory

According to some of my notes, Euro 5 diesel models, or cars that support Extended/Enhanced OBD-II in general, might support mode/service 23 for dumping ROM or RAM blocks:

Format is similar or same as ReadMemoryByAddress (23 hex) service specified UDS (Unified Diagnostic Services, ISO 14229) protocol:

"23 <Format> <Address[]> <Length[]>"

Several $23 formats can be supported, Euro 5 diesel:

  1. "23 14 A1 A2 A3 A4 L1"
  2. "23 24 A1 A2 A3 A4 L1 L2"

As you can guess, format byte e.g. 0x14 means:

  • 4 address bytes → uint32 big endian, encoded in low nibble of format byte
  • 1 length byte → uint8, encoded in high nibble of format

Restrictions

Stock firmware usually restrict available address ranges, allowing only partial dumps. ROM calibration data and RAM regions might work. Knowing how to reflash and reverse-engineer the logic, such restrictions can be patched and therefore eliminated.

Errors

Depends on actual implementation, (early) Euro 5 diesel ROM logic:

  • 0 < length ≤ 0x400 (dec 1024) bytes otherwise NRC 31
  • other formats or request message lengths yield NRC 13
NRC (hex) Description
13 Incorrect message length or invalid format
31 Request out of range

Example

Euro 5 diesel (1.5 MiB ROM, SH7059 chip) example – dump beginning at ROM calibration data:

Start address = 0xC0000
Length (per request) = 0x40 = 64 bytes

"23 14 00 0C 00 00 40"
Positive response: "63 <XX XX XX ... total 64 payload bytes ... XX XX>"

"23 14 00 0C 00 40 40"

"23 14 00 0C 00 80 40"

"23 14 00 0C 00 C0 40"

"23 14 00 0C 01 00 40"

Anyone able to confirm that these mode 23 commands and formats are working?

Personal experience on many different control units: Maximizing length per request yields max transfer speed, however application algorithm must be able to handle NRC codes and react properly.

Definitions Download for Extended OBD-II

Uploaded first draft of definitions file for diagnostics protocol Extended/Enhanced OBD-II. Should be easy to work with, can export to CSV etc. Everyone is welcome to use the data as long as it is mentioned where it came from.
Also added a few more PIDs in the meantime.
Go to page: Extended OBD-II

Protocols page Extended OBD-II

Added 3 more DPF related PIDs on page Extended OBD-II:

114A Pressure Difference between DPF Inlet and Outlet
1155 Estimated Distance to Oil Change
1156 Running Distance since last DPF Regeneration

Will add some more over time…
Apparently newer petrol models now also use this protocol (exclusively apart OBD-II, no SSM2 anymore ?). Might add petrol specific PIDs in the future.
Also, apps like Torque have been confirmed working with this.
Anyone able to provide any data, testing new or known PIDs, screenshots of software including SSM etc. or spot any issues, please get in touch!

Updated protocols page Extended OBD-II

Updated protocols page Extended OBD-II:

  • corrected “Exhaust Gas Temperature (EGT) at DPF Inlet”
  • added “DPF Regeneration Count”

Euro 5/6 model owners please test and report results, thanks!

Would also be interesting to know (logging) software capable of using this protocol. Tactrix Openport 2.0 standalone logging, Torque perhaps???

Injector Codes

Denso Injector DCRI107890 (Denso part# 095000-7890, Subaru part# 16613-AA020) for Euro 4 Subaru Diesel

Introduction

Quote from a DENSO document incl. picture below:

Replacing a Diesel Common Rail Injector:
When replacing a DENSO Diesel Common Rail Injector, marked with a compensation code, it is necessary to register the ID code, printed on the upper part of the injector, with a genuine OEM – or DENSO diagnostic tool, into the electronic control unit (ECU). The injector compensation (ID) code is used to compensate injector production tolerances.
Some vehicles also require Small Injection Quantity Learning.

Denso Injector ID graphic

Subaru’s term for injector compensation or ID code is “injector code“. Dealership diagnostic software (SSM-III, SSM4) has menu items like “Injector Code Display” and “Injector Code New Registration (SSM to ECM)

First off, the engine control unit has no way of measuring actual injected fuel amount, such technology would be expensive for these kind of small fluid quantities. Due to high common rail pressure, even tiny production tolerances result in unwanted injection quantity variations. Obviously, each injector must be registered using its correct cylinder number so the ECU can apply individual adjustments when it is calculating injections. Basically, the ECU accomplishes desired (target) injection quantity by adjusting the duration of injector drive signal.

Since programmed injector codes as well as any other important data is being saved into an extra EEPROM chip, there is no risk of data loss having the car battery disconnected.

Consequences of Wrong or Missing Injector Codes

According to DENSO:

  • Knocking noise
  • Unstable idle
  • Wiggling during driving
  • MIL (Check Engine Lamp) on

Cylinder numbers – Quick Reference

As for a quick reminder, looking at the front of the car into engine bay, cylinder numbers are:

towards back
transmission
  3        4
  1        2
car front (radiator etc.)

Getting Injector Codes via QR Code

Although normally this should not be necessary, injector codes can be read from the actual injector parts even when mounted on the engine and inside the engine bay, therefore not easily accessible. Taking a picture using a mirror tool is relatively easy, no need to disassemble any parts:

Injector QR Cyl2 small

While the injector code label itself is hidden by the (white) electrical connector, its QR code is visible by default.
Make sure the QR code on the photo is as sharp as possible and has sufficient resolution. At the car I usually just try to get high quality pictures. Later on my computer I simply select the best pic, then scan QR info straight off the computer screen using a smartphone.

Using an image manipulation program (i.e. GIMP, PhotoShop) in order to improve the QR code area can result in much better QR detection. In my case, this was not needed as the app can also detect inverted QR (light code on dark background).
Android app tested: “Barcode Scanner” from F-Droid repository. Check settings → Invert scan.

As an example, the following pic is the extracted and improved QR code portion from above picture. I used these steps in GIMP: crop, perspective correction, grayscale, invert, brightness & contrast . You should be able to scan this:

Injector QR Cyl2 processedScanning captured QR code results in a line of text containing 49 characters:

7890AA0200809118736B30000000000E9EBEBECF300000045

First 19 chars:

7890AA0200809118736
  • First four chars 7890 match Denso basic part number.
  • AA020 is also found in Subaru part# 16613-AA020
  • Possibly contains production date 2008-09-11 ?
  • Serial# ?

Injector Code Format

Remaining 30 chars is the exact injector code needed for ECU. These chars must be in hexadecimal [0-9, A-F] form as they are transmitted as 15 bytes to and from the ECU:

B30000000000E9EBEBECF300000045
Byte index [0..14] Content
0 const, sort of generation ID, verified by ECU:

  • Euro 4: B3
  • Euro 5: B2
  • Euro 6: B6
1..12 12 payload bytes containing correction data, type int8, for up to 12 pre-defined correction points. Each signed byte must be within range [-125, 125]. In other words, the following five bytes are not allowed: 7E, 7F, 80, 81, 82.
13 const 00
14 simple XOR checksum

Resultant properly formatted injector code (left to right, 4 chars per block):

B300    0000
0000    E9EB
EBEC    F300
0000    45

Notes

Invalid codes will be rejected! Euro 5+ will return NRC 0x31 (request out of range).
Injector code data is not compatible between common rail system generations due to differing correction points! Euro 4 uses fewer points (10) than E5+ (12). Therefore, for example, programming a Euro 5 injector code into Euro 4 ECU will not work and vice versa.

Software

AFAIK, Denso’s own PC diagnostic software has the ability to read from a QR scanner device, Subaru OEM application SSM-III does not – need to type in codes manually.

Protocols needed for injector code display & registration:

  • Euro 4: SSM2 via Serial
  • Euro 5/6: Extended OBD-II

As far as we know, there is no free/open-source software for this yet.

EcuTek tool probably supports injector coding (up to Euro 5 ?).

Other Brands

Many other car brands are based on Denso diesel software. These often use similar 15 byte injector codes as well. However, injectors and pre-defined correction points usually differ!

Mazda CX-5 (SkyActiv-D 2.2)

Piezo injectors! 15 bytes; first byte: 3C; pressure levels and corrections points differ vs. Subaru.

Updates

  • 2017-05: additional notes and details
  • 2016-04-03: Euro 6

Fuel Consumption

Consumption Display Correction

It is the ECU software that estimates fuel consumption as it calculates all individual injections (multiple per stroke) anyway. Based on injection quantity demand it will calculate injector drive time, taking conditions like rail pressure and fuel temperature into account. It cannot measure fuel flow directly as this would require expensive equipment – tracking fuel flow + return flow accurately, all temperature compensated.
In reality most drivers notice some trip computer offset vs. actual consumption calculated at gas station fill-up. Usually the displayed value is too optimistic. The offset may depend on driving conditions and fuel quality. Often enough it is roughly constant for an individual driver so it is still useful information.

We offer fuel consumption display correction by patching ECU software.
Simple solution is to derive a constant factor.

E.g. indicated 6.6 litre/100km vs. 7.0 actual → correction factor = 7.0 / 6.6 = 106.1 %.
After modifying and reprogramming ECU ROM, fuel consumption CAN value (ECU output, [mm³/s]) will be adjusted accordingly, to be picked up by combination meter computer. This one calculates all trip values, finally sends display control commands to center display over serial connection.

Injecting complex ECU subroutine f(torque, temp, rpm, …) and/or table data is also possible, requires measurement data in the first place, though.

DPF Active Regeneration

As you may have noticed, active DPF regeneration has a big impact on instant fuel consumption. All injection parts are included in CAN consumption value, therefore post-injections are noticeable in center display when it is set to current consumption mode.
Collected CAN data showed ~300 % actual fuel consumption at idle when active regeneration is in progress, mainly due to post-injections and intake air throttling in order to heat up the DPF, compared to normal idling with regeneration off.

Idling at 800 rpm, coolant temperature ~90°C both times:

Item Unit Normal Active Regeneration
Injection Amount mm³/st 3.3 12 1
Fuel Consumption mm³/s 88 319
cm³/s 0.088 0.319
litre/h 0.32 1.15

1) Calculated from CAN value, SSM2 item “Final Injection Amount” would indicate 4.0 mm³/st (!). Logged data suggests this SSM2 parameter matches CAN consumption value as long as post-injections are not occurring (DPF active regeneration). To get fuel consumption, best way is to parse the CAN fuel flow value instead.

Formulas

Other Brands

Mazda CX-5 (SkyActiv-D 2.2)

Fuel consumption algorithm and correction works similarly.