Category Archives: RomRaider

Oil Dilution Reset (K-Line, Euro4)

Applies to

Old Euro 4 models, model years (MY) 2009/2010, fitted with closed-type DPF, (therefore Impreza and Forester only?). This also means using SSM2 via Serial (K-Line) protocol, as SSM2 via CAN will not work for most maintenance operations on such old ECUs due to ROM software limitation.


After changing the engine oil, the ECU needs to be told in order to reset its oil dilution amount and ratio values – the ECU cannot detect the change by itself. By the way, Euro 4 engines do not even have an oil level switch/sensor. Also look at post Oil Dilution Graph describing ECU calculations.

By applying a little communication, dilution will be zeroed, also saved into the ECU’s EEPROM after ignition off. Otherwise this (estimated!) value might rise over time and trigger DPF light flashing having reached 10% ratio.

It seems there are still folks out there interested in this, changing oil by themselves, not at the dealership where mechanics use Subaru Select Monitor (SSM-III or newer SSM-IV) software.
I searched through some of my old notes and found the rather short and easy procedure.


Working K-Line connection to ECU. See page SSM2 via Serial.

C-style pseudo code

// only one single SSM2 address is needed
const int address = 0x27D;
byte b = Read(address);

if (b == 0xFF) { print("Probably unmanaged (closed-type) DPF, nothing to do."); exit; }

// set bit 6
Write(address, b | 0x40);

// Wait for some time (500 ms or so is more than enough for the ECU to do its work)

// clear bit 6
b = Read(address);
Write(address, b & ~0x40);

// verify, make sure bit 6 is zero again...
b = Read(address);

Almost done! Now turn ignition off so that new content gets saved into EEPROM! I also recommend waiting for about 20 seconds, then turn ignition back on in order to query oil dilution ratio [%] and/or oil dilution amount [g] parameter(s) to be sure. These values should be zero now. See post Why and when cycling ignition matters for explanation.

In RomRaider logger definitions (version 310) these parameters are called:

P193 Oil Dilution Ratio % Öl Verdünnung Verhältniss
P236 Cumulative oil diesel entry g Öl kum Dieseleintrag

SSM2 via K-Line communication example

SND = message from tester to ECU
RCV = received response from ECU

SND: 80 10 F0 05 A8 00 00 02 7D AC
RCV: 80 F0 10 02 E8 00 6A

SND: 80 10 F0 05 B8 00 02 7D 40 FC
RCV: 80 F0 10 00 F8 40 BA

SND: 80 10 F0 05 A8 00 00 02 7D AC
RCV: 80 F0 10 02 E8 40 AA

SND: 80 10 F0 05 B8 00 02 7D 00 BC
RCV: 80 F0 10 00 F8 00 7A

SND: 80 10 F0 05 A8 00 00 02 7D AC
RCV: 80 F0 10 02 E8 00 6A


It has been confirmed to be working, using RomRaider‘s built-in Test tool (menu: Tools → Launch Test App…). Since the sequence of individual commands is not time critical, it can be done by sending SSM2 messages manually one after the other. See this RomRaider Forums thread.


SSM2 via Serial at 10400 Baud

Standard SSM2 via serial protocol uses 4800 baud = bits/second on “K-Line”, OBD-II Connection pin# 7.

Some (rather recent model year it seems) ECU stock ROM software, both diesel and petrol, support switching to 10400 baud. Btw, 10400 is speed of ISO 14230 (alias KWP 2000) protocol, needed for BIU and several other control units.
It’s relatively easy to do, starting in standard 4800 baud mode, which is the default mode after ignition ON:

Write exact byte 0x5A into SSM2 address 0x000198 in order to switch to 10400 baud (default content is 00 = standard 4800 mode):
W 80 10 F0 05 B8 00 01 98 5A 30
R 80 F0 10 02 F8 5A D4

Ok, above positive response is the last message to receive using 4800 baud. At this point, all further SSM2 commands will fail (no response) because ECU can only understand 10400 baud.
Set interface device to 10400 baud, all other settings as usual, SSM2 is working again, most important commands at least.
Note: In this mode you have to use tester device ID 0xF2 instead of 0xF0! Everything else, including reported data, is the same it seems.

SSM2 Init:
W 80 10 F2 01 BF 42
R 80 F2 10 69 FF A2 10 14 ...

Read single byte, requesting that SSM2 0x000198 byte set above for example:
W 80 10 F2 05 A8 00 00 01 98 C8
R 80 F2 10 02 E8 5A C6
→ 5A, as set before

Read some standard addresses for sampling:
W 80 10 F2 11 A8 00 00 00 08 00 00 0D 00 00 0E 00 00 0F 00 00 10 7D
R 80 F2 10 06 E8 67 62 00 00 00 39
→ coolant temp = 63°C, MAP =98 kPa, engine speed = 0 rpm, vehicle speed = 0 km/h

Block read from address 0xFFB00, length 5. Btw, reflash counter bytes on 1 MiB ROMs live there, word + negated word at 0xFFB00.
W 80 10 F2 06 A0 00 0F FB 00 04 36
R 80 F2 10 06 E0 00 03 FF FC FF 65
→ reflash counter = 3

Write-Single-B8 command does not seem to work, blocked by ROM code! Looks like this mode isn’t gonna meant for maintenance, just faster logging. Don’t know a way to set baudrate back to 4800, except ignition OFF + ON, yet. Also, sending zero byte(s), like turning off continous mode, did not do it for me.
W 80 10 F2 05 B8 00 01 98 00 D8
(no response)

Continous push mode (RomRaider “Fast Poll“) is working, too! Tested working for both read single A8 and read block A0 commands.
So 10400 baud + continous mode should yield even higher sample rates – if someone (RomRaider ?) hacks this stuff into software… Not much fun without proper software support.
Did not do benchmarks yet. Theoretically 10400 vs. 4800 baud might yield factor 2.167 speed improvement.

Still not fast enough and cannot use CAN?
As stock ROMs can be patched, the code that actually does the baudrate settings can be modified. We might test that in the future, e.g. 31250 bits/s or even higher might still work reliably. Thanks to this additional mode, we can try changing that one and leave standard mode intact so any diagnostic software keeps working. Don’t know of any software using SSM2 at 10400 baud. All knowledge about this is derived straight from ROM.

RomRaider Logger Status

Kudos to RomRaider for including diesel definitions!
Especially interesting for people driving both petrol and diesel cars, no need to use separate definition files.

Links to RR pages:
Latest app version: RomRaider 0.5.3b RC9
Latest definitions: (2011-04-04) Experimental Logger Definition Updates

The application can only do SSM2 via Serial, no CAN protocol(s) support for Euro5 diesels I’m afraid. TCU support has been added, too, but then again, diesels only have MT.

We’ve spotted some extended diesel parameter errors, easy to fix in XML, though. Still safe to use, won’t hurt ECU, just expect some weird data. Will upstream any corrections to RR source of course…

ECU connection problem Euro5 v2

Update 2011-04-19: Apparently SSM via CAN does work on Euro5 while SSM via serial does not. Therefore Euro5-owners might need a CAN interface – more expensive, less software support, unfortunately. Not sure yet if serial diagnostics can be activated somehow or does not exist in ROM anymore. Euro4 supports both methods out of the box.

Apparently people cannot connect to Euro 5 Boxer Diesel ECUs using SSM software like RomRaider or FreeSSM.
Such applications use standard SSM2 protocol (4800 baud over serial K-Line, OBDII pin# 7).
All I can say for now is we’re starting to investigate, just takes time as our tech guys don’t own such new models.
Please let us know if any (non-OBDII protocol) software is working with your Euro 5 model.

Did anyone owning Openport 2.0 interface try standalone-logging via CAN method (logging to memory card) yet?

We could also use pics from OBDII port (below steering wheel) with metal pins visible for confirmation. OBDII port changes are unlikely, though, there should still be lots of other control units talking serial protocols.

2D-Table Recognition Improved

With the ROM-tool I’ve been wondering why certain 2D-tables weren’t recognized.
Turned out these tables have duplicate points in them – Denso’s fault!
By relaxing axis values validation code (xn ≤ xn+1 instead of xn < xn+1) I solved the problem.

Download small generated RR def XML containing nine calibrated sensors for Impreza JZ2F401A (and Forester JP3F501A) here:
Rename to .zip and extract XML file for RomRaider.

Certainty for eight sensors is high, the special 9th one I don’t know yet – might be unused.
Other sensors like those for pressure probably don’t need calibration tables (linear) so they don’t show up here.

ROM Analysis Tool – New Project

We’ve turned our command line analysis tool, capable of finding most 2D and 3D tables inside a ROM file, into a library. Now this is being consumed by our new project, a GUI tool with graphing and basic editing features.
Although RomRaider ECU definitions XML export has been working fine, the edit-XML-then-view-in-RR roundtrip is too slow and cumbersome for hundreds of tables.
With the new tool we can read a ROM file directly (takes about a second on a fast machine), browse/search/view through the tables, add metadata (title, axis names, units), correct data type if necessary etc.
Adhering to our “Linux first” policy, the tool runs on Linux. Does work on other platforms, too.
Technologies/Libraries used: Mono, Gtk#, NPlot.
Viewing 2D and 3D data has been implemented, other UI stuff is not quite there yet.
Couple of screenshot pieces on Linux x64:

Updated RomRaider Logger Definitions

Added some more RAM values for Impreza Diesels. Link to page.