Some parts of Denso’s complex Diesel Particulate Filter (DPF) algorithms are somewhat known by now. Will update with new results from time to time.
Link to page
Like all or most engine related sensors, coolant temperature is being digitised by ECU. There’s a 2-dimensional table to convert measured sensor voltage to temperature result inside ROM:
Calibration curve is typical for a NTC (Negative Temperature Coefficient) thermistor.
Moving on to combination meter, coolant temperature lights are driven by ECU CAN output, precisely CAN-ID 0x600 byte 3. That byte contains coolant temperature, conversion formula is “
There are no additional flags for the dashboard lights. Meaning combination meter computer parses coolant temperature from CAN frame and decides on its own.
EXACT conditions, confirmed by testing: 1
||< 50 °C (122 °F)
||≥ 112 °C (234 °F)
A possible way to change stock thresholds is to modify ECU ROM resulting in faked 0x600 coolant temperature value output. This has already been tested working. However, other control units then read wrong temperature, too, resulting in possible side effects – especially if the offset is significant.
Coolant temperature certainly has effect on:
- A/C (can hear actuator move depending on temperature)
- BIU (copies data onto low speed bus)
- Combination Meter
Didn’t have time to investigate low-speed CAN bus and BIU (Body Integrated Unit) yet. In theory, BIU could transform data from high-speed (ECU, VDC/ABS etc.) to low-speed bus instead of just copying it. Anyone knows? BIU is the gateway, the only control unit connected to both CAN busses. Combination meter is on low speed bus for sure.
1) No hardware has been harmed, we’ve used CAN injection/simulation.
Posted in Boxer Diesel, CAN, ECU Analysis
Tagged BIU, BoxerDiesel, CAN, combination meter, coolant, ECU, light, Subaru, temperature
Finally, now that we are able to reflash diesel ECUs it makes sense to do some changes – or improvements as we think of it.
Couple of things already implemented and working perfectly:
- Added SSM2 getter function Engine Load, using standard definition
0x000007, x*100/255 [%] – unused in stock diesel ROMs. As engine load value is being calculated internally anyway, also available as OBDII
Mode 1 PID 0x04, it makes sense to provide this in SSM2 protocol, too. Very easy to do actually, just a single function pointer change – 4 bytes.
- Added SSM2 getter function Gear, standard def
0x00004A, x+1 [-], unused in stock ROMs. Tiny function required because of +1 offset.
Btw, as with all SSM2 functions, the physical layer does not matter – any SSM2 function gets called via both serial (Euro4) and CAN connection. Diesel ECUs typically have SSM2 virtual address space
0x000000-0x00034F. That’s 848 function pointers, plus same amount in SSM2-write vector table. You could hook up a lot non-standard things as there are plenty of unused addresses…
- Modified SSM2 init capability bits accordingly. That way above additional params do show up automatically on ALL SSM2 capable software (RomRaider, FreeSSM, SSM3, DashDAQ ?, …).
- DPF light active regeneration flashing mode. Applies to closed-type DPF models only. Stock behavior (steady on and error flashing) is untouched, we managed to append own additional code. New code part checks if any stock DPF light mode is currently active. If not, it checks DPF regeneration flag, and only if true it performs this new flashing mode. It’s particularly useful at low engine speed – warning driver that additional turbo lag can occur. Remember, engine management reduces boost and manifold air pressure – sometimes a lot – when active regen is in progress.
Update: got very positive feedback on this one. Even on a bright sunny day looking through the windshield, that blinking light on dashboard gets noticed immediatly. Whole thing is only a screen page of easy C++. Kudos to GCC, v4.6.x generated code is awesome – highly efficient.
Right now this is all internal, experimental, Linux-centric stuff. Availability of our services to the public will be discussed. It meant many months of full-time work to get this far, call for open source collaboration (less work for everyone) did not work…
Posted in Boxer Diesel, Development, ECU Analysis
Tagged BoxerDiesel, Diesel, DPF, ECU, light, Logging, Patch, reflash, SSM2, Subaru
- Do consult your car manual! Unfortunately owner’s manuals lack useful details.
- Please also read our DPF management page.
- Same DPF light logic in Euro 4/5/6 ROMs.
- DTC numbers differ across boxer diesel generations.
All Boxer Diesel models fitted with closed-type Diesel Particulate Filter (managed DPF), emissions spec Euro 4, 5, 6.
Therefore does NOT apply to early diesel models equipped with open-type DPF (MY 2008/2009 Legacy/Outback). These do not have DPF management at all in software, no sensors, no DPF light, a lot less to worry about!
Constant light means “Soot High Warning“, also called “Vehicle Speed Request“.
According to manual, one should drive for at least 15 minutes at 60+ km/h, providing favorable conditions (exhaust gas temperature high enough) for active DPF regeneration to start (and ideally complete) in order to reduce soot.
Steady light is triggered by single condition:
- Soot Accumulation Ratio > 85%
According to ROM logic, steady light will turn off when soot drops below 75% (hysteresis).
If there’s any error condition, see below, the error has higher priority, always resulting in flashing mode.
Flashing/blinking means “Error“, any of the four possible conditions can trigger this mode right away – without showing steady light before.
The manual usually states something like: go to Subaru dealership for inspection. Waiting too long might worsen the issue! Mileage driven with light ON can be recorded by ECU and read out with software!
- Oil Dilution Ratio ≥ 10% (also sets DTC P1468 Oil Dilution). Remember, as dilution is just a rough estimate, the value and therefore this error can easily be false! Might disappear when dilution drops below threshold due to calculated evaporation, see post Oil Dilution Graph. Dealership might have forgotten to reset oil dilution at oil change – seen this many times on forums.
- Compulsory regeneration required, also called “Dealer Visit Request“; e.g. Soot Accumulation ≥ 100%; ECU does not try active regen anymore unless soot drops to normal level
- Ash Accumulation Ratio ≥ 100% (also sets DTC Ash Overfill). Need to clean or replace DPF and tell the ECU to reset this value.
- DPF Limp-Home Mode (also sets DTC DPF Limp-Home Mode).
DPF Light Control
At ignition ON, the DPF light illuminates for two seconds exactly – light test – and should stay off afterwards, indicating normal condition. Otherwise see above.
On Impreza Euro 4 / 5, ECU operates DPF light using CAN message 0x600 byte 0 bit 1, bit = 1 means light ON.
Euro 6 just seems to use different CAN IDs and frame contents.
Like we did in above GIF animation, flash rate is 400 ms/400 ms on/off (8/8 CAN messages at 50 ms interval), respectively. There are no other stock flash modes.
In the future we’d like to use DPF light for additional purposes e.g. indicating active regeneration by implementing a different flash rate. We already did a patch using DPF light to indicate active regeneration: Diesel ECU Patch v1. For source code see post DPF Light Patch.
- 2016-10 incorporate Euro 6 findings
Posted in Boxer Diesel, CAN, ECU Analysis, Euro4, Euro5, Euro6
Tagged ash, BoxerDiesel, Diesel, DPF, ECU, light, maintenance, oil, Subaru
The engine control unit supports uploading code into RAM because that’s part of standard engine management software (ROM reflash) update procedure. I also use the transfer via CAN method as it is quite fast.
Actually, the ECUs stock firmware does not care about the uploaded bytes as long as generic conditions are met (max 12 KiB total size on diesels, checksum, …). That way you can abuse the system and do what you want. Did some relay/actuator testing lately, confirming some ports…
Valid for MY 2009/2010 Impreza Diesel Euro 4 only. Euro 5 models differ!
||both, low power
||left one only, high power
|PE02 & PE03
||both, high power
||Sub Fuel Pump
||noise originating from fuel tank area
||A/C Compressor Clutch
||loud click noise, looking at pulley one can see clutch part move
||Almost same trigger point (pedal position) as stop light switch.
||Stop Light SW
I already knew those output ports from ROM analysis so it was rather safe for me to try them. Just reading any port is supposed to be safe.
Many are reversed, then bit ‘
ON and ‘
The MIL is what I often use for debugging ECU code – e.g. flashing it to indicate some condition. Unlike most dashboard indications you don’t operate it using CAN messages (much more complicated).
However, ports can be model specific so one must be careful – i.e. might hit the starter with transmission not in neutral.
C/C++ Code snippet to test and operate a port
// Port E Data Register, from Renesas manual
#define PE_DR_w (uword*)0xFFFFF754
// Port L Data Register
#define PL_DR_w (uword*)0xFFFFF75E
// port bitmasks
const uword PE14_MIL = 1 << 14; // 0x4000
const uword PL06_BrakeSW = 1 << 6; // 0x40
for(;;) // infinite loop
ToggleBits(PE_DR_w, PE14_MIL); // toggle MIL
uword pldr = *PL_DR_w; // read Port L Data Register
if ((pldr & PL06_BrakeSW) == 0) // test bit
Wait(100); // Brake ON -> fast flashing of MIL
Wait(1000); // Brake OFF -> slow flashing, 1000 ms delay
/* alternative, set (true) or clear bits (false):
AdjustBits(PE_DR_w, PE14_MIL, true); // OFF
AdjustBits(PE_DR_w, PE14_MIL, false); // ON
void ToggleBits(uword* address, uword bitmask)
*address ^= bitmask; // XOR
Questions: What software can I use to compile SuperH code? How much $$$?
Answer: Linux and utilities, all open source and free!
Free open source GNU compiler collection (GCC) can generate binaries for Renesas SH-2E, the microcontroller’s (e.g. SH7058S) CPU inside the engine control unit.
The beauty of GNU binutils plus GCC is, you can use the same toolchain to produce code for tons of different platforms1.
So same stuff I use for producing Intel/AMD PC x86/x64 software plus some platform specific command line options will do it. GCC is very powerful, supports multiple source code languages. (Personally, I even compile small Windows tools directly on Linux using winelib.)
Uploading a binary via CAN is another story but once it is automated, you don’t have to think about it, e.g. just run a make command…
1) Compiling binutils and GCC from source with target platform support enabled might be necessary. Default Linux packages usually have not been compiled with such special platform support enabled.
Display a list showing all architectures and object formats available for specification with -b or -m:
Posted in Boxer Diesel, Development, ECU Analysis, Impreza Diesel
Tagged BoxerDiesel, Denso, ECU, gcc, light, Renesas, software, Subaru, SuperH
Owners want to be able to change oil by themselves obviously.
On closed-type DPF models (all except MY 2008/2009 Legacy/Outback which are mated with open-type DPF) you’ll need to reset oil dilution parameter as it is calculated (not measured!) by the ECU. Basically active DPF regenerations in particular cause diesel fuel bypass into engine oil. Piston rings cannot seal perfectly.
Not doing a reset could even cause limp-home-mode in the LONG TERM, IF the ECU assumes dilution being too high.
Following info as seen in all managed-DPF-ROMs so far.
DTC P1468 Oil dilution is being triggered when oil dilution ratio ≥ 10 %. Also results in DPF light flashing.
The engine management software assumes 6.13 kg oil mass and this maintenance operation sets RAM variable “Oil Dilution Amount [kg]” to zero.
The ROM’s internal calculation steps are:
- Oil dilution amount [kg]
- Oil dilution ratio [%] = 100 * OilDilutionAmount [kg] / 6.13 kg
- Estimated distance to oil change [km], via LUT
Also see posts Estimated Distance to Oil Change as well as Oil Dilution Graph.
Oil Dilution Reset
We’ve traced related Euro 4/5/6 ECU-ROM code. Here are all possible options:
Euro 4 (IV)
- Diagnostic protocol (SSM2 via Serial only). See post Oil Dilution Reset (K-Line, Euro4). There is no alternative method on Euro 4 models! ¹)
Euro 5 (V), Euro 6 (VI)
- Diagnostic protocol (Extended OBD-II only since it is not implemented via SSM2 in ROM)
- Manual procedure, check your owner’s manual. You only have 4 seconds to accomplish each item, starting from brake pedal:
- Transmission in neutral
- Apply parking brake
- Start engine
- Depress and hold brake pedal
- Defogger ON
- Lights ON (step 1 = parking/clearance/DRL lights is sufficient)
- Defogger OFF
- Lights OFF
- Defogger ON (again)
- Lights ON (again)
- Defogger OFF
- Lights OFF
- Release brake. Now the glow light (depicting yellow coil) will flash for a few seconds. Otherwise try again, repeat from 4th item.
Many users have confirmed this procedure, e.g. Subaru Forester Owners Forum – Oil change on Diesel engine and ECU service reset. We also know the related software subroutines, seems to work as advertised.
1) In theory, we could patch Euro 4 ROMs to add the same Euro 5/6 manual procedure. Not a trivial task, though, talk about hours of development and testing…
Posted in Boxer Diesel, Development, ECU Analysis, Euro4, Euro5, Euro6, Maintenance
Tagged BoxerDiesel, Diesel, DPF, ECU, Euro4, Euro5, Euro6, light, maintenance, oil, Subaru