[dimtey]

Hello,

From the title this might seem like another post asking for help Well, it is a bit different this time!

I have reverse-engineered the communication protocol for the Siemens ECU used in 94-95 164s (60577438 and 60585472). I've put together a tool (under Linux) that works with a home-made RS-232 to ISO9141 adapter. It can read out and reset airbag DTCs (diagnostic trouble codes).

I have a spare '94 airbag ECU which I have used for reverse-engineering the protocol and the codes. I have a little harness simulating sensors and the squib, as well as the warning light. Disconnecting pieces of it I obtained all code definitions.

Here is the output of the tool when I first got DTC readout (no harness connected, just power and warning light):

ID (msg 0): B01AIRBAG
ID (msg 2): 6057743800
ID (msg 4): GF05652178
DTC (msg 8): 30 (0x1e)
DTC (msg 8): 8 (0x08)
DTC (msg 10): 11 (0x0b)
DTC (msg 10): 68 (0x44)
DTC (msg 12): 12 (0x0c)
DTC (msg 12): 68 (0x44)
DTCs received: 3

First 3 lines are ECU IDs. Second line is the Alfa part number, third is probably code revision or serial number.

Trouble codes have 2 bytes: actual code and status. First code (30) is the warning light disconnected. Status of 8 shows that code is not currently active. Second code is the the left sensor, the third - the right.

After sensor/squib harness was connected and codes were reset, the tool reads:

ID (msg 0): B01AIRBAG
ID (msg 2): 6057743800
ID (msg 4): GF05652178
DTCs received: 0

And the warning light stays off!

I've also tested the tool in my 1995 164Q. It works, but I need to fix the steering wheel squib connection

So, now there is a way to troubleshoot airbag issues and reset codes in 94-95 164s without rare (and expensive) Marelli tester.

 

[Alfisto Steve]

Great info, thanks for posting.

 

[goats]

great job!

For the longest time I have been wanting to hook up a sniffer to the serial comm between the marelli tester and the airbag (and all the others for that matter) connector to determine the traffic between them. Long time ago I had access to a sniffer but no longer---

I think (but not sure) that the Marelli writes a command to flush the DTC buffer-- called 'write iso code' in the manual-- otherwise I think the code stays in diag and enables the flashing dash light?

Once you have this done then its easy to flash an EEPROM and make a kit!

bob

 

[sonny]

Reverse engineering

Great job, Goats. We need people with your expertise and dedication to keep our 164's running.

 

[goats]

Sonny Dimtry did it!

not Goats! Dimtry sounds like another one of us 'explorers'!

Don't you have expertise in sound systems? I recall I think many great posts by yourself as well...??

MC and HNY to all

 

[sonny]

Yes, Goats, of course, Dimtey was the one who did the reverse engineering! Sorry, Dimtey!

Yes, I was very much into car audio systems. I read everything I could get hold of and experimented. In my heyday (around 2000), just for the heck of it, I took a certificate for professional installers, called MECP. I was into the sound quality aspects, as opposed to "SPL".

Nowadays, with multiple kids, I usually have at least one of them traveling wherever I go, so conversation with them is my preferred form of in-car entertainment. If I listen to music, it is from CD's or our excellent local classical station...I haven't even gone to Ipod or MP3's.

 

[dimtey]

An update

Had to replace the clockspring to get the squib resistance in range. After that I was able to reset the code with my tool and the warning light is now off.

If people are interested in trying this out on their cars, let me know. I will be happy to supply the program and to help.

 

[goats]

Nice!!!!

way to go!

 

[onealfanut]

Air Bag light on

I also have the air bag light on in my '94 164LS after replacing the steering wheel due to issues with the clock spring and the air bag squib becoming detached. I have no idea if the air bag actually works and don't really want to find out. However, the air bag light being on does bother me.

[email protected]

'94 LS
'87 Quad
81 Delorean

 

[dimtey]

I also have the air bag light on in my '94 164LS after replacing the steering wheel due to issues with the clock spring and the air bag squib becoming detached. I have no idea if the air bag actually works and don't really want to find out. However, the air bag light being on does bother me.

If you are in San Francisco Bay Area you could swing by Otherwise you need a set of cables like these to connect to the 3-pin diagnostic connector. Once you have the cables I can provide the software to communicate to the ECU.

 

[onealfanut]

Air bag light

Thanks for the info, but where do I buy the cables? I'm in the greater Seattle area.

 

[dimtey]

Thanks for the info, but where do I buy the cables? I'm in the greater Seattle area.

I've built the cable myself, but the code should work with various off-the-shelf cables. I am working right now on locating good sources for compatible cables.

Here the price quoted is 55 euro for the cable set. I don't know if Sander still sells his cables, trying to find out.

I think it should be possible to come up with a cheaper cable setup, though.

 

[AlexGS]

Sorry if I'm missing something really obvious here, but... having made the ECU transmit the codes, does that reset/clear them as well?

I assume you have to send a particular byte (or several?) to start the transmission by the ECU that you showed us. I wonder how on earth you figured out what that byte was - brute force attack? And perhaps having found it, you'd rather keep it secret.

My 164s don't have airbags and I have the Alfadiag software/OBD2 cable that has communicated with the airbag ECU in my 156. But I was curious and just trying to understand in general how the process works for the interface you've made. Cheers!

-Alex

 

[dimtey]

Sorry if I'm missing something really obvious here, but... having made the ECU transmit the codes, does that reset/clear them as well?

Yes, the program I have right now can read and (optionally) clear the codes.

I assume you have to send a particular byte (or several?) to start the transmission by the ECU that you showed us. I wonder how on earth you figured out what that byte was - brute force attack? And perhaps having found it, you'd rather keep it secret.

No I am not trying to hide this. 164TD got me started by mentioning that existing kw71diag program starts communicating with the ECU, but gets an error. I found description of the protocol FIAT uses to talk to the ECUs (kw71diag can communicate with the Motronic ML1.7 ECU). Clearly the airbag ECU by Siemens followed a slightly different protocol. I hooked up the scope to the data lines and studied the response of the ECU to the initialization sequence. One sends the ECU address (0x80, courtesy of 164TD) and receives a response of 6 bytes at 4800 baud: 0x55, four keybytes, and a checksum. ECU was responding with the right sequence. Next the tester has to send the acknowledgment which in the FIAT protocol is specified as the complement of the third byte. This did not work for Siemens ECU - it repeated the 6-byte sequence three times and timed out. I started thinking what acknowledgment could be. Before I started going through all 255 combinations, I tried complements of each of the 6 bytes. As it turns out the ECU wants to see the complement of the last byte it sends (checksum).

Next I saw data from the ECU which corresponds to the three ID strings. Actually the ECU uses KW1271 protocol (used by BMW and others), but the initialization is a mix of KW1271 and FIAT protocol. Somewhat messy.

Error codes, however, conform to the FIAT format with the component code and the failure code.

 

[AlexGS]

One sends the ECU address (0x80, courtesy of 164TD) and receives a response of 6 bytes at 4800 baud: 0x55, four keybytes, and a checksum. ECU was responding with the right sequence. Next the tester has to send the acknowledgment

Thanks for that - interesting to learn how it works.

-Alex

 

[164TD]

The last month Dimtey and I tried to get my light out,(I'm a Windows addict and a Linux "noob"). With an extreme lot of effort and patience from Dimtey's side we didn't only made Dimtey's program work, but we also found a way that everyone would be able to reset the airbagmodule by himself.

Dimtey, a lot of thanks for your help and patience!

Arjen

 

[onealfanut]

Ait Bag Light Reset

HOW!!



Onealfanut

 

[dimtey]

HOW!!

164TD already has the necessary cables. I have located the USB OBD-II cable that works, but one also needs an adapter from OBD-II 16-pin connector to the 3-pin connector Alfa and Fiat used. I am getting parts to build a few adapters.

Right now the program to read out and reset codes is in a somewhat ugly shape. It runs under Linux from command line. I'd like to package it at least in a form where it does not require an expert to run it.

Right now I have very little time before an upcoming trip, so I probably will get to this in mid-February.

 

[ALFAHEIDA]

Great job you guys! Congratulations.

 

[Alfisto Steve]

HOW!!



Onealfanut

So what type model series and year is the kind of 164 do you have? That is a need to know bit of info when posting questions.