Alfa Romeo Forums banner

94-95 airbag reset

39K views 107 replies 29 participants last post by  taco  
#1 ·
Hello,

From the title this might seem like another post asking for help :) Well, it is a bit different this time!

I have reverse-engineered the communication protocol for the Siemens ECU used in 94-95 164s (60577438 and 60585472). I've put together a tool (under Linux) that works with a home-made RS-232 to ISO9141 adapter. It can read out and reset airbag DTCs (diagnostic trouble codes).

I have a spare '94 airbag ECU which I have used for reverse-engineering the protocol and the codes. I have a little harness simulating sensors and the squib, as well as the warning light. Disconnecting pieces of it I obtained all code definitions.

Here is the output of the tool when I first got DTC readout (no harness connected, just power and warning light):

ID (msg 0): B01AIRBAG
ID (msg 2): 6057743800
ID (msg 4): GF05652178
DTC (msg 8): 30 (0x1e)
DTC (msg 8): 8 (0x08)
DTC (msg 10): 11 (0x0b)
DTC (msg 10): 68 (0x44)
DTC (msg 12): 12 (0x0c)
DTC (msg 12): 68 (0x44)
DTCs received: 3

First 3 lines are ECU IDs. Second line is the Alfa part number, third is probably code revision or serial number.

Trouble codes have 2 bytes: actual code and status. First code (30) is the warning light disconnected. Status of 8 shows that code is not currently active. Second code is the the left sensor, the third - the right.

After sensor/squib harness was connected and codes were reset, the tool reads:

ID (msg 0): B01AIRBAG
ID (msg 2): 6057743800
ID (msg 4): GF05652178
DTCs received: 0

And the warning light stays off!

I've also tested the tool in my 1995 164Q. It works, but I need to fix the steering wheel squib connection :(

So, now there is a way to troubleshoot airbag issues and reset codes in 94-95 164s without rare (and expensive) Marelli tester.
 
#3 ·
great job!

For the longest time I have been wanting to hook up a sniffer to the serial comm between the marelli tester and the airbag (and all the others for that matter) connector to determine the traffic between them. Long time ago I had access to a sniffer but no longer---

I think (but not sure) that the Marelli writes a command to flush the DTC buffer-- called 'write iso code' in the manual-- otherwise I think the code stays in diag and enables the flashing dash light?

Once you have this done then its easy to flash an EEPROM and make a kit!

bob
 
#5 ·
Sonny Dimtry did it!

not Goats! Dimtry sounds like another one of us 'explorers'!

Don't you have expertise in sound systems? I recall I think many great posts by yourself as well...??

MC and HNY to all
 
#6 ·
Yes, Goats, of course, Dimtey was the one who did the reverse engineering! Sorry, Dimtey!

Yes, I was very much into car audio systems. I read everything I could get hold of and experimented. In my heyday (around 2000), just for the heck of it, I took a certificate for professional installers, called MECP. I was into the sound quality aspects, as opposed to "SPL".

Nowadays, with multiple kids, I usually have at least one of them traveling wherever I go, so conversation with them is my preferred form of in-car entertainment. If I listen to music, it is from CD's or our excellent local classical station...I haven't even gone to Ipod or MP3's.
 
#7 ·
An update

Had to replace the clockspring to get the squib resistance in range. After that I was able to reset the code with my tool and the warning light is now off.

If people are interested in trying this out on their cars, let me know. I will be happy to supply the program and to help.
 
#10 ·
I also have the air bag light on in my '94 164LS after replacing the steering wheel due to issues with the clock spring and the air bag squib becoming detached. I have no idea if the air bag actually works and don't really want to find out. However, the air bag light being on does bother me.

If you are in San Francisco Bay Area you could swing by :) Otherwise you need a set of cables like these to connect to the 3-pin diagnostic connector. Once you have the cables I can provide the software to communicate to the ECU.
 
#12 ·
Thanks for the info, but where do I buy the cables? I'm in the greater Seattle area.
I've built the cable myself, but the code should work with various off-the-shelf cables. I am working right now on locating good sources for compatible cables.

Here the price quoted is 55 euro for the cable set. I don't know if Sander still sells his cables, trying to find out.

I think it should be possible to come up with a cheaper cable setup, though.
 
#13 ·
Sorry if I'm missing something really obvious here, but... having made the ECU transmit the codes, does that reset/clear them as well?

I assume you have to send a particular byte (or several?) to start the transmission by the ECU that you showed us. I wonder how on earth you figured out what that byte was - brute force attack? :) And perhaps having found it, you'd rather keep it secret.

My 164s don't have airbags and I have the Alfadiag software/OBD2 cable that has communicated with the airbag ECU in my 156. But I was curious and just trying to understand in general how the process works for the interface you've made. Cheers!

-Alex
 
#14 ·
Sorry if I'm missing something really obvious here, but... having made the ECU transmit the codes, does that reset/clear them as well?
Yes, the program I have right now can read and (optionally) clear the codes.

I assume you have to send a particular byte (or several?) to start the transmission by the ECU that you showed us. I wonder how on earth you figured out what that byte was - brute force attack? :) And perhaps having found it, you'd rather keep it secret.
No I am not trying to hide this. 164TD got me started by mentioning that existing kw71diag program starts communicating with the ECU, but gets an error. I found description of the protocol FIAT uses to talk to the ECUs (kw71diag can communicate with the Motronic ML1.7 ECU). Clearly the airbag ECU by Siemens followed a slightly different protocol. I hooked up the scope to the data lines and studied the response of the ECU to the initialization sequence. One sends the ECU address (0x80, courtesy of 164TD) and receives a response of 6 bytes at 4800 baud: 0x55, four keybytes, and a checksum. ECU was responding with the right sequence. Next the tester has to send the acknowledgment which in the FIAT protocol is specified as the complement of the third byte. This did not work for Siemens ECU - it repeated the 6-byte sequence three times and timed out. I started thinking what acknowledgment could be. Before I started going through all 255 combinations, I tried complements of each of the 6 bytes. As it turns out the ECU wants to see the complement of the last byte it sends (checksum).

Next I saw data from the ECU which corresponds to the three ID strings. Actually the ECU uses KW1271 protocol (used by BMW and others), but the initialization is a mix of KW1271 and FIAT protocol. Somewhat messy.

Error codes, however, conform to the FIAT format with the component code and the failure code.
 
#16 · (Edited)
The last month Dimtey and I tried to get my light out,(I'm a Windows addict and a Linux "noob"). With an extreme lot of effort and patience from Dimtey's side we didn't only made Dimtey's program work, but we also found a way that everyone would be able to reset the airbagmodule by himself.

Dimtey, a lot of thanks for your help and patience!

Arjen
 
#18 ·
164TD already has the necessary cables. I have located the USB OBD-II cable that works, but one also needs an adapter from OBD-II 16-pin connector to the 3-pin connector Alfa and Fiat used. I am getting parts to build a few adapters.

Right now the program to read out and reset codes is in a somewhat ugly shape. It runs under Linux from command line. I'd like to package it at least in a form where it does not require an expert to run it.

Right now I have very little time before an upcoming trip, so I probably will get to this in mid-February.
 
#22 ·
That one will work!

If you have a laptop with USB port, hi speed internet to download Ubuntu(a Linux operating system) a provision to burn Ubuntu on a CD rom, all you need is a USB to OBD cable(FDTI chipset based) and, if you want to do it fancy, you should get yourself a OBD to Fiat/Alfa 3 pin testconnector.(otherwise you have to fiddle a little bit with a selfmade 4 wire cable.)

The good thing about this testcables is that you will be able to read out faultcodes, read out realtime data and reset faultcodes of your ML1.7 Motronic system with Unidiag.

More info about Unidiag and the 164 can be found here.

Alfa Romeo 164 Register
 
#25 ·
I will make a "resetting your airbaglight for dummies" for use with the 164bag program Dimtey made.
Dimtey guided me through the program step by step since it isn't exactly plug and play.
Hopefully in the next month I will make the program a bit more user friendly (Windows?), but I won't have time to work on it till mid-February.

Did you also ordered the second cable?
I am making a few OBD-II to 3-pin Fiat/Alfa adapters. So I will either sell or lend one to onealfanut.
 
#27 ·
Although DemTey's program is free, it's worth every penny!

Yesterday I did a reset on the airbaylight of the Q4.First I had to installl the two bulbs, already removed by the previous owner and indeed it was flashing.Again the reset went flawless, childsplay!(once you kown what you have to do ofcourse.)
Faultcode was 30 and not present, same as the other one.

Which of the cables do you have?
If you have the USB to OBD cable and you're a litle bit handy with cables, the light could be out before nightfall.
 
#29 · (Edited)
Ok, first you have to download the live CD of Ubuntu.
Burn it on a CD rom (slow speed, you don't want to have any failures on the CD rom)

Downloading it, can be done here:

Download Ubuntu | Ubuntu

Now we have to take the biggest hurdle; getting from OBD to your ECU.Having the OBD to Alfatestconnector makes life much easier and can be of greater joy as well when you start to go into the motronic ECU with Unidiag which is using the same interface cables.

Grab the airbagtestcable from behind the RH footwellcarpet.It could be, never been used before, that it is still tight up to the rearside of the dasboard.

Image


The connector has 3 wires; black is ground, white/red is K line and lightblue/white is L line.

Now you have to hook up each of those 3 wires to the OBD connector and add a 12V from your car as well.
When you have the 12V and the ground connected, the LED on the interface should light up.

Image


On the OBD connector, the pinout is as follows:

5-ground (4 might need a ground as well, the pinout says chassis ground, just in case)
7-K-line
15-L-Line
16-12V from the car

Copy 164bag program to a USB drive (Sent to you by mail; courtesy of Dimtey)

Now put your LiveCD into your laptop and let it startup; your computer will now startup from the live CD and bring you into a Linux environment.

Insert USB drive - Linux should notify you that new device is added.

Open the USB drive and copy 164bag to the desktop.

Open a terminal (console);"Applications">"Accessoiries" then select "Terminal"

Use command "cd Desktop" (Note the capital D!) in the terminal

Run "chmod +x 164bag.dat" to make it executable (spaces after chmod and +x)

Connect diagnostic cable and turn igition to on.

Run command "dmesg" - it should output a lot of stuff, last few
lines should say that FTDI serial device is detected and list its
device name, something like /dev/ttyUSB0

Run "sudo ./164bag.dat 0x80" (spaces after sudo and dat)

sometimes the first attempt fails, but then it will come up with something like this:

ID (msg 0): B01AIRBAG
ID (msg 2): 6057743800
ID (msg 4): GF05652178
DTC (msg 8): 30 (0x1e)
DTC (msg 8): 8 (0x08)

DTCs received: 1

Most likely your faultcode is 30 and the status is 8.

Now run

sudo ./164bag.dat -c 0x80

and the light will stop flashing and extinguish!


All credits for the above are going to Dimtey !!

I already resetted 3 airbagECU's all with faultcode 30 and status 8*

* 30 means "lights/instrumentpanel was disconnected; status 8 means "not present anymore"
 
#30 ·
Just wanted to report that thanks to Dmitry's (Dimtey) software and Arjen's (164TD) guidance, I was able to successfully reset the airbag light on my '94LS (and with a Mac, no less)! Took me less than 15 minutes and this was my first time using Linux. I'd be happy to lend out the cables if the borrower covers the postage (although they only cost about $20 total on eBay).
 
#33 ·
First byte (0x14) is the system code. Unfortunately in my bench tests where I simulated different sensors and squibs failing I have never seen this code. Here is the list I put together:

0x0a Sensor signal/power fault
0x0b Left-hand sensor
0x0c Right-hand sensor
0x1e Warning light
0x15 Steering wheel squib
0x16 Passenger side A squib
0x17 Passenger side B squib

So 0x14 is near the 0x15/0x16/0x17 group, but unclear what device this is.

Second byte seems to follow the table in the Fiat-9141 document. Error type is the least significant 5 bits of the second byte. Bit 6 set to 1 means "error present". When bit 6 is zero, error is not present.

01 Open circuit
02 Short to ground
03 Short to battery
04 Open circuit/short to ground
05 Open circuit/short to battery
06 Too low value
07 Too high value
08 Constant value
09 Plausibility

Typical second byte codes are 0x44 (open circuit/short to ground, currently
present). If the problem is fixed, the code changes to 0x04.

So 0x06 is "too low value, not currently present". Not currently present part is obvious - if it was 0x46, it would get set again after reset.
 
#34 ·
Just wanted to report that I too was successful resetting the airbag light in my 95 LS. Thanks very much, Dmitry, for you help.

For anyone looking for the necessary cables, there are lots on ebay right now that connect to the Fiat connector on the 164. Just search for "fiat obd cable" for the cable that connects to the car, and "usb obd cable" for the cable that connects to the computer. I got both of mine from seller gogotopdigi for less than $20 including shipping. For example, items 300469073674 and 290476570426.

Jason
San Jose, CA
 
#35 ·
Update: 6 weeks after I posted the previous message, my wife was in a bad accident but came out with nothing more than a bloody noise. Both air bags deployed, drivers door jammed shut, roof buckled. I'm sure glad that Dmitry figured out how to read the air bag codes and shared what he learned, and that I didn't wait long to fix the clockspring that had thrown the code. So the car is totalled (although I bought it back for parts....I had just spent $8k on the engine seals, clutch, steering rack, timing belt, etc and fortunately all that stuff survived). Good news is we bought a new 94LS which is even nicer than the old one. First thing I did to that one within 12 hours of buying it was resetting the air bag light.....

Jason
San Jose, CA
 
#40 ·
Jason,

Update: 6 weeks after I posted the previous message, my wife was in a bad accident but came out with nothing more than a bloody noise. Both air bags deployed, drivers door jammed shut, roof buckled.
I am glad that your wife was not hurt. And it is a pleasure to think that the software has actual utility beyond simply turning off the annoying light.