Alfa Romeo Forums banner
1 - 13 of 13 Posts

·
Registered
Joined
·
28 Posts
Discussion Starter · #1 ·
Hello,

From the title this might seem like another post asking for help :) Well, it is a bit different this time!

I have reverse-engineered the communication protocol for the Siemens ECU used in 94-95 164s (60577438 and 60585472). I've put together a tool (under Linux) that works with a home-made RS-232 to ISO9141 adapter. It can read out and reset airbag DTCs (diagnostic trouble codes).

I have a spare '94 airbag ECU which I have used for reverse-engineering the protocol and the codes. I have a little harness simulating sensors and the squib, as well as the warning light. Disconnecting pieces of it I obtained all code definitions.

Here is the output of the tool when I first got DTC readout (no harness connected, just power and warning light):

ID (msg 0): B01AIRBAG
ID (msg 2): 6057743800
ID (msg 4): GF05652178
DTC (msg 8): 30 (0x1e)
DTC (msg 8): 8 (0x08)
DTC (msg 10): 11 (0x0b)
DTC (msg 10): 68 (0x44)
DTC (msg 12): 12 (0x0c)
DTC (msg 12): 68 (0x44)
DTCs received: 3

First 3 lines are ECU IDs. Second line is the Alfa part number, third is probably code revision or serial number.

Trouble codes have 2 bytes: actual code and status. First code (30) is the warning light disconnected. Status of 8 shows that code is not currently active. Second code is the the left sensor, the third - the right.

After sensor/squib harness was connected and codes were reset, the tool reads:

ID (msg 0): B01AIRBAG
ID (msg 2): 6057743800
ID (msg 4): GF05652178
DTCs received: 0

And the warning light stays off!

I've also tested the tool in my 1995 164Q. It works, but I need to fix the steering wheel squib connection :(

So, now there is a way to troubleshoot airbag issues and reset codes in 94-95 164s without rare (and expensive) Marelli tester.
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #7 ·
An update

Had to replace the clockspring to get the squib resistance in range. After that I was able to reset the code with my tool and the warning light is now off.

If people are interested in trying this out on their cars, let me know. I will be happy to supply the program and to help.
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #10 ·
I also have the air bag light on in my '94 164LS after replacing the steering wheel due to issues with the clock spring and the air bag squib becoming detached. I have no idea if the air bag actually works and don't really want to find out. However, the air bag light being on does bother me.

If you are in San Francisco Bay Area you could swing by :) Otherwise you need a set of cables like these to connect to the 3-pin diagnostic connector. Once you have the cables I can provide the software to communicate to the ECU.
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #12 ·
Thanks for the info, but where do I buy the cables? I'm in the greater Seattle area.
I've built the cable myself, but the code should work with various off-the-shelf cables. I am working right now on locating good sources for compatible cables.

Here the price quoted is 55 euro for the cable set. I don't know if Sander still sells his cables, trying to find out.

I think it should be possible to come up with a cheaper cable setup, though.
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #14 ·
Sorry if I'm missing something really obvious here, but... having made the ECU transmit the codes, does that reset/clear them as well?
Yes, the program I have right now can read and (optionally) clear the codes.

I assume you have to send a particular byte (or several?) to start the transmission by the ECU that you showed us. I wonder how on earth you figured out what that byte was - brute force attack? :) And perhaps having found it, you'd rather keep it secret.
No I am not trying to hide this. 164TD got me started by mentioning that existing kw71diag program starts communicating with the ECU, but gets an error. I found description of the protocol FIAT uses to talk to the ECUs (kw71diag can communicate with the Motronic ML1.7 ECU). Clearly the airbag ECU by Siemens followed a slightly different protocol. I hooked up the scope to the data lines and studied the response of the ECU to the initialization sequence. One sends the ECU address (0x80, courtesy of 164TD) and receives a response of 6 bytes at 4800 baud: 0x55, four keybytes, and a checksum. ECU was responding with the right sequence. Next the tester has to send the acknowledgment which in the FIAT protocol is specified as the complement of the third byte. This did not work for Siemens ECU - it repeated the 6-byte sequence three times and timed out. I started thinking what acknowledgment could be. Before I started going through all 255 combinations, I tried complements of each of the 6 bytes. As it turns out the ECU wants to see the complement of the last byte it sends (checksum).

Next I saw data from the ECU which corresponds to the three ID strings. Actually the ECU uses KW1271 protocol (used by BMW and others), but the initialization is a mix of KW1271 and FIAT protocol. Somewhat messy.

Error codes, however, conform to the FIAT format with the component code and the failure code.
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #18 ·
164TD already has the necessary cables. I have located the USB OBD-II cable that works, but one also needs an adapter from OBD-II 16-pin connector to the 3-pin connector Alfa and Fiat used. I am getting parts to build a few adapters.

Right now the program to read out and reset codes is in a somewhat ugly shape. It runs under Linux from command line. I'd like to package it at least in a form where it does not require an expert to run it.

Right now I have very little time before an upcoming trip, so I probably will get to this in mid-February.
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #25 ·
I will make a "resetting your airbaglight for dummies" for use with the 164bag program Dimtey made.
Dimtey guided me through the program step by step since it isn't exactly plug and play.
Hopefully in the next month I will make the program a bit more user friendly (Windows?), but I won't have time to work on it till mid-February.

Did you also ordered the second cable?
I am making a few OBD-II to 3-pin Fiat/Alfa adapters. So I will either sell or lend one to onealfanut.
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #31 ·
Just wanted to report that thanks to Dmitry's (Dimtey) software and Arjen's (164TD) guidance, I was able to successfully reset the airbag light on my '94LS (and with a Mac, no less)! Took me less than 15 minutes and this was my first time using Linux. I'd be happy to lend out the cables if the borrower covers the postage (although they only cost about $20 total on eBay).
Congratulations! Just out of curiosity, do you remember which code(s) you had?
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #33 ·
Yes, I have the print-out: DTC (msg 8): 20 (0x14) and DTC (msg 8): 6 (0x06). Are these ones that are likely to repeat?
First byte (0x14) is the system code. Unfortunately in my bench tests where I simulated different sensors and squibs failing I have never seen this code. Here is the list I put together:

0x0a Sensor signal/power fault
0x0b Left-hand sensor
0x0c Right-hand sensor
0x1e Warning light
0x15 Steering wheel squib
0x16 Passenger side A squib
0x17 Passenger side B squib

So 0x14 is near the 0x15/0x16/0x17 group, but unclear what device this is.

Second byte seems to follow the table in the Fiat-9141 document. Error type is the least significant 5 bits of the second byte. Bit 6 set to 1 means "error present". When bit 6 is zero, error is not present.

01 Open circuit
02 Short to ground
03 Short to battery
04 Open circuit/short to ground
05 Open circuit/short to battery
06 Too low value
07 Too high value
08 Constant value
09 Plausibility

Typical second byte codes are 0x44 (open circuit/short to ground, currently
present). If the problem is fixed, the code changes to 0x04.

So 0x06 is "too low value, not currently present". Not currently present part is obvious - if it was 0x46, it would get set again after reset.
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #39 ·
Hello Brian,

Is this cable set and software arrangement useful in anyway on a non LS car?

I have a '93 164S and was wondering if this could be of use to me?
My software is only useful to communicate to airbag controllers on 94-95 164s. However the same cable set can be used to interrogate the ECU on the 91-93 164s. I've used Unidiag software to monitor ECU parameters in real time.
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #40 ·
Jason,

Update: 6 weeks after I posted the previous message, my wife was in a bad accident but came out with nothing more than a bloody noise. Both air bags deployed, drivers door jammed shut, roof buckled.
I am glad that your wife was not hurt. And it is a pleasure to think that the software has actual utility beyond simply turning off the annoying light.
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #65 ·
Richard,

My airbag light came on after the car had stood for a few months while replacing heater matrix and starter motor. If I replace the airbag CPU will this be enough to reset things?

Richard
1995 164 3.0 24v
I'd suggest reading out the codes and trying to reset them first. I can help you with my program. There is also another tool that has been developed by wilco3006 that is capable of reading out airbag ECU codes.
 

·
Registered
Joined
·
28 Posts
Discussion Starter · #67 ·
Hi Richard,

Have seen the other airbag CPU working fine in its car. It is being scrapped so CPU and all parts available. Can I not just unplug it from this 164 and put it in mine? Seems a great opportunity.
If the airbag hardware is fully intact in your car (sensors, squibs, etc.), then a working ECU with no codes set should work well. If, however, there is some issue in the system (intermittent connection, high squib resistance), the new ECU will set a code and turn on the warning light.

Regards,
Dmitry
 
1 - 13 of 13 Posts
This is an older thread, you may not receive a response, and could be reviving an old thread. Please consider creating a new thread.
Top