Login Register

Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
how to communicate Kia Pride 20pin Diagnustig connector
#11
Hi A gain
Excuse me update this page
It occurred to me A few cases .
I see this page http://www.fixkick.com/ELM327/taurus-sim...ml#allcode

i have A Arduino UNO . Can i use this for Communicate to my car ecu ? also i find this shield http://sigalabs.com/projects/vehicle-obd...tn1110-ic/

Do you think this obd Shield work my care?

Can i use oscilloscope and connect prop to pin 19 or L-line Connector and see signal and frequency . for help to know witch protocol work my care?
also i have original eprom file for this ecu . Can this file help for know protocol?
Reply
#12
STILL NO TAGS POSTED
http://www.fixkick.com
Reply
#13
(11-20-2015, 09:54 AM)fixkick Wrote: no, that page is all OBD2.
sorry.
only KIA/Hyundai knows this,

the eprom can be disassembled to machine code.
then reverse engineered, a man/ years work. there.

i bet flash codes work but the lamp is missing in the car, so says the schematics.
id try go get flash codes working first.

thank's

i do the flash cod From this http://www.troublecodes.net/Kia
this work well on my care
Dear fixkick : i think to try go interface MAKER in here and request help them . if them help me !!!
what do you think . Can i use logic analyzer for see signal and know protocol ?
i see the arduino Forum . here https://forum.arduino.cc/index.php?topic=236092.0
post 2 : answer from robtillaart : you need a logic analyzer to determine the baudrate and to see the data.
Reply
#14
HACKING 101, omg, what a complex topic.... /?
ok, i can comment on general practices, OBD1. (again there are no OBD1 standards) but there USA OBD2, JOBD (Japan) and EOBD (Europe
not knowing which of the 4 it might be, makes this job , complex to vast degree, (OBD2 has 4 class inputs , ISO, etc)

the connection (communications) are usually serial. (modified bi-directional too)
and are usually 1 pin only, (before OBD2 , 1 line is common,)
that means its a bidirectional serial line. (unlike most computers on earth, but sames the car maker copper wire , cheap skates they are.....)
So who to communicate.
that means you send a command , and wait a fixed time (no handshaking used, just waits)
the serial line is Asynchronous, (means very exact timings, used or you get, Framing errors. (into ECU )
so the first step is to learn the serial rates, (ill assume levels are good now,,, oops?)
there is a start bit, and at least one stop bit. and 7 or 8 bits of data. (note the variances here possible)
so, this one line has a Transmitter and receiver in the ECU. (and so do you at your end)
the ECU transmitter is usually quiet, until you ask it a question (a command.) keep in mind ECU quite for garbage commands is good, keeping transmission noise to a minimum. (but who knows, there is no standards here,period, they did as the chose )
so there is nothing at all to see. just putting a scope or (logic analyzer ) (its quite now) (the are exceptions, some cars send data full time never ending,broad caste)
that means you get to guess, the many possible baud-rates, it might use, and and 1 start bit, and 2 stop bits and guess baud.
but wait, the ECU will ignore, illegal framed transmissions to its receiver. (in most cases , the UART frame error pin is ignored)
not only that, many ECU do not respond at all until you send it the proper, vehicle type number, (this wakes it up) The secret code...
usually your transmitter will be TTL signals, going out. and the response can be TTL or weaker. 0 to 4v.
may ECU send back illegal TTL levels, weak. (like ours) and takes a well designed receiver to recieve this weak single, (0urs is 1.2v for logical 1)

It's not like mainframe computer or some (name one) brand of computer. with real RS-232C and real ASCII communications. at all.
(in fact the only commonality is the core UART , design)
in that case we send 12v signals and all transmissions are responded to, with legit responses or and error codes or just a carriage return transmission.
in the case of ECU there is only 1 wire. not 2. RX/TX on one wire.
point 2 is that there is no STANDARD for one wire serial comms. used on ECUs.

The problem is knowing the transmitted (by you) commands in advance,
so how was this done. (one solution easy)
well, we take a real scan tool "tech1"? and connect our scope and see the baud rate. (we measure it)
then we take or "communications analyzer", (yes, they make those or you can make one using a real PC with Rs232 ports and 2wire to 1 wire converter.)

we then capture the live transmissions from the real scan tool !, to see all commands (rx/tx), and preamble codes,etc (wake up commands) to the ECU
and see all responses.. !
the responses are not a standard, and are complex, all you see is ASCII, or simple hex data. but what does it mean.?
well with a scan tool real , you know what was asked, say i scanned ECT , then you get back and answer and decode that the hard way.
I won't go beyond hard way, for each sensor, and PID.
ill say most are a voltage and using ohms law we get 1/2 the answer, R= E/I
the R value resistance is in a table (we make it) and it returns temperature....
To solve this you have to know the ECU pull up resistor value on the ECT pin, (hardware) also a secret i can find using my meter, and popping the ecu lid.

how is that>>?
IMHO:
i'd not do that, i'd , find what scan tool works with your car and buy one used.
or live with flash codes.
but no lie, hacking ECUs is fun,,,, great for late night insomniacs like me... (was)

This is been done on all Honda's. and many Toyota's (they race them and add Turbo)
but who does this on kia, ( nobody.....?)

my dead files (hacking) is here.
http://www.fixkick.com/hacking/hacked/ad...acked.html


our baud rate was found to be
Baud: 15625 N,8,1 serial parameters.

all serial computer folks know what that means.

N = no parity bit. 1 stop bit , 8 bits data framed with 1 start and 1 stop bit.

and some UARTS JUST HATE the baud rate. (30 years worth until year 2000)
in fact most do, old.
the modern one (USB virtual UART) has no trouble at all...

it's like fishing , blindfolded.
you drop the line (serial tx)
the line drops, and something bites and catches. (RX) (if lucky)
the line comes up, the fisher man, he is blindfolded.
but can feel the object, only,... touching it, scared.(lol)
it's slimy? or is at an old license plate or shoe? no it wiggles strongly...
it's alive (might be real data) but what is this?,,, i've no clue. it's impossible... shark or bass. or crab., or?
YMMV , our your fish may vary.... good luck.

not knowing the commands in advance, is like fishing every lake there is to find a specific fish type. and endless process.
but you could send all command possible, and see which hit (easy to do on any computer made,using a "FOR" loop)
0000 to FFFF (hex)
65k possible with 2byte command fields... some well be error codes, (if true) and makes this insanely impossible task to discover that.
http://www.fixkick.com
Reply
#15
oh . my god
this This description is very high
But my English is not good

Dear fixkick : You say on the first post : my car is 1 line i bet., this takes a special driver to make that work. very special. (bidirectional mode)
Do you mean of 1 line is 1-wire protocol of Dallas Semiconductor Corp ?

this is true?
[img=http://img.overpic.net/thumbs/l/p/8/xlp85qvig9vmiksx10lp2_s.jpg]
Reply
#16
that is just on ONE upsmanship from I2C. (a modern design that MAXIM is,,, ) look at 1990's through , 2015 eyes, this is not possible.
for sure has nothing to do with any 90s' designs
you forget to read my statement, obd1 is not a standard at all, each and every ECU maker, did what every they pleased (car maker the dictator)
there is no standard here... (its not OBD2 , JOBD or EOBD, it it was then yes, it is a standard, AND WAS THE PURPOSE TO DO THAT in 1996, (we invented that)

but INSIDE< KIA, if you worked there, this proprietary (secret) is at your hands. you are not there, so you can not look. nor can I, ($4000 is the charge for most car makers to see these docs, ive asked them.)

you need a book as thick as your arm to know how this works.
the signing levels. (my guess , poor TTL levels or worse)
the data transmissions and methods.
the baud rates.
the framing structures.
the handshaking rules. (if not only a delay , like back when, the XON/.OFF method,, used on DEC VT100s and other main frame systems.,
the the command set, how would you ever learn that ? (there is no way to guess, even if you land on something , what is that something, good luck there.)
and the analog to a/d conversion factors... and tables for that. in side the ECU hidden from you.

OBD1 sends out analog levels in HEX (A/D counts) (direct read off sensors with no conversions done)
OBD2, sends out temperatures, or air flows, or % throttle or o2 %. so we dont have to guess this.... its in real physics output, (a goal tool then)

see?

why not try to find a scan tool that matches your car.?
surely you can find one in your country or a near by country that uses the same car. same engine, same ECU.
try to understand that the ECU does not just hook up and print out a page of text with live data. (if i was in charge, yes, that would happen!)

this will not ever happen on any 90s car. not even on my 2010 car.
on old cars its better tto replace the ECU with a custom ECU, now you have everything at hand and zero secrets..... per below... open source products.

buy it , connect it (not trivial) tune it , no more factory EFI. no more OBD1. gone ended. (not to mention the learning values)

http://www.msextra.com/product-range/ms3-pro/

not too many folks racing KIA's !
nor replacing ECUs to do so, that means the long long road to success... (zero help. and zero sharing of tuning tables.)
http://www.fixkick.com
Reply
#17
. ok
i find Scan tools match my care in here . But is very expensive
this
http://rayankhodro.ir/ProductDetails.aspx?prodId=446
and this
http://rayankhodro.ir/ProductDetails.aspx?prodId=445
and this
http://rayankhodro.ir/ProductDetails.aspx?prodId=643

But not Worth buying for just my car
i try go to the this Factory . may be help me
thank you
Reply
#18
that is one of the reasons we invented OBD2, so the cost to make them dirt cheap.
after all 1 tool fits all cars. here. see? just 1 tool works... ( i have one that does that and air bags and ABS all in one for $150)
so with economies of scale make that dirt cheap, as cheap as $10 (elm327 FIY)
sure its not worth that to fix any 90s car.
that is why we rent tools or find a shop that has them.
there is no other ways.... (beyond the easy flash codes)
would you spend 500 hours labor , to reverse engineer a ECU? why?

I just paid $80 to program 1 , jeep key. (locksmith price) the dealer is more.

better yet get a car with OBD2/JOBD, or EOBD, and win.,...
or find used tools.
but i dont see to many for KIA.
there are very few 90s KIA on the road here..

very few sold and still running... this old....
In 1992, Kia Motors America was incorporated in the United States.
The first Kia-branded vehicles in the United States were sold from four dealerships in Portland, Oregon in February 1994
http://www.fixkick.com
Reply
#19
Hi
dear fixkick
I noticed something :
when select pride kia 1999 and 2000 model on the cascade software . on the ft232RL pin tx reaction show
i try see the signal from the rx pin . for this . i do connect tx pin from ft232 to digital pin on adruino uno and upload this code to arduino
http://xoscillo.googlecode.com/files/XOs...0515v9.rar
and run xoscillo on desktop
i see this signal
   
The first time I tested the car
Reply
#20
time base too slow. need more data, need more pulses...
what voltages is that? where is the scaling? what is the volts /division?
what time base is that, what is the time/division.

all that shows is a simple square wave.
what it comes from , or what it might be, is any ones guess.

rs232 is like in music the name syncopated,, or a'rithmic,.

start pulse, data1... data2...3,4,5,6,7,9, stop stop.
there will be data missing (unless all FF hex data)
for example the letter "A" is 41hex.
0100-0001 (binary.)
the serial data would look just like that, if the letter "A" was sent.
this is how serial comms work.

https://en.wikipedia.org/wiki/Universal_...ransmitter


lets say, you decode the data, and saved it.
the data is useless to you.
you do not know what it is.

the only way to do this, as stated above, is to use a real working scan tool and monitor it.
reverse engineer all that.... months work.

(send a command for the scan ECT)
the capture the full Rx/TX responses.

you learn levels. (using a real scope)!
you learn the command out (your tx) structure and command set.
you learn the response to your RX (obd1 is voltage in many cases) eg, ECT volatage 0.65v = 180F water temp (ours)
repeat for every scan-able parameter of the working scan tool.
http://www.fixkick.com
Reply


Forum Jump:


Users browsing this thread: 2 Guest(s)