Reset adaptive values
- Thread starter Tammaru
- Start date
No. I was in the queue to buy it but didn't come up with the cash quickly enough. You got it instead.
Consequently I still have this stupid-idiotic-keep-the-idle-at-10000-rpm-even-though-the-TPS-is-present-and-working problem.
reset adaptive values
Send. 4 A3 23 48 0 12
Response 3 E3 23 48 51
That's what you're paying the dealer 100 bucks for. 6 bytes and an acknowledgement
The default obd2 init for elm327 isn't letting that work. I'll bust out the logic analyzer and see what it is. The elm manual says it can be changed from $33. If it works I think I remember enough java from my 2 semesters as a comp sci major to throw a shitty android app together with one button to reset adaptive values. Maybe a second button to pair with a new alarm unit
https://www.amazon.com/Version-Bluetooth-Multi-Language-12Kinds-Android/dp/B00N2K6M2A
Send. 4 A3 23 48 0 12
Response 3 E3 23 48 51
That's what you're paying the dealer 100 bucks for. 6 bytes and an acknowledgement
The default obd2 init for elm327 isn't letting that work. I'll bust out the logic analyzer and see what it is. The elm manual says it can be changed from $33. If it works I think I remember enough java from my 2 semesters as a comp sci major to throw a shitty android app together with one button to reset adaptive values. Maybe a second button to pair with a new alarm unit
https://www.amazon.com/Version-Bluetooth-Multi-Language-12Kinds-Android/dp/B00N2K6M2A
It would probably be easier to make a Torque (Android App) plug-in.
The Android Studio development environment is pretty nice. It simplifies putting apps together. I was reading the Torque plugin info today.
I understand there is a mode in the ELM327 that is read-only. Maybe toggling that would allow it to send to any PID?
I can get it to send whatever I want by changing the headers and keep alive message. It just doesn't get a response. Iso9141 is initialized by sending '33' at 5bps. The OE diagnostic stuff appears to be sending a different value based on some crude analysis, but I need to use different equipment to listen at that speed
It's amazing how much better these trucks can be after resetting the adaptive values (After doing appropriate repairs). It must have been Land Rovers way of forcing us to go to a shop.
so there is no 5 baud init required for a rover, but it looks like there is some kind of password seed/key generator required before doing anything worthwhile
4 reads. The top is boilerplate intialization as far as I can tell. Its a mix of send and responses. I can duplicate this and get these responses, its not until the ecu sends "4 67 1 XX XX XX" that it craps out. The first 2 XX are always different, and the last one is jus a checksum. The "4 27 2 XX XX XX" is the scan tool response. Its calculated based on the ECU message, but no idea on the formula. This will take some thinking
22 4 BF E8 DA 55 AA 55 AA 25 2 10 2 14 2 50 2 54 2 27 1 2A
4 67 1 EE BF 19
4 27 2 E6 ED 0
3 67 2 AA 16
4 A3 23 48 0 12
3 E3 23 48 51
22 4 BF E8 DA 55 AA 55 AA 25 2 10 2 14 2 50 2 54 2 27 1 2A
4 67 1 9C E9 F1
4 27 2 8 8B C0
3 67 2 AA 16
4 A3 23 48 0 12
3 E3 23 48 51
22 4 BF E8 DA 55 AA 55 AA 25 2 10 2 14 2 50 2 54 2 27 1 2A
4 67 1 82 1E C
4 27 2 CD BA B4
3 67 2 AA 16
4 A3 23 48 0 12
3 E3 23 48 51
3 22 4 BF E8 DA 55 AA 55 AA 25 2 10 2 14 2 50 2 54 2 27 1 2A
4 67 1 69 17 EC
4 27 2 E9 75 8B
3 67 2 AA 16
4 A3 23 48 0 12
3 E3 23 48 51
4 reads. The top is boilerplate intialization as far as I can tell. Its a mix of send and responses. I can duplicate this and get these responses, its not until the ecu sends "4 67 1 XX XX XX" that it craps out. The first 2 XX are always different, and the last one is jus a checksum. The "4 27 2 XX XX XX" is the scan tool response. Its calculated based on the ECU message, but no idea on the formula. This will take some thinking
22 4 BF E8 DA 55 AA 55 AA 25 2 10 2 14 2 50 2 54 2 27 1 2A
4 67 1 EE BF 19
4 27 2 E6 ED 0
3 67 2 AA 16
4 A3 23 48 0 12
3 E3 23 48 51
22 4 BF E8 DA 55 AA 55 AA 25 2 10 2 14 2 50 2 54 2 27 1 2A
4 67 1 9C E9 F1
4 27 2 8 8B C0
3 67 2 AA 16
4 A3 23 48 0 12
3 E3 23 48 51
22 4 BF E8 DA 55 AA 55 AA 25 2 10 2 14 2 50 2 54 2 27 1 2A
4 67 1 82 1E C
4 27 2 CD BA B4
3 67 2 AA 16
4 A3 23 48 0 12
3 E3 23 48 51
3 22 4 BF E8 DA 55 AA 55 AA 25 2 10 2 14 2 50 2 54 2 27 1 2A
4 67 1 69 17 EC
4 27 2 E9 75 8B
3 67 2 AA 16
4 A3 23 48 0 12
3 E3 23 48 51
It appears 3 encoded bytes stand between us and reset freedom. I took a look at it, but haven't been able to determine the coding method yet.
Excuse my ignorance, but are the adaptive values a GEMs thing, or is it active in the 14CUX system as well?
Calculating all possible values then correlate to the values in the trace you took?