[Malafax_dand]

paul,

I have not tried running each sucessive HEX command one at a time immediately after powerup. I will put that on the list of things to do.

I obviously have everything in your list except the rov@com/diagnostic unit. I have had several personal messages about the rov@com but still nothing has panned out fully. Partially my fault and partially not.

Several people have stated that the PBDII passthrough cable is out of stock at http://www.OBD2Cables.com. The supplier promises that there will be more very soon.

I have decided last night right before I drifted off to sleep, that I am going to hide an extra laptop behind the drivers seat and have the Stealer unlock my EAS. In the earliest version of all this I tapped directly into the EAS C117 plug for my serial connection and ran the cable to the back seat foot well. I am going to pay the 45 dollars at the dealer and record the conversation.

I was hoping that this thread would encourage dozens of people to get out their laptop and OBD2 cable and start tinkering away. So far there have only been about 7 primary reoccuring people who have shown interest. So come on get out there and start playing with the EAS.

 

[NorCal RR]

Storey,

Just so you know, I have been following your thread with great interest. I have not posted because you guys are way over my head with your electronics knowledge. I am very interested in an interface that would reset the EAS ECU since this remains the part of the EAS system that I can't sort out myself (with Rover Renovations assistance of course).
The one thing I do have that might be of assistance to you is an OBD to USB cable. I have a Ross Tech dongle and software package for my Audi also reads basic OBD info of the Rover (but not EAS). If this can be of assistance in any way, I can loan it to you.
But the main purpose of my post is to let you know that the interest level is probably much higher than the 7 active posters to your thread. We are just quietly reading the posts in awe of your determination and hoping you figure it out.

 

[BargePilot]

I too am following this with great interest. I am still looking for a (more or less) local supplier of OBD2 connectors. I'd love to strike up a conversation with my EAS. I have no access to a Rovacom or Testbook. Alas.

 

[paul.adshead]

I have decided last night right before I drifted off to sleep, that I am going to hide an extra laptop behind the drivers seat and have the Stealer unlock my EAS. In the earliest version of all this I tapped directly into the EAS C117 plug for my serial connection and ran the cable to the back seat foot well. I am going to pay the 45 dollars at the dealer and record the conversation.

Storey, I suggest we need to do more on the datalogging system before I would take it to be unlocked. We need to be logging the data on Pin 1, 11 and 12. I suggest that 'optocouplers' are setup on each on these three wires - as each channel really needs to be logged. Also, that the output of each 'optocoupler' is then ANDed into a final channel, which is then also logged, so that the sequence/timing, of the commands and responses can be seen. Through some clever use 'windiff' or similar software (during analysis after the conversation has been logged), you could get rid of the need for one of these individual logging channels. Maybe, you could also get rid of the logging on pin 1 (- power reset pin), if we assume that there will just be a single 'HIGH bit' early in the conversation. However this still leaves a definite need for two channels to be logged, in order to work out timings, commands and responses. How accurate is the logging output on Realterm - just 's' or 'ms' or better? Dare I say it, but yesterday I was looking at Dos programs to log from ports directly (XP doesn't allow direct port access and needs a kernel level driver to be written). I'm also looking at trying to get a twin-serial-port PCMCIA card. I've got access to old lappys with a single db9, so if I could add another 2 ports from the PCMCIA then I'd be all set with the 3 logging channels needed, (after I find a source for the OBD cable and I see my friendly Autologic owner).

When it is taken to the dealer to be logged/unlocked, I suggest you modify your under-dash panel, so that it is the 'piggy-backed connector' that is visible through the panel, NOT the standard connector with a 'piggback' visible in the footwell as well. Oh, and make sure the lappy is well covered up too - don't give the stealer any reason to suspect anything... ;-)

I was hoping that this thread would encourage dozens of people to get out their laptop and OBD2 cable and start tinkering away. So far there have only been about 7 primary reoccuring people who have shown interest. So come on get out there and start playing with the EAS.

If you've got a fault'ed EAS ECU, then you have little to lose by just playing around with the laptop and OBD cable. However, for those of us, whos EAS is currently functional and the car is a daily driver, then I think thoses are the ones who are holding back on just 'playing around' - not wanting to break/un-calibrate/fault the ECU, with quite a long shot at finding a breakthrough. I would put money on it, that the Autologic/Rovacom guys, probably just bought/borrowed/stole/bribed a LR Service Manager, to get a Testbook system and did exactly what we are trying to do - record a conversation - to work out what was going on. Making a breakthrough from nothing is very difficult, but building on info already known makes things slightly easier. Just like if you go to a foreign speaking country, you need to know quite a lot about the language before you can have a conversation, especially if they were to stop talking to you, should you get anything wrong!

 

[paul.adshead]

Having a bit of a further think on this opto-couplers may not cope with a 600bps switching rate. It may need some other buffering hardware/ICs that can cope with this frequency.

 

[Malafax_dand]

Do not worry, I will not pay good money to the stealer for the EAS unlock until I have a working two way serial recording method and the laptop hidden.

Using Realterm I will be able to record the serial conversation. One part using the receive line on com1 and the other, using the receive line on com2. With two com port receive lines, I can monitor both sides of the communication between the EAS and the Diagnostic unit. Realterm allows us to use to com ports for just this purpose. We do not need to do any programming, just wiring.

As stated before, I am going to tap directly into the C117 connector on the EAS module, underneath the drivers seat. Very easy to hide a laptop on the floor behind the drivers seat. I will place lots of stuff back there strategicaly placed to hide the laptop. The laptop will run on both the car 12v adapter and the internal battery. With realterm running, the session should be recorded.

I will of course first test that realterm and this wiring scheme can record a conversation on the EAS communications line.

Pictures to follow.

 

[nigelh]

Dare I say it, but yesterday I was looking at Dos programs to log from ports directly (XP doesn't allow direct port access and needs a kernel level driver to be written).

You can get round this.
It's a bit messy but Google for Userport.zip and it is all done for you.
I have used this to use a laptop printer port act as an input device when I was miles from a logic analyser... HTH

 

[ghind]

how about this?

I've been watching this thread carefully, wondering if I could be of any help.

How about if you could plug your laptop into your RR and allow somebody with a rovacom (via their internet link) to remotely do stuff to your car?

If the protocol really is RS-232, it can!!!

All you need is some kind of software to share your serial port. On my laptop, I'd run the sharing software and allow access to it via ADSL. My laptop would be plugged into my RR. On the remote PC, you would plug the serial port into say a rovacom unit (or whatever else). You would probably need to use a null modem cable at the rovacom end. This port is then mapped to the remote port. Basically, a couple of laptops and the internet pretend to be a really, really big serial cable!!!

http://www.taltech.com/products/tcpcom.html

The program above even comes with a free 30 day trial!!!!

RS-232 is really simple, old school stuff. 600 baud should be a sinch to share.

Now all we need is a sympathetic eas suspension renovation shop with a rovacom and a computer. Is there anybody around here who does rover eas suspension rennovations... :mrgreen:

Even more interesting would be to use Windows XP remote support, WinVNC (realvnc.com) or similar to watch what is being done with your car! How cool would that be?

There would also be software out there that could do this and record the serial conversation...

If I can be of help in trying this out, I'd love to.

 

[ghind]

And more

http://www.topshareware.com/search.aspx?q=serial+ip

There would be heaps of software out there that can do this.

Or this FREE one http://www.download.com/HW-Virtual-Seri ... ag=lst-0-1

 

[kyle h.]

I've been semi following this thread. I have limited time to dive into projects as I am juggling many at the moment.

I am unaware of your level of knowledge on this subject, but I might suggest this link to read.

http://en.wikipedia.org/wiki/Controller_Area_Network

For data interpretation and figuring out the conversations. Sorry if I am underestimating the present knowledge on this subject.

 

[Jim-00-4.6]

CAN bus didn't go into RRs until after 2003; so we'll all be worrying about THAT when we get our NEXT trucks.

In the meantime, I've not given up on this project, I just have nothing to report... yet.
Theories, possibilities, and some cables arriving late this week.

Chin up, then!

 

[Malafax_dand]

gHind: Great approach I ahd not thought of that method. Although complex it might work. Currently I have a couple of people out there with Rover diagnostic units attempting to record the conversation. Currently it is just a waiting game.

Kyle: I did consider the CAN buss but we still really just have to wait until we see an actual conversation from a real diagnostic unit.

Hopefully in the next few weeks we will se some more progress when the conversations start rolling in.

 

[ghind]

my idea won't quite work

Hi All

I looked into it some more and my idea seems flawed.

The ODBII bus is likely not standard RS-232 although I would love to be corrected and told it is. Can anybody confirm otherwise?

I can suggest alternative methods though.

Method One Steps:

1. Disconnect the transmit and receive wires on EAS C117 connector on broken car. Connect them to the appropriate pins on a 9 pin D connector (standard serial plug). Connect ground as well, but in parallel (don't remove ground from the plug).
2. Disconnect transmit and receive wires from plug on good (remote) car. Put new transmit and receive wires into the plug and connect them to a D connector. Plug this into laptop.

Use tricky serial mapping software and plug diagnostic system such as rovercom, autologic or whatever into remote car.

The EAS on the broken car should then be fully under the control of the remote car. You will be able to reset it etc. It is possible that the remote height controls etc will also control the broken car!

This method costs practically nothing but gives control over EAS only. It also requires hacking into wires/connectors under the seat. Most people would be a bit timid with this kind of thing - unless they are used to the jumper method.

Another extension of this is to get some male and female C117 EAS connectors and make up a loom and post it to people.

Method two:

IF the connection betwen the vehicle server and the vehicle communications interface is serial then we have another option. All I know is it uses a 15 pin D plug and it is relatively simple (the interface converts it into all the "hard" formats, that is why they have it).

If it is serial, simply put the serial sharing software between the units. So, a small number of people own complete units and others buy just the interface ($190 odd dollars plus a $70 ODBII cable). Then, a remote PC and server does all the work and all we have locally is a computer with serial sharing software plus the interface and cable. I can see all sorts of options here. For example $350 for unit and postage to get whatever jobs done and $275 on return of the parts. Or whatever.

It takes me two weeks to get anything done by the dealer so I would pay an amount per job plus own the necessary hardware knowing that I can get help within X hours (say 24 hours) anywhere I can get an internet connection. Since I will be traveling soon and have mobile broadband this would be VERY attractive.

Most important to me is the ability to reset an EAS fault myself. Nothing much else the BCM does is likely to fault and likely to leave me with the annoyance of manual suspension control or bump stop travel.

Method Three:

Share ODBII over the internet.

Does anybody know anything about the ODBII protocol. Can we capture it somehow and either play it back or share it over the internet?

http://www.bb-elec.com/bb-elec/literature/obdiij.pdf

Can we convert ODBII to serial and back??

Does anybody know what protocols the RR use ISO 9141, KWP2000
SAE J1850 or others??? I'm sure it uses a basic one for many functions but any idea what protocol is used for the more exclusive stuff?

Any comments on my first method above?

 

[shupack]

I like the idea of "buy an obdII cable and a VCI and you're set."

I think it would save me time to do it myself than talk people through it.

I'll sell fewer RCL packages though....

 

[ghind]

i've re-read the thread

I've read this thread from the beginning.

The ODB port does have the necessary EAS communactions pins right there for us!

So a special ODB to DB9 cable and a laptop which passes on the correct reset command sequence is probably all that the end user needs.

This will only work EAS though, not the other functions as I believe they use other protocols (not RS-232) although I'm not certain.

I bet we only need to record what the rovercom says, I suspect what the EAS says back doesn't matter all that much. Especially if we pause 1 second between issuing each command.

Anybody make the cable and recorded it yet?

I would love to but I don't have access to the cable or a rovercom unit...

 

[Malafax_dand]

gHind:
Important point, the OBDII does not specify or indicate a specific protocol. This is just a standardized connector and agreed upon error code table, for emmsisions only. It does not specify the actual communications protocol, i.e. there can be OBDII plugs with SAE J1850 VPW, SAE J1850 PWM, ISO 9141, etc. It also does not specify all the other litany of communications systems that the Rover has, ie. ABS, HVAC, BECM, etc.

In addition to this, just because the EAS uses the OBDII connector does not imply anything either. The EAS uses pins on the OBDII connector that go straight and only to the EAS. So this means the buss is very simple and there is no need for any address framing to differentiate it from any other devices on the line, there are no other devices on the line. The protocol as far as I have determined is just RS-232, 600 bps, 8N1.

Stating that the RS-232 line protocol works does not tell us anything about the higher level message framing. With any protocol there is the physical line level protocol and the higher level messaging. I have also looked at just about every automotive protocol I have bneen able to get my hands on in hopes that the EAS might use somehting similar. It only stands to reason that when the EAS was developed, the protocol used might relate to other protocols in the market at the time.

Yes simply placing a DB-9 connector directly on the EAS C-117 connector and the OBDII connector works just fine. That is how I worked my way up, starting at the EAS first then moving to the OBDII connector, absolutely no difference.

As stated before, we should have some communications examples very soon

 

[Nige]

I was playing with pin 1 on the OBD DLC connector and I found some interesting stuff. The relay clicks off if you take the voltage to negative 5 volts. Not ground but negative 5 volts. I was only able to play with it for just a few minutes, I will let you all know when I find more.

Just read in the EAS GTR documents that pin 3 on the Timer Relay must be "pull(ed) low to open relay" and it is connected to the OBDII port. So now we have a very small piece of the puzzle confirmed....

Page 26 if anyone is looking.

 

[Andrew Parker]

Common Guys,
Collaborate all the more this is just what RangeRovers.net is all about. Please don't tell me I'll have to get hit up for another C-note to get the ruddy EAS reset the next time.
Andrew

 

[paul.adshead]

I was playing with pin 1 on the OBD DLC connector and I found some interesting stuff. The relay clicks off if you take the voltage to negative 5 volts. Not ground but negative 5 volts. I was only able to play with it for just a few minutes, I will let you all know when I find more.

Just read in the EAS GTR documents that pin 3 on the Timer Relay must be "pull(ed) low to open relay" and it is connected to the OBDII port. So now we have a very small piece of the puzzle confirmed....

Page 26 if anyone is looking.

Nige, have a read of:
http://rangerovers.net/forum/viewtopic. ... 039#105039

 

[ghind]

Hi Guys

I'm hanging out for an update, i've been checking this thread twice a day at least. It seems the answer is so close...

Any news?

Thank you for the work so far.

Greg