Professional Documents
Culture Documents
Too expensive
Poor traction, when the ECU may push back the throttle
to control wheel slip.
Torque-based throttle control is more complex. The EMS
interprets pedal position not as a demand for a certain throttle
position but as a demand for torque, which gives the ECU some
flexibility in deciding how to deliver the requested torque.
Parameters under the control of some ECUs that can affect
engine torque output include throttle position, spark advance,
air/fuel ratio, cam phasing and lift, intake plenum configuration,
turbo or supercharger boost, nitrous injection, exotic tricks like
actuating a hinged upper block surface to vary the compression
ratio, and a nearly infinite range of combinations of the above.
Torque-based engine management requires that the ECU have
access to multiple tables that model the engines torque output
under all possible operating conditions, allowing the EMS to
calculate and recalculate exact torque output on an ongoing
basis. The EMS processes torque demands from the driver via
the accelerator pedal position (to, say, maintain or increase
vehicle speed) exactly the same as torque demands that are not
directly under driver control, such as incremental torque needed
when the ECU turns on an A/C compressor.
Torque-based ETC is dependent on an accurate model of
torque the engine can deliver under various conditions in the
form of a table that lists engine torque output as a function
of the various combinations of engine load and rpm (torque
being a derivative of airflow, timing, and air/fuel ratio). To
find predicted engine airflow (loading), the EMS combines
the torque table with a second table unique to the engine
configuration that models airflow (loading) as a function of
effective throttle area (a derivative of throttle butterfly angle).
As youd expect, any modifications to the intake manifold,
camshaft profile, throttle diameter, exhaust backpressure, or
intake manifold pressure that affect engine airflow can require
changes to the airflow and throttle area table to avoid triggering
EMS malfunction codes.
Torque-based ETC calibration is a final stage in EMS
calibration that comes after everything else in the calibration
is perfect. The procedure is to manually command the
electronic throttle to a particular position with the engine or
vehicle on a load-holding dyno and populate the reference ETC
tables with actual values obtained in steady-state conditions for
load versus rpm and torque versus load and rpm. When the
contents of the ETC tables are specified, it is possible to build
a transfer table that maps a torque request in the form of
incoming data from the pedal position sensor into desired
engine outputs. Feedback from MAF or MAP sensors is then
used by the EMS throttle control logic to verify that actual
engine loading matches predicted loading to protect against
any error conditions that could result in unintended or
undesirable acceleration.
By definition, any hot rodding modifications that increase
power change the relationship between throttle position and
engine power, which will often be seen as a fault by a torque-
based EMS. Since as little as 5 percent extra airflow may trigger
limp mode in some EMSs, the solution is to modify the ETC
tables to match the increased power the engine is now making,
though it may also be possible in some cases to reconfigure the
EMS ETC strategy from torque-based to pedal-follower.
Note that many transmission-control strategies depend on
engine torque at the input shaft. ETC vehicles with automatic
transmissions usually integrate engine and transmission torque
control strategies, modeling not just engine torque output but
reliability of throttle position information by providing
redundancy in the form of a second TPS. The secondary TPS
output signal typically has a different range or slope than
the primary sensor, which improves the ability of the ECU
to verify throttle position with high accuracy and allows it
to perform a plausibility check between the two sensors. Any
discrepancy between the two throttle position sensors triggers
a malfunction code and will probably lead to ECU throttle
control algorithms entering a fail-safe limp mode in which
throttle position is limited to the minimal range that will
move the vehicle (less than 20 percent throttle is typical), a
state that persists until the system can be reset.
The EMSs automatic last line of defense against the
consequences of a catastrophic throttle control failure is an EMS
table that specifies maximum airflow rates for representative
breakpoints of commanded throttle position and engine rpm.
Airflow that exceeds the maximum causes the ECU to conclude
that there is a serious problem with the ETC system and enter
limp mode. EMS countermeasures against excessive airflow are
robust, given the potentially lethal consequences of a stuck or
out-of-control throttle, and potentially include not only limiting
throttle angle but extremely aggressive timing retard that limits
power at any airflow to a fraction of normal. Consequently, turbo
or supercharger conversions are nearly impossible on ETC engines
unless you reprogram the maximum airflow table to allow higher
flow rates under heavy load without entering limp mode. Simple
enough if you have access to the connectively hardware and security
seed that allow table access and modification via laptop computer,
otherwise impossible. The ideal maximum allowable airflow rate
at any given combination of rpm and loading should be low
enough to protect against the consequences of ETC failure but
high enough to prevent unintended limp mode. Twenty percent
above expected maximum flow should accomplish both, but new
maximum airflow table values must ultimately be confirmed for
specific combinations of stock and hot rod parts and levels of
boost in actual rigorous testing. Keep in mind that eliminating
maximum airflow thresholds entirely could expose the tuner
to ruinous liability in the event of ETC-related crash or engine
damage, as could faulty maximum airflow values that fail to halt
a stuck ETC throttle runaway that results in injury or loss of life.
The two main classes of EMS electronic throttle control
strategies are commonly referred to as pedal-follower and
torque-based.
Pedal-follower throttle control is rather simple. The EMS
straightforwardly translates PPS sensor input into throttle
position in a way that is equivalent to what would happen if a
cable connected the accelerator to the throttle blade. Exceptions
to this 1:1 correspondence of pedal position to throttle position
occur during
Forty percent more fuel used per acre or per job and only
20 percent more power output in return.
Warranty:
Mil-Spec?
Case size:
Weight:
Cylinders:
Maximum rpm:
Expandability:
Ruggedized/potted/mil-spec ECU?
High-temp-tolerant ECU?
Operating voltage:
Reversed-battery protection?
OBD-II self-diagnostics?
Nitrous stages:
VE table fueling?
VE-based Startup?
Auto-Tune?
Idle/Accel
Number:
Coil-on-plug?
Waste-spark?
Distributor?
Dual distributor?
CDI support?
Integral multi-spark?
Ignition Calibration
Accuracy:
Auxiliary compensations:
Gear compensation?
Multi-spark?
Number injectors:
Accuracy:
Auxiliary compensations?
Gear compensation?
Direct-injection modes:
Lambda range:
Lambda resolution:
Lambda switch?
EGT/pyrometer?
Data Logging
Multi teeth:
Missing teeth:
Auxiliary-injector control?
Self-dyno datalogging
Data-logging: [memory/rate/length-of-time/
number parameters]
Gear detection?
GPS logging/controls:
Electronic throttle
Antitheft, emissions
The vehicle speed sensor (VSS) tells the ECU how fast
the vehicle is going. Some engine management algorithms
make use of ground speed data to control torque converter
lockup, EGR valve, evaporative charcoal canister purge
valve, cooling fans, closed-loop air/fuel ratio, and idle
speed. There is a lot of ECU logic that depends on the
VSS, which will affect the operation of the above devices.
You should retain the VSS if you want the engine to run as
well as it did stock.
The wave arrives at the end of the pipe and enters the
atmosphere, triggering a negative pressure wave that travels
back up the pipe. If the pipe length, rpm, cam overlap,
and duration are tuned correctly, the low-pressure wave
reaches the combustion chamber just before the exhaust
valve closes.
At all other rpm but the target sweet engine speed, the
effect is negativesubtracting volumetric efficiencyand
making for a peaky motor.
Atmospheric pressure
Absolute humidity
Air temperature
Fuel characteristics
Air/fuel ratio
Oil characteristics
Spark timing
Type of transmission
Make sure the spark plugs are new, of the right heat
range, and gapped correctly for the engine in its current
configuration. Turbo conversion engines usually run a
much narrower gap than stock (that is, 0.029 or less,
versus, say, 0.044)
Air-temp enrichment.
Some EMSs can provide the following:
You can also do this test with the key on, engine off by
applying vacuum to the MAP sensors hose with a hand-
held vacuum-pressure pump.
Start the engine and check the reading again. If the MAP
sensor is functioning properly, the reading should drop to
about 290 to 330 on the tachometer, which corresponds
to a frequency output of about 93 to 98 hertz. No change
would indicate a defective sensor or leaky or plugged
vacuum hose.
Troubleshooting VAF Meters
Vane airflow sensors are no longer used on new vehicles, but you
may encounter one on a classic vehicle. There are special testers
for troubleshooting VAF sensors, but you dont always need
one to check sensor operation. By watching the VAF sensors
output with an analog voltmeter or ohmmeter (or better yet an
oscilloscope), you can look for a change in the sensors output
as airflow changes. One simple check is to look for a voltage
change as you slowly push the airflow flap all the way open. A
good sensor should produce a smooth and gradual transition in
resistance (ignition off ) or voltage readings (ignition on) all the
way from full-closed to full-open. If you see any sudden jerks in
the movement of the needle (analog ohmmeter or voltmeter) or
dips or blips in the scope trace (similar to sweeping a TPS), the
VAF sensor needs to be replaced.
Changes in the sensors voltage output should also produce
a corresponding change in fuel injector duration when the
engine is running. Injector duration should increase as the VAF
flap is pushed open.
On Ford EFI systems, you can use a breakout box and
voltmeter to check VAF sensor voltage readings. Pushing the
flap open should cause a steady and even increase in the sensors
output from 0.25 volts when the flap is closed to about 4.5 volts
with the flap fully open. The reference voltage to the airflow
sensor from the computer should be 5 volts.
Of course youre going to need a standard set of mechanics tools for tuning and
modifying engine management systems, but since wiring is so important, it is worth
having a really good ratchet-type crimp tool with the correct slots for a handling a
variety of crimping jobs. This MSD tool has multiple, interchangeable jaws with a
variety of connector gripping slots. Such a tool can (and should) cost a few bucks,
but remember that a broken or shorted wire could destroy your vehicle.
E
M
S
T
R
O
U
B
L
E
S
H
O
O
T
I
N
G
(Ray)
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:236
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:237
178-336_30412.indd 237 4/4/13 2:42 PM
(Ray)
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:238
178-336_30412.indd 238 4/4/13 3:49 PM
238
(Text)
E
M
S
T
R
O
U
B
L
E
S
H
O
O
T
I
N
G
75 hertz at 3,500 rpm. The later model units (like those on a
3800 V-6 with the Hitachi MAF sensor) should read about 2.9
kilohertz at idle and 5.0 kilohertz at 3,500 rpm. If tapping on
the MAF sensor produces a sudden change in the frequency
signal, its time for a new sensor.
On GM hot-film MAFs, you can also use a scan tool
to read the sensors output in grams per second (gps), which
corresponds to frequency. The reading should go from 48
grams per second at idle to as much as 100240 grams per
second at wide-open throttle.
Like throttle position sensors, there should be smooth linear
transition in sensor output as engine speed and load change. If
the readings jump all over the place, the computer wont be able
to deliver the right air/fuel mixture, and drivability and emissions
will suffer. So you should also check the sensors output at various
speeds to see that its output changes appropriately.
Another way to observe the sensors output is to look at its
waveform on an oscilloscope. The waveform should be square
and show a gradual increase in frequency as engine speed and
load increase. Any skips or sudden jumps or excessive noise in
the pattern would tell you the sensor needs to be replaced.
Yet another way to check the MAF sensor is to see what effect
it has on injector timing. Using an oscilloscope or multimeter
that reads milliseconds, connect the test probe to any injector
ground terminal (one injector terminal is the supply voltage and
the other is the ground circuit to the computer that controls
injector timing). Then look at the duration of the injector pulses
at idle (or while cranking the engine if the engine wont start).
Injector timing varies depending on the application, but if the
mass airflow sensor is not producing a signal, injector timing will
be about four times longer than normal (possibly making the fuel
mixture too rich to start). You can also use millisecond readings
to confirm fuel enrichment when the throttle is opened during
acceleration, fuel leaning during light load cruising and injector
shut-down during deceleration. Under light load cruise, for
example, you should see about 2.5 to 2.8 milliseconds duration.
Troubleshooting Knock Sensors
For this test you need a strobe gun so you can physically see the
timing change via the cam belt or the timing mark on the crank
pulley wheel.
Catalyst
Misfires
Evaporative system
Fuel system
ONBOARD DIAGNOSTICS
The 1990 Clean Air Act specified emissions-related requirements
for new cars in the 1990s and beyond as well as organizing
requirements for aftermarket automotive equipment. The act
extended the prohibition against removal or rendering inoperative
the emissions-control devices to the consumer. It would now be
a violation to manufacture, sell, or offer to sell parts where the
principal effect is to defeat the emissions-control devices.
EPA memorandum 1A states that those who might be
subject to claims of tampering as a result of installation of
certain parts can be certain there will be no such claims if the
manufacturer of the part(s) is able to certify that the vehicle
with the parts in question installed could pass the Federal Test
Procedureor if they have received an Exemption Order (EO)
from the California Air Resources Board. Any entrepreneur who
wants to manufacture parts that might interfere with emissions-
related systems on a vehicle (almost anything related to the
combustion cycle of the engine) can obtain the Procedures for
Exemption of Add-on and Modified Parts from the California
Air Resource Board.
ENGINE SWAPS
According to the California Bureau of Automotive Repair
(BAR), an engine change is the installation of an engine in
an exhaust-controlled vehicle that is different from the one that
was installed originally in the vehicle and does not qualify as a
replacement engine. A replacement engine is defined as a new,
rebuilt, remanufactured, or used engine of the same make, size,
and number of cylinders as the original engine with all original
emissions controls reinstalled, or an engine that matches a
configuration offered by the manufacturer for that year, make,
and model of the vehicle with the appropriate emissions controls
for the installed engine and chassis components present and
connected. Licensed California smog check stations must refer
vehicles with engine changes to the BAR for referee inspection.
Once a vehicle has been inspected by the referee and a BAR label
attached to the doorpost (listing the required emissions-control
equipment), any licensed smog check station may thereafter
perform an inspection. The vehicle must have all the emissions-
control equipment listed on the BAR label.
In California, cars more than 30 years old are considered
non-exhaust-control vehicles, and may have any year engine
installed and only require PCV (and appropriate retrofit devices,
if required). These vehicles may be inspected at licensed smog
check stations and do not need referee intervention. For newer
vehicles, note the following explicit regulation: An automotive
repair dealer shall not make any motor vehicle engine change
that degrades the effectiveness of a vehicles emissions controls.
ONBOARD DIAGNOSTICS, LEVEL II
Onboard Diagnostics, Level II (OBD-II) is a series of regulations
intended to reduce in-use vehicle emissions by requiring the
OEM engine management system to continuously monitor
the powertrain and its emissions-control systems for failures or
deterioration. OBD-II includes provisions for standardization
of diagnostic, repair, and other service-related information. The
system was designed to reduce high in-use emissions caused
by emissions-related malfunctions, to reduce time between
occurrence of a malfunction and its detection and repair, and to
assist in the diagnosis and repair of emission-related problems.
To be OBD-II compliant, an EMS must monitor virtually
all emissions-control systems and components that can affect
E
M
I
S
S
I
O
N
S
,
O
B
D
-
I
I
,
A
N
D
C
A
N
B
U
S
(Ray)
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:242
178-336_30412.indd 242 4/4/13 2:42 PM
(Ray)
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:242
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:243
178-336_30412.indd 243 4/4/13 3:49 PM
243
(Text)
controllers could communicate with each other and diagnostic
equipment to synchronize operations in a prioritized scheme that
allowed critical communications to propagate at very high speed.
OBD-IIS EFFECT ON VEHICLE DESIGN
OBD-II had a significant impact on the engineering of new OEM
engine management systems. Compared to earlier factory engine
management systems, powertrain control modules became much
faster, with much more memory and more features, and cost and
complexity increased significantly. OBD-II required additional
components and systems for many of the monitors, including
additional oxygen sensors, fuel tank, and EGR pressure sensors.
Existing components/systems required substantial upgrades.
Achieving higher standards required higher accuracy, durability,
and reliability in addition to design changes that compensate for
differences in the duty cycle or function of parts.
In addition to effectively revising existing functions, the
global effect of OBD-II was to require that the base operating
strategy, or algorithm, of the EMS be completely retooled to
incorporate new features specific to OBD-II. Since the system
required a substantial amount of monitoring to be performed
while driving, a considerable effort was required to make sure
monitoring was completely transparent to the driver. Older
OBD-I diagnostic routines had to be significantly revised to
support repairing malfunctions identified by the gamut of new
monitors. Standardization of terms and equipment helped
to some degree, but although the increased complexity of the
overall system vastly improved diagnostics, it could actually
result in more difficult repairs.
SMOG CHECKS AND OBD-II
OBD-II was designed for full integration into the smog check
procedures required in many states and cities. At the time of
the smog check, technicians would verify that the MIL was
not illuminated (light and computer indication), that the I/M
readiness code was fully set, that no fault codes were stored, and
that proper calibration was installed.
The Specialty Equipment Marketing Association (SEMA)
the organization of aftermarket automotive equipment
suppliershas noted that various government agencies have
been highly interested in implementing countermeasures to
stop people from tampering with OBD-II engine management
systems. Such agencies, says SEMA, want to prevent passing of
vehicles that have had their fault codes erased (or readiness code
set) illegally by hackers. The potential for such activity is purely
speculative; there has been no proof it is occurring.
SEMA notes that the same agencies have had a strong
interest in preventing consumers or non-OEM technicians from
any tinkering whatsoever (recalibration/tuning) that would
make adjustments to the vehicles computereffectively locking
the hood.
SEMA points out that the OBD-II standard made no
provisions for non-OEM calibrations and limited the performance
aftermarkets ability to develop and sell many current emissions-
compliant products since such calibrations would automatically
fail I/M. Limiting parts and service to dealerships, says SEMA,
reduces consumer choice and could raise costs.
In the meantime, says SEMA, aftermarket calibrations/
computer chips have proven they do not increase emissions and
many have California Air Resources Board (CARB) exemption
orders. In fact, SEMA notes, CARB has agreed that aftermarket
recalibration should remain possible under VC 27156/38391,
Oxygen sensor
Comprehensive components
OBD-II requires that the connectors through which the
emissions-control diagnostic system would be accessed for
inspection, diagnostic service, or repair are standard and uniform
on all motor vehicles and motor vehicle engines, and that access
to the emissions-control diagnostics system through such
connectors is unrestricted and does not require any access code
or any device that is only available from a vehicle manufacturer.
OBD-II requires that the output of the data from the emissions-
control diagnostics system through such connectors should be
usable without the need for any unique decoding information
or device.
OBD-I/OBD-II COMPARISON
OBD-I OBD-II
Oxygen Sensor Oxygen Sensor (enhanced)
EGR System EGR System (enhanced)
Fuel System Fuel System (enhanced)
Electronic Input Components Electronic Input Components
Diagnostic Information Electronic Output
Fault Codes Components
Catalyst Efficiency
Catalyst Heating
Engine Misfire
Evaporative System (leak
check/function)
Secondary Air System
Diagnostic Information
Fault Codes
Engine Parameter Data
Freeze-Frame Engine
Parameters
Standardization
BENEFITS OF OBD
OBD-II was designed to provide certain clear benefits. In addition
to reducing air pollution, one of the most important benefits
was standardization. Standardized interfacing, diagnostics,
and datalogging were of great concern to independent repair
shops that might otherwise find it prohibitively expensive to
acquire proprietary diagnostic tools for every make and model
of vehicle serviced. OBD-II standardization reduced the cost
and complexity of diagnosis by providing a known
communications protocol for handshaking between the ECM
and diagnostic devices.
OBDII provided a physical diagnostic connector that
would be the same on all 1996 and later vehicles (and a few
1994 and later vehicles) andbottom lineallowed one
diagnostic device to connect to any vehicle sold in the United
States. Standardization basically enabled one scan tool to work
on any vehicle. OBD-II provided a set of fault codes designed to
help identify faulty components. OBD-II provided for real-time
diagnostic information and, thus, continuously updated engine
parameter data. It provided a facility to supply freeze-frame
information, in which the system would store engine operating
conditions upon detection of a malfunction.
OBD-II was later expanded by 2008 to include Controller
Area Network (CAN) protocols by which multiple onboard
E
M
I
S
S
I
O
N
S
,
O
B
D
-
I
I
,
A
N
D
C
A
N
B
U
S
(Ray)
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:242
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:243
178-336_30412.indd 243 4/4/13 2:42 PM
(Ray)
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:244
178-336_30412.indd 244 4/4/13 3:49 PM
244
(Text)
replacement parts; they were not defeat devices. It was clear by
this time that the use of add-on or modified parts would not be
considered a form of tampering if the product has been granted
a CARB EO number (California and 49 states) or meets the
requirements of the EPAs antitampering policy document,
Memorandum No. IA (49-state only).
Hundreds of products of all types had been granted
EO numbers for thousands of applications, with many
specialty products sold by OEMs with EO numbers and
many manufacturers representing their products as meeting
Memorandum 1A. It was clear that such products did meet
emissions and applicable criteria for an EO or Memo 1A, and
that enforcement provisions/penalties designed to prevent
fraud would be considered adequate to prevent fraud. In fact,
elimination of components present in the originally certified
configuration would be allowable under certain circumstances
(for example, GMs Camaro package).
BARRIERS TO ENTRY: THE PERFORMANCE
AFTERMARKET AND OBD-II
OBD-II presented a challenge to aftermarket firms in the
business of providing performance recalibrations on PROM-
based OEM engine management systems. Using the new flash
memory technology, OEMs in some cases implemented write-
protect features that removed the ability to perform aftermarket
recalibrations required for compatibility/compliance for
performance equipment packages.
OBDs sensitivity to changes and modifications increased
the risk of incompatibility. The need to uniquely calibrate
each engine family further added to the complexity. Extended
warranties and increasingly higher vehicle useful life requirements
have expanded emissions liability for both OEMs and the
aftermarket, providing more chances for unexpected use, wear,
adaptations, failures, and so on. To make street-legal products,
aftermarket performance firms need a full understanding of
the powertrain control/OBD system operation to minimize
potential incompatibilities and false MILs over the vehicles
useful life. Given that OEMs continue developing OBD
systems while they are being produced, OEMs have a nearly
insurmountable advantage in having the information needed to
maximize compatibility of aftermarket parts.
With the world going OBD-II in 1996, SEMA launched
a lawsuit against the federal EPA, Californias EPA, and the
California Air Resources Board, basically to prevent these
governmental organizations from enforcing OBD-II and the
Clean Air Act of 1990 in ways that were economically ruinous
and anti-competitive toward legitimate aftermarket equipment
and performance suppliers capable of building parts and
equipment that genuinely did not degrade vehicle emissions or
even improved emissions performance. SEMA was looking to
force OEMs to meet the following conditions with respect to the
$200B specialty equipment aftermarket:
1. Provide initial calibration development training on
applicable power trains.
2. Designate a liaison from each participating OEM.
3. SEMA acts as specialty aftermarket liaison.
4. Provide information to aftermarket for product
development/recalibration.
5. Provide access to equipment/tools needed for
development.
6. Provide ongoing training/communication as vehicles
are updated.
though the OBD-II standard does not explicitly allow this.
Bottom line, says SEMA, electronic tampering has never been
verified as a real problem. It is unlikely it ever will be since the
required sales volume, equipment investment and knowledge
are prohibitive for all but the aftermarket [industry itself, not
individual consumers]. The latter are too responsible/visible to
consider such risks. The above statement is fairly true.
TAMPERING
In fact OBD-II initially required that computer-coded engine
operating parameters should not be changeable without the
use of specialized tools and procedures, for example, soldered
or potted computer components or sealed (or soldered)
computer enclosures. However, subject to executive officer
approval, manufacturers could exempt from this requirement
those product lines unlikely to require protection. Criteria to
be evaluated in making such an exemption includedbut were
not limited tocurrent availability of performance chips, high-
performance capability of the vehicle, and sales volume.
Manufacturers using reprogrammable computer code
systems (for example, flash memory) were required to employ
proven methods to deter unauthorized reprogramming, which
could include copyrightable executable routines or other
methods. Beginning with the 1999 model year, manufacturers
were called upon to implement enhanced tamper-protection
strategies including data encryption with countermeasures to
secure the encryption algorithm, as well as write-protect features
requiring electronic access to off-site computers maintained by
the manufacturer.
By 1997 it was clear that specialty products could still be
used on pollution-controlled motor vehicles. SEMA was making
a strong point of the distinction that SEMA members products
made provisions for emissions-control devices or were considered
CAN-USB-COM converter provides bi-directional communication between a USB
COM Port Serial interface and a CAN 2.0A/B (ISO 11898) Network. Features include:
Fast Cortex-M3 32-bit microcontroller
Easy setup using Configuration Push Button
Virtual Serial Baud Rates up to 1 Mbps
CAN Messages formatted in ASCII or binary
Integral Help menu for set-up/configuration commands.
Automatic set-up of bit-time and slew rate, adjustable via
configuration commands
Usable with any COM Port based software, including HyperTerminal and
TeraTerm.
Standard Drivers for Windows XP-plus, MAC and Linux.
Usable in command or virtual circuit mode
E
M
I
S
S
I
O
N
S
,
O
B
D
-
I
I
,
A
N
D
C
A
N
B
U
S
(Ray)
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:244
178-336_30412.indd 244 4/4/13 2:42 PM
(Ray)
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:244
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:245
178-336_30412.indd 245 4/4/13 3:49 PM
245
(Text)
Bosch pioneered the controller area network (CAN) serial
data-link protocol in the early 1980s and licensed a number of
semiconductor vendors to develop and produce controller chips.
Twenty-five years later, starting in 2008, the U.S. government
required all cars sold in the U.S. to support CAN protocol for
OBD-II diagnostics. CAN specified whats called the data-link
layer of a networking protocol stack, and left the physical layer
and all higher layers open to be implemented by automakers as
they saw fit. CAN does, however, specify that the physical layer
must support an active (i.e., dominant) state for a zero bit and
a passive (i.e., recessive) state for a one bit, which is critical to
resolving collisions between messages of differing priority
Many organizations have developed differing physical layers
that support CAN. GM, for example, developed GMLAN, a
representative onboard network which defines two physical
layers along with the higher level layers that provide standards
by which all of a vehicles various processors or nodes cooperate
to accomplish diagnostic, bulk data transfers, ECU reflash or
recalibration, and so forth. CAN uses a Non-Return-to-Zero
protocol, NRZ-5, with bit stuffing, and the network implements
Carrier Sense Multiple Access with Collision Resolution
(CSMA/CR). GMLAN consists of two linked CAN buses: a
high-speed dual-wire CAN for high-speed (EMS and brake)
nodes and a lower-speed single-wire CAN for other nodes (in
some cases there may be a medium-speed bus). The primary
purpose of GMLAN was to improve reliability and lower costs
by reducing the numbers of wires, connections, and special-
purpose circuits in a vehicle. GMLAN promotes synergism
between vehicle nodes to provide features that would not be
feasible without a network.
CAN does not include addresses in the traditional sense,
but is a publish-and-subscribe communications module. Each
packet is physically broadcast to all nodes, which decide for
themselves whether to process the message packets. Packets
include no authenticator fields, meaning any embedded
controller can indistinguishably send a packet to any other. There
is a defined challenge-response sequence designed to protect
the system against certain actions without authorization. Thus,
a given ECU may participate in zero, one, or two challenge-
response pairs for: (1) reflashing and memory protection (for
upgrading the firmware), and (2) tester capabilities (on GM,
DeviceControl diagnostic service used during manufacturing
and servicing operations).
Normal messages are the messages broadcast between
controllers. Data varies depending on the electronics systems,
and being undefined by CAN/OBD-II, is defined by vehicle
manufacturers, most of which have taken a similar approach.
Normal message data does not need to be requested but is
typically sent at a periodic rate by a controller as fast as it needs
to be sent so that listening controllers get a timely value.
Diagnostic messages are command/response messages. If
you want to get data from an embedded controller, you have to
send it a request. The controller will then respond to that request
using a common diagnostic protocol. There are only a handful
of protocols that are used and these are typically specific to the
OEM; however, there is not much difference between OEMs on
how they have implemented their flavor of diagnostic messages.
DeviceControl protocol takes an argument (parameter)
called a control packet identifier, which specifies a group of
controls to override. DeviceControl is used for situations that
require exporting control commands from one ECU to other
embedded controllers on the CAN bus.
7. Provide specifications, documentation, and other items
needed to get an exemption order (information could be
provided to J2008/central databases).
Aftermarket manufacturers would be liable for proper use
of information and equipment provided, as well as security.
In spite of the above challenges, after some initial pessimism,
aftermarket companies and individuals have succeeded in
reverse-engineering the EMS of many of the most important
OEM performance vehicles to the point of making aftermarket
recalibration feasible, so OBD-II has not been the lock on the
hood that some people feared. New software like LS1edit was
developed that readily hacked into the flash memory of the
millennium C5 Corvette and other LS1/6 vehicles, and the
software has been expanded and upgraded in the years since to
interface with a large number of GM vehicles and engines. With
highly sophisticated piggyback and interceptor computers able
to manipulate OBD-II systems so effectively, government and
OEMs seem to have understood that it was somewhat pointless
to worry too much about providing insurmountable barriers to
entry around the sacred OBD-II OEM calibration.
HACKING THE CAN BUS
Understanding the CAN-standard vehicle network is vital to
a successful engine swap involving any U.S.-market vehicle
or engine built after 2007 and some vehicles or engines built
much earlier, starting with the 1986 BMW 850 coupe. Engine
data broadcast on the CAN by the engine control module may
be required by other embedded controllers to work properly.
Obvious examples include rpm data thats required by a dash
controller to operate the tachometer, vehicle speed data required
by a body control module to lock or unlock the doors above
a certain speed, or engine rpm, manifold pressure, and vehicle
speed required by a transmission control module to shift the
gears of an electronic automatic transmission.
ANATOMY OF AN
OBDII MESSAGE
T
he diagnostic scanner and the vehicle communicate with
each other by exchanging small pieces of information, called
diagnostic messages. The message transmitted from the scanner to
the PCM is called a command. The message transmitted back from
the PCM to the scanner is called a response.
Once the OBD11 scanner tool is connected, it will transmit a
command message to the vehicle. The PCM microprocessor will
receive the message and verify it. If the message is valid, the PCM
will respond.
A typical scanner command looks as follows:
C4 10 Fl 23 FF 06 8D
C4 Required Header Byte
10 Destination (PCM)
F1 Originator (Scanner)
23 Command (Request data)
FF 06 Data (Address FF06)
8D Message checksum
In the above message, the scanner is requesting data from the
PCM memory at address FF06.
E
M
I
S
S
I
O
N
S
,
O
B
D
-
I
I
,
A
N
D
C
A
N
B
U
S
(Ray)
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:244
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:245
178-336_30412.indd 245 4/4/13 2:42 PM
(Ray)
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:246
178-336_30412.indd 246 4/4/13 3:49 PM
246
(Text)
$2D - Define PID by memory address
$34 - Request download
$36 - Transfer data
$3B - Write DID
$3E - Tester present
$A2 - Report programming state
$A5 - Enter programming mode
$A9 - Check codes
$AA - Read DPID
$AE - Device control
A GM enhanced diagnostics CAN bus sequence to retrieve
engine rpm (Service $22) would be:
Request: $7E0 03 22 0D 00 00 00 00
Response: $7E8 04 62 00 0D 01 7E 00 00
FORD (ISO-14229) ENHANCED DIAGNOSTICS
$10 - Diagnostic session control
$11 - ECU reset
$14 - Clear diagnostic information
$19 - Read diagnostic trouble codes (DTC)
$22 - Read data by ID
$23 - Read memory by address
$24 - Read scaling data by ID
$27 - Security access
$28 - Communications control
$2A - Read data by periodic ID
$2C - Dynamically define data ID
$2E - Write data by ID
$2F - Input / output control
$31 - Routine control
$34 - Request download
$35 - Request upload
$36 - Transfer data
$37 - Request transfer exit
$3D - Write memory by address
$3E - Tester present
$83 - Access timing parameter
$84 - Secured data transmission
$85 - Control DTC setting
$86 - Response on event
$87 - Link control
Generic diagnostic services that youll find in common across
virtually all diagnostics systems include the following:
The first four bits of the first byte (the most significant
nibble) specifies which speaker will emit the sound.
Front driver-side speaker is controlled by bit 7 (the
most significant bit) of the byte, Front passenger speaker
by bit 6, rear driver side bit 5, then rear passenger
speaker by bit 4. Making a sound in only the driver
speaker then you would send 0x8X in the first byte (where
X is irrelevant).
VIN
Stored codes
Make sure the thermostat has not been swapped for a low-
temperature unit, and consider configuring the electric
fan to kick ON in the 200-215 degrees Fahrenheit range,
which will tend to reduce engine friction and improve fuel
vaporization for more complete combustion and improved
consistency between all cylinders.
Run the vehicle nearly out of (regular) fuel and fill up with
premium gasoline of at least 91 octane.
Remove the fuel pump fuse and fan fuse. Be sure heater
fans, windshield wipers, or any other current draw is
minimized during flashing.
Magnuson MP2300 supercharger/manifold/
intercooler assembly for GM LS3 V8.
Magnuson 2010-2011 Camaro SS supercharger kit.
(Ray)
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:258
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:259
178-336_30412.indd 259 4/4/13 2:42 PM
(Ray)
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:260
178-327_C68862.indd 260 4/12/13 8:05 PM
260
(Text)
S
U
P
E
R
C
H
A
R
E
D
C
A
M
A
R
O
S
S
5. During the reflash process you will be prompted to turn
the ignition key on and off multiple times without starting
the vehicle. Do not unplug the OBD-II cable at any point
during this process.
6. Completely loading the Magnuson supercharger
calibration may take around 5 to 7 minutes, after which
it is safe to remove the device from the OBD-II port and
start your engine.
7. In the event the SF3 Power Flash does not successfully flash
the vehicle it will display an error message. If this happens,
you must recover the ECU. Turn the key off and program
the vehicle with the return to stock option, at which point
you can make a second attempt.
With the Camaro reflashed and the GM E38 engine control
module ready to provide supercharging engine management
via upgrade fuel injectors, you can now proceed to install the
rest of the supercharger kit. The main procedures include:
Put unleaded race gas in fuel tank for initial testing (after
that the best premium street gasoline).
Does the fuel pump provide sufficient fuel mass under the
most demanding conditions during nitrous boost?
Select the rpm and loading above which the EMS would
turn off the air conditioning compressor.
Increase in boost was linear and smooth with the Eaton,
which flattened out the already flat torque curve of the
stock variable-volume and length Toyota 1MZ intake
system. The Eaton greatly extended the useful rpm range
of an otherwise stock powerplant, providing almost 100
more horsepower at 6,500 to 7,000 rpm. The blower
duplicated the effect of a bigger cam on a bigger motor,
and this is equally true when you compound forced
induction with a turbochargers.
Twin-Entry Majestic Turbo
The instant the throttle was opened, the TRD bypass valve
closed and the Eaton supercharger provided an instant jolt
of 3-psi boost below 2,000 rpm and 5-psi boost at mid-
to-high rpm. At high rpm the supercharger was actually
adding up to 9 psi.
Motec M4-8 datalog showing boost surging as the wastegate and boost controller tried in vain to maintain steady manifold pressure.
(Ray)
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:318
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:319
178-336_30412.indd 319 4/4/13 2:42 PM
(Ray)
(Fogra 39)Job:03-30412 Title:MBI-How To Tune And Modify Engine Management Systems
#175 Dtp:225 Page:320
178-336_30412.indd 320 4/4/13 2:48 PM
320
(Text)
much backpressure on an engine with extremely large
dynamic range can start to force open the wastegate at
too low a boost, which can result in a torque-killing
midrange situation where the wastegate cracks open,
greatly depleting torque until the point at which the
volume of exhaust gases increases enough to force boost
to creep up to the maximum boost you really wanted
only at a higher rpm. If youre not datalogging boost
pressure, you might never know youre a hundred horses
down in the midrange, attributing it all to a
lazy turbocharger.