DIY ECU Reprogramming by CAN

Background

Modern cars contain many electronic control units (ECUs) and they are usually connected via CAN bus. Updating the ECU firmware by CAN has been typical since the 2000’s and the CAN protocol used is generally Unified Diagnostic Services (UDS) as defined in ISO14229-1.

 

 

UDS Programming

The protocol defines many services that are pretty much self explanatory. They cover both diagnostics and programming. Some examples of UDS services are:

• 11h ECU Reset
• 22h Read Data by Identifier
• 34h Request Download
• 36h Transfer Data
• 3Eh Tester Present

 

The service is generally the second byte of a UDS frame sent from the tester/programmer to the ECU. Often the service is followed by a sub-function byte. Here is more extensive information on UDS Services.

For example, a tester present complete UDS frame might be 02h 3Eh 80h 00h 00h 00h 00h 00h. There are really just three bytes to the message – 02h means expect two more bytes, 3Eh is the service and 80h is the sub-function. In this case, sub-function 80h tells the target ECU that no response is required to the tester present command.

Tester present service is often used as a heart beat message to let the target ECU know there is a tester present and to stay in programming mode, or possibly in boot-mode.

You might have noticed the above command uses 8 bytes. This is the maximum byte count of a CAN frame as defined by the CAN 2.0 standard.

This is a recording of some CAN frames. The ID is usually unique to the ECU the message is transmitted from. Normally 8 bytes are transmitted, but this can be 1-7 as described by the data length code DLC.

 

Programming by CAN Replay

To update the firmware on an ECU, the tester/programmer device must send hundreds or even thousands of CAN frames because they are limited to 8 bytes. Except for a few issues around security services, the CAN frames can often be known before-hand and either recorded during a programming session, or prepared by a tool.

The tester/programmer used for programming can be a PC with a USB2CAN adapter such as this one from 8devices.

 

Programming GP-meter 6.0 with CAN

GP-meter 6.0 is an air fuel ratio (AFR) gauge that uses the ECUHost 1.4 PCB. The ECUHost software includes a boot-loader program that communicates using UDS over CAN.

By replaying a firmware update script, the ECUHost controller microprocessor can receive new firmware that has new features and updates.

To replay the firmware update script, you can use MDAC Network Tool connected to the 8devices USB2CAN converter.

 

The Network Tool is designed to replay and record CAN traffic scripts in standard ASC format. Here is some video of the firmware update.

 

And video of the GP-meter 6.0 booting after the firmware is updated.

Summary

The GP-meter 6.0 can be updated using a low-cost converter such as USB2CAN from 8devices or Leaf-Light from  Kvaser.

The MDAC Network Tool is a free programming application in beta testing please contact MDAC if you would like to try it for updating your GP-meter 6.0.