35 replies to this topic

[AeroNotix]

@Aeronotix

You are a programmer yourself,

so why not downloading the code and programming yourself?

Colin has  his code on the web and mine is on the web too :github com/LeopoldG

Both are open source. Mine is based on Colins librosco and  I wrote it with QT (open source too) but you may enhance it for linux or whatelse .

 

 

A few things:

 

• I already mentioned I was playing with librosco
• It doesn't work with MEMS1.9 (MPI) minis
• None of the libraries on your github seem to do anything other than wrap Colin's librosco
• I have tried MEMSDiag_lite with no success so far. I have emailed the developer (more on this later)
• The thread you linked is about adding a 16-pin connector to a K-series Caterham that didn't ship with the connector. I have the diagnostics connector (obviously) so I don't need to wire one in.

 

Out of frustration with no success between poking the MEMS1.9 ECU with the existing librosco library (AGAIN, librosco ONLY implements the MEMS1.6/SPI "protocol") I decided to download the MEMSDiag_lite apk from the Android PlayStore and decompile it. Here's what I found:

 

• The actual on-wire protocol/bytes sent is exactly the same between MEMS1.6 and MEMS1.9.
• The only difference I can find between 1.6 and 1.9 what MEMSDiag_lite is doing is performing some as of yet not understood (because the decompiled java .class files aren't very readable) initialisation routine.
• The initialisation sequence is very simple, both MEMSDiag_lite and librosco have the same init sequence and MEMSDiag_lite uses the same one for 1.9.
• MEMSDiag_lite performs a strange set of commands over USB where it sends some data, pauses for a few hundred milliseconds and sends more.
• The data it sends in these sequences is not any "real" data, but it is simply some USB-level protocol commands.
• This is as far as I understand it. 

 

With the decompiled MEMSDiag_lite Java code, I obviously don't have the original source code but a representation of it built from the compiled classes in the MEMSDiag_lite APK from the PlayStore. I am fully aware that code built from decompilers is often not 100% accurate, however I certainly believe that the initialisation sequence is the same between MEMS1.6 and MEMS1.9. I believe the difference in the protocol lies simply in how those bytes are sent and the parameters used for creating the serial connection.

 

I don't have any tools such as an oscilloscope/logic analyzer nor an actual code reader to reverse engineer the MEMS1.9 initialisation sequence so I am hoping that someone may know more on how it works compared to MEMS1.6.

 

 I *personally* can't get MEMSDiag_lite itself to work with my set up. I have no idea why, the MEMSDiag_lite application just times out trying to wake up the ECU. When I manually send the initialisation sequence of {0xCA, 0x75, 0xD0} they all get echoed back by the ECU, in librosco (and the MEMSDiag_lite decompiled code) they then proceed to send 0xF4 which on BOTH pieces of code the ECU then fails to respond to this byte. Apparently the next data from the ECU after 0xF4 should be a large (if I remember correctly 34 bytes) data frame containing various sensors/values. 

 

This is the point I am stuck. I'm convinced the initialisation sequence is the same but willing to be corrected. I believe the issue lies somewhere else.

[AeroNotix]

Has anone got a standard MPI car to connect with an app..? that would be awesome!

Apparently people have but so far I am not having any luck. Since other people have managed to get MEMSDiag to work I assume the issue lies in my set up. I listed by set up above if any one has any insight.

[pauldridge]

Several people have asked about specific links to obtain the cable needed for the SPI version of the MEMS_DIAG Android app.  Here it is:

The 3-pin cable for the SPI came from the UK.. here is the expired listing,
but I am pretty sure the seller has them available regularly"

http://www.ebay.com/...872.m2749.l2648

The OBDII-style cable also came from eBay, and supposedly should work with
the MPI set up (untested by me, but I may try it on my airbag diagnostic
plug as I get time)

http://www.ebay.com/...872.m2749.l2649

For each of these cables, which terminate in a "standard, old-style" USB
plug, if you are going to use on your Android device, you will need a simple
adapter cable, available readily on Amazon.

Finally, the Android diagnostic software is available on the Google Play
Store:
https://play.google....rmemsfull&hl=en

There is a free version with limited capabilities, but I went ahead and
sprung for the paid version, which, as I recall, was under $10.  The paid version includes provision to semi-permanently change several ECU parameters in real time, such as idle speed, and ignition timing offset.

My only minor difficulty: initially it wasn't connecting, so I emailed the
developer.. He suggested I select a different MEMS version in the software..
turns out the initial default is for MEMS 1.9 (likely the MPI version),
whereas the SPI MEMS is 1.6. Once I changed that parameter I was off and
running.

[AeroNotix]

Well, personally I've got a similar cable. I've tried MEMSDiag_lite and it doesn't connect. It times out. I've emailed the developer to see what he thinks might be going on. 

 

On a bit of a tangent, reading about the ECUs available I've read that the ECU with a single black connector (no vacuum input) is a MEMS1.9 (https://blackbox-sol...help/SM002.html)

. The ECU with a black and red connector is a MEMS2J. (https://blackbox-sol...help/SM072.html) 

Will this make any difference in communicating with the ECU using MEMSDiag?

 

For example, on my 1998 MPI. The ECU is of the latter type, with both a red and black connector.

Edited by AeroNotix, 23 August 2017 - 12:42 PM.

[genpop]

Hi Aeronotix

 

MemsS 2J is not supported neither by mems-gauge, nor by mems-diag. You may try Toaf

[AeroNotix]

Neither is MEMS1.9 supported by librosco. I'm hestitant to believe that there are vast differences in the underlying protocol as evidenced by the code in MEMSDiag_lite I've seen. 

 

I've seen toaf but it's a closed-source, paid-for, Windows-only application. Doesn't really fit my use-case. I'll give it a go, however. 

 

Anyway, the point is, we need more eyes on the protocol to describe and document it. Colin made a very good blog post explaining the 1.6 protocol, for example.

[FlyingScot]

I would suggest that you check that physically the lead for the 16 pin actually connects the MEMS signals. Remember it isn't EOBD on MEMS 2J. Also the Rover set up for the MPi is always a bit flaky even when using a proper code reader as the chassis and signal grounds weren't respected in the connector. That and the fact the MEMS ECU keeps power on for a while can lead the unwary to getting a false connection,

FS

[AeroNotix]

I would suggest that you check that physically the lead for the 16 pin actually connects the MEMS signals. Remember it isn't EOBD on MEMS 2J. Also the Rover set up for the MPi is always a bit flaky even when using a proper code reader as the chassis and signal grounds weren't respected in the connector. That and the fact the MEMS ECU keeps power on for a while can lead the unwary to getting a false connection,

FS

 

My plan for when I got home from work today was to check the actual ECU <> diagnostics port wiring. I'm aware that the connector/protocol is Rover's own and not any widely-used standard.

 

My question is more about whether any one knows for sure without guessing or assuming that if MEMS1.9 and MEMS2J are in fact massively different from MEMS1.6 (protocol-wise)? And also whether or not it is correct that the later MPI Minis did indeed have MEMS2J ECUs installed.

 

As I've mentioned, the initialisation sequence that MEMSDiag_lite seems to use for MEMS1.9 isn't at all different from MEMS1.6, it does however seem to do funky thing with the USB connection and changing parameters with random sleeps embedded in the init sequence. I'm reading decompiled code so it doesn't make much sense. Hoping someone could shed some light on that. 

 

As for false connections. The only thing I've managed to get so far from the ECU is it echoing basically any byte that I send it aside from 0xF4, on 0xF4 it does not reply.  Anything else it'll echo straight back at me. 

Edited by AeroNotix, 23 August 2017 - 02:18 PM.

[AeroNotix]

Right. I'm running TOAF in a Windows VM on my laptop and passing through the serial port to it and dumping serial traffic on the host machine with slsnif.

 

At first glance, it seems to be doing something, but alas, the program returns absolute garbage. It seems that TOAF just expects the connection to be made as literally nothing is being returned from the ECU. TOAF just continually feeds it data. 

 

So, I don't believe TOAF works with this. I could try to contact the developers of TOAF and see if they know for sure whether or not it would work with a late MY MPI.

 

Any other ideas welcome guys and gals.

[AeroNotix]

Also, is the pscan.eu adapter anything more than a regular old USB<>Serial adapter? It costs 145 quid. Since the MEMS1.9, MEMS1.6 versions work with this software, and the MEMS1.9 ECU works with things like MEMSDiag_lite (apparently) why does pscan.eu need the 145 quid adapter? 

 

Something smells fishy there.

[Carvell]

Interesting to know what the answer is on this. I've been thinking of buying a ACR4 but then saw the Pscan was cheaper. Now there seems to be more in the mix.

[AeroNotix]

Looking at pscan's kickstarter there is some special sauce in the adapter. Come on peeps, someone has to know more about the protocol.

 

Years and years and all these minis and only a handful of people know anything about it? I'm shocked!

Edited by AeroNotix, 23 August 2017 - 06:55 PM.

[eric.sen]

Yes !

But years and years waiting for someone able the decode the MEMS 2J and loving the Minis !

 

I'm following this topic and hoping for a future App and cable for our Mini

[AeroNotix]

People have done it and gone the way of turning into their profit. Which obviously I understand. I wouldn't have done that personally but it's understandable. 

 

For me, I just want something I can talk to the ECU with. I'd prefer to write something myself but futzing around with the protocol very likely requires an existing ECU reader any way and associated tooling to analyze the protocol when using those tools (this is how librosco was created).

 

Same for pscan.eu I would guess. Though pscan.eu supports a whole bunch of other protocols for the various ECUs.

 

I just need a starting point, I don't have the tools to analyze the protocol and if I did I'd just use the scanner as is! Surely someone must have some idea about the proprietary protocol used on MEMS2J. I've done countless hours of searching on the internet and there's quite literally nothing out there on the underlying protocol! MEMS1.6, MEMS1.9 all have been analyzed and their protocols described (mainly by Colin and librosco). MEMS2J not so much.

Edited by AeroNotix, 24 August 2017 - 11:33 AM.

[FlyingScot]

Not sure what your objective is ?

You want to know so you don't have to purchase something that someone else has spent time and money to develop?

Or from a technical interest point of view?

I'm guessing here but the earlier protocols could probably be worked out from analysing a proprietary code reader or if you were that way inclined reading the software code on the units EPROMs (which could be an infringement of the owners copywrite)

FS