Honda SEFMJ protocol

[AndreyB]

Trying to make a PnP for 2004 Honda Civic Si with K engine. Last frontier is A/C control and dash coolant temperature gauge.

I am stuck and confused about pin E24 called SEFMJ, it runs between ECU and multiplex control unit.

* At the moment I am still not sure if that's a uni-directional serial or bi-directional something
* if it's a bi-directional then what is it? we have k-line tja1021 circuit which seems to work on Mazda but did not pass through SEFMJ traffic.

wiring diagram https://github.com/rusefi/rusefi_documentation/raw/master/OEM-Docs/Honda/2003-acura-rsx-type-R.pdf

A/C diagram attached

image.png (7.56 KiB) Viewed 2693 times

[mck1117]

have you scoped that pin on a working unmodified car?

[AndreyB]

So many hints on the internet but nothing definitive

hondata mention that pin could be repurposed as serial output http://www.hondata.com/help/kmanager/index.html?serialoutput.htm

AIM says pin is ECU *output* but how would A/C request work if it's only output?! https://www.aemelectronics.com/sites/default/files/aem_product_instructions/30-6030%20Series%202%20Plug%20%26%20Play%20EMS.pdf

http://www.race-technology.com/forum/viewtopic.php?t=2079 says it's a custom RS-232?!

mentions k-line

image.png (12.55 KiB) Viewed 2691 times

[AndreyB]

have you scoped that pin on a working unmodified car?

logic analyzer snippet in first post is from working car, with resistor divider. A couple of photos of same, on unmodified car.

[mck1117]

well it's certainly 9600 baud 8n1 serial, probably bidirectional on that one line. So it's effectively LIN/kline.

[mck1117]

image.png (72.16 KiB) Viewed 2665 times

[AndreyB]

well it's certainly 9600 baud 8n1 serial, probably bidirectional on that one line. So it's effectively LIN/kline.

Effectively LIN/kline or proper TJA1021 LIN?

Somehow I was not able to sniff with TJA1021 - nothing on RX pin of TJA1021. Yes baud rate was wrong on software side but I would expect something on the scope?

[AndreyB]

Ohh Link calls it kline

image.png (47.22 KiB) Viewed 2651 times

[AndreyB]

Effectively LIN/kline or proper TJA1021 LIN?

They say that LIN is k-line with break and 0x55 sync byte. So here we have k-line not Lin.

[AndreyB]

Hello CRC8_EBU with 0xFF OutXor

http://www.sunshine2k.de/coding/javascript/crc/crc_js.html

image.png (41.28 KiB) Viewed 2571 times

[puff]

LIN definitely looks different.

[AndreyB]

More drama https://github.com/rusefi/hellen125honda-issues/issues/33#issuecomment-1454827569

[puff]

K-line and Lin, although based on usart, are still different protocols. The image from the scope could be a break frame sent by Lin master (right now playing with it) - it should be followed by sync byte (0x55), and Id byte, followed by data and crc.

[puff]

L-line is a third one, which is different from Lin

[AndreyB]

Progress - now with a bench setup!

Now time to improve software a bit

2023-03-09_17_28_04_573: EngineState: kline: 0x40
2023-03-09_17_28_04_573: EngineState: kline: 0x7E
2023-03-09_17_28_04_573: EngineState: kline: 0x40
2023-03-09_17_28_04_573: EngineState: kline: 0x7E
2023-03-09_17_28_04_573: EngineState: kline: 0x40
2023-03-09_17_28_04_573: EngineState: kline: 0x7E

image.png (2.34 MiB) Viewed 2360 times

image.png (2.27 KiB) Viewed 2360 times

[AndreyB]

thank you @dron_gus for the great idea

Code: Select all

2023-03-10_23_01_06_349: EngineState: kline: got 0x40
2023-03-10_23_01_06_349: EngineState: kline: got 0x00
2023-03-10_23_01_06_349: EngineState: kline: got 0x00
2023-03-10_23_01_06_349: EngineState: kline: got 0x00
2023-03-10_23_01_06_349: EngineState: kline: got 0x7E
2023-03-10_23_01_06_349: EngineState: happy CRC 0x7E
2023-03-10_23_01_06_349: EngineState: kline: got count 0x05
2023-03-10_23_01_06_349: EngineState: kline: got 0x40
2023-03-10_23_01_06_349: EngineState: kline: got 0x00
2023-03-10_23_01_06_349: EngineState: kline: got 0x00
2023-03-10_23_01_06_349: EngineState: kline: got 0x00
2023-03-10_23_01_06_349: EngineState: kline: got 0x7E
2023-03-10_23_01_06_349: EngineState: happy CRC 0x7E

[AndreyB]

Have data, need help guessing the protocol!

Raw data pack https://github.com/rusefi/rusefi_documentation/tree/master/OEM-Docs/Honda/E24-SEFMJ-white-civic-si

Notes on problem statement: https://github.com/rusefi/rusefi_documentation/blob/master/OEM-Docs/Honda/E24-SEFMJ-white-civic-si/E24-SEFMJ-white-civic-si.md

[AndreyB]

Looks like too little data variation to deduct much.

Q packet only happens in the "going to sleep" scenario.

sometimes leading means BCM?: Header 0: packet of length 4. Total 6 payload variations
[0x0 0x1 0x0 0x0 , 0x0 0x40 0x6 0x0 , 0x0 0x40 0x8 0x0 , 0x0 0x40 0x86 0x0 , 0x0 0x40 0xe 0x0 , 0x0 0x50 0x0 0x0 ]

sometimes leading means BCM?: Header 1: packet of length 3. Total 1 payload variations
[0x1 0x0 0x0 ]

unknown: Header 2: packet of length 6. Total 2 payload variations
[0x2 0x0 0x0 0x50 0x0 0x0 , 0x2 0x0 0x10 0x50 0x0 0x0 ]

BCM with A/C: Header 64: packet of length 4. Total 5 payload variations
[0x40 0x0 0x8 0x0 , 0x40 0x40 0x6 0x0 , 0x40 0x40 0x8 0x0 , 0x40 0x40 0x86 0x0 , 0x40 0x40 0xe 0x0 ]

sometimes leading means BCM?: Header 65: packet of length 3. Total 1 payload variations
[0x41 0x0 0x0 ]

rare?: Header 66: packet of length 6. Total 2 payload variations
[0x42 0x0 0x0 0x50 0x0 0x0 , 0x42 0x0 0x10 0x50 0x0 0x0 ]

BCM QUIT: Header 81: packet of length 3. Total 1 payload variations
[0x51 0x0 0x0 ]

rare?: Header 130: packet of length 6. Total 1 payload variations
[0x82 0x0 0x10 0x50 0x0 0x0 ]


https://github.com/rusefi/rusefi/commit/eb9e48906ac83bf42c63cd5a0bc3a2b92d4233a2

[AndreyB]

I've replayed 0x02 packet and fuse box has noticed!

New logs added into existing zip files https://github.com/rusefi/rusefi_documentation/commit/067ccc76722a82ac7230a8126b086602644c3ae7

image.png (19.98 KiB) Viewed 1748 times

[AndreyB]

Looks like too little data variation to deduct much.

Same 0x0 0x10 0x50 0x0 0x0 payload in packets 0x2 0x42 and 0x82 those seem related

0x1 0x0 0x0 from BCM usually gets 0x2 ECU response and 0x41 from BCM usually gets 0x42 response

Same 0x40 0x86 0x0 payload comes in 0x0 and 0x40 packet

Quit 0x51 has same lower "1" nibble.

So it seems to be about nibbles not bytes.

0 lower nibble of first byte BCM status, no response from ECU
1 lower nibble is BCM requesting ECU
2 lower nibble is ECU response