First let me ask...how many diag codes are currently working in Nistune on the z31 ecu? So far the only one I have been able to get easily is for the CHTS.
Second, I cant seem to clear the codes. Is this function working yet? Can you explain how this works without the pot attached?
Diag codes...cant clear
Moderator: Matt
code currently is not implemented in NIStune or ROM image to change RAM values
these values would need to be cleared when the button is pressed. its a to do item and currently only works on Nissan consult
the RAM locations on mine are 0000/0001 yours might be different perhaps? i coudln't test it here. need to check your disassembly
can you tell me if the 0000/0001 DTC codes in RAM monitor change when you change things which would normally affect diag codes
these values would need to be cleared when the button is pressed. its a to do item and currently only works on Nissan consult
the RAM locations on mine are 0000/0001 yours might be different perhaps? i coudln't test it here. need to check your disassembly
can you tell me if the 0000/0001 DTC codes in RAM monitor change when you change things which would normally affect diag codes
okay i need your help with this one
here is the R31 stuff. it is split into two RAM addresses, with one bit representing each code ie
80 00 = RAM1: 1000000 RAM2: 0000000 = CAS
40 00 = RAM1: 0100000 RAM2: 0000000 = AFM
20 00 = RAM1: 0010000 RAM2: 0000000 = TEMP
etc
hex to binary if you use the windows calculator
below is the mappings that i use. on the right are the flashing LED codes (11, 12 etc)
i should also note that these internal to the ECU are duplicated at 1000,1001 in RAM. so i might need to clear these also from NIStune. they are also copied to 1402,1403 somewhere too... clearing may be a few more addresses than i thought. only can try... this will need another patch code update since i currenntly only allow writes to 0000-00ff in the RAM area on the boards to clear DTC codes at 0001,0002
the unused entires with the ; next to it my car doesn't use but they match other cars like R32 consult tables. you might use some of these in Z31 vehicles
RAM address 0001/0002
const WORD LCONSULT_DTCXREF_CAS = 0x8000; //11
const WORD LCONSULT_DTCXREF_AFM = 0x4000; //12
const WORD LCONSULT_DTCXREF_TEMP = 0x2000; //13
const WORD LCONSULT_DTCXREF_SPEED = 0x1000; //14
const WORD LCONSULT_DTCXREF_IGN = 0x0800; //21
const WORD LCONSULT_DTCXREF_FUEL_PUMP = 0x0400; //22
const WORD LCONSULT_DTCXREF_TPS = 0x0200; //23
const WORD LCONSULT_DTCXREF_NEUTRAL = 0x0100; //24
const WORD LCONSULT_DTCXREF_AIR_COND = 0x0080; //31
const WORD LCONSULT_DTCXREF_START = 0x0040; //32
const WORD LCONSULT_DTCXREF_UNUSED1 = 0x0020; //33 ; o2 sensor
const WORD LCONSULT_DTCXREF_UNUSED2 = 0x0010; //34 ; knock sensor
const WORD LCONSULT_DTCXREF_UNUSED3 = 0x0008; //41 ; air intake temp
const WORD LCONSULT_DTCXREF_UNUSED4 = 0x0004; //42 ; fuel temp
const WORD LCONSULT_DTCXREF_UNUSED5 = 0x0002; //43 ; TPS
const WORD LCONSULT_DTCXREF_OK = 0x0001; //44
your Z31s are different however. there are five RAM addresses
0001,0002,0003,0004,0005. i can see that 0001 and 0002 are duplicated at 1000,1001 like mine, but the other three???
i also see that 1425,1426,1427,1428,1429 are copied to these values. these may need to be cleared
what i need is for you guys to
(a) tell me all the DTC codes the Z31s have
(b) tell me what the Z32s may have which fill in the gaps
(c) use the RAM monitor and look at what DTCs you can generate, various RAM values to the different sensors. what values change 0001-0005?
to test stuff
- running MAF voltage out of range
- pulling temp plug
- not clearing speed sensor but all others during drive tests
- not using Air cond switch
- not using TPS switch etc
(all the switches in mine uses flags at register 0011)
etc
from disassembly i think the following (using dyno_more_boost3 as a base file for disassembly) look the same as my R31. so current nistune should work with at least these?
AFM = RAM 0001 & 1000 bit #40
CAS = RAM 0001 & 1000 bit #80
speed = RAM 0001 &1000 bit #10
coolant = RAM 0001 & 1000 bit #20
additional DTC checks i dont know about but are in the code....
check RAM address 0009 (what is this - can you guys find out. it checks a range between 02 - F8) if outside range then 1003 #40 and 1004 #40 are set
check RAM address 000B (what is this. another Z31 one? it checks range between 02 - F8 also). if outside then 0001 #20 and 1000 #20 are set
check RAM address 1057 (another Z31 one? check range 02 - F1). sets bits 0004 #20 and 1003 #20 if set
check RAM 1000#20, RAM 0013 < B799 (some constant ROM value), RAM 1058 < B79B (another constant ROM value). if these fail set 0003#08
check RAM 142b < 5 then 0001#10
etc etc
the checks in this code to set DTCs against RAM values are massive compared to mine. i dont know what DTCs you guys have or where to start here to display them. maybe something to do with turbo model and more sensors?
routines for the code in this file start at 8CC5 in this file
example
00AA is the CAS flag
1000 and 0001 are the DTC RAM store areas for DTC flags
this will either get set by
or #$80 = set flag #80
or unset by
and #$7f = negate (#ff - #7f = #80) so turns off this flag
in this example
various ram addresses are checked (using CMP instructions) and then jump to set or clear flags
too much to go through at this stage. perhaps see what you guys can find in the car what codes are triggered watching the monitor.
if i have a list of DTC codes it may all fall in place like it did for my car (ie codes are in same order as bits stored in ecu DTC RAM locations in table above)
8CC5 L8CC5:
8CC5 : D6 AA " " ldab X00AA
8CC7 : CA 80 " " orab #$80
8CC9 : D7 AA " " stab X00AA
8CCB : B6 10 00 " " ldaa X1000 ;cas
8CCE : 8A 80 " " oraa #$80
8CD0 : B7 10 00 " " staa X1000
8CD3 : C1 8A " " cmpb #$8A
8CD5 : 25 16 "% " bcs L8CED
8CD7 L8CD7:
8CD7 : 96 01 " " ldaa X0001 ;cas
8CD9 : 8A 80 " " oraa #$80
8CDB : 97 01 " " staa X0001
8CDD : 7F 14 07 " " clr X1407
8CE0 : 20 0B " " bra L8CED
;
8CE2 L8CE2:
8CE2 : 7F 00 AA " " clr X00AA
8CE5 : B6 10 00 " " ldaa X1000 ;cas clear
8CE8 : 84 7F " " anda #$7F
8CEA : B7 10 00 " " staa X1000
let me know how it goes
here is the R31 stuff. it is split into two RAM addresses, with one bit representing each code ie
80 00 = RAM1: 1000000 RAM2: 0000000 = CAS
40 00 = RAM1: 0100000 RAM2: 0000000 = AFM
20 00 = RAM1: 0010000 RAM2: 0000000 = TEMP
etc
hex to binary if you use the windows calculator
below is the mappings that i use. on the right are the flashing LED codes (11, 12 etc)
i should also note that these internal to the ECU are duplicated at 1000,1001 in RAM. so i might need to clear these also from NIStune. they are also copied to 1402,1403 somewhere too... clearing may be a few more addresses than i thought. only can try... this will need another patch code update since i currenntly only allow writes to 0000-00ff in the RAM area on the boards to clear DTC codes at 0001,0002
the unused entires with the ; next to it my car doesn't use but they match other cars like R32 consult tables. you might use some of these in Z31 vehicles
RAM address 0001/0002
const WORD LCONSULT_DTCXREF_CAS = 0x8000; //11
const WORD LCONSULT_DTCXREF_AFM = 0x4000; //12
const WORD LCONSULT_DTCXREF_TEMP = 0x2000; //13
const WORD LCONSULT_DTCXREF_SPEED = 0x1000; //14
const WORD LCONSULT_DTCXREF_IGN = 0x0800; //21
const WORD LCONSULT_DTCXREF_FUEL_PUMP = 0x0400; //22
const WORD LCONSULT_DTCXREF_TPS = 0x0200; //23
const WORD LCONSULT_DTCXREF_NEUTRAL = 0x0100; //24
const WORD LCONSULT_DTCXREF_AIR_COND = 0x0080; //31
const WORD LCONSULT_DTCXREF_START = 0x0040; //32
const WORD LCONSULT_DTCXREF_UNUSED1 = 0x0020; //33 ; o2 sensor
const WORD LCONSULT_DTCXREF_UNUSED2 = 0x0010; //34 ; knock sensor
const WORD LCONSULT_DTCXREF_UNUSED3 = 0x0008; //41 ; air intake temp
const WORD LCONSULT_DTCXREF_UNUSED4 = 0x0004; //42 ; fuel temp
const WORD LCONSULT_DTCXREF_UNUSED5 = 0x0002; //43 ; TPS
const WORD LCONSULT_DTCXREF_OK = 0x0001; //44
your Z31s are different however. there are five RAM addresses
0001,0002,0003,0004,0005. i can see that 0001 and 0002 are duplicated at 1000,1001 like mine, but the other three???
i also see that 1425,1426,1427,1428,1429 are copied to these values. these may need to be cleared
what i need is for you guys to
(a) tell me all the DTC codes the Z31s have
(b) tell me what the Z32s may have which fill in the gaps
(c) use the RAM monitor and look at what DTCs you can generate, various RAM values to the different sensors. what values change 0001-0005?
to test stuff
- running MAF voltage out of range
- pulling temp plug
- not clearing speed sensor but all others during drive tests
- not using Air cond switch
- not using TPS switch etc
(all the switches in mine uses flags at register 0011)
etc
from disassembly i think the following (using dyno_more_boost3 as a base file for disassembly) look the same as my R31. so current nistune should work with at least these?
AFM = RAM 0001 & 1000 bit #40
CAS = RAM 0001 & 1000 bit #80
speed = RAM 0001 &1000 bit #10
coolant = RAM 0001 & 1000 bit #20
additional DTC checks i dont know about but are in the code....
check RAM address 0009 (what is this - can you guys find out. it checks a range between 02 - F8) if outside range then 1003 #40 and 1004 #40 are set
check RAM address 000B (what is this. another Z31 one? it checks range between 02 - F8 also). if outside then 0001 #20 and 1000 #20 are set
check RAM address 1057 (another Z31 one? check range 02 - F1). sets bits 0004 #20 and 1003 #20 if set
check RAM 1000#20, RAM 0013 < B799 (some constant ROM value), RAM 1058 < B79B (another constant ROM value). if these fail set 0003#08
check RAM 142b < 5 then 0001#10
etc etc
the checks in this code to set DTCs against RAM values are massive compared to mine. i dont know what DTCs you guys have or where to start here to display them. maybe something to do with turbo model and more sensors?
routines for the code in this file start at 8CC5 in this file
example
00AA is the CAS flag
1000 and 0001 are the DTC RAM store areas for DTC flags
this will either get set by
or #$80 = set flag #80
or unset by
and #$7f = negate (#ff - #7f = #80) so turns off this flag
in this example
various ram addresses are checked (using CMP instructions) and then jump to set or clear flags
too much to go through at this stage. perhaps see what you guys can find in the car what codes are triggered watching the monitor.
if i have a list of DTC codes it may all fall in place like it did for my car (ie codes are in same order as bits stored in ecu DTC RAM locations in table above)
8CC5 L8CC5:
8CC5 : D6 AA " " ldab X00AA
8CC7 : CA 80 " " orab #$80
8CC9 : D7 AA " " stab X00AA
8CCB : B6 10 00 " " ldaa X1000 ;cas
8CCE : 8A 80 " " oraa #$80
8CD0 : B7 10 00 " " staa X1000
8CD3 : C1 8A " " cmpb #$8A
8CD5 : 25 16 "% " bcs L8CED
8CD7 L8CD7:
8CD7 : 96 01 " " ldaa X0001 ;cas
8CD9 : 8A 80 " " oraa #$80
8CDB : 97 01 " " staa X0001
8CDD : 7F 14 07 " " clr X1407
8CE0 : 20 0B " " bra L8CED
;
8CE2 L8CE2:
8CE2 : 7F 00 AA " " clr X00AA
8CE5 : B6 10 00 " " ldaa X1000 ;cas clear
8CE8 : 84 7F " " anda #$7F
8CEA : B7 10 00 " " staa X1000
let me know how it goes
Ok. I tried clearing a temp sensor code that had popped up in the latest version (.76) and it seemed to work. Havent had time for anything else yet.
Here's some info from the FSM regarding diag modes and DTCs.
The z31 ecu has 5 modes.
Mode 1 - "Mixture Ratio Feeback Control Monitor A"
- During closed loop the green LED goes on when lean and off when rich
-During open loop the green LED stays on or off
Mode 2 - "Mixture Ratio Feedback Control Monitor B"
-Green LED acts the same as in Mode 1
- During closed loop the red LED turns on or off simultaneously with the green LED if the mixture ratio is controlled within the specified value
- During open loop the red LED stays on or off
Mode 3 - Self-Diagnosis
Codes - (green blinks, red blinks)
11- Crank angle sensor circuit
12 - Air flow meter circuit
13 - Cylinder head temp sensor circuit
14 - Vehicle speed sensor circuit
21 - Ignition signal missing in primary coil
22 - Fuel pump circuit
23 - Idle Switch
31 - E.C.S.
32 - E.G.R. function (California ecus only)
33 - Exhaust gas sensor circuit
34 - Detonation sensor circuit (turbo only)
35 - Exhaust gas temp circuit (California ecus only)
42 - Fuel temp sensor circuit
43 - Throttle sensor circuit (Cali ecus only)
45 - Injector leak (Cali ecus only)
55 - No malfunction in above circuits
It's also important to note that these codes are stored in the ecu for 50 starts after the last occurance of the code. Once the ecu has started 50 times after the last malfunction was detected the error code gets cleared. Maybe this has something to do with codes being copied to other locations?
Mode 4 - Switches On/Off diagnosis
- Monitors the On/Off condition of the idle switch, starter switch, and vehicle speed sensor
Mode 5 - Real time diagnosis
- The inspection lamps display the error codes similar to mode 3 but as
the malfunction happens
------------------------------------------------------------
As far as actual codes (blinks) the z32 ecu uses....
11, 12, 13, 21, 34, 42, and 43. These are all the same as the z31 codes.
The z32 also has code 54 "Signal circuit from A/T to ECU) for auto transmisison.
Here's some info from the FSM regarding diag modes and DTCs.
The z31 ecu has 5 modes.
Mode 1 - "Mixture Ratio Feeback Control Monitor A"
- During closed loop the green LED goes on when lean and off when rich
-During open loop the green LED stays on or off
Mode 2 - "Mixture Ratio Feedback Control Monitor B"
-Green LED acts the same as in Mode 1
- During closed loop the red LED turns on or off simultaneously with the green LED if the mixture ratio is controlled within the specified value
- During open loop the red LED stays on or off
Mode 3 - Self-Diagnosis
Codes - (green blinks, red blinks)
11- Crank angle sensor circuit
12 - Air flow meter circuit
13 - Cylinder head temp sensor circuit
14 - Vehicle speed sensor circuit
21 - Ignition signal missing in primary coil
22 - Fuel pump circuit
23 - Idle Switch
31 - E.C.S.
32 - E.G.R. function (California ecus only)
33 - Exhaust gas sensor circuit
34 - Detonation sensor circuit (turbo only)
35 - Exhaust gas temp circuit (California ecus only)
42 - Fuel temp sensor circuit
43 - Throttle sensor circuit (Cali ecus only)
45 - Injector leak (Cali ecus only)
55 - No malfunction in above circuits
It's also important to note that these codes are stored in the ecu for 50 starts after the last occurance of the code. Once the ecu has started 50 times after the last malfunction was detected the error code gets cleared. Maybe this has something to do with codes being copied to other locations?
Mode 4 - Switches On/Off diagnosis
- Monitors the On/Off condition of the idle switch, starter switch, and vehicle speed sensor
Mode 5 - Real time diagnosis
- The inspection lamps display the error codes similar to mode 3 but as
the malfunction happens
------------------------------------------------------------
As far as actual codes (blinks) the z32 ecu uses....
11, 12, 13, 21, 34, 42, and 43. These are all the same as the z31 codes.
The z32 also has code 54 "Signal circuit from A/T to ECU) for auto transmisison.
Last edited by Stinky on Tue Feb 14, 2006 3:10 am, edited 1 time in total.
hmmm the z31 has modes simlar to the r32. do those modes seem to work in practice like in the service manual?
my R31 only has two modes
1. if the selector is in diagnostics mode, it will flash the codes as indicated above
2. if the selector outside diagnostics mode, it will flash green/red codes depending on mixture ratio (see the service manual section i posted for details)
i will add the extra 'unused' values to match your table. i will also clear the extra memory addresses i know about
my R31 only has two modes
1. if the selector is in diagnostics mode, it will flash the codes as indicated above
2. if the selector outside diagnostics mode, it will flash green/red codes depending on mixture ratio (see the service manual section i posted for details)
i will add the extra 'unused' values to match your table. i will also clear the extra memory addresses i know about
Two quick things I noticed tonight.
Ram address 0003h goes to 10h when code 34 is thrown.
Ram address 0002h? goes to 40h when code 22 is thrown.
To add to this 02/16/06
01h goes to 20h when chts code is thrown
01h goes to 60h with chts code and afm code
01h goes to 40h when afm code is thrown but not chts
02h goes to 80h when coil is unplugged
Temp and afm code work for sure. Fuel temp and fuel pump codes dont seem to work.
Also......
I've noticed the diag modes seem to be acting a bit funny. For example when I got to switch between modes sometimes the lights skip past mode I. The lights will blink III, IIII, IIIII,II,... Sometimes it does it sometimes it doesnt. Also, i have to double check but it seems like codes sometimes get erased without me doing anything that should erase them. I need to do more testing with the oem bin.
Ram address 0003h goes to 10h when code 34 is thrown.
Ram address 0002h? goes to 40h when code 22 is thrown.
To add to this 02/16/06
01h goes to 20h when chts code is thrown
01h goes to 60h with chts code and afm code
01h goes to 40h when afm code is thrown but not chts
02h goes to 80h when coil is unplugged
Temp and afm code work for sure. Fuel temp and fuel pump codes dont seem to work.
Also......
I've noticed the diag modes seem to be acting a bit funny. For example when I got to switch between modes sometimes the lights skip past mode I. The lights will blink III, IIII, IIIII,II,... Sometimes it does it sometimes it doesnt. Also, i have to double check but it seems like codes sometimes get erased without me doing anything that should erase them. I need to do more testing with the oem bin.
i have included the extra codes for Z31 in the latest version (excluding cali ecu codes since i dont know how they are implemented) but from what you have indicated so far ooks like the Z31 works quite differently....
so currently we have the following table from what you've checked. I've added mine in [] what i think these should still be. you will notice there that only the LHS digit is used for each ram address. i dont know what the RHS digit is then but for the codes below its always 0....
ram1,ram2,ram3 = xx,xx,xx
[80,00,00 CAS (11)]
40,00,00,AFM (12)
20,00,00 Water temp (13)
[10,00,00 Speed (14)]
00,80,00,Ignition signal (21)
00,40,00 Fuel pump (22)
[00,20,00 TPS idle (23)]
[00,10,00 Neutral (24)]
[00,00,80 Air cond (31)]
[00,00,40 Start (32)]
[00,00,20 O2 Sensor (33)]
00,00,10 Detonation Knock sensor (34)
there is probably a fourth ram4 used for Airintake, fuel temp, tps also given the logical pattern above
so your Z31 ecu splits what i represent in ram1,2 over ram1,2,3,4 from the pattern i can see above. this can be adjusted accordingly in the software
some of these codes in my ecu (like air cond) need to be cancelled out by activating the switch, then the code will disappear.
please try the OEM bin since i dont actually change any RAM locations unless the software using Clear DTCs actually tells it to
if you have disconnected the diagnostics pot, this may cause the ecu to skip through these codes. perhaps shorting where the pot was located, or moving the pot / USB connector somewhere else in the ecu
what code do you get when you unplug one of the spark plugs? 02/80h still?
what about the AFM, do you get an air intake temp signal at all?
so currently we have the following table from what you've checked. I've added mine in [] what i think these should still be. you will notice there that only the LHS digit is used for each ram address. i dont know what the RHS digit is then but for the codes below its always 0....
ram1,ram2,ram3 = xx,xx,xx
[80,00,00 CAS (11)]
40,00,00,AFM (12)
20,00,00 Water temp (13)
[10,00,00 Speed (14)]
00,80,00,Ignition signal (21)
00,40,00 Fuel pump (22)
[00,20,00 TPS idle (23)]
[00,10,00 Neutral (24)]
[00,00,80 Air cond (31)]
[00,00,40 Start (32)]
[00,00,20 O2 Sensor (33)]
00,00,10 Detonation Knock sensor (34)
there is probably a fourth ram4 used for Airintake, fuel temp, tps also given the logical pattern above
so your Z31 ecu splits what i represent in ram1,2 over ram1,2,3,4 from the pattern i can see above. this can be adjusted accordingly in the software
some of these codes in my ecu (like air cond) need to be cancelled out by activating the switch, then the code will disappear.
please try the OEM bin since i dont actually change any RAM locations unless the software using Clear DTCs actually tells it to
if you have disconnected the diagnostics pot, this may cause the ecu to skip through these codes. perhaps shorting where the pot was located, or moving the pot / USB connector somewhere else in the ecu
what code do you get when you unplug one of the spark plugs? 02/80h still?
what about the AFM, do you get an air intake temp signal at all?