I'm betting nobody will answer this one even if they know, but here goes:

Has anyone figured out what the bytes in red, that are always '00', are for?

55 59 20 00 00 00 88 cb 00 00 00 a9 05 22 0d

The green ones appear to be the fuel rate. The blue ones are timing. The very last two, in black, are engine speed/2, 0.125RPM/bit.

I'd just try stuffing numbers in there to see what happens, but I can't afford a new vp44 if I screw up the PSG by doing so.

 

I am totally lost on this one. Maybe you can educate me.

What CAN message are you referring to?

What is PSG?

 

PSG = the module on top of the vp44 (also called the FPCM, and many other names)

The message I'm looking at is what gets sent from the engine controller to the vp44 over the CAN bus.

 

There is a shielded 2-wire datalink between the VP44 and the ECM.

I am under the impression that this datalink is a J1587 datalink and is not a CAN bus. I could be wrong. I do not think that there is a CAN bus anywhere on a VP44-equipped ISB.

How did you read this message on the VP44-ECM data link? Scan Tools do not display individual datalink bytes, they can process the info and display the intended message.

Did you backprobe pins 1 & 2 at the VP44 or pins 4 & 13 at the ECM to retreive the data?

 

It is a CAN bus. There is an Intel 82527 CAN controller chip inside the ECM that is used to talk to the vp44 through the 'vp44 datalink (+) and (-)' pins. This datalink also appears on the pins going out to the 3-pin data link connector (the ones that various aftermarket boxes and the Cummins tools connect to).

I read the message using a hacked ECM software that allows me to browse the ECM's memory while the truck is running. With this, I can read the data that is in the buffer before it is transmitted to the vp44 by the 82527 controller chip.

The software works with a special cable that is used to connect a laptop computer to the truck's OBD port.

Jim

 

Could those bits be for 3 cylinder mode and advanced diag/calibration.
If the vp44 requests data from the ecm is it random and at what frequency.
What happens if the ecm doesn't respond in a timely manner will it just keep going with the last reply data. Is the CAN controller buffer a fixed memory location? maybe you can search all the code for any sections that write there. I have one schematic that has a wire between the vp44 and ecm labeled KNOCK SENSOR RETURN . I always thought this was an error have you discovered any thing in the code that looks like that could be?

 

I don't know what happens if the ECM doesn't respond in a timely manner. What I do know is there is one message transmitted per cylinder, and the 3-cylinder function (and also the diagnostic cylinder disable) are accomplished by transmitting the message for that cylinder with the fuel rate filed set to zero.

The KNOCK SENSOR RETURN - I saw that one too. I believe it is an error.

The vp44 does send data back to the ECM, a message with error bits encoded into it. The message processing function clearly shows where the P0216 and other errors get activated from.

The various CAN messages have fixed buffer locations. I have completely disassembled/commented the function in the code that sends the message in question. The field that's always zero comes from a word in the calibration data that is zero in all the softwares I have looked at.

 

I have heard the vp44 could do multiple injection events but was not implemented could that be the extra bytes?

 

i dont know if this is considered can protocol. closed area network protocal may be a little bit on the advanced side because it is only between two modules in this sense. However i do agree with you that this is indeed a variation of the can protocol. Anyway The first thing that came to my mind when i saw that is possibly a malfunction count??? i really dot know though. PS is that sowtware home brewed or open source. i was trying to to something like that but the whole lack of free time thing shut it down

 

The software I'm using to communicate with the engine controller is something I wrote myself. I also had to hack the stock flash file to allow me to read memory, then reflash my truck with the hacked file.