Announcement

Collapse
No announcement yet.

Explained: Scangague II (SG2) vs Torque Pro (TP)

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Explained: Scangague II (SG2) vs Torque Pro (TP)

    Note: Below is for a 2012 KDJ150 (Diesel) Kakadu and may not work with GRJ150 and later GDJ150 models. There should be enough info below to convert to the 7E02182 PIDs used on these models for the temp sensors.

    SG2 is a much lower level device that requires a more intimate understanding of how data is used within a computing environment. For instance, TP operates on a much higher function level by filtering the response messages and converting the hexadecimal values into decimal and storing them in single bytes labelled A, B, C, D, etc. for manipulation along with some inbuilt functions such as int16(A:B) which converts 16 bits of information into a 16 bit integer (this is equivalent of 256*A+B which most will be familiar with). This makes it relatively easier to understand and fiddle with.

    On the other hand, with SG2 the user is required to understand how the messages are returned and apply the appropriate filter to correctly identify and extract the required information. There is a good PDF floating around explain how this works if you look for it. You will need to be able to understand and interpret the hexadecimal system along with twos compliment for negative numbers. However, this paper does not describe how SG2 handles large data packets which appears to be present in firmware 4.0 and above (hence the SG2 website requirement for some of the codes). I assume for this explanation this paper has been read along with the Wiki page on OBD2 and PID protocols.

    A good starting place which explains each of the scenarios would be to make a gauge for the transmission oil pan temperature sensor, torque convertor temperature sensor, torque converter lock status and turbine rotational speed. To accomplish this you require PID 0xD9 and 0xDA and various different RXF filters which will be explained. I have previously posted about this for TP where I assumed it appeared the temp sensors are only 8 bits. I have since been able to get Techstream working and can confirm they are 16 bits and scaled down in order to get the decimal place.

    TXD
    The TXD part is fairly straight forward and understandable for both SC2 and TP. So I won’t dwell too much. Using SG2 the TXDs used will be TXD: 07E121D9 and TXD: 07E121DA. At this stage it’s important to understand that both devices pack these TXDs with additional bytes to simplify usability. More information can be found on the Wiki page. In TP, the PID will be 21D9 and 21DA and both headers 7E1.

    RXF
    This is where it gets a bit messy based on the way SG2 handles the response. TP automatically filters the data for you and deals with it (high level) where as with SG2 you need to understand the message structure to locate the info (low level). This is explained in the PDF regarding Xgauge coding structure however doesn’t discuss how the large data packets are handled with firmware 4.0 and above.

    We’ll start with the RXF required to locate the torque converter lock up bit. The TXD will be 07E121DA and the message received back will be something like “07E9xx61DAaabbccdd” where xx is the data length (in bytes) and aa, bb, etc. correlate to TP with bytes A, B, C and D. The SG2 filter using an offset to ensure it has picked up the correct response from the ECU. In this case we are mostly concerned about the two bytes 0x61 and 0xDA. The 0x07 header value begins as an offset of byte 1 (don’t ask why the designer didn’t use 0 for this). This make bytes 02 = 0xE9, byte 03 = xx byte 04 = 0x61 and byte 05 = 0xDA. Thus, the RXF will become RXF: 02E9046105DA. The leading 0 of the offset can be used for special inputs, in this case, assigning the second offset of 0461 to 2461 tells the SG2 we want to display the value as either ON or OFF.

    Now, with PID 0xD9 where the temperature sensors sit and the turbine speed, you will be familiar with the bytes in TP labelled E and F, and G and H. This is a large response from the ECU and is handled very differently to the above example. Typically, the response from TXD: 07E121D9 will be “07E9xxyy61D9aabbccddeeffgghh”. The turbine speed resides in data byte aa (A in TP). What we can see is the additional “yy” byte. I haven’t really tried to figure what this is yet, but it causes the required RXF filter offsets to be shifted. Thus, to locate byte A, the RXF becomes RXF: 02E9056106D9.

    Again, to try and complicate things even more, when accessing the data for bytes E to H for the two temperatures, the SG2 seems to store this somewhere else unrelated to the 0x61D9 response and is based on the original TXD query. In this case, the bytes E onward can be filtered by applying RXF: 02E903210000. Again though, we can do more to the data by assigning one of the special functions in offset 2. Buy setting this to “8” the RXF becomes RXF: 02E983210000. Adding this means that the data is divided by 10 and a decimal place is inserted. It just needs to be remembered that you will then need to multiply the data in the MTH function for this. Using the value of “4” will give two decimal places and need multiplying by 100.

    Hopefully this now gives an insight into the codes you see on the SG2 website. It’ll also require you to do some fiddling with the RXF depending on the size of the payload and where the data you want is located.

    RXD
    The RXD is fairly easy to explain now that RXF has been discussed. The first byte (leading two numbers) tells SG2 how many bits (remember a byte consists of 8 bits) with the first bit being assigned 00 and the second byte (last two numbers) is how long the data is in bits. Again, these are hexadecimal numbers.

    I’ll start here with the turbine speed as it uses a single byte of data and not a specific bit. So for the turbine speed, we have established it is the first returned data byte aa (or A in TP). We know the offset byte for 0xD9 was 06, thus the 7th byte in the sequence consists of bits 48 to 55. We then need to convert this to hexadecimal, 48 = 0x30 and thus RXD will be RXD: 3008. When it comes to the temperature sensors, keeping in mind the offset for 0x0321, meaning bytes E will actually start from bit 24 = 0x18 and is 2 bytes (16 bits) long 16 = 0x10 and the RXD: 1810 (bytes E and F) and RXD: 2810 (bytes G and H). For the torque converter lock up bit, the TP equation I come up with previously was bit(A:4) so bit 4 in byte A. This will convert to RXD: 2B01 (bit 43, single bit in length).

    MTH
    The math function is again straight forward. The MTH input consists of 6 bytes of information, 2 for the multiplier, 2 for the divisor and 2 for the add/subtract. Again, we need to remember the add/subtract represent negative numbers as the twos compliment. First of all, the torque converter lock bit doesn’t need any maths and it’s either on or off, so the MTH is simply MTH: 000100010000.

    The turbine speed is detailed (searched on the internet) as being the turbine rotational speed in 50rpm increments. This means that the conversation equation in TP is (12750/255)*A. To convert this to MTH in SG2, we need to convert to hexadecimal 12750 = 0x31CE and 255 = 0x00FF and the MTH will become MTH: 31CE00FF0000.

    The temperature sensors have scaled two bytes of data from 0 to 255 (in decimal) thus in TP the equations are int16(E:F)/257-40 and int16(G:H)/257-40. The int16(xx:yy) is a simpler way of writing 256*xx+yy making the equation more readable, it basically converts two bytes (16bits) into an integer. Remember in RXF for the temp sensors we used an offset of 0x8321? Well now we need to multiply the data by 10. Normally the MTH will be MTH: 00010101FFD8 (257 = 0x0101, -40 = 0xFFD8 signed twos compliment to match the TP equations), but because we are multiplying by 10 because the RXF offset divides by 10 we end up with MTH: 000A0101FE70 (10 = 0x000A, 257 = 0x0101, -400 = 0xFE70).

    ***Update: temp scaling changed to 257=(2^16-1)/(2^8-1)***


    Final settings
    So now the part we’ve all been waiting for… drum roll please… These have been verified using Techstream.

    Transmission oil pan temperature (°C)
    In SG2
    • TXD: 07E121D9
    • RXF: 02E983210000
    • RXD: 1810
    • MTH: 000A0101FE70
    • NME: cAT
    and for TP
    • PID = 21D9
    • Min = -40
    • Max = 215
    • Scale = x1
    • Unit = °C
    • Equation = int16(E:F)/257-40
    • Header = 7E1
    Torque converter temperature (°C)
    In SG2
    • TXD: 07E121D9
    • RXF: 02E983210000
    • RXD: 2810
    • MTH: 000A0101FE70
    • NME: cTC
    and for TP
    • PID = 21D9
    • Min = -40
    • Max = 215
    • Scale = x1
    • Unit = °C
    • Equation = int16(G:H)/257-40
    • Header = 7E1
    Turbine Speed (RPM)
    In SG2
    • TXD: 07E121D9
    • RXF: 02E9056106D9
    • RXD: 3008
    • MTH: 31CE00FF0000
    • NME: rTC
    and for TP
    • PID = 21D9
    • Min = 0
    • Max = 6000
    • Scale = x1
    • Unit = RPM
    • Equation = (12750/255)*A
    • Header = 7E1
    Torque Converter Lock (ON/OFF)
    In SG2
    • TXD: 07E121DA
    • RXF: 02E9246105DA
    • RXD: 2B01
    • MTH: 000100010000
    • NME: TCL
    and for TP
    • PID = 21DA
    • Min = 0
    • Max = 1
    • Scale = x1
    • Unit =
    • Equation = bit(A:4)
    • Header = 7E1
    Attached Files
    spencerm106
    Junior Member
    Last edited by spencerm106; 24-06-2020, 11:01 PM.

  • #2
    Great post, always nice to see people sharing their research.

    Comment


    • #3
      I can't 100% confirm, but think I have found the injection periods. note that the " / " indicates the different gauges, there are four in total. Further from the original post, you can now see how more user friendly TP is over SG2.

      SG2:

      TXD: 07E021AD
      RXF: 02E8056106AD
      RXD 3010/4010
      MTH: 000100010000
      NME: sP1/sP2 (micro seconds Pilot 1 injection period / Pilot 2 injection period)

      TXD: 07E021AD
      RXD: 02E803210000
      RXD: 1810/2810
      MTH: 000100010000
      NME: sMI/sAI (micro seconds Main injection period / After injection Period)

      Torque Pro:
      PID: 21AD
      Long name: [Prado] Pilot 1 Injection Period / [Prado] Pilot 2 Injection Period / [Prado] Main Injection Period / [Prado] After Injection Period
      Shortname: sP1 / sP2 / sMI / sAI
      Minimum Value: 0
      Maximum Value 65535
      Scale factor: x1
      Unit type: us
      Equation: int16(A:B) / int16(C : D) / int16(E:F) / int16(G:H)
      OBD header to use: 7E0
      Attached Files
      spencerm106
      Junior Member
      Last edited by spencerm106; 24-06-2020, 10:20 PM.

      Comment


      • #4
        Great info, ill test it tomorrow - btw, this throws an error when setting up Pilot 2 int16(C) Should it read int16(C : D) without the spaces??

        Comment


        • #5
          Originally posted by blw View Post
          Great info, ill test it tomorrow - btw, this throws an error when setting up Pilot 2 int16(C) Should it read int16(C : D) without the spaces??
          Yes mate, I tried to edit it to int16(C : D) but didn't change.... Now I know why... Haha. Thanks.

          Comment


          • #6
            I'm also thinking for the temps the divider should be 257 (0x0101) and not 256 (0x0100). Based on (2^16-1)/(2^8-1)=257. But that's just probably being pedantic. Close enough for practical purposes. I'll update tomorrow.

            Comment


            • #7
              I tested the Injector duration values on my 2015 (1KD) Hilux and its working, its showing similar values to your screenshot.

              Comment


              • #8
                Hi Guys,
                Any chance you got to find the pid's for the injector volume #1/2/3/4 thanks

                Comment


                • #9
                  The holy grail... I went through and logged each and every byte over a few days and recorded results in excel (for $21, so 00 to FF) I then looked for bytes that would reflect the right values and run them through the correct scaling with no luck. Maybe I missed them, maybe they use a specific CAN bus not related to the standard OBDII (my thoughts). So I don't think they are possible to find.

                  Comment


                  • #10
                    Hi Spencer,

                    Are you only looking for 1KD codes?

                    I have logged and mapped most of the codes for the new 1GD 150kw Engine/Transmission ECU which includes the injector durations, volumes and feedback values etc if they are of any interest to anyone I will post what I have found..

                    Comment


                    • #11
                      If it's any help, from this post Prado 150 PID Codes - Toyota Prado How To's, Technical Information & Reviews (pradopoint.com.au) the most likely codes that contain the injector values your after are 21A3 and 21AD which are both in the 21Ax series and multi-frame responses. I found that the data is generally structured with info grouped and most are in the same order as on the Techstream display.

                      Command: 21a3 response (The 15 prior to 61A3 indicates that the message is 21 bytes long):
                      7E8101561A300910100
                      7E82100000000000E00
                      7E8220000006B610003
                      7E8234D000000000000

                      (Message Content: 00 91 01 00 00 00 00 00 00 00 0E 00 00 00 00 6B 61 00 03 4D 00 00 00 00 00 00)

                      Command: 21ad response (The 1B prior to 61AD indicated the message is 27 bytes long so there should be another frame):
                      7E8101B61AD01CD01D3
                      7E82102E80000FF8CFF
                      7E822DB03B200008041
                      7E823463F39027C01FD

                      (Message content: 01 CD 01 D3 02 EB 00 00 FF 8C FF DB 03 B2 00 00 80 41 46 3F 39 02 7C 01 FD XX XX)
                      ptommo59
                      Member
                      Last edited by ptommo59; 08-04-2023, 01:06 PM.

                      Comment


                      • #12
                        I'd definitely be interested to see what you have for the 1GD. My earlier work was only for 1KD and I did a fair bit of playing around with both A3 and AD PIDs and couldn't find anything that would match up to the injector values.

                        With the messages, the message length includes the 61xx in the DLC, thus there isn't another frame for 7E021AD response, FD is the last byte of data. I've started an example cheat sheet on how to use xgauge to supplement the old one that's been floating around, mostly focusing on the multi frame packets, so I can assure you this is the case.

                        It has been a few years now, so might be worth going back. But yes, please flick through some of those 1GD codes.

                        Cheers Spence

                        Comment


                        • #13
                          Hi Spence,

                          This is what I have found so far - There are lots of unverified items and formulas but it' s a good start point for anyone that is interested in topic (Sorry had to save as tab delimited text to be under max upload size limits) 1GD-FTV 150kw PID List.txt

                          You should be able to copy into excel to make more readable but first select the entire blank worksheet and convert to text as cell type, or it will strip all the leading zeros.

                          Cheers Phil
                          Attached Files
                          ptommo59
                          Member
                          Last edited by ptommo59; 09-04-2023, 02:59 PM.

                          Comment


                          • #14
                            Cheers Phil

                            I've just spent the day having another look for the 1KD (I came in because footy is about to start). I believe I may have found the injector feedback values. I may have missed them years ago as I think I was using the wrong equation. I landed on (xx*20/128) -10 which seems to work. I originally assumed 8-bits, but it appears they could be 7-bits in the 1KD, your sheet looks like 8-bit precision.

                            So if people are interested, can they please try the following and report back for injector feedback values? From what I can see it matches pretty close to Techstream, however, I can't run both simultaneously (Techstream loses connection with ECU).

                            TXD:07E021AD
                            RXF: 032280000000
                            RXD: 4808
                            MTH: 00C8 0080 FF9C
                            NAM: VI1 (injector feedback value #1)

                            TXD:07E021AD
                            RXF: 032380000000
                            RXD: 1808/2008/2808
                            MTH: 00C8 0080 FF9C
                            NAM: VI2/VI3/VI4(injector feedback value #2, #3 and #4)

                            I can see the other values nearby are also the other readings, but didn't have time to figure out the equations yet. So I'll save that for another day. The 80 on frame 07E22 (4008) is likely the Injector volume feedback learning and the 58 on frame 07E23 (3808) appears something to do with the volume.
                            spencerm106
                            Junior Member
                            Last edited by spencerm106; 10-04-2023, 11:34 AM.

                            Comment


                            • #15
                              Looks promising :-)

                              One question in your MTH you are multiplying by 206 using 00CE should this be 00C8 (200) to match your proposed equation with the RXF config xxxx8xxxxxxx and the -10 to 10 range?

                              Agree that 07E22 (4008) is likely the Injector volume feedback learning in 8 bit (*20/256-10)
                              Also suggest that the values between the after injection period and Injector volume feedback learning value are most likely the pilot1 (FF4A), pilot 2(FF96), main (03B2) and after injection (0000) timing in signed 16 bit groups. The range changes for each so not certain if it's a standard equation for all or custom for each.
                              07E23 (3010) could be the Injection volume in 16 bit (*10/512)
                              Only leaves the last 2 bytes (01 08) in 07E23 to crack.
                              ptommo59
                              Member
                              Last edited by ptommo59; 10-04-2023, 12:05 PM.

                              Comment

                              canli bahis siteleri bahis siteleri ecebet.net
                              mencisport.com
                              antalya escort
                              tsyd.org deneme bonusu veren siteler
                              deneme bonusu veren siteler
                              gaziantep escort
                              gaziantep escort
                              asyabahis maltcasino olabahis olabahis
                              erotik film izle Rus escort gaziantep rus escort
                              atasehir escort tuzla escort
                              sikis sex hatti
                              en iyi casino siteleri
                              deneme bonusu veren siteler
                              casibom
                              deneme bonusu veren siteler
                              deneme bonusu veren siteler
                              betticket istanbulbahis
                              Working...
                              X