Background
So how did Mazda disable this function with a simple PCM firmware update? (if you're not interested in the history / already know, you can skip reading this section and just jump straight ahead to the Instructions section )
Well, most cars with electronic modules have something called as-built data, which can be thought of as the "DNA" of the car. It is a chunk of data that maps out all the features the car left the factory with, effectively a series of on-off switches that tell the PCM what hardware is present and so which functions it should enable. There is also more complex data encoded in there, such as the VIN, country codes, units to use etc, and probably a lot more that we haven't decoded yet. Basically everything required to define a particular model for a particular market (USDM, EUDM, JDM, etc.), and everything that identifies that specific car.
This means that the actual executable code (firmware) that runs on the PCM can be identical or very similar across different markets (it is stored separately to the as-built data, such that if the firmware is updated, the as-built data stays the same, and vice versa), cutting costs and making production easier. (This is a bit of a simplification for the purposes of this explanation - we know for example that JDM PCMs run slightly different code for their quirky features, but the majority is the same). The PCM just disables certain routines once it has read the as-built data and knows that the hardware for a particular function isn't present. In other words, the firmware is like a program running on your computer, and the as-built data could be thought of as a configuration file that the program loads, telling it how to behave. Or something along those lines.
Cars that have cruise control from the factory, such as some US models, and the R3, therefore have a bit set in the as-built data to signify this. The PCM is supposed to check this before allowing cruise control to work, however it seems the original build of the firmware on early UK S1s didn't. I believe Mazda's PCM firmware update simply corrected this mistake, such that it now checks the as-built data first, before allowing cruise to work. Since UK S1s weren't supposed to have cruise control hardware, the correct bit is not set in the as-built data, and so it stopped working for those who retrofitted the steering wheel buttons (but still continued to work in US cars for example, who likely got the same/similar firmware update, because their as-built data does have the cruise bit set).
So in order to enable the function again, we have to modify the as-built data (modifying the firmware code itself is a next to impossible task, unless you want to disassemble hundreds of thousands of lines of assembler code - much harder than mapping which is "just" modifying static data tables - though people do do it...). I have identified which part of the as-built data needs to be changed by comparing the as-built data of cars from different markets around the world that do or don't have cruise control, narrowing it down to only a small number of possibilities. Thanks to everyone who provided their data which made this possible! With some trial and error, I found the correct bit to flip (as in computer "bit", yes it is as "simple" as changing a single 1 to a 0)! See here if interested: https://www.rx8ownersclub.co.uk/forum/v ... 0#p1049461. For an even more in-depth look at the data if you're really bored, see my FORScan forum post here: http://forscan.org/forum/viewtopic.php? ... =10#p16553
Instructions
So how do we do it? Up until now, the only way to program the as-built data was using Mazda's IDS software and compatible hardware (VCM or a clone). This either required a trip to a dealer, large investment in diagnostic scan tools (high £100's-£1000), or messing about with clone hardware (still ~£80-£100) and running IDS in a VM to bypass the licensing, which is temperamental at best. It can be done though, as evidenced by this post: https://www.rx8ownersclub.co.uk/forum/v ... 5#p1101701, and if you prefer to go down that route, or perhaps already have IDS setup there are instructions here: https://www.rx8ownersclub.co.uk/forum/v ... 5#p1096906
Well, not content with that, I have a better way. Having been kindly lent a VXDiag VCX Nano (one of the better VCM clones) by forum user "ed80" after he got it working (thanks dude! ), I've done all the hard work for you, reverse engineered the protocol, and re-written it for ELM327 based OBD scan tools, which can be picked up for next to nothing (£5-£20, but most people already have them lying around). I recommend a USB one, Bluetooth sometimes works but is a bit hit-and-miss. Not tried Wifi (I don't have one), fundamentally it should work but it is untested thus far (let us know if you try one and it works!). The problem is the latency - to write the as-built data successfully the commands must be sent in quick succession or it will fail. Some poorer quality ELM327 clones are just not fast enough, and my guess is neither is Wifi.
Anyway, first of all, it's obvious but has to be said just in case:
WHILST I HAVE TAKEN EVERY PRECAUTION I CAN TO MAKE THIS AS SAFE AS POSSIBLE, I TAKE NO RESPONSIBILITY IF SOMETHING GOES WRONG AND YOU BRICK YOUR ECU OR ANY OTHER ASPECT OF YOUR CAR STOPS WORKING OR CHANGES BEHAVIOUR IN AN UNDESIRABLE WAY. PROCEED ENTIRELY AT YOUR OWN RISK!
The program I have written can be downloaded from the bottom of this post. However, there are some pre-requisites / hardware mods that need to be performed first - read the steps below.
Also note that it may not work on remapped ECUs. This is because most mappers use MazdaEdit to "protect" their maps, which basically just means changing the securityAccess shared secret "key" in the PCM ROM. There's not much we can do about this - not even Mazda would be able to reprogram your ECU at this point - the best you can do is ask your mapper to unlock it for you, or put it back to a stock unprotected map temporarily so you can modify the as-built data, then put the proper map back on. The mod should persist across maps (which are really PCM firmware flashes), as explained earlier in this post. EDIT: Confirmed - the mod will persist across remaps - I had a full remap after my bridgeport and the cruise still works
It won't break anything if you do try it on a mapped ECU and it fails, it'll just give you an error message - so you can safely give it a try anyway if you like. There is another option - dump the flash memory of your ECU (requires hardware mods, soldering etc.) and extract the key from the ROM - but your mapper may not be best pleased about this I'm curious to find out if the key is the same for all MazdaEdit maps, or different on a map-by-map or mapper-by-mapper basis. EDIT: Recent evidence seems to suggest that MazdaEdit may be using the same key for all protected maps, which I have coded into my program. So it should work for mapped ROMs too now. Give it a try and see!
Right, with that out of the way, here we go:
- Install a set of cruise control steering wheel buttons as per the instructions in this thread: https://www.rx8ownersclub.co.uk/forum/v ... =30&t=7129
Ignore the big red warning about it not working any more, we now have the powers to change that If you have a later model year car (we think post '06 when they changed lots of stuff?) then you may be lucky and already have the wiring in place, and just need to add the buttons and plug them in. - Check you have a 4-pin brake pedal switch (black connector), and if not, install one. Non-cruise cars tend to only have the 2-pin switch (white connector). Depending on the age of your car, you may also have to add another wire for this over to a connector in the passenger foot well, and a ground, just like for the steering wheel buttons. See here. Again, later cars may already have this wiring, so it's not enough to assume if there's 4 wires going to the brake switch then it's a 4-pin one - pull the connector out and check for the physical pins. Cruise will work for a short while with a 2-pin switch if you ground the corresponding wire (see https://www.rx8ownersclub.co.uk/forum/v ... 5#p1106167), but once enabled quickly throws DTCs and stops working, followed by an eventual CEL. So I'd recommend installing a 4-pin switch before enabling cruise in your data.
- Obtain an ELM327-based OBD scan tool. This is probably the most annoying part. It must support HS-CAN (ISO15765-4 CAN, 11bit ID, 500 Kbaud). It will without a doubt be a Chinese clone version of the ELM327 (https://en.wikipedia.org/wiki/ELM327#Pirate_clones), which is fine, but some clones are better than others. I recommend an older USB one. Bluetooth is next best, may work, may not. WiFi seems to have the most latency. YMMV. Basically the better the clone it is, the more likely it is to work. The As-built data may fail to write on poorer quality "bad" clones / slower devices. I seem to have gotten lucky in that the one I own is quite a "good" clone. It's an ELM327 USB V1.4 if that helps, with a 500kbps FTDI UART chip for communication with the PC.
- Plug the ELM327 into your computer (or connect if it's wireless), install drivers, and find out which COM port it has been assigned to. If you don't know how to do this you may struggle with the next part... (but there are plenty of guides on the internet, hint - look in device manager for the serial COM port).
- Download the latest version of rx8cc.zip from the attachments to this post below. Unzip it. You should find an executable rx8cc.exe inside. It is just a python script packaged up with PyInstaller, feel free to decompile it and check the Python source if you wish - there's nothing sinister but I encourage you not to trust random .exes from the internet! It is a command line program, no GUI I'm afraid, if you're not familiar with the command line I'd suggest you get someone to help you (hint: navigate to the unzipped folder and type "cmd" in the address bar, then hit return).
- Connect ELM327 OBD scan tool to car and switch on the ignition.
- Run the following command from the command line in the folder you extracted the zip to:
where <n> is the COM port number you found out earlier. E.g.
Code: Select all
rx8cc.exe COM<n>
For help you can also runCode: Select all
rx8cc.exe COM4
Code: Select all
rx8cc.exe --help
- The program will read your current ABD, check to see if the cruise control bit is enabled, and if it isn't, perform the necessary modification to enable it, all automatically. Just sit back and let it work its magic Hopefully you won't get any errors, but if you do it should give you some hints as to what the problem is. I have included a lot of error handling, so it should catch most common problems and be relatively fail-safe. Sometimes it can think it hasn't programmed the data when it actually has - just run the program again and it should say "Cruise control already enabled" if that was the case (it is fine to run the program multiple times). In fact, do try running it a few times if it fails to rule out patchy adapters (especially Bluetooth/Wifi).
- Once it's done, turn off your ignition and disconnect everything, then go for a drive to enjoy your new cruise control!
If you want to show your appreciation, I accept beer and/or food or the means to obtain them
Troubleshooting
If you keep getting errors around the writing or verifying process having tried several times, it could be that your ELM327 just isn't fast enough / up to the job of doing the programming. Try a different one if you have one, and let us know - perhaps we can build up a list of adapters that work and ones that don't! Failing that, there's always the Mazda IDS + VCX Nano option to fall back on.
If it fails for any reason other than the a write/verify failure, then something else may be wrong - check your setup. RX8CC should give you some hints in its error messages. Until this has been tested on multiple devices with multiple cars there are likely to be certain combinations / conditions that don't work, and some bugs to iron out, so bear with me. Give it a try on your setup and let us know if it works!
If the programming was successful, and you can now switch on cruise control and get the orange "cruise main" light, but you can't actually set a speed and activate cruise and get the green "cruise" light, then you likely have the wrong brake pedal sensor switch and/or need to add some wiring - see here: https://www.rx8ownersclub.co.uk/forum/v ... 3#p1104723. We currently believe this only applies to pre-'55 plate 231s (no idea about 192s or AT). Alternatively, one of your pedal sensor switches or associated wiring may be faulty - clutch, brake, transmission neutral. From the technical guide, in order to activate cruise control the following conditions must be met:
Cruise control operation condition
- When all of the following conditions are met, execution of the cruise control system is enabled (cruise control standby status).
- Cruise control main switch: ON
– Vehicle speed: Exceeds 27 km/h {16.8 mph}
- When any of the following conditions are met even while in cruise control, the PCM stops the cruise control and clears the set vehicle speed.
– Ignition switch: OFF
– Cruise control main switch: OFF
– Cruise control related DTCs (P0564, P0571) detected - When any of the following conditions are met even while in cruise control, the PCM stops the cruise control while storing the set vehicle speed.
– Cancel switch: ON
– Neutral switch or CPP switch: ON
– Vehicle speed: Less than 22.5 km/h {13.9 mph}
– Brake switch: ON
– The actual vehicle speed is 15 km/h {9.3 mph} or more lower than the set vehicle speed during cruise control (ascending).
– Condition where actual vehicle speed is 15 km/h {9.3 mph} or more lower than the set vehicle speed continues for 60 s or more even when the RESUME/ACCEL switch is on.
Please try and keep this thread for discussion of the program itself, or any bugs, working / not working etc.
For hardware discussion / problems (e.g. cruise switching on but not holding speed, which is usually a brake switch wiring issue), please refer to / post in this thread: https://www.rx8ownersclub.co.uk/forum/v ... d#p1104723
Cheers
Attachments: