AT/SST/CVT MUT communication

[acamus]

I have started to decipher AT part of mitsu code, so mainly GTA and CT9W shall benefit from this.
But I see potential for X guys.

So far I have found in 88780004:
MUT_REQUEST_0 = AT_MUT_UNK0 = constant reply 0x81
MUT_REQUEST_1 = AT_MUT_UNK1 = constant reply 0x45
MUT_REQUEST_2 = AT_MUT_UNK2 = constant reply 0x5
AT ECU ID probably

Now all MUT request > 2 are taken from AT_MUT_Table. Last one is MUT_REQUEST_AD.
AE-FF are AT MUT commands. 0xFC seems to clear AT DTC's

Now the only outstanding issue is how to initialize, but as far as I could see
the initialization shall be @10,400bps and when done switching to 15625. I hope someone can test this.

[0xDEAD]

Good stuff. How popular is the 4g63 bolted to an AWD transmission in your country?

[Ceddy]

Acamus, you sure it doesn't do a 5 Baud Init?

Almost all the ISO ecus use a 5-Baud Init.

The H8 5 Baud Init is impossible to follow.
Baud isn't changed to 5, instead it does a reverse Bit-Bang by checking if the K-Line is Hi/Low every 200 mS.

The Init Response is spaghetti code, but can be found by searching for bytes loaded into the TX buffer.
MUT sends: 55 EF 85
OBD sends: 55 08 08

I'm not sure which CPU the AT TCU uses, but if you found the code in a ECU with the same CPU the code may match.

Since the 5 Baud Init isn't in the code in Byte form, its easiest to find by setting up a loop and sending all 256 combinations.

[logic]

Since we're playing with init codes, has anyone spent any time with the 2g or Evo SRS ECU, by any chance?

(Ask me about my book: "Thread Hi-Jacking for Fun and Profit". )

[acamus]

Originally Posted by Ceddy

Acamus, you sure it doesn't do a 5 Baud Init?

Almost all the ISO ecus use a 5-Baud Init.

The H8 5 Baud Init is impossible to follow.
Baud isn't changed to 5, instead it does a reverse Bit-Bang by checking if the K-Line is Hi/Low every 200 mS.

The Init Response is spaghetti code, but can be found by searching for bytes loaded into the TX buffer.
MUT sends: 55 EF 85
OBD sends: 55 08 08

I'm not sure which CPU the AT TCU uses, but if you found the code in a ECU with the same CPU the code may match.

Since the 5 Baud Init isn't in the code in Byte form, its easiest to find by setting up a loop and sending all 256 combinations.

Wakeup sequence is still valid also for AT part.

[acamus]

Originally Posted by 0xDEAD

Good stuff. How popular is the 4g63 bolted to an AWD transmission in your country?

If you are asking about EVO's, its rare. One can see more Eclipses thou.
4G63 on 2WD can be seen more frequently.
But we are speaking about ~1% market share of all sold cars in Slovakia for mitsu.

[acamus]

Originally Posted by logic

Since we're playing with init codes, has anyone spent any time with the 2g or Evo SRS ECU, by any chance?

(Ask me about my book: "Thread Hi-Jacking for Fun and Profit". )

Starting point for SRS is the OBD pinout

OBD Mitsu pinout:

1 Diagnosis control line
2 J1850 (+) line
3 Suspension - ECS -
4 Gnd
5 Gnd
6 Transmission - ELC-4/5AT
7 К-Line (ISO 9141)
8 Brake – ABS
9 ETACS: Pulse signal only
10 J1850 (-) line
11 Air Conditioner - Full Auto AC
12 Air Bag – SRS
13 Cruise Control – ASC
14 Vehicle speed signal
15 L-line (ISO 9141)
16 Power supply +12V
21 Traction – TCL/4WD
22 Steering - 4WS/ECPS
25 ECU
26 ECU programing
27 Transmission ECU programming
32 Adapter identification

[logic]

acamus, I've added that list to the wiki. Thanks for reminding me that I need to check my service manual from time to time.

[acamus]

So I have found some usefull AT MUT IDs

MUT_AT_0B_ADC_CHANNEL_11
MUT_AT_80_ADC_CHANNEL_1B
MUT_AT_81_ADC_CHANNEL_1D
MUT_AT_82_ADC_CHANNEL_1E
MUT_AT_83_ADC_CHANNEL_1F
MUT_AT_84_ADC_CHANNEL_1A
MUT_AT_85_ADC_CHANNEL_19
MUT_AT_86_TRANSMISSION_TEMPERATURE
MUT_AT_87_ADC_CHANNEL_1
MUT_AT_88_ADC_CHANNEL_18
MUT_AT_89_ADC_CHANNEL_12

[acamus]

I have verified that AT_MUT_86 is transmission temperature

AT MUT Table for 88780004 EVO IX GTA

<table name="AT MUT table" category="Misc" address="7F784" type="3D" level="1" scaling="Hex16">
		<table name="X" type="Static X Axis" elements="32" scaling="Hex16">
			<data>-</data>
			<data>0</data>
			<data>-</data>
			<data>1</data>
			<data>-</data>
			<data>2</data>
			<data>-</data>
			<data>3</data>
			<data>-</data>
			<data>4</data>
			<data>-</data>
			<data>5</data>
			<data>-</data>
			<data>6</data>
			<data>-</data>
			<data>7</data>
			<data>-</data>
			<data>8</data>
			<data>-</data>
			<data>9</data>
			<data>-</data>
			<data>A</data>
			<data>-</data>
			<data>B</data>
			<data>-</data>
			<data>C</data>
			<data>-</data>
			<data>D</data>
			<data>-</data>
			<data>E</data>
			<data>-</data>
			<data>F</data>
		</table>
		<table name="Y" type="Static Y Axis" elements="30">
			<data>AT_MUT0X</data>
			<data>AT_MUT1X</data>
			<data>AT_MUT2X</data>
			<data>AT_MUT3X</data>
			<data>AT_MUT4X</data>
			<data>AT_MUT5X</data>
			<data>AT_MUT6X</data>
			<data>AT_MUT7X</data>
			<data>AT_MUT8X</data>
			<data>AT_MUT9X</data>
			<data>AT_MUTAX</data>
			<data>AT_MUTBX</data>
			<data>AT_MUTCX</data>
			<data>AT_MUTDX</data>
			<data>AT_MUTEX</data>
			<data>AT_MUTFX</data>
			<data>AT_MUT10X</data>
			<data>AT_MUT11X</data>
			<data>AT_MUT12X</data>
			<data>AT_MUT13X</data>
			<data>AT_MUT14X</data>
			<data>AT_MUT15X</data>
			<data>AT_MUT16X</data>
			<data>AT_MUT17X</data>
			<data>AT_MUT18X</data>
			<data>AT_MUT19X</data>
			<data>AT_MUT1AX</data>
			<data>AT_MUT1BX</data>
			<data>AT_MUT1CX</data>
			<data>AT_MUT1DX</data>
		</table>
	</table>