1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

DRB III Reverse Engineering Project

Discussion in 'General Viper Discussion' started by MoparMap, Oct 21, 2019.

  1. Mumbles05

    Mumbles05 VCA Member VCA Member

    Posts:
    34
    Joined:
    Mar 18, 2016
    Location:
    Los Angeles
    https://www.amazon.com/dp/B07D21GG6J/

    I thought it was made by OTC and was later bought out by bosch who was providing repairs service for them up until a couple years ago.
    The switchbox for the sensors just handles cycling between the two sensors or selecting a single one. If you look back on the first page when I replied about the screen, it says it uses a 16 MHz Motorola 68332 which is a Motorola 68000-based CPU core.I don't believe the SC designation is of any consequence; the core architecture is still part of the same family. PEP is an abbreviation for "peripheral expansion port" and it was intended to host multiple different modules, though only one was ever made to fit there, so it will very likely be a generic protocol. It would have been way more difficult to develop and maintain a proprietary protocol. The PEP module itself accommodates many different attachments, so again, it will likely be some standard protocol.

    I strongly suspect those sensors are just a rebranded off the shelf inclinometer. There was no reason they would have tried to develop their own when it had such a limited application to their vehicle line. The best route to pursue would be hunting down the manuals for existing similar sensors on the market, that explain how to add them to a system and communicate with them, and try to use the same commands to initiate the Viper inclinometer. Otherwise you will need to get a logic probe/analyzer and record the traffic from the DRB 3 to the sensor.

    Going that route, you'll need a logic analyzer, an actual DRB 3, the switch box with sensors and the knowledge on how to interpret the data you collect.
    There is no sense in jumping off the deep end by trying to dig that far into the DRB 3 when all signs point to a standard communications protocol being used to drive a rebranded off the shelf inclinometer. (SPI I2C UART RS-232)

    I did receive that single senor I ordered but haven't had the time to look into it more. I had a bunch of equipment become available so I've been working my butt off to sell some stuff to keep my head above water with the new stuff coming in; had 15 used micropod 2's come in just this week. The holidays had me a bit busy as well. I might get some more time later to assist you but you are the only one with any relevant knowledge or experience in this area. I am also not in a position to buy additional hardware like a logic analyzer for investigating this.
     
    Last edited: Jan 3, 2020
  2. MoparMap

    MoparMap VCA National President Venom Member

    Posts:
    1,669
    Joined:
    Jan 7, 2013
    Location:
    Kansas
    Yeah, I guess the more I think about it the more it seems like it should just be RS232. The level shifter chip is in there and the port "looks" like a standard 9 pin serial, so it would make sense to actually operate like one (aside from the multiplexing part and power). As far as I can guess it seems like there should only be three messages the DRB III uses too. There would be one to zero one axis, one to zero another, and one to read back an axis (probably another one for the other axis, but I don't think the DRB III actually uses it). I haven't seen any consistent message setup on the few serial inclinometers I've found, but I guess that's still somewhere to start. Finding someone with a DRB III, sensors, and a signal analyzer does seem to be the issue, though that would probably be the fastest way to get an answer. I need to see if there is a generic serial "ping" command or something so I can at least verify I have the right baud rate. I've tried screening into a sensor with my Raspberry Pi at some typical baud values, but I don't see any feedback. I'm not sure that just doing that would actually give me any feedback though since that's more trying to SSH in than just send a command.

    I did hear back from some contacts, but not quite the detail I'm looking for yet. They did say that they tested the sensors against an alignment machine and found that they were within 3%, so at least they aren't as critical as some have made them out to be in the past. Though they are about the only way to check rear caster as the "normal" way to measure that is to turn the wheels 20 degrees either direction. Not sure that rear caster is as important, but wouldn't hurt to be able to measure it to at least keep it consistent side to side.
     
  3. MoparMap

    MoparMap VCA National President Venom Member

    Posts:
    1,669
    Joined:
    Jan 7, 2013
    Location:
    Kansas
    I think I have an idea of the baud rate after reading up on some RS232 info and looking at my pictures again. On the sensor itself there is a large blue component that I think is somehow related to the clock generator. It doesn't look like a typical oscillator, but based on the part designation on the board (X1), I'm guessing it's not a capacitor. It appears to have 1.84G printed on it. From what I was reading, the baud rate is typically the clock rate divided by 16. 1.84 divided by 16 is 0.115. Moving some decimals around I'm guessing that's probably 115,200 baud. Will see about putting the scope on a sensor again this weekend to see if I can see any signal fluctuation at power on. I'm thinking it should make some kind of "noise" at power up if there is any type of boot sequence in it.
     
  4. Mumbles05

    Mumbles05 VCA Member VCA Member

    Posts:
    34
    Joined:
    Mar 18, 2016
    Location:
    Los Angeles
    I wish I could be of more help. I'm not too keen on sending my DRB 3 through an unnecessary tumble dry cycle, also known as the mail. I don't own the switchbox to go with my sensor and I don't own a Mixed signal oscilloscope or logic analyzer. I wouldn't know what to do with them if they were available to me either. If you want to formulate the experiment and mail me the appropriate hardware needed to use with my DRB 3, I'd be happy to help but it's not practicle for me to buy that stuff and learn the ins and outs of hardware communications protocols at this time. I'll read up on it in my spare time but it would take me awhile to catch up to what you already know so I'm not sure how helpful I would be.

    If you find yourself in the market for an oscilloscope, I'd suggest this one. It's well reviewed online and includes the protocol decoder.
    https://www.amazon.com/dp/B0771N1ZF9
     
    Last edited: Jan 3, 2020
  5. MoparMap

    MoparMap VCA National President Venom Member

    Posts:
    1,669
    Joined:
    Jan 7, 2013
    Location:
    Kansas
    No worries. I'm not really in a hurry to do it, it's more just a side project and I tend to get really focused on stuff and dig in further than I probably need and get carried away. CTC actually rents the real deal DRB III, $150 for 3 days if I was super desperate. I really don't have the equipment to be doing this the way I want either, but I have enough to be dangerous. I have a little cheapo digital oscilloscope my parents got me for Christmas several years back. Doesn't do much aside from displaying, but I can always screenshot it and do the "math" the long way. I think I more just like the challenge of trying to figure this out because it seems like a "simple" enough problem and if I can get the commands sorted out I have the parts to build a sensor reader already on hand. I've mostly just been posting everything I come across as a kind of journal to keep the info in one place and in case anyone else wants to follow along and has any ideas.

    From what I found online OTC is the one now owned by Bosch, which I think got their start with GM tools. It looks like the Miller line of Dodge tools is really just a named they badge on any tool that Mopar had made for dealers. If you go to the current Mopar tool site and the contact tab it actually shows that the correspondence is care of Snap-On. The CTC website claims they developed the original DRB III and the emulator afterwords. I've emailed them, but haven't heard anything back yet. Was hoping I could get a datasheet on the inclinometer from them, but not holding my breath. Don't suppose you have a contact there from all the troubleshooting and work you've done regarding the DRB III?
     
  6. Mumbles05

    Mumbles05 VCA Member VCA Member

    Posts:
    34
    Joined:
    Mar 18, 2016
    Location:
    Los Angeles
    I wasn't even aware CTC had anything to do with it. You should really give the patents a look. Chrysler has a bunch of them that may be helpful.
    https://patents.google.com/?assignee=Chrysler+Motors+Corp&page=2
     
  7. MoparMap

    MoparMap VCA National President Venom Member

    Posts:
    1,669
    Joined:
    Jan 7, 2013
    Location:
    Kansas
    So I think I found the pot of gold at the end of the rainbow, the only problem is it's currently locked in a box I can't open. I'm pretty sure I found the project lead that worked on the development of the DRB II and III. No surprise he's the current president of CTC. Now the issue is trying to either find someone that knows him or an email address he might respond to. Any former Chrysler engineers out there that know the guy? His name is Dan Marus. Shows he worked at Chrysler developing diagnostic tools from 83-91 and then started CTC after that and still works there.
     
  8. Mumbles05

    Mumbles05 VCA Member VCA Member

    Posts:
    34
    Joined:
    Mar 18, 2016
    Location:
    Los Angeles
    That is great. Be sure to mention the patents for the DRB 3 have expired so he wouldn't be doing anything wrong by discussing it with you.

    https://patents.google.com/patent/US6181992B1/
    2020-01-05 Application status is Expired - Lifetime

    https://patents.google.com/patent/US5541840A/
    2020-01-05 Application status is Expired - Lifetime
     
    Last edited: Jan 5, 2020
  9. MoparMap

    MoparMap VCA National President Venom Member

    Posts:
    1,669
    Joined:
    Jan 7, 2013
    Location:
    Kansas
    Those are interesting. The circuit "schematics" are novel to look at, even if they don't spell out actual circuitry but more at a data level.

    I messed with the inclinometers some more this past weekend, but I'm coming up empty. It looks like they don't run any kind of OS or bootloader, which doesn't entirely surprise me. The Tx line just goes high and stays there as soon as they power on. There doesn't appear to be any kind of initial messages sent for stuff like serial number or calibration values or anything. I did stumble on an idea I didn't think of before though. My little oscilloscope isn't great for trying to capture communication style signals as they happen. It really doesn't have the power or the settings. However, it seems you can set up a Raspberry Pi as a signal analyzer, so going to see about trying that at some point this week. I'll need a level shifter as the Pi has very limited voltage input levels, but that saves me the cost of a real logic analyzer. I might test it out on the connection between the VCI pod and the car and see how it works. If it actually gives me something useful I think I'd have a way to see the signals between the inclinometer and the DRB III with tools already at my disposal.
     
  10. MoparMap

    MoparMap VCA National President Venom Member

    Posts:
    1,669
    Joined:
    Jan 7, 2013
    Location:
    Kansas
    So to stray a bit from the topic again, I think I figured out how the TPMS module is supposed to talk to the system. Reading back over the communication protocols, I think the TPMS module uses the ISO 9141 (also known as K-Line) standard. One of the links I posted earlier discusses how it works and mentions it can be combined with the SCI Tx wire. The PCM runs on SCI and uses 5 volts to communicate, but 9141 uses 12 volts. 9141 is also single wire, so it doesn't need a separate transmit and receive.

    Still need to scope the output of the emulator and see what it's doing, but I wonder if the VCI pod doesn't have the circuitry to provide the 12V necessary for the TPMS module to communicate.
     
  11. Mumbles05

    Mumbles05 VCA Member VCA Member

    Posts:
    34
    Joined:
    Mar 18, 2016
    Location:
    Los Angeles
    I need to open up one of my original ones in a couple days to resolder the reset button, so I'll snap some pictures of it when I do. The OBD 2 port supplies it 12v power so it's reasonable to assume it would have a way to send 12v out again for 9141.
    If you have your pod connected via usb, you can actually navigate to the debug menu and see the voltages on the various lines.

    http://172.22.22.22/webconfig/sysdebug.bsp
     
    Last edited: Jan 7, 2020
  12. MoparMap

    MoparMap VCA National President Venom Member

    Posts:
    1,669
    Joined:
    Jan 7, 2013
    Location:
    Kansas
    Yeah, once I thought about it some more I realized that it would have easy access to 12v, so that didn't make as much sense. I'll have to try that debug menu.

    I do wonder if maybe it's not on the right pins though. 9141 typically lives on pin 7 of the diagnostic connector I believe. Don't remember what the PCM SCI line is on, but it might be different, so there's a chance it's just not talking on the right pin for the module to hear. Should be easy enough to check.
     
  13. Steve-Indy

    Steve-Indy VCA Venom Member Venom Member

    Posts:
    8,111
    Joined:
    Oct 2, 2000
    Location:
    Zionsville,IN. USA
    Just happened to be looking at DLC:

    #2....PCI

    #6...SCI Receive

    #7...SCI Transmit
     
    Mumbles05 likes this.
  14. MoparMap

    MoparMap VCA National President Venom Member

    Posts:
    1,669
    Joined:
    Jan 7, 2013
    Location:
    Kansas
    Lol, one more theory out the window potentially. Just need to try to log some communication at this point and see what happens.
     
  15. DJ'sviper

    DJ'sviper Enthusiast

    Posts:
    255
    Joined:
    Jun 20, 2007
    You lost me at DRB III
     
  16. Mumbles05

    Mumbles05 VCA Member VCA Member

    Posts:
    34
    Joined:
    Mar 18, 2016
    Location:
    Los Angeles
    Behold, the holy grail! CDA 6 offline. Cost me an arm and a leg but I finally got my hands on it. IMG_6612.jpg
     
  17. MoparMap

    MoparMap VCA National President Venom Member

    Posts:
    1,669
    Joined:
    Jan 7, 2013
    Location:
    Kansas
    Sweet! Certainly helpful for the newer cars I imagine. When did the CDA series start? Was that the first CAN based cars? 5 at least doesn't appear to do much for the gen 3, though I haven't toyed with it all that much. Was hoping to be able to do some communication logging without having to build something inline, though I think I at least know what I'm looking for now. Partially waiting on parts (12v to 3.3v converter so my Raspberry Pi can see the signals) and partially just haven't had a lot of incentive to dig into in. The cold weather around here also makes sitting in a garage with a computer a little less pleasant.
     
  18. Mumbles05

    Mumbles05 VCA Member VCA Member

    Posts:
    34
    Joined:
    Mar 18, 2016
    Location:
    Los Angeles
    Well, based on the numbering I would assume it started at CDA 1 but the lowest version number I have seen or heard about was CDA 3. I have no idea what form it was in prior to that but CDA 3 as I knew it was software that ran on the starscan. There may have been a desktop version of 3 but I haven't seen it. There is no demand for it either so that is probably lost to history. I have only seen CDA cover CAN bus vehicles. Prior to that, the iBox II+ was part of what they used. I know very little about that and nothing about what software was used in conjunction with it.

    No worries about the progress with the other stuff, I've got my hands full with other things at the moment myself. I did get some more pictures of that factory tool that used the vci pod. It was referred to as the blue brick from what I've been told. I didn't get a complete one, I just got the pictures of it in it's native form.

    20200122_153213.jpg 20200122_153829.jpg
     
  19. MoparMap

    MoparMap VCA National President Venom Member

    Posts:
    1,669
    Joined:
    Jan 7, 2013
    Location:
    Kansas
    Very interesting. Doesn't look all that pleasant to use with that tiny keyboard, lol.

    The more I think about it the more I can understand why "generic" tire tools might work with the Viper module. It appears to use an established standard communication protocol on standard wiring. I'm thinking you could probably even use a generic OBD II dongle and a laptop if you know the right commands. From my understanding it works like old modems, you just have to know what to send. Haven't actually tried out the little dongle I have yet.

    No luck hearing back from the CTC guy yet or finding anyone else that knows him. I'm thinking at this point it's just going to come down to getting my hands on a real DRB III to try to record the signals to the inclinometers. That or open the sensors up and try to rewire them to connect directly to the sensor and not the controller inside. Guessing the sensors themselves are normal voltage or current output like I was expecting and the controller inside just translates that.
     
  20. Mumbles05

    Mumbles05 VCA Member VCA Member

    Posts:
    34
    Joined:
    Mar 18, 2016
    Location:
    Los Angeles
    I haven't forgotten about you. Had my hands full recently (see below). Sounds like you have a gameplan though. It'll just take time and money as all things do.
    The computer part of that blue brick is touch screen so I doubt anyone had to fiddle with the keyboard. It has some heft to it though so that would have been annoying. Had to trade my other arm and leg in to buy microsoldering equipment. The price difference between the 'toy' version and quality equipment is staggering. A nice stereomicroscope cost me close to a grand.


    IMG_6791.JPG IMG_6790.JPG IMG_6797.JPG
     
    Last edited: Feb 6, 2020
  21. MoparMap

    MoparMap VCA National President Venom Member

    Posts:
    1,669
    Joined:
    Jan 7, 2013
    Location:
    Kansas
    Wow, that is quite the collection. And yeah, I know what you mean about good equipment. I've had enough cheap tools that barely even make it through a single job. I remember buying a power steering pulley puller from Harbor Freight because I was tired of renting one every weekend when I was dealing with my power steering issues and the first time I used it it just bent and didn't even pull the pulley off.

    I think the next big electronics tool I want is a desoldering gun. I have the little spring pump version, but it's hard to run it and an iron at the same time. Saw someone using a heater desoldering gun and that instantly went on my list. It's not like I even work on electronics that often, but that would be a major quality of life improvement.
     
  22. MoparMap

    MoparMap VCA National President Venom Member

    Posts:
    1,669
    Joined:
    Jan 7, 2013
    Location:
    Kansas
    So there has been some new life breathed into this little project of mine. I had to pick up a real DRB III for some tuning stuff with my car, so I now have one in my own hands to play with. Planning to get things hooked up with my angle sensors to see if I can intercept the communications between the two and figure out what is going on. I'm hoping my Raspberry Pi is going to work for this, but will have to see. If nothing else I'm hoping I can see some life on the communication lines via an oscilloscope, so maybe I can pause and record that data and interpret it.
     
  23. MoparMap

    MoparMap VCA National President Venom Member

    Posts:
    1,669
    Joined:
    Jan 7, 2013
    Location:
    Kansas
    Progress at last! I managed to intercept the command the DRB III is sending to the sensors and can replicate sending that command from a PC terminal program and get a response back. Now I have to decode exactly what that response is saying. I have an idea right now, but haven't checked it against the readout on the DRB III to see if my calculations are correct.

    For those who care about the geeky details, the DRB III sends a 6 byte command to the sensor and the sensor responds with 6 bytes as well. The first 3 bytes of the response don't appear to change, regardless of sensor orientation, so it looks like I only have to figure out the last 3 bytes of the message. When changing the orientation of the sensor 90 degrees at a time, the first of those three bytes changes from 0-255 in increments of 64, so it looks like it's splitting 360 degrees into 8 bit resolution basically. My suspicion is that the second two bytes might be minutes and seconds of angle, each in 8 bit resolution as well. It's a bit odd because the readout on the DRB III is only 0.1 degree precision, so going down to seconds of angle is almost irrelevant, but it makes some sense in my head.

    My plan going forward is to use a digital angle finder I have to hold the sensor at some set angles and see what the readout on the DRB III is and what message the sensor is sending back. If my math doesn't work out at the very least I have an 8 bit resolution angle value. Not great since it would be more than a degree per step though.
     
    ViperJeff likes this.

Share This Page