The Pump Of Doom

[Jack Bauer]

Welcome folks to my nemesis, the pump of Doom!! also know as the auxiliary 12v oil pump in the phev version of the ZF 8hp gearbox. I'm 4 days in so far and have managed the amazing feat of making it run reliably for 300ms! I know I'm amazing. In an attempt to help others who may be foolishly following along here is a breakdown of learnings to date :

ZF GA8P75HZ 12V Aux Oil Pump – Project Summary (as of April 2026)
Hardware & Protocol Basics
• LIN @ 19200 baud, 8-byte frames (LIN V2)
• Master request on 0x30, slave responses on 0x32 / 0x33 / 0x34
• Byte 7 = rolling 4-bit counter (must increment each frame)
• All three status frames bytes 0 and 1 must be 0x00 for the pump to be “happy”
Mandatory Coldstart Sequence in 0x30
1. byte0 = 0xAA, byte2 = 0x0A (Phase 1)
2. After ~900–1000 ms, change byte2 to 0x42 (Phase 2)
3. Only after this will the pump respond to any command
Run Trigger
• Only byte0 = 0x55 will makes the pump spin
• 0x55 is the bitwise inverse of 0xAA (classic safety pattern)
• Any other value for byte0 is ignored
Key Observations
• Byte 1 has the strongest effect on behavior (ticking speed, how long it stays happy)
• Almost every 0x55 command eventually triggers 0x40 fault in status frames byte 0
• The pump is extremely safety-paranoid and has a watchdog (~330–770 ms typical)

Run procedure used
• TCM sends 0xAA, 0x00, 0x0A, 0x00, 0x00, 0x00, 0x73, at first.
• Then switches to 0xAA, 0x00, 0x42, 0x00, 0x00, 0x00, 0x73, after approx 900ms.
• Setting 0x55, 0x00, 0x42, 0x00, 0x00, 0x00, 0x73, will cause a spin for approx 300ms then pump faults until next power cycle or LIN pause for approx 5 seconds causes the pump to sleep and reset.

ZF GA8P75HZ Pump – 0x32 Feedback Summary

0x32 is the pump’s main status & motion report
• 8-byte LIN slave response (ID 0x32)
• Most important frame for understanding if the pump is happy and spinning
Byte-by-byte breakdown (what actually matters)
Byte
Meaning
Observed values
What it tells us
0
Status
0x00 = Normal 0x40 = Fault (most common) 0x50 = Alternate fault
0x00 = pump is accepting command 0x40/0x50 = immediate shutdown
1
Usually static
Almost always 0x00 or 0xAA
Not useful for motion
2
Safety / Run flag
0xAA = Standby / reset / coldstart 0x55 = Run acknowledged
Critical! This is the clearest “pump is in run mode” flag
3
Motion / Speed indicator
0x00 / 0xAA = stopped 0x2A, 0x17, 0x3A, 0x55 etc. = spinning
Best motion signature we have. Non-zero + non-AA here = motor is physically kicking
4
Secondary motion / torque
Changes together with byte 3 during spin
Supports byte 3 (less consistent)
5–7
Counters / checksum
Rolling low nibble in byte 7
Mostly housekeeping

Core behavioural pattern we see every time
1. Coldstart finishes (AA 00 42 …)
2. First good 0x55 command arrives → 0x32 instantly becomes something like: 00 00 55 2A 14 xx xx xx ← motor spins briefly
3. Second (or any subsequent) 0x55 frame arrives → 0x32 immediately changes to: 40 00 AA 00 00 xx xx xx ← fault + reset
4. Pump makes the rapid ticking sound and goes silent (“Slave not responding” on PeakLIN)
→ The pump accepts exactly one valid 0x55 frame before its internal safety watchdog kills the command.
What we have proven so far
• Only byte 0 = 0x55 ever produces motion in 0x32.
• The brief spin is real (we hear it and see byte 3 change).
• The watchdog is extremely strict — it looks at the second 0x55 frame and decides “this is not a valid sustained command”.
• 0x32 is the only frame that reliably shows the motor is turning (bytes 2 + 3 together are the smoking gun).
• 0x33 and 0x34 are basically just status / temperature / version registers — no useful motion data.

[Jack Bauer]

I see everyone is as super excited about this as I am and can't wait for an update. I was sent this link which has some useful photos and other info :
https://static.oemdtc.com/NHTSA-PDFs/MC ... 4-0001.pdf

[Jack Bauer]

The update nobody was waiting for. Now trying all possible 4 byte combos with this nifty program. Gonna take about 5 days it seems. Don't worry , I'll make irregular updates.

[MattsAwesomeStuff]

Brute forcing CAN? Well alright, I'm here for it.

[Jack Bauer]

LIN actually but yay for the bump

[Ruudi S]

The update nobody was waiting for. Now trying all possible 4 byte combos with this nifty program. Gonna take about 5 days it seems. Don't worry , I'll make irregular updates.

You are always so many years ahead of most of us that's why at least I cannot understand what's all that and why. I am in the process of trying to make civic hybrid inverter work according to forum descriptions. I believe some day I also make it to the hp8 gearbox and be very thankful that Damien hacked it and made it work, all I need is to buy the controller from evbmw and it works as in the original car.