ECU Diagnostics - CAN Bus, hunt for answers

126 posts / 0 new
Last post
CtrMint
CtrMint's picture
Offline
Last seen: 5 hours 49 min ago
Joined: 13/06/2018
ECU Diagnostics - CAN Bus, hunt for answers

Guys,

I'd like to start a thread about the diagnostics on the later 7s, such as the Sigma and Duratec cars using the locked MBE ECUs.  I am attempting to understand what is and isn't possible from the diagnostic connector.  I'm not interested in mapping the car, just reviewing the data from the car.  Now I understand  Easymap and the MBE 985 cable is the standard method of gaining such insights, and I've placed my order for a cable this weekend.

I would however like to understand why this is specifically needed and why there seems to be a general acceptance the only solution which works.  During my build I did plug in a generic OBDII CAN supporting diagnostic tool, and as far as I could tell it gave me a sensible coolant temp reading, which was very close to that on the dash gauge.   So I am a little cynical about the limits.

I'd also like to compose a post for my blog, I'm sure there are others that have similar queries.  

Additionally, I'd prefer to use a non-Windows tool to log and chart the diagnostics data.  Maybe even write a bespoke tool I can hang off my Linux box I have in my garage, or use on a raspberry pi etc.  Lastly depending on the information I can put together at an early stage I'm going to try and mirror the USB stream from the MBE985 cable being feed into Easymap and use Wireshark on Linux using the Linux SocketCan driver.  Hopefully this should give me the ability to inspect the data stream and identified the values/identifiers I'm interested in.

I know this is a relatively specialized area, but the expertise here seems boundless at times, so I'm sure there's sufficient knowledge to support this endeavour.  Thanks for your support,  fingers crossed.

What I believe to be the case...... but please correct me!
The 7 has or uses;

  •  An SAE J1962 diagnostic connector (pretty standard) 
  • A single ECU, which uses CAN bus, it is unclear whether it is 11 bit or 29  bit wide implementation. Bit rate is also unknown.
  • Standard ISO 15765-4 d Pins 6 (CAN_L) & Pin 14 (CAN_H) are utilized for signaling.
  • Identifiers and Payloads within the data stream are not published, sticking point and issue or concern.  Hope they are encoded in a simple manner.

To me, the final point is where the issue occurs,  but I might be wrong.   The ECU developers have either not published or not used common identifiers and payloads permitting the use of generic tools.  

I see no reason why with some time and effort aspects of this can't be overcome.  If I can get access to the stream with Wireshark, using the CAN protocol analyser it is entirely possible different identifiers could be inspected and charted with a Wireshark IO Graph etc and thus deciphered.  For example, the identifier for engine speed would be clear when the throttle is pressed.

Or am I missing something here?

I appreciate this thread is going to turn many people away.  For me, it's an interesting topic and while CAN is totally new to me, the concept of protocols deciphering isn't.  Plus I'd really like more freedom when monitoring the car.   Easymap serves a purpose but I really don't want a Windows host just for that.  If you can offer some knowledge or experience from the point of the 7 its implementation of CAN and connectivity then I'd appreciate it.

Thanks

 

David_Long
David_Long's picture
Offline
Last seen: 9 hours 6 min ago
Joined: 17/04/2014

Good luck on this. I'd never say never, but there's a few out there that have tried. Those that have succeeded in getting access to the pin, passwords, and past the encryption seem to keep it close to their chest. You may get data, but not necessarily anything meaningful.  I also believe things have changed over time and the latest ECU from Caterham can no longer be wiped and remapped.

For those without the time, usually buying an open ECU from SBD and a remap is the best way forward.

nickh7
Online
Last seen: 2 min 37 sec ago
Joined: 17/04/2014

Have you thought about selling the 7 and buying a Tesla or computer to play with Laugh 

 

"I take her to the floor, looking for a moment when the world feels right"

anthonym
anthonym's picture
Offline
Last seen: 1 hour 19 min ago
Joined: 17/04/2014

Is Emerald a solution? 

To solve my not wanting to use a PC I bought a very tiny laptop, I’ll edit with details later. Even has RS232, which was what persuaded me, to escape the unreliable USB adapter. 

I guess for a new build this may not be what you want. There are some wizards in here who will no doubt be along soon :-)   Search revilla’s ecu posts. 

anthony

CtrMint
CtrMint's picture
Offline
Last seen: 5 hours 49 min ago
Joined: 13/06/2018

Guys,

Just to be clear I'm not looking to change the map in any way.  I'm working on the assumption a pin, password or decryption to read the data stream isn't required, though I might be wrong.

This is more about the challenge of supporting the standard ECU etc.  3 years ago I wrote a graphical dashboard for the Codemasters video game F1 2016, it used a Raspberry Pi and small 7" display, basically provided the sort of digital display from AIM.  Data was extracted from a UDP multicast stream picked up over WiFi.  As a solution, it was enjoyable to build but had poor longevity due to the life of the game etc.  I didn't get much value as I built for a friend.   Building something for the 7 which is available for the standard ECU would be as fun, and potentially infinitely more useful to me and anyone else interested.

 

Caterham 420R S3 Lotus Toxic Green,  Caterham 620R S3 Exocet Red. Blog: https://www.caterham7diaries.com
aerobod
aerobod's picture
Offline
Last seen: 52 min 35 sec ago
Joined: 17/04/2014

I think with time and effort to reverse engineer the PIDs that MBE uses, all diagnostic info should be available via a standard CANbus cable. From what I have looked at it is a matter of non standard PIDs and lack of documentation.

You don’t need the decrypted ECU image for diagnostics. The 982 / 9A4 ECUs don’t seem to use a PIN / password for the factory image anyway, just a direct flash of the encrypted image - I scripted the use of all possible PIN codes against the factory ECU a couple of years ago and non worked, I think this is why no one has the PIN codes available for the later ECUs.

I didn’t bother looking into the PID structure when I decided to put in an unlocked ECU, as I needed to remap due to limitations in the original mapping that didn’t suit my needs, so I just bought a new 9A4 ECU with external SBD Baro and IAT sensors and 985 cable and Innovate wideband Lambda system to solve my problems.

James

CtrMint
CtrMint's picture
Offline
Last seen: 5 hours 49 min ago
Joined: 13/06/2018

Great well it sounds like I'm not too far off in my assumptions then.

I've found some great tools available on Linux which are capable of sorting and displaying the identifier/PIDs, which should make filtering some bit easier.   The real question of course  reversing the values will be, if there are offsets all over the place I guess it will be pretty tricky.

I wonder why the ECU manufacturer feels it's beneficial to keep the PIDs away from the public.

Caterham 420R S3 Lotus Toxic Green,  Caterham 620R S3 Exocet Red. Blog: https://www.caterham7diaries.com
aerobod
aerobod's picture
Offline
Last seen: 52 min 35 sec ago
Joined: 17/04/2014

I don't think MBE obscured the PIDs from the public deliberately, more likely due to the ECUs being aimed at aftermarket and racing use they prioritised processing speed (bearing in mind limited processor capabilities in the ECU compared with the large manufacurers) and stripped all unnecessary packet and data overhead that didn't meet their needs.

James

CtrMint
CtrMint's picture
Offline
Last seen: 5 hours 49 min ago
Joined: 13/06/2018

It would be amazing if the PIDs were the same as those listed on this WIKI

Caterham 420R S3 Lotus Toxic Green,  Caterham 620R S3 Exocet Red. Blog: https://www.caterham7diaries.com
CB
Offline
Last seen: 3 weeks 3 days ago
Joined: 17/04/2014

A while back one of the data logging hardware manufacturers attached a CANalyzer to my car (2012 Sigma) in order to work out what info was being published to the bus. The answer was nothing, unless another live device was on the bus too (we turned acknowledgement on to see that), in which case the answer was RPM only.

If, however, you used the MBE cable to the OBDC socket and the MBE software, then there was rather a lot of data covering all sorts of useful stuff.

It may be that the MBE isn't using CAN for that? Or requires it to be explicitly queried?

CtrMint
CtrMint's picture
Offline
Last seen: 5 hours 49 min ago
Joined: 13/06/2018

That is interesting to hear, from my research CANalyzer looks pretty good, certainly one of the best looking I've found while researching CAN.  For it to miss CAN bus data from your ECU is surprising and slightly worrying for my plans.

From my understanding, and at present I'm going through a steep learning curve, CAN should broadcast its messages regardless of other nodes on the network.  Its basically the same as UDP in IP networks, but with a 2 layer model.

I'd be surprised, and very disappointed to find MBE using something proprietary protocol instead of CAN.  I know OBDII diagnostic data is mandated now by many jurisdictions, but I'm not sure CAN is, still you'd expect the standard to be used.

Hopefully when I get my cable I can run Easymap on my VM and tap the USB into Wireshark, it should show if Easymap is acting as a second node, and transmitting in some way.

Caterham 420R S3 Lotus Toxic Green,  Caterham 620R S3 Exocet Red. Blog: https://www.caterham7diaries.com