Decyphering iMiEV and iON CAR-CAN message data

[svingen]

this is great news and good work!
is it posibol to use this info and send the command using OVMS to start the heating?
Imiev does have a remote controll to start the heating (when car is off and it heat upp the car 30 min before it stop) so gues it should in theory?

[PV1]

I have an OBDLink MX dongle and my i-MiEV has the remote. Can I use the dongle with a Windows or Linux computer to sniff the CANbus and retrieve the PIDs when the remote is activated? If yes, how would I do that?

I also have the OVMS module and am interested in replicating the MiEV remote with the app instead.

[svingen]

@PV1 that was nice, i have not try it my self but i think ou can followed this guid http://theksmith.com/technology/hack-ve ... sy-part-1/ does any one else have somthing else to recomed?

i have a peugot ION 2011 so it wold be nice if this "hack" can work on the ION also.
don`t have the OBDLink MX but think i have to buy one

[cristi]

@svingen

this is great news and good work!
is it posibol to use this info and send the command using OVMS to start the heating?
Imiev does have a remote controll to start the heating (when car is off and it heat upp the car 30 min before it stop) so gues it should in theory?

This would be great, but I don't know whether anybody managed to write data to the iMiev CAN bus. To what I remember there are important risks regarding losing break assistance, etc. I did not follow this issue lately, maybe it got better.

Anyway, here are more specific details:

PID 3A4
byte 0, bits 0-3: heating level (7 is off, under 7 is cooling, over 7 is heating)
byte 0, bit 7: AC on (ventilation dial pressed)
byte 0, bit 5: MAX heating (heating dial pressed)
byte 0, bit 6: air recirculation (ventilation direction dial pressed)

byte 1, bits 0-3: ventilation level (if AUTO is chosen, the automatically calculated level is returned)
byte 1, bits 4-7: ventilation direction (1-2 face, 3 legs+face, 4 -5legs, 6 legs+windshield 7-9 windshield)

[svingen]

@cristi that was great news,hopefull sombody can use this data to make OVMS support can-bus writing.

have you try to send this message to the car to see if it work?
does this work if the car is off?

do you have any tips regard software to sniff out the can buss data that @PV1 is trying?
wold be nice to find out the remote controll can buss message.


huge thx cristi hopefull this will make the OVMS even bether and we know understand even more can buss messages

[cristi]

have you try to send this message to the car to see if it work?

To my knowledge nobody managed to write to the imiev CAN bus but I may be wrong. I tried once with no good results and then @priusfan told me that one can lose break assistance and I was mostly interested in reading anyway.

does this work if the car is off?

I don't know whether writing (if it works at all) works when the car is off. Reading works only when the car is on, and it is on (some PIDs available) also when it is charging.

However, I noticed that heating itself does not work so well when the car is charging. Ventilation is started and all, but there is not much heat coming in... That's strange since that would be a perfect time for pre-heating the car.

do you have any tips regard software to sniff out the can buss data that @PV1 is trying?
wold be nice to find out the remote controll can buss message.

For sniffing there is a lot of information in this thread. You need a complete CAN bus log (no filters). You also need an USB STN1100-based OBD connector (not Bluetooth due to the high baud rate, so OBDLink MX will not work as far as I know). From the current ScanTool offer, OBDLink SX and OBDLink Wifi seem to have USB. In the past they had a Bluetooth scan tool with USB, it is phased out I think.

Use a terminal that can handle 921600 (RealTerm in windows works, even under Parallels on Mac). Configure it to log to a file. Then send these commands:

STSBR 921600
(reconfigure terminal for the new baudrate!)
ATSP6
ATS0
ATH1
ATCAF0
ATMA

Manipulate the remote control when the logging is on... Maybe film the whole process so you know what time you pressed which remote control button (make sure the camera and computer clocks are synchronized).

Then it's a matter of analysis. I personally parse the file in Java and look for changes (that's how I found 3A4). I know @priusfan uses excel. There are probably many other ways... In this case I would check which PIDs change around the time when you pressed the buttons. Anyway, if you share the log, many people will be able to help.

[PV1]

What commands does Canion send to the OBDLink to trigger the data stream, and what protocol does it use? I know you said that you think bluetooth won't work, but I'd like to take a stab at it.

[priusfan]

@PV1
Bonjour
You have all the responses in cristi's message....
a) the commands

STSBR 921600
(reconfigure terminal for the new baudrate!)
ATSP6
ATS0
ATH1
ATCAF0
ATMA

b) the protocol :

Use a terminal that can handle 921600 (RealTerm in windows works, even under Parallels on Mac). Configure it to log to a file. Then send these commands:

maybe you could start with a look to the stn11xx' s documentation

on iMiev, we can see 1625 frames/sec.
using Bluetooth, the bandwidth is just not sufficient...

Xavier

[TestO]

Have some logs i did when developed the OVMS i-Miev puggin.
In the excel file there is one log where i start preheating, one from normal charging and one where i just push the button on the remote to activate the remote and get error on the remote.

As you can see from the summary page, there are 3 PID that only appear when heating: 384, 385 and 3A4. I also get some 60, 600, 6000 and 60000 messages that i only get when preheating, but know what is.

These logs is made with CAN-do tool http://www.wwwsite.com/puzzles/cando/

The logfile can be downloaded from here: https://www.dropbox.com/s/m36u0j905xgfi ... N-PID.xlsx

[kiev]

i did a 1-second capture to see what showed up when the key was switched to READY, sorry the tabs didn't transfer cleanly,

Code: Select all

CAN data capture notes for Key to Ready, 1 second capture 20161203
sorted from highest priority to lowest

PID	period	len	typical data				Notes
hex	msec	# byte	hex

101	100	1	0x04			=Key ON/READY;  00= off (lock)

210	20	7	0x00 0x00 0x00 0x00 0x80 0x00 0x0                accel pedal position
212	20	8	0x00 0x00 0x00 0x00 0xA7 0xD0 0x00 0x00     
285	10	8	0x07 0xD0 0x14 0x00 0x8F 0xFE 0x0C 0x10
286	100	8	0x00 0x00 0x00 0x37 0x00 0x00 0x00 0x00
288	10	8	0x07 0xD0 0x27 0x10 0xB3 0x00 0x11 0x10	
298	100	8	0x37 0x38 0x3D 0x38 0x00 0x00 0x27 0x10

29A	100	8 index	0x00 0x4A 0x41 0x33 0x32 0x31 0x35 0x48
			0x01 0x31 0x36 0x43 0x55 0x30 0x31 0x38
			0x02 0x39 0x39 0x37 0xFF 0xFF 0xFF 0xFF
2F2	100	3	0x00 0x00 0x03

308	20	8	0x00 0x03 0xE8 0x00 0x00 0x00 0x00 0x00
346	20	8	0x27 0x10 0x64 0x20 0x00 0x00 0x04 0x43	x2710
373	10	8	0xC8 0xC8 0x7F 0x79 0x0E 0x18 0x00 0x16

418	20	7	0x50 0x00 0x00 0x00 0x00 0x00 0x00            shifter position = P
428	100	0	remote request

564	50	8	0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
565	50	8	0x00 0x00 0x00 0x00 0x00 0x00 0x07 0x00
5A1	50	8	0x14 0x00 0x00 0x00 0x00 0x00 0x00 0x00

695	100	8	0x04 0x08 0x00 0x01 0x15 0x09 0x19 0x06
696	100	8	0x03 0xE4 0x01 0xF2 0x41 0x00 0x27 0x10	x2710
697	100	8	0x00 0x00 0x00 0x01 0x72 0x00 0x00 0x00

6D0	50	8	0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
6D1	50	8	0x00 0x04 0x00 0x00 0x40 0x00 0x00 0x00
6D2	50	8	0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
6D3	50	8	0x00 0x00 0x01 0x00 0x50 0x00 0x00 0x00
6D4	50	8	0x00 0x00 0x00 0x00 0x00 0x10 0x00 0x00
6D5	50	8	0x10 0x00 0x00 0x04 0x00 0x00 0x00 0x00
6D6	50	8	0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
6DA	50	8	0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

6E1	40	8 index	0x01 0x00 0x3E 0x3E 0x01 0x90 0x01 0x90	cell data
			0x02 0x00 0x3F 0x40 0x01 0x90 0x01 0x90
			0x03 0x00 0x3F 0x40 0x01 0x90 0x01 0x90
			0x04 0x00 0x3E 0x40 0x01 0x90 0x01 0x90
			0x05 0x00 0x3D 0x3F 0x01 0x90 0x01 0x90
			0x06 0x00 0x3D 0x3D 0x01 0x90 0x01 0x90
			0x07 0x00 0x3E 0x3F 0x01 0x90 0x01 0x90
			0x08 0x00 0x3E 0x40 0x01 0x90 0x01 0x90
			0x09 0x00 0x3F 0x40 0x01 0x90 0x01 0x90
			0x0A 0x00 0x3E 0x40 0x01 0x90 0x01 0x90
			0x0B 0x00 0x3D 0x3F 0x01 0x90 0x01 0x90
			0x0C 0x00 0x3E 0x3D 0x01 0x90 0x01 0x90

6E2	40	8 index	0x01 0x3E 0x3D 0x00 0x01 0x90 0x01 0x90
			0x02 0x40 0x3E 0x00 0x01 0x91 0x01 0x90
			0x03 0x40 0x3F 0x00 0x01 0x90 0x01 0x90
			0x04 0x40 0x3E 0x00 0x01 0x90 0x01 0x90
			0x05 0x3F 0x3D 0x00 0x01 0x90 0x01 0x90
			0x06 0x3D 0x00 0x00 0x01 0x90 0x01 0x90
			0x07 0x3E 0x3D 0x00 0x01 0x90 0x01 0x90
			0x08 0x40 0x3E 0x00 0x01 0x90 0x01 0x90
			0x09 0x40 0x3F 0x00 0x01 0x90 0x01 0x90
			0x0A 0x40 0x3E 0x00 0x01 0x91 0x01 0x90
			0x0B 0x3E 0x3D 0x00 0x01 0x90 0x01 0x90
			0x0C 0x3D 0x00 0x00 0x01 0x90 0x01 0x90

6E3	40	8 index	0x01 0x3D 0x3D 0x00 0x01 0x90 0x01 0x90
			0x02 0x3E 0x3D 0x00 0x01 0x90 0x01 0x90
			0x03 0x3E 0x3E 0x00 0x01 0x90 0x01 0x90
			0x04 0x3E 0x3D 0x00 0x01 0x90 0x01 0x90
			0x05 0x3D 0x3D 0x00 0x01 0x90 0x01 0x90
			0x06 0x00 0x00 0x00 0x00 0x00 0x00 0x00
			0x07 0x3D 0x3D 0x00 0x01 0x90 0x01 0x90
			0x08 0x3E 0x3E 0x00 0x01 0x90 0x01 0x90
			0x09 0x3E 0x3E 0x00 0x01 0x90 0x01 0x90
			0x0A 0x3E 0x3E 0x00 0x01 0x90 0x01 0x90
			0x0B 0x3D 0x3D 0x00 0x01 0x90 0x01 0x90
			0x0C 0x00 0x00 0x00 0x00 0x00 0x00 0x00

6E4	40	8 index	0x01 0x00 0x00 0x00 0x01 0x90 0x01 0x90
			0x02 0x00 0x00 0x00 0x01 0x90 0x01 0x90
			0x03 0x00 0x00 0x00 0x01 0x90 0x01 0x90
			0x04 0x00 0x00 0x00 0x01 0x90 0x01 0x90
			0x05 0x00 0x00 0x00 0x01 0x90 0x01 0x90
			0x06 0x00 0x00 0x00 0x00 0x00 0x00 0x00
			0x07 0x00 0x00 0x00 0x01 0x90 0x01 0x90
			0x08 0x00 0x00 0x00 0x01 0x90 0x01 0x90
			0x09 0x00 0x00 0x00 0x01 0x90 0x01 0x90
			0x0A 0x00 0x00 0x00 0x01 0x8F 0x01 0x90
			0x0B 0x00 0x00 0x00 0x01 0x8F 0x01 0x90
			0x0C 0x00 0x00 0x00 0x00 0x00 0x00 0x00

6EA	100	0
6FA	100	8 index	0x00 0x4A 0x41 0x33 0x32 0x31 0x35 0x48	VIN
			0x01 0x31 0x36 0x43 0x55 0x30 0x31 0x38
			0x02 0x39 0x39 0x37 0x00 0x00 0x00 0x00

738	1000?	2	remote request
75A	100	8	0x03 0xE8 0x03 0xE8 0x64 0x64 0x38 0x37
75B	100	8	0x36 0x36 0x37 0x3D 0x17 0xEF 0x84 0x00

The VIN number is coded into PID 6FA, convert the hex value to Ascii to read the 17 digit VIN. The first time it appears it sends an index of x03 with zeroes, then the index sequence starts and repeats x00,1,2.

i will try to sort another run in which the motor is READY in N, shift to D and accelerate, then hit the brakes.

Also i could try to capture during charging when the REMOTE is turned ON and signalling the car to turn on heat/defrost.