Hi everyone!
I'm currently reverse engineering the CAN network of a Mitsubishi iMiEV (aka Citroën C-Zero and Peugeot iOn) and trying to make a DBC. As you know, this is quite time-consuming, so I would like to share the information I find. This is still a work in progress. When finished I will share all my findings together with a full DBC!
Note: All messages on CAN 1 (VCU, radio, combination meter, EPS...) also appear in CAN 2 (inverter, DC-DC, A/C...) and vice versa.
- When the ignition is not on, CAN 1 and CAN 2 do not send the same data. Does anyone know anything about this?
- Does anyone have useful information to avoid double work?
Hexadecimal numbers are preceded by ‘0x’, otherwise they are decimal. All formulas are in decimal. Everything is read MSB first.
A 'B' represents a byte, a 'b' represents a bit.
Note: constants can also be a variable that did not change during logging → example: no charging in our log → constant is not necessarily a heartbeat!
Thanks for your help!
I'm currently reverse engineering the CAN network of a Mitsubishi iMiEV (aka Citroën C-Zero and Peugeot iOn) and trying to make a DBC. As you know, this is quite time-consuming, so I would like to share the information I find. This is still a work in progress. When finished I will share all my findings together with a full DBC!
Note: All messages on CAN 1 (VCU, radio, combination meter, EPS...) also appear in CAN 2 (inverter, DC-DC, A/C...) and vice versa.
- When the ignition is not on, CAN 1 and CAN 2 do not send the same data. Does anyone know anything about this?
- Does anyone have useful information to avoid double work?
Hexadecimal numbers are preceded by ‘0x’, otherwise they are decimal. All formulas are in decimal. Everything is read MSB first.
A 'B' represents a byte, a 'b' represents a bit.
Note: constants can also be a variable that did not change during logging → example: no charging in our log → constant is not necessarily a heartbeat!
| ID | comments | formula |
| 0x101 | always constant → B0 = 0x04 heartbeat? → no, would be key status | |
| 0x119 | B5 increases by value 1 every so often B6 increases by 1 value with each frame. B7 no idea I suspect a kind of timer, can also be a complicated heartbeat. | |
| 0x149 | clear correlation with driving B2: constant 0 B3: constant 0xFF B6: increases from 0 to 0xF → index? → explains the erratic behavior of B0, B4, B7 B1: yaw sensor B5: yaw sensor | |
| 0x156 | B0, B1, B2, B3: constant 0 B4: could be an index (increases per value of 2) B5: no idea, not a measurement B6: could be an index from 0x10 to 0x1F → explains jagged graph of B7 | |
| 0x200 | B0: constant 0 B1: constant 0x03 B2-3: RPM wheel front left B4-5: RPM wheel front right B6: constant 0xFF B7: constant 0xFF | RPM = (value * 0.5) - 24576 (RPM = (value * 0x0.8) - 0x6000) |
| 0x208 | B0: constant 0 B1: constant 0x20 B2: constant 0x60 B3: brake pedal → bias = 0, scale = 0.39216 (= 100/255) → full press = 100% (not sure, further testing needed) B4-5: wheel speed rear right B6-7: speed wheel rear left | pedal % = TO BE MEASURED |
| 0x210 | B0: constant 0 B1: constant 1 B2: accelerator pedal B3: is 0 or 0x80 → strong correlation with B2 B4: twice 00, then twice 0x80 B5: constant 0 B6: constant 0 | pedal % = value * 0.4 (full press = 0xFA = 250 → 100%) |
| 0x212 | B4b4-7-B5 → very strong correlation with current/voltage traction battery | |
| 0x215 | B0-1: just under speed and always positive I suspect actual speed, 0x412 (is then for combimeter (speed slightly higher and always integers) B2–3: bias = –20, scale = 0x0.0A (rough estimate!) → distance traveled since start? B4–5: bias = –20, scale = 0x0.0A (rough estimate!) → distance traveled since start? → deviates more and more under B2–3 → left/right? B6: constant 0 B7: constant 0 | km/h = value * 0.0078125 (0.0078125 = 0x0.02) km = (value * 0.0390625) - 20 → rough estimate (0.0390625 = 0x0.0A) |
| 0x231 | B0: constant 0 B1: constant 0 B2: constant 0 B3: constant 0 B4b1: brake pedal switch (you can also view per byte) B5: constant 0 B6: constant 0 B7: constant 0 | 1 = on 0 = off |
| 0x236 | B0–1: steering wheel position B2–3: EPS → is this the torque across the steering wheel (in that case → find data of 2nd sensor) or is it the voltage across the steering servo? B4b0–3 adds from 0x0 to 0xF B5: constant 0 B6: constant 0 B7: no idea | steering wheel % = (value * 0.078125) - 320 steering wheel angle = TO BE MEASURED |
| 0x285 | B1–B2b2–7: acceleration no idea for the rest | |
| 0x286 | B0: constant 0 B1: constant 0 B2: constant 0 B3: gear selection? → only difference in signal at the start and end of the ride B4: constant 0 B5: constant 0 B6: constant 0 B7: constant 0 | |
| 0x288 | B0–B1b2–7: acceleration (corresponds exactly to the same bits in 0x285) B2–3: motor RPM → with the same scale and bias it is close to the motor RPM of 0x298 B4: very similar to current through traction battery BUT less accurate B5: constant 0 B6: constant 0 B7: only change at the end of the ride? | |
| 0x298 | B6–7: motor RPM according to online sources B0, B1, B2, B3: clear measurement results, of what? B5: constant 0 | RPM = (value * 1) - 10000 → according to online sources |
| 0x29A | the following sequence is repeated: index for information in another frame? or heartbeat? | |
| 0x2F2 | B0: clear measurement result, of what? B1: constant 0 B2: constant 0x03 | |
| 0x300 | everything constant besides: B4: is 0x07 or 0x87 i.e. B4b4-7 is also constant | |
| 0x308 | completely constant probably heartbeat | |
| 0x325 | completely constant probably heartbeat | |
| 0x346 | B0–1: very similar to current through traction battery → maybe current through motor alone? Or vice versa? Note: Short peaks in the middle of stopping to enter the road: B2: constant 0x5D B3: constant 0x20 B4: constant 0x0 B5: constant 0 B6: constant 0 B7: bias = 0, scale = 1 → range according to online sources → possible because in general the graph is decreasing, some strange jumps? | |
| 0x373 | B0b0–6: bias = 3, scale = 0.01 → max cell voltage according to online sources B1b0–6: bias = 3, scale = 0.01 → min cell voltage according to online sources B2–3: bias = -328, scale = 0.01 → traction battery current according to online sources B4–5: bias = 0, scale = 0.1 → traction battery voltage according to online sources B6–7: constant 0016 | |
| 0x374 | B0 and B1: have something to do with battery SOC (online sources contradict). Process B0-1? Or would B0 and B1 each refer to specific number of modules? B2 constant 0 B3 constant 0 B6 constant 0x31 B7 constant 0 | |
| 0x375 | completely constant probably heartbeat | |
| 0x384 | B0–1: AC according to online sources B3: current to 12V battery according to online sources B4: heating according to online sources rest: no idea, probably also something to do with AC | AC = value * 0.001 → according to online sources 12V current = value * 0.01 → according to online sources |
| 0x385 | B1: change at the end of the ride (like 0x384) rest: constant 0 | |
| 0x3A4 | B0b0: 1 = AC on, 0 = AC off B0b1: 1 = recirculation on, 0 = recirculation off B0b2: 1 = MAX btn on, 0 = MAX btn off B0b5-7: bias = 0, scale = 1 → heating level B1b0-3: bias = 0, scale = 1 → vent direction 1 or 2 = face, 3 = legs + face, 4 or 5 = legs, 6 = legs + windshield, 7 or 8 or 9 = windshield B1b5-7: bias = 0, scale = 12.5 → fan speed everything according to online sources, not entirely sure, further testing needed | |
| 0x408 | whole message constant 0 |
Thanks for your help!
