To coin a phrase... Canbus reverse engineering 🙄

[tomhanman]

Hello, so to stop cluttering up other's threads here is one all of my own.

I reserve the right to add "failed" to the title at any point In the future

So a little recap for those not familiar with my aim...

In the immediate I would like to convert a 1958 petrol Peugeot 203 to electric using the motor and brain of a Peugeot Ion without abs, eps etc. I chose the Ion because being Peugeot it should be much easier than if I had a mitsubishi donor. Yes, that was what passes for humour around here.

In the longer term I would love to arrive at a point where we could, using can, remove various components of the imiev system for future small classic conversions whilst maintaining as a minimum the motor, system cooling, obc, inverter, dcdc, chademo and bms. Adapting the system to the vehicle requirement, potentially keeping abs, heater, air con, srs, traction control, power steering etc.

I have been reliably informed that this might be tricky and take longer than the weekend .

When I see a desirable and valid goal, I don't consider difficulty much of a deterrent. But that is not to say I think I will succeed, I just think it's worth a shot.

I have done some fun car builds in the past, so I have the basics. However, whilst I have written code, it was on a BBC Master in around 1989. Times have changed, I have not! So a lot to master, but I figure I'll just get Deepseek to do the hard work... I mean what haven't the Chinese reverse engineered?

I might get in trouble along the way, because I have a tenancy to say what I think near enough. I know, I apologise in advance, that's not how it's done these days.

Right anyway, progress.

Today I finished my 3d printed enclosure for the arduino due with it's two transceivers and cable connections for USB and obd2.



I followed a tutorial on openinverter for the due setup. It works until you get to compiling the program for the due, that doesn't work. But if you watch this video posted by Jack Bauer (nope, someone even cooler) you will learn from the master how to get it installed the easy way. Then I stole a wiring harness from an old lexia, 3d printed a case and Bob's your uncle. Oh, I'm English so if there are any random phrases that appear to mean nothing, that's probably what they mean.

It works


First time lucky.

I started with a car that had been disconnected from 12v for a week. So I got SavvyCan running and listening to Obd, then I connected the bad old fashioned lead acid to the car and got a faceful of frames. They calmed down and stopped after a few seconds.

Then I inserted the key and I got another 272 frames which also stopped after a few seconds.

Then I turned the key to position 1 and got another 272 frames. I haven't looked to see if they are the same ones... But one might imagine.

And then, I turned the key to position 2. Then the frames were flowing at over 1500 per second. I fiddled with each pedal in turn, the handbrake, the lights, wipers, just to give my log some shape, and then I shut it down again.

I haven't had time to look at anything again, but bloody hell it worked .

Now to scrape (to train my not so artificial intelligence) as much info on already decoded PIDs as possible from around the Web including the very helpful links already received.

I will try to amalgamate them and present them here in some fashion. This not going to include anything from the chademo or bms bus. I will expect to leave them be.

Well, there we are, I'll let you fill in the rest, I mean its virtually job done

 

[MickeyS70]

Nice setup, but imho you’re trying to do this the ‘hard’ way?

Rather than listen to all CAN messages at the same time I would try to isolate the traffic with the ‘man in the middle function’:

- select an ECU you don’t need for your conversion
- disconnect it’s CAN lines from the bus and put your bridge in-between
- forward all traffic to/from ECU to make sure the car is ‘happy’
- stop the outgoing traffic altogether and see what DTCs are set
- allow traffic again, PID by PID until all is good
- record what PID needs to be sent and how often
- program your bridge to be a simple CAN node that simulates the ECU
- remove the original ECU

At this stage you don’t necessarily need to decode each PID, it might even work if you just ‘record’ the data stream and ‘play’ it back in an endless loop?

One thing to bear in mind though, CAN isn’t the only communication method used by the car…

 

[tomhanman]

All in good time sir!!

Yes that is indeed the way of working I will graduate towards. But I felt it a little presumptuous to jump in like that without knowing my arse from my elbow. I want to get a feel for things as the car is supposed to be. Or at least as close as can be in an imiev without any roof or doors...

I feel I have to learn a bit about the canbus, and about the car before jumping to removing bits and bobs!

So it is only responsible to collect all the free data there is on the canbus, and try and get a little of it into my head, then maybe set about decoding a PID or two on my own to fully understand the process, and move on from there (if I ever achieve even that).

If I can achieve the goal without knowing or understanding some PIDs that will be great. But on the other hand I'm going to have to calculate some values to send in place of the reality, so will need to understand them much better. I'm thinking of steering wheel position, yaw, and road wheel speeds etc. Some of this is loosely detailed by 318iEV on his blog. He did an amazing job although he should have started with a Leaf motor as we previously discussed.

I expect to have to convince ev-ecu that the car is always driving straight with full adherance on all four wheels. But we'll see, Thomasinjapan seemed to state that he unplugged the abs altogether and everything kept working just fine. But when I asked for clarification, there was none forthcoming.

And yes indeed there is the K-line network of communication as well. Plus potentially any sort of electrical interconnect. Scary thoughts. I had seen the UK-line described in the online manual as a "backup" system. So I'm hoping it wouldn't be required if all was hunky dory on the can side... But this is just hope, not reasoning. I guess I'll find out eventually.

Baby steps for now

 

[tomhanman]

I've been reading... I've found a lot of PID...

So when were you going to tell me that nobody has managed to write to the imiev canbus?

And that finer men than me have trod this path to their eventual demise. (When I say finer, I mean those more qualified for the task, I have no knowledge as to their moral fiber )

I mean nobody except 318iev who remains a mystery.

Well that could be a setback

 

[MickeyS70]

So when were you going to tell me that nobody has managed to write to the imiev canbus?

Well, you can’t change data frames directly, if that’s what you mean. You need a CAN bridge to do that (NMC cell upgrades use this method successfully).

It’s also possible to insert ‘missing’ PIDs once you remove a ECU..

… back on track…

 

[kiev]

Man-in-the-middle MITM, you read the CAN Pid on one side, then change the data to what you desire and sent it out on the other side. That's the whole idea of dual CAN chips (can due)

 

[tomhanman]

It’s also possible to insert ‘missing’ PIDs once you remove a ECU..

Ah, doth my heart dare to beat again?

I was reading the Garrygids, dopey, Kiev and even Coulomb threads from some time back. And that was some high brow chatting! I felt like I was trying to learn Korean for bits of it. But what I thought I understood was that basically everyone gave up trying to control elements of the car by sending in can commands presumably due to crc issues which seem to remain a mystery.

Now that's not what I want to do, but also mitm isn't what I want to do. I know all about the idea, but as several ecus will be absent there will be no signal to modify by the man. It will have to be a man on his tod either replying to requests/handshakes, or just sending out repeating frames at the correct interval indicating that all is well down in wheel city.

And crc or whatever black magic isn't an issue there?

 

[MickeyS70]

And crc or whatever black magic isn't an issue there?

Folks have successfully managed to get standalone CMUs to balance by sending simple CAN messages (‘pretending’ to be from the BMU); don’t see any reason why this wouldn’t work on the main OBD bus.

 

[tomhanman]

Well there was a guy... Dopey, back in July 22... "My goal is to turn the heater on remotely in winter".

He and Kiev as well as others had a long thread, it was not a happy ending! He was trying to wake up the car, so another level of complication I guess, but as he said during his experiments, all he managed to do was make the dashboard indicator lamps flash!

I've sent a message to 318iev on his reddit page, and he has just replied in a very positive fashion. Exciting. Anybody have any more pertinent questions for him than my dribbling "please help me"?

 

[tomhanman]

So just to confirm, I'll be working on my secretarial duties as and when I can to turn the numerous lists of Can into one... unless I find that they are all perfect replicas of each other.

This afternoon I had some outside time and did some experiments following on from Thomasinjapan's comment about everything working fine with the ABS disconnected.

Well, yes and no. The dashboard shows some pretty colours, corresponding to two fault codes:
U1102 no comms ABS (fault logged in four or five ECU's) and P1231 ESP fault.

Pretty minimal faults given the scale of the problem, and the repercussions which are:
First the car no longer has 'creep' function or 'inching' or whatever the term is in your locality for the car gently trying to drive away as soon as you take your foot off the brake in drive mode. As I hate creep, this makes me happy. Second it does a lot of wheelspin on loose terrain without complaining, behaving basically as a good old fashioned dumb rear wheel drive, again, happy. But there appears to be a lack of regen. I took some logs, so I'm going to try to analyse them to see if there is any overrun regen or any regen while braking. I would settle for braking regen only. Brake pedal switch seems to be connected in parallel to ASC-ECU and EV-ECU, pedal position sensor again seems connected to both ECUs and brake servo pressure sensor is connected to EC-ECU. So there is hope for braking regen, does the strangth of braking regen vary with drive mode? I haven't tested to see if charging works despite these faults being set, but I figure if it lets the car drive then charging should be fine - I rarely cause the abs to engage whilst charging ;-)

The SRS and ABS leds I can simply remove as the systems won't be present on the car. So the only certain problems so far is that the orange car and red exclamation led on the dashboard are constantly on. Which makes them useless at displaying any other fault situation. Food for thought.

 

[MickeyS70]

does the strength of braking regen vary with drive mode?

Yes, from high to low: B-D-C-N

The SRS and ABS leds I can simply remove as the systems won't be present on the car. So the only certain problems so far is that the orange car and red exclamation led on the dashboard are constantly on. Which makes them useless at displaying any other fault situation. Food for thought.

The various ECU's are looking for PID's generated by the ABS/SRS ECUs, take wheel speed as an example, the four sensors are connected to the ABS ECU and the measured speed is transmitted over the CAN bus. Reconnect the ECUs and look out for PIDs 200/208 in standstill/moving.

Not sure if you can do that with your current setup, but it would be interesting to see what will happen if you 'simulate' wheel speed (with the ABS ECU disconnected) via the OBD port.

The U1112 should change to something else and (if you're lucky) the fault light might just disappear??

 

[tomhanman]

Mickey I'm not yet at a stage where I can send signals... Not a hardware problem, nor software, one must learn to walk before running

But thanks to all those that have already identified regen on 0x696 byte 6+7 I can sadly announce that there is zero regen with abs disconnected. My first foray into using savvycan. Can't say it is a pleasure so far. But I do believe that I have filtered the log and displayed those bytes from my two logs in flow view. I haven't done any conversion into real world units, but the simple lack of any activity in those two bytes is pretty definitive when set alongside the same bytes on the same test track (my drive) with abs unit connected. Some might say; chalk and cheese.

When running without abs there are 6 PIDs missing, no extras but I don't know if these were all coming from the abs or if some are missing because of data not being received by another ecu.
0x119' timer or complicated heartbeat'

0x200 'front wheel speeds'

0x208 'rear wheel speeds and brake pedal'

0x215 'real speed, journey lengths?L/R déviation ?'

0x231 'brake pedal switch'

0x300 byte 4 bit 7 On two frames then Off 2 frames repeated. Also byte 4 and 5 vary wildly describing some sort of event, I suspect it is a wheelspin event and this is the signal to limit motor torque. Outside of these events the bits always return to the same state, no counters etc.

So progress. But I'm suspecting just feeding in wheel speeds might not be enough. I will hope to find out more from 318iev's experience.