canbus deciphering

[fprigge]

Hi, I have read most of what could be found on the web about the canbus messages in the truck but the info is still pretty thin.

Most of what has been R.E. up to now is polled OBD-II pids. Instead, I am trying to figure out the traffic that is already present on the diagnostic CAN.

I have figured some of the stuff out, on my Canadian '18, but I am sure I am not the only one doing this! I would like to put all of our efforts in common. I have consigned my findings in a .dbc file, but any other sharing format it ok with me. The forum does not allow me to upload a pdf or a xls file, any suggestions?

 

[anko]

Like this?

134_CEL,134_CEL,220134,(D*256+E)*100/255,0,100,%,
134_ALV,134_ALV,220134,(D*256+E)*10/32,0,100,%,
134_TADV,134_TADV,220134,G-20,0,100,%,
134_CTA,134_CTA,220134,H*100/255,0,100,%,

154_FUELREAL,154_FUELREAL,220154,A*100/255,0,100,%,
154_FUELDASH,154_FUELDASH,220154,B*100/255,0,100,%,
154_FUELLOW,154_FUELLOW,220154,C*100/255,0,100,%,
154_FUELSTART,154_FUELSTART,220154,D*100/255,0,100,%,
154_ODO,154_ODO,220154,((F*256+G)*256+H)/10,0,150000,KM,

208_Brk,208_Brk,220208,(C&15)*256+D,0,66000,,
208_Spd1,208_Spd1,220208,E*256+F,0,66000,,
208_Spd2,208_Spd2,220208,G*256+H,0,66000,,

210_Pedal,210_Pedal,220210,C*100/255,0,100,%,

214_SPEED1,SPEED1,220214,(A*256+B)/2,0,66000,
214_WHEEL1,WHEEL1,220214,C*256+D,0,66000,Cnt
214_WHEEL2,WHEEL2,220214,E*256+F,0,66000,Cnt
215_SPEED2,SPEED2,220215,(A*256+B)/2,0,66000,
215_WHEEL3,WHEEL3,220215,C*256+D,0,66000,Cnt
215_WHEEL4,WHEEL4,220215,E*256+F,0,66000,Cnt

287_FrTrqReq,Front Trq Req,220287,(A*256+B-10000)/10,-200,200,Nm,
287_RrTrqReq,Rear Trq Req,220287,(C*256+D-10000)/10,-200,200,Nm,
287_TotTrqReq,Total Trq Req,220287,VAL{287_FrTrqReq}+VAL{287_RrTrqReq},-350,350,Nm,
287_GenTrqReq,Generator Trq Req,220287,(E*256+F-10000)/10,-200,200,Nm,
287_G,287_G,220287,G,0,255,Cnt,
287_H,287_H,220287,G,0,255,Cnt,

288_FrTrq,Front Trq,220288,(A*256+B-10000)/10,-200,200,Nm,
288_FrRPM,Front RPM,220288,C*256+D-20000,-10000,10000,RPM,
288_FrPwr,Front Power,220288,VAL{288_FrTrq}*VAL{288_FrRPM}/9548.8,-70,70,kW,
288_FrForce,Front Force,220288,VAL{288_FrTrq}*20.05,-5000,5000,N,
288_E,288_E,220288,E,0,255,?,
288_F,288_F,220288,F,0,255,?,
288_G,288_G,220288,G,0,255,?,
288_H,288_H,220288,H,0,255,?,

289_RrTrq,Rear Trq,220289,(A*256+B-10000)/10,-200,200,Nm,
289_RrRPM,Rear RPM,220289,C*256+D-20000,-10000,10000,RPM,
289_RrPwr,Rear Power,220289,VAL{289_RrTrq}*VAL{289_RrRPM}/9548.8,-70,70,kW,
289_RrForce,Rear Force,220289,VAL{289_RrTrq}*27.42,-5000,5000,N,

289_E,289_E,220289,E,0,255,?,
289_F,289_F,220289,F,0,255,?,
289_G,289_G,220289,G,0,255,?,
289_H,289_H,220289,H,0,255,?,

28B_GenTrq,Gen Trq,22028B,(A*256+B-10000)/10,-200,200,Nm,
28B_GenRPM,Gen RPM,22028B,C*256+D-20000,-10000,10000,RPM,
28B_GenPwr,Gen Power,22028B,VAL{28B_GenTrq}*VAL{28B_GenRPM}/9548.8,-70,70,kW,
28B_E,28B_E,22028B,E,0,255,?,
28B_F,28B_F,22028B,F,0,255,?,
28B_G,28B_G,22028B,G,0,255,?,
28B_H,28B_H,22028B,H,0,255,?,

28X_TotTrq,Total Trq,220289,VAL{288_FrTrq}+VAL{289_RrTrq},-350,350,Nm,
28X_TotPwr,Total Power,220289,VAL{288_FrPwr}+VAL{289_RrPwr},-140,140,kW,
28X_TotForce,Total Force,220289,VAL{288_FrForce}+VAL{289_RrForce},-10000,10000,N,
28X_Distrib,Distribution, 220289,100*VAL{289_RrPwr}/(VAL{289_RrPwr}+VAL{288_FrPwr}),0,100,%,

328_Speed,Speed,220328,(A*256+B)/2,0,200,km/h,
328_Power_KM,Power_KM,220328,VAL{373_Amps}*VAL{373_Volt}/VAL{328_Speed},-1000,1000,Wh/km,

345_RANGE,RANGE,220345,G*256+H,0,1000,KM,
345_EVRANGE,EVRANGE,220345,signed(F),-1,60,KM,

346_BARS,BARS,220346,(C*17/100),0,18,Bars,
346_EVPCT,EVPCT,220346,H,0,100,%,
346_Power,346_Power,220346,(A*256+B-10000)/100,-100,100,%,

373_A,373_A,220373,C/2,0,110,?,
373_B,373_B,220373,B/2,0,110,?,
373_G,373_G,220373,G,0,110,?,
373_H,373_H,220373,H,0,110,?,
373_Amps,Amps,220373,(C*256+D-32700)/100,-200,200,A,
373_Volt,Volt,220373,(E*256+F)/10,0,330,V,
373_Power,Power,220373,VAL{373_Amps}*VAL{373_Volt}/1000,-70,70,kW,

374_SOCCTRL,SOC Controller,220374,A/2-5,0,110,Pct Ctrl,
374_SOCDisp,SOC Display,220374,B/2-5,0,110,Pct Disp,

375_SOCReal,SOC Real,220375,(D*256+E)/100-5,0,110,Pct Real,

387_BA,BA,220387,A,0,255,Cnt,
387_BB,BB,220387,B,0,255,Cnt,
387_BAMPS,BAMPS,220387,(C*256+D-32700)/100,-250,250,A,
387_BVOLT,BVOLT,220387,(E*256+F)/10,0,350,Volt,
387_BG,BG,220387,G,0,100,C
387_BH,BH,220387,H,0,100,C
387_BPOWER,BPOWER,220387,VAL{BVOLT}*VAL{BAMPS}/1000,-70,70,kW,

389_Volt,Volt,220389,A*2,0,110,V,

608_Coolant,608_Coolant,220608,A-40,-40,120,deg C,
608_Ambient,608_Ambient,220608,B-40,-40,50,deg C,

732_RrCurr1,Rear Curr 1,220732,A*256+B-1000,0,255,A,
732_RrCurr2,Rear Curr 2,220732,C*256+D-1000,0,255,A,
732_RrDiff1,Rear Diff 1,220732,E,0,255,%,
732_RrDiff2,Rear Diff 2,220732,F,0,255,%,
732_G,732_G,220732,G,0,255,Cnt,
732_H,732_H,220732,H,0,255,Cnt,

734_GenCurr1,Generator Curr 1,220734,A*256+B-1000,0,255,A,
734_GenCurr2,Generator Curr 2,220734,C*256+D-1000,0,255,A,
734_GenDiff1,Generator Diff 1,220734,E,0,255,%,
734_GenDiff2,Generator Diff 2,220734,F,0,255,%,
734_G,734_G,220734,G,0,255,Cnt,
734_H,734_H,220734,H,0,255,Cnt,

75A_FrCurr1,Front Curr 1,22075A,A*256+B-1000,0,255,Cnt,
75A_FrCurr2,Front Curr 2,22075A,C*256+D-1000,0,255,Cnt,
75A_FrDiff1,Front Diff 1,22075A,E,0,255,%,
75A_FrDiff2,Front Diff 2,22075A,F,0,255,%,
75A_G,75A_G,22075A,G,0,255,Cnt,
75A_H,75A_H,22075A,H,0,255,Cnt,

This is in Torque Pro format, so:
- Long PID Name
- Short PID Name
- Mode / PID (in this case, ignore 220 and the last three bytes are the header)
- Formula
- Lowest value
- Highest value
- Units

Obviously, TP cannot use this file to talk to an adapter, as TP expects to send polling commands. I have a little Java app running on my phone that captures raw CANBUS data and presents itself towards TP as an adapter on 127.0.0.1:35000. The app fullfils the requests from TP from the buffered data. Although not 100% stable, it works like a charm. Refresh rates are way faster than normal.

Do you have some jewels to share?

 

[anko]

Note: the primary CANBUS is split in two with a firewall in between. Some data only exists on (what I call) the front half, some only on the back half. Some data exists on both. To capture data that only exists on the back half, you have to create a second diagnostics port and use a second adapter.

I have two OBDLink MX-es in STMA mode (plus a third one for polling data that I was not able to identify in the raw data).

BTW: What does "R.E." mean?

 

[fprigge]

Hummm all the pasted stuff looks like polled OBD requests... I am trying to snoop the general bus traffic. I do understand the limitations of the canbus architecture of the vehicle. Here is the traffic already present on the bus and some of my Reverse Engineering (R.E.).

EDIT: sorry, some id's do match! I'll try to integrate that to my DBC and go for a ride...

 

[anko]

Hummm all the pasted stuff looks like polled OBD requests...

Looks like you did not read my comments directly below the 'pasted stuff' (which happens to be the result of my own personal R.E.).

Like I said, strip 220 from the PID in the third column, and you get the header of the CANBUS frame. Next column is the formula to apply.
Look for example at the lines starting with 387 and compare with your own:

387_BA,BA,220387,A,0,255,Cnt,
387_BB,BB,220387,B,0,255,Cnt,
387_BAMPS,BAMPS,220387,(C*256+D-32700)/100,-250,250,A,
387_BVOLT,BVOLT,220387,(E*256+F)/10,0,350,Volt,
387_BG,BG,220387,G,0,100,C
387_BH,BH,220387,H,0,100,C
387_BPOWER,BPOWER,220387,VAL{BVOLT}*VAL{BAMPS}/1000,-70,70,kW,

Pretty much a match. Although, according to my formula, HV amps would be -3.55 though.

Or these ones:

346_BARS,BARS,220346,(C*17/100),0,18,Bars,
346_EVPCT,EVPCT,220346,H,0,100,%,
346_Power,346_Power,220346,(A*256+B-10000)/100,-100,100,%,

Look familiar?

 

[fprigge]

Super, some stuff matches! For the traction power, I managed to get the value in watts and it matches 100% the on-board display. So by scaling it this way (instead of your % value):

in your format:
346_Power,346_Power,220346,(A*256+B-1000000)/10,??,??,watts,

this section is a bit cryptic to me:
134_CEL,134_CEL,220134,(D*256+E)*100/255,0,100,%,
134_ALV,134_ALV,220134,(D*256+E)*10/32,0,100,%,
134_TADV,134_TADV,220134,G-20,0,100,%,
134_CTA,134_CTA,220134,H*100/255,0,100,%,

what does CEL, ALV, TADV and CTA stand for? Also, the fist 2 signals share the same sources (bytes D and E)?

Thanks a lot!!!

 

[fprigge]

the stuff I've got also is:
VIN at 0x6FA (it is multiplexed)
electric ebrake at 0x32F
transmission gear at 0x318
steeringAngle at 0x236


if you want the details, I'll be happy to share!

 

[fprigge]

here is the VIN and tx messages

 

[anko]

346_Power,346_Power,220346,(A*256+B-1000000)/10,??,??,watts,

So, this matches power needle (power usage for driving)? Nice! My value includes heater, A/C and other stuff.

Sthis section is a bit cryptic to me:
134_CEL,134_CEL,220134,(D*256+E)*100/255,0,100,%,
134_ALV,134_ALV,220134,(D*256+E)*10/32,0,100,%,
134_TADV,134_TADV,220134,G-20,0,100,%,
134_CTA,134_CTA,220134,H*100/255,0,100,%,

what does CEL, ALV, TADV and CTA stand for? Also, the fist 2 signals share the same sources (bytes D and E)?

Thanks a lot!!!

CEL = Calculated Engine Load (normally 0104)
ALV = Absolute Load Value (normally 0143)
TADV = Timing Advance (if I remember correctly, normally 010E)
CTA = Commanded throttle actuator (normally 014C)

See https://en.wikipedia.org/wiki/OBD-II_PIDs.

Not sure why both CEL and ALV use D+E. Did this about two years ago. Maybe, I never finished this bit ;-)

Personally, I liked the Torque bit a lot, requested and delivered. You can actually see the PHEV ECU asking the generator to produce torque to start the ICE or to consume torque to produce electricity.
And BRK, allows you to see when the physical brakes are really applied.

 

[anko]

Nice stuff. Unfortunately, I am a few timezones ahead of you and it's time for me to get some sleep ;-)

 

[fprigge]

steering stuff

 

[TediK]

the stuff I've got also is:
VIN at 0x6FA (it is multiplexed)
electric ebrake at 0x32F
transmission gear at 0x318
steeringAngle at 0x236


if you want the details, I'll be happy to share!

Hey, are you still here? I am very interested - I have Outlander PHEV 2019 and I need to build additional modules (e.g. for cornering lights on front fog lights ...). An excel sheet with information about the identified CAN frames and how to encode the values would be very helpful for me!

 

[highvoltagebeetle]

Is your DBC published anywhere? Does anyone have a log with the electric heater running?

 

[Bejam]

Hello,
Very interesting thread here. I'm not able to open images attached. Is the DBC file shared somewhere or as a starter, do we have the scantool variable name list ?

 

[heo445]

Hello,

Did any one find a DBC file?

 

[Pshemek]

Hello,

Did any one find a DBC file?

Anko's first post in this thread is something like DBC.
Most probably you can use it in Torque Pro

 

[Pshemek]

Please keep in mind - almost all "Anko's codes" are ECUs response IDs (except 287 - this is a request ECU ID of )
They are useful to "monitor" things - without asking.
For others you explicitly need to "ask" for data.
Here is a list of ECUs, Request IDs, Response IDs and their part numbers (where I added them)

ECU list​

Req.ID / Resp.ID / ECU name, remarks
61E / 61F / CMU, Cell Management Unit 1
62E / 62F / Cell Management Unit 2
63E / 63F / Cell Management Unit 3
64E / 64F / Cell Management Unit 4
65E / 65F / Cell Management Unit 5
67E / 67F / Cell Management Unit 7
68E / 68F / Cell Management Unit 8
69E / 69F / Cell Management Unit 9
6AE / 6AF / Cell Management Unit 10
6BE / 6BF / Cell Management Unit 11
600 / 500 / Keyless Operating System (available always! - even with power off) (P/N:8637B328) Also: TPMS
620 / 504 / ETACS (available always! - even with power off)
622 / 484 / Steering wheel angle sensor (P/N:8651A174)
688 / 511 / Airco
6A0 / 514 / Combination Meter (P/N:8100C385)
6E0 / 51C / Supplemental Restrain System SRS (P/N:8635A305)
718 / 719 / ACC / FCM / …
71A / 71B / Lane Departure Warning
724 / 725 / Compressor
726 / 727 / P-Lock
73A / 73B / EV – MiEV
73C / 73D / Generator Control Unit
753 / 754 / Rear Motor Control Unit
755 / 756 / Front Motor Control Unit
761 / 762 / BMU, Battery Management Unit (available while charging! - even with power off)
765 / 766 / OnBoardCharger
773 / 774 / OSS
784 / 785 / AWC / ABS / …
796 / 797 / Power Steering (P/N: 8633A097)
7A8 / 535 / Audio
7E0 / 7E8 / Engine (default for all 0x0ABC PIDs) (P/N:1860C102)
7E2 / 7EA / PHEV (P/N:9486A056)

Note: there is no CMU no 6. Thats not a mistake, as you see - there is CMU 11 instead. Overall modules number in Outlanders is 10.
Each module consists of 8 Cells.
What is interesting for reading cell temperatures: each module has only 4 temp sensors, not 8 as one could expect.

Example:
This is ECU information for the CMU:

Request:
0x61E 02 1A 87

Response:
0x61F: 10 16 5A 87 04 85 00 04
0x61F: 21 FF 02 02 03 01 00 39
0x61F: 22 34 39 39 43 39 34 37
0x61F: 23 20 20 FF FF FF FF FF

Bytes: 39 34 39 39 43 39 34 37 20 20 represent P/N: 9499C947

 

[Pshemek]

Registered TPMS list

(I don't know if its first or second set)

Req.Id: 0600 Resp.Id: 500, pid: 2128

resp: [05] [00] [61] [28] [00] [0e] [eb] [52] [fc] [0e] [e8] [e2] [b1] [0e] [eb] [53] [06] [0e] [e8] [e2] [ae] [ff] [ff] [ff] [ff]

1st tpms id: [0e] [eb] [52] [fc]
2nd: [0e] [e8] [e2] [b1]
3rd: [0e] [eb] [53] [06]
4th: [0e] [e8] [e2] [ae]

remark: sensors are away so I believe - instead of FFs at the end - there should be actual TPMS sensor readings?

Please correct me if its wrong assumption.

 

[littlescrote]

I don't understand this as CAN is a "produce and consume" protocol, not a "master and slave/send and receive" protocol like Modbus. So why are some IDs "ask" and are more like Modbus registers?

 

[Pshemek]

I don't understand this as CAN is a "produce and consume" protocol, not a "master and slave/send and receive" protocol like Modbus. So why are some IDs "ask" and are more like Modbus registers?

Its true - it resembles a little master/slave in specific scenarios: ECU do not broadcasts its P/N during normal work, so you need to explicitly ask for it.
Its sometimes hard to say which entity is master and which is slave though.

Please do not stick with my nomenclature. It may be just wrong naming.
If you want to understand this better - there is excellent introductory page here: https://www.csselectronics.com/pages/obd2-explained-simple-intro

In general its just one particular entity (one ECU) is little shisofrenic it is listening on one specific ID (I called it send ID) but it produces messages using another one - I called it "response ID".

There is another thing: one ECU (lets use ICE motor ECU as an example) do not listen for any message to set specific motor RPMs. It listens only on messages from "his known colleauge" which can be throttle pedal.