With reference to my
thread on CAN scoping, this gets into packet contents
and is more appropriate for over here. My DSO has some basic bus-protocol
analysis capability, which is really handy for getting a quick look at CAN
without having to set up a whole sniffing system. The effort in this case was
to see if the OBD2 queries sent into the tiny network behind the diagnostic
connector would make it through the gateway module to the powertrain P-CAN
unmolested. Having a generous "dashboard" full of fun stuff to watch by now,
I figured that bringing it up would supply plenty of high-ID traffic and I
might be able to see all of the answers.
I wasn't disappointed. Not only do the queries appear verbatim, they get sent
back on the P-CAN, and I could now see all of the ISO-TP multi-packet response
blocks if I got lucky and captured a sample with all of it inside. Once I
started peering at the response headers I realized that which sample the parts
came out of really didn't matter, the overall construction was the same every
time. Looking at this along with Jeju's google-spreadsheet really brings
home a better understanding of how OBD2 is encapsulated into the CAN layer,
as screwed-up as the "standard" for it is with all the byte changing and
sequencing and which length covers what.
This page offers a rather
lengthy explanation, and it's also worth searching for "ISO-TP" in the
Car Hacker's Handbook for more. It *is* confusing, but I think
I understand it somewhat better now.
The packet analysis stuff on the scope isn't smart enough to do filtering, but
with a little post-extraction work and patching together lines from a handful
of captures, data from my car looks remarkably like
Jeju's dumps. Since
my dashboard is asking most heavily on ids 7E2 and 7E4, I looked for those and
the replies. I left the timing fields in the .csv data because it gives some
idea of how fast the responses come back -- on average, seems to be about
10 ms/packet amid everything else screaming across in between, so on the order
of every fortieth packet where a responding ECU can get an appropriate word in
edgewise. Again, OBD2 traffic is about the lowest priority on the bus, but it
eventually gets there. Sure, it would have been easier to just look at the
DLC bus and see only my stuff, but then I wouldn't get such a clear idea of
the traffic density.
Code:
# good 7e4 block : BMS
33.17ms, 7E4, 8, 0322 0101 0000 0000 # len=03, mode=22, pid=0101, pad*4
38.82ms, 7EC, 8, 103E 6201 01FF F7E7 # seq 0 of 3Eh bytes, M/P=620101, "a" - "c"
48.83ms, 7EC, 8, 21FF 8742 6842 6803 # seq 1, bytes "d" thru "j"
58.82ms, 7EC, 8, 2200 030E A50E 0D0D # seq 2, bytes "k" thru "q"
68.82ms, 7EC, 8, 230C 0D0E 0000 0EBF # seq 3, bytes "r" - "x"
78.82ms, 7EC, 8, 2401 BF54 0000 9300 # seq 4, bytes "y" - "ae"
89.66ms, 7EC, 8, 2500 65E9 0000 6403 # seq 5, bytes "af" - "al"
# from diff response packet group but same contents:
53.93ms, 7EC, 8, 2600 0025 7A00 0023 # seq 6, bytes "am" - "as"
63.93ms, 7EC, 8, 2774 0013 FAE1 0D01 # seq 7, bytes "at" - "az"
79.41ms, 7EC, 8, 2876 0000 0000 03E8 # seq 8, bytes "ba" - "bg"
# total 62 = 3Eh bytes: 3 of mode/pid confirm + 59 bytes of answer data
# good 7e2 block : EPCU / VCU
-5.93ms, 7E2, 8, 0221 0200 0000 0000 # len=02, mode=21, pid=02, pad*5
3.917ms, 7EA, 8, 1027 6102 F8FF FC00 # seq 0 of 27h bytes, M/P=6102, "a" - "d"
10.91ms, 7EA, 8, 2101 0100 0000 950A # seq 1, bytes "e" thru "k"
27.01ms, 7EA, 8, 22BB 80F1 39A0 033E # seq 2, bytes "l" - "r" <-- LDC
30.91ms, 7EA, 8, 2392 7039 2080 514C # seq 3, bytes "s" - "y"
43.90ms, 7EA, 8, 2422 6B00 0001 0101 # seq 4, bytes "z" - "af"
53.07ms, 7EA, 8, 2500 0000 0700 0000 # seq 5, bytes "ag" - "ak", pad*2
# total 39 = 27h bytes: 2 of mode/pid confirm + 37 of answer data
# LDC current: q,,p = 0x03A0, or 928, /100 --> 9.28 amps at the time
The LDC emphasis points out the previously unknown fields I believe to have
determined are the DC/DC converter current, described in
this thread.
Given the timing observations, one full query/response cycle for a big block
like BMS data takes about a tenth of a second. I'm pondering if there's a way
to determine whether any given scantool that asks for a bunch of data with the
same mode/pid is intelligent enough to batch them up, e.g. send ONE query and
pick the different answers out of ONE reply block, or if it sends a whole
'nother Q&A transaction for each little item. I'd really hope for the former
method, for Torque Pro and OBDlink and EVOBD2 and Dr.Prius and other notable
tools, but maybe in some their designers didn't consider that or just assumed
buses are fast enough that they can be sloppy.
What I would love to have is dumps of all the *actuation* commands that a
dealer GDS can issue to the car, such as running coolant pumps and changing
valve positions to assist coolant bleeding or brake work, recalibrate sensors,
and whatever. Where's our
right to repair?! What we need is someone with
a pump recall and a small CAN logger they can hang off the DLC bus and let it
run over the duration of a service visit, and/or a friendly dealer tech willing
to help the community. The ones I've talked to are VERY cagey about their
diagnostic systems, and generally have only one on site and keep it in a
special bay. Ridiculous, because it's supposed to be *portable*.
_H*