NefMoto

Hi! As some of you know, I'm looking into MS43 quite a lot and recently wanted to expand the CAN routine with additional custom data.

I was able to do so with a single message, but as soon as I added others, the CPU was dropping another one. But first lets look at the configuration. (Manual here: https://www.keil.com/dd/docs/datashts/infineon/c167cr_um.pdf)


The C167CR-LM has 16 (0x0F) message boxes that can be configured in Rx or Tx Mode in fixed registers for the CAN1 interface configuration starting at 0xEF00.

The configuration of these message boxes is explained here: https://www.ms4x.net/index.php?title=Siemens_MS43_CAN_Bus including a configuration table.

This configuration table is copied to CAN1 registers while ECU startup. The ARB ID is located in C1UAR if you right shift the word by 5. This is the routine in IDA:

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=19974.0;attach=35065;image)

CSR: 0x741
BTR: 0x3601 (results in 500kbit/s)

In short, there are 7 Rx boxes and 3 Tx boxes. ECU sends data every 10ms. Original IDs for Tx are 0x316, 0x329 & 0x545.

So far so good, if I mimic the original way for a Tx message, its working great. This way I was able to add custom data (additional ID 0x33C) to my vehicles CAN Bus, that is read by the aftermarket gearbox controller. Here is the snippet:

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=19974.0;attach=35067;image)

But as soon as I added a fifth message for sending, I was missing one of the other IDs, 6 messages, two of the original IDs.

Genarally speaking, only the 4 last prepared messages in the code flow where sent. I also tried sending only ZEROES, but same outcome.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=19974.0;attach=35069;image)


Does somebody know what Im missing here?

How are you confirming the messages are not sent vs sent but not received?

I checked CAN bus output with Arduino CAN Hacker, Canchecked display and the original cluster stopped responding to oiltemperature updates from the ECU becuase 0x545 message was no longer sent.