Pages: [1] 2
Author Topic: finding CAN-IDs in ECU Image  (Read 18597 times)
lulu2003
Full Member
***

Karma: +11/-1
Offline Offline

Posts: 242



« on: May 29, 2012, 02:03:17 AM »

ME7 is receiving and sending information through CAN bus, but the IDs are kept quite secret.
many GPS data loggers are able to get data from CAN but you need to have a definition, often called ".dbc".

isn't that information also in the ECU image?

I can find what I need (I think) in the FR pdf in the CAN function e.g. "Botschaft Motor 7 ($588, 20ms-Raster, 8 Byte)".
I guess $588 is the CAN ID, 50 Hz. But I need that for a ME7 I have no Funktionsrahmen for...
Logged
terok
Full Member
***

Karma: +8/-3
Offline Offline

Posts: 132


« Reply #1 on: May 29, 2012, 04:50:44 AM »

Yes you can find them in bin. For example, open 06a906032hj 366426, go at address 3EC9C.
You will see ID $280 (16bit) which is Motor1.
There's few bytes of data after each ID, it's up to you to make something out of it.
Logged
terok
Full Member
***

Karma: +8/-3
Offline Offline

Posts: 132


« Reply #2 on: May 29, 2012, 05:00:30 AM »

I might be able to help you, if you tell me what you are looking for, or what data you need to extract from the bus.
Logged
lulu2003
Full Member
***

Karma: +11/-1
Offline Offline

Posts: 242



« Reply #3 on: May 29, 2012, 06:09:21 AM »

examining that Skoda 1.8t(?) image, I would find some IDs:

0280
0288
0380
0488
0010(??)
0440
01A0
0540
0420
05E0
0050
04A0
038A

is this right?
but these Blocks usually are some bytes of length with unknown composition....(to me)
Logged
terok
Full Member
***

Karma: +8/-3
Offline Offline

Posts: 132


« Reply #4 on: May 30, 2012, 01:54:34 AM »

From these you can see what IDs are used by ecu to send data.
$280=Motor1
$288=Motor2
$380=Motor3
$488=Motor6

These are some IDs that ecu is interested in hearing about.
$440=Transmission1
$1A0=Brake1
$540=Transmission2
$420=Kombi-instrument2
$5E0=Klima1
$050=Airbag1
$4A0=Brake3
$38A=GRA

What data you need to read from the can-bus?
Some of these messages are cyclic, so they update all the time. Some are sent only when data changes.
Logged
lulu2003
Full Member
***

Karma: +11/-1
Offline Offline

Posts: 242



« Reply #5 on: May 31, 2012, 03:23:53 AM »

From these you can see what IDs are used by ecu to send data.
$280=Motor1
$288=Motor2
$380=Motor3
$488=Motor6

These are some IDs that ecu is interested in hearing about.
$440=Transmission1
$1A0=Brake1
$540=Transmission2
$420=Kombi-instrument2
$5E0=Klima1
$050=Airbag1
$4A0=Brake3
$38A=GRA

What data you need to read from the can-bus?

very nice!  Smiley
Did you gather that information from the Skoda image or is it a common standard for VAG cars?
Logged
terok
Full Member
***

Karma: +8/-3
Offline Offline

Posts: 132


« Reply #6 on: May 31, 2012, 04:03:50 AM »

I knew these IDs already, so i just looked for them in the file.
They are pretty much standard to some extent.

Boost pressure should be in packet ID $588 (Motor7), startbyte 5, 8 bits long, scaling 0.02
Logged
20VTMK1
Full Member
***

Karma: +0/-0
Offline Offline

Posts: 113


« Reply #7 on: May 31, 2012, 04:17:55 AM »

@ TeroK ,

Can you turn these data requests off ? In the case that you dont have the airbags and ABS ? Or is it easier to dis-able the code word and testers ect ?
Logged
terok
Full Member
***

Karma: +8/-3
Offline Offline

Posts: 132


« Reply #8 on: May 31, 2012, 02:22:09 PM »

Not by this method. It propably is possible if correct config bits are found. Easier to just delete codes.
Logged
andrew
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 10


« Reply #9 on: May 17, 2013, 06:07:19 AM »

@ TeroK
Can you point where to search torque from engine, in 280?, how to scale it ?
Logged
terok
Full Member
***

Karma: +8/-3
Offline Offline

Posts: 132


« Reply #10 on: May 17, 2013, 06:42:07 AM »

ID 280$, Inneres Motormoment, startbyte 2, length 8 bits, scaling 0.39, 0..99.06% MDI. Value of 255 = fehler.
Is this what you are looking for?
This propably doesn't apply to all engines.
« Last Edit: May 17, 2013, 06:45:57 AM by terok » Logged
andrew
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 10


« Reply #11 on: May 17, 2013, 07:10:29 AM »

I assume that you are counting from 1, right  ?

After day of tracing and I also picked byte at offset 1 as most probably candidate, with scaling ~1.4 to reach Nm
I have very good correlation in 2000 to 5000 RPM revolution range at WOT,
e.g. 308Nm vs. 306Nm taken from measuring grp 120 field 2 (engine 2.0TFSI).

At idle my tq oscialtes around 20Nm vs. 0Nm  from grp 120,
in range from 20 to 100Nm, I have 20Nm disperacy, I accounted above for mechanical losses.

But one thing I don't underestand, above 5000RPM till red line,
at 5000RPM when ECU stops maintain constant torque and start to main constant power,
my difference raises, ending with 270Nm vs 240 Nm from grp 120

I assume that explnaition is in "scaling 0.39, 0..99.06% MDI" scaling 0.39 gives what units %?
what is MDI, (eventully can you point me to some documntation/resources ?)
Is there somewhere MaximumEngineTorque ? I need convert to Nm somehow

thx for replay,
« Last Edit: May 18, 2013, 12:25:05 AM by andrew » Logged
phila_dot
Hero Member
*****

Karma: +171/-11
Offline Offline

Posts: 1709


« Reply #12 on: May 17, 2013, 07:58:26 AM »

Have you looked at TKMWL (IIRC) in the FR?

You should find the answer to alot of your questions there.
Logged
terok
Full Member
***

Karma: +8/-3
Offline Offline

Posts: 132


« Reply #13 on: May 17, 2013, 09:46:53 AM »

TKMWL is for tester communication.
Powertrain CAN-messages you find in section CAN in FR.

There is MDMAXKBI Nm output in $580, startbyte 5 (first is 1), 8bits, scale 0..2550Nm, scaling factor 10.

Other engine torque messages are handled in internal torque %.
« Last Edit: May 17, 2013, 09:55:13 AM by terok » Logged
phila_dot
Hero Member
*****

Karma: +171/-11
Offline Offline

Posts: 1709


« Reply #14 on: May 17, 2013, 10:04:40 AM »

I know.

I was speaking specifically about his questions in his last post.
Logged
Pages: [1] 2
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.031 seconds with 17 queries. (Pretty URLs adds 0s, 0q)