[marcm]

Hi All,
I have been looking at trying to get some info off the CANBUS network in the car.

I have previously read a rather long thread but stupidly didnt bookmark it. I have tried to search to get it again but there are hundreds of hits for CANBUS.

Does anyone have a link to it handy ?

I also need to understand with the CAN sniffer that I have should I be able to see lots of CAN traffic on the ODBII port Can H/L or do I need to request the data I require ?

I'm after things like rpm/throttle position/brake light/indicators/lights

Can I get these by sniffing the OBDII port or am I blocked by a gateway and do I need to connect to the CAN network say behind the instrument cluster ?

Any help advice appreciated for a CAN newbie.

Thanks
Marc

[MB London]

Can you translate into English

[marcm]

What do I need to do to get the electronic chatter from the car to my laptop using a CAN sniffer thingamy bob ?

Any hints ?

[JonnySi]

So which BUS do you want?

PT-CAN High
PT-CAN Low
LIN BUS
K-CAN High
K-CAN Low
MOST
BSD Line

I'd leave well alone really, if you take a BUS down it'll cost you!

[Tipper]

Have you checked out using Bavarian Technic kit?

[marcm]

Originally Posted by JonnySi

So which BUS do you want?

PT-CAN High
PT-CAN Low
LIN BUS
K-CAN High
K-CAN Low
MOST
BSD Line

I'd leave well alone really, if you take a BUS down it'll cost you!

OK Im after reading/sniffing the following;
RPM
Road Speed
Indicators
Brake Light
Accelerator position
Gear

Just for a bit of background I am an embedded engineer and want to learn about CANBUS. I have an understanding about electronics and have purchased a CAN Analyser so I can start to see what is happening on the bus.

The problem I have is understanding where to hook into. From what I have read its the CAN High and CAN Low but I don't seem to be getting anything from the ODBII CAN High and CAN Low. There is data there but the ID's I have entered to filter dont seem to be there.

I just need a little help to get up and running.

I have set the bus speed to 100k and had the termination both enabled and disabled in the analyser but I still dont get the ID's.

So any help is appreciated.

[JonnySi]

RPM is on the PT-Can
Accelerator position is on PT-Can
Wheel speed is PT-Can between the DME and DSC control units.
The PT-Can can be accessed in the multiplug connection to the KOMBI.

Brake lights are on the K-CAN high & low, they recieve a pulse width modulated voltage of around 6 volts. This voltage can only be seen on an ossciloscope. This is best accessed at the FRM near the bonnet release.

[marcm]

Originally Posted by JonnySi

RPM is on the PT-Can
Accelerator position is on PT-Can
Wheel speed is PT-Can between the DME and DSC control units.
The PT-Can can be accessed in the multiplug connection to the KOMBI.

Brake lights are on the K-CAN high & low, they recieve a pulse width modulated voltage of around 6 volts. This voltage can only be seen on an ossciloscope. This is best accessed at the FRM near the bonnet release.

So I should be able to access the PT-Can on the ODBII connector ? If not then thats where Im going wrong.

As a starting point I've been trying to listen out for PID 0x0C which should be rpm. But Im getting nothing.

Am I right in assuming the bus speed is 100k ?
And should I be requesting the value for PID 0x0C by sending a request:
0x0C 0x01

Just want to get some data so I know Im connecting correctly.
I have connected to pins 6(CAN-high) and 14(CAN-low) on the ODBII connector. Is this right ?

[JonnySi]

Without the schematics I dont know the pin designations off by heart. I'd be very careful going into random pins incase you spike a BUS or control unit.

You need to be on the back of the instrument cluster for PT

K-Can high and low are orange and green, with orange wires in a twisted formation. you will find them all over the car.

[Dr Dave]

Knicker sniffer!

You'll get Will all excited!

[gIzzE]

Garmin now do a wireless obdII connector that talks back to some of their nav units and gives you everything you are after, so maybe look on the Garmin forums to see if someone has listed the pinouts.

Must be standard too as the same device is compatible far many different marques.

In fact just google OBDII pinouts....

[marcm]

Originally Posted by gIzzE

Garmin now do a wireless obdII connector that talks back to some of their nav units and gives you everything you are after, so maybe look on the Garmin forums to see if someone has listed the pinouts.

Must be standard too as the same device is compatible far many different marques.

In fact just google OBDII pinouts....

Yo gIzzE thanks for that. I have googled ODBII but as you can see there are a few busses. I was trying to find out if the J-2234 is the equivalent to the PT-Can.

I want to sniff the data instead of having to probe a module to get it. This leads me more to looking at the bus that goes to the instrument cluster as this info is constantly flowing.

Just need to find somewhere to tap in without taking the instrument cluster out.

[marcm]

Originally Posted by Dr Dave

Knicker sniffer!

You'll get Will all excited!

Easy tiger....

[marcm]

Ok been having a read around and I should be able to get the PT-CAN on the ODBII connetion with pins 6 and 14.

Does anyone know the message format and speed ?
•ISO 15765-4 CAN (11 bit ID,500 Kbaud)
•ISO 15765-4 CAN (29 bit ID,500 Kbaud)
•ISO 15765-4 CAN (11 bit ID,250 Kbaud)
•ISO 15765-4 CAN (29 bit ID,250 Kbaud)


Hopefully thanks in advance.

[m1bjr]

Why not drop a line to Terry Burger, he 'may' help you out

Do you not have to address the modules directly, unlike simple packet sniffing?

I recall something odd about shorting / opening a couple of those OBD2 pins too, depending upon model year...

How about tapping the ECU connectors directly, like BMS tuner boxes do, I think all required connectors must all be present there?

[marcm]

Originally Posted by m1bjr

Why not drop a line to Terry Burger, he 'may' help you out

Do you not have to address the modules directly, unlike simple packet sniffing?

I recall something odd about shorting / opening a couple of those OBD2 pins too, depending upon model year...

How about tapping the ECU connectors directly, like BMS tuner boxes do, I think all required connectors must all be present there?

Does Terry have a user ID ??

I would prefer to sniff as its more likely to be approved for connection to the CAN network and not invalidate any warranty.

If I could just find somewhere to connect to without having to remove the dash it would be great.

[marcm]

After lots of searching I have found the post that outlines lots of info about the CAN network on the E9x... happy days

http://www.e90post.com/forums/showthread.php?t=177272

[Mike in Hampshire]

Originally Posted by marcm

After lots of searching I have found the post that outlines lots of info about the CAN network on the E9x... happy days

http://www.e90post.com/forums/showthread.php?t=177272

Wow. I don't understand one word of this whole damned thread.
It's like that old Monty Python sketch where they all talk in "banter".

Mike.

[zltm089]

I got no idea what everyone is on about!!!...

jasvnnvhhn h bvn tf n tf bn gvy ngnm ksdk kh h gsdjdkj =d0sd9sd89dsv 0sfd0gvsd-sd9svd78 7fd7 89.....

and the engine bhp goes to 560....

[marcm]

Originally Posted by zltm089

I got no idea what everyone is on about!!!...

jasvnnvhhn h bvn tf n tf bn gvy ngnm ksdk kh h gsdjdkj =d0sd9sd89dsv 0sfd0gvsd-sd9svd78 7fd7 89.....

and the engine bhp goes to 560....

My god youve cracked it... your a genius.

[m1bjr]

_._

[marcm]

Just in case anyone can understand what is being discussed here, I have managed to get some data off the ODBII port.

bus speed is 500k and I can see the ignition toggle when I start the car:

Started: 08/09/2011 21:24:29
RX (HEX),130,5,C1,42,FF,FF,FF,,,,425.381,0.1,
RX (HEX),130,5,C1,42,FF,FF,FF,,,,0.915,0.04,
RX (HEX),130,5,D5,42,FF,FF,FF,,,,0.965,0.05,
RX (HEX),130,5,C5,42,FF,FF,FF,,,,1.855,0.07,
RX (HEX),130,5,C1,42,FF,FF,FF,,,,14.677,0.1,

C1 = Ignition ready
D5 = Engine starting
C5 = Engine running

So first bit of successfull sniffing.... PT bus next.