Jump to content
PCMTEC Forums
TheReaper

CAN Messages

Recommended Posts

Hi All,

Out of curiosity, would any of you have any information on the below messages within the FG PCM.

 

I have the following messages completed (anything with xx has been completed)

ID    Data                  

097   xx xx 00 7E 00 00 xx xx

120   00 00 xx xx 00 00 00 00

12D   xx xx xx 00 xx xx 00 01

200   01 82 02 51 xx xx C0 00

207   xx xx xx xx xx xx xx 00

230   00 FF 82 06 68 00 00 01

425   xx xx xx 0C 80 03 xx xx

427   xx xx xx xx xx 00 05 xx

44D   00 00 00 00 xx xx xx CA

4C0   00 00 00 00 00 00 00 00

623   xx xx xx xx 00 00 00 00

640   xx xx xx xx xx 00 xx 00

650   xx xx 00 00 00 00 00 00

6F6   xx xx xx xx xx xx xx xx

 

Currently I have the following on the remaining messages:

0x200 Byte0&1 moves in the same way that 0x097 Byte 3 does however they are inverse (0x097 value increases where 0x200 value decreases) and its 16 bit rather than 8.

The value moves with RPM, and has a jump in the opposite direction and freezes when the engine speed limiter is active.

0x200 Decimal values range from around [email protected] to [email protected] however goes to 386 when the engine speed limiter is active.

0x097 Decimal values range from around [email protected] to [email protected] and doesn’t change when the engine speed limiter is active. (

Both of these numbers are also affected by Injector Duty.

 

0x200 Byte2&3 decreases with RPM between 0rpm and 1100rpm starting with a decimal value of 593 and ending with 240.

 

0x200 Byte6 seems to have some bit information for engine states. (Mask 0x02 – Engine Cranking)

0x12D Byte7 seems to have some bit information for engine states. (Mask 0x04 – Engine Cranking)

 

0x097 Byte5 goes to 0 when the speed limiter is active.

 

Thanks!!

Share this post


Link to post
Share on other sites

I now have a few more completed:
ID    Data                   
097   xx xx 00 7E 00 00 xx xx
120   xx xx xx xx 00 00 00 00
12D   xx xx xx 00 xx xx 00 01
200   01 82 02 51 xx xx C0 00
207   xx xx xx xx xx xx xx xx
230   00 FF 82 06 68 00 00 01
425   xx xx xx xx xx 03 xx xx
427   xx xx xx xx xx 00 05 xx
44D   00 00 00 00 xx xx xx xx
4C0   00 00 00 00 00 00 00 00
623   xx xx xx xx 00 00 00 00
640   xx xx xx xx xx 00 xx 00
650   xx xx 00 00 00 00 00 00
6F6   xx xx xx xx xx xx xx xx

 

The one that i am very interested in at the moment is the 7E value in 0x97. it seems to increase with RPM but not in a linear fashion, and i cant seem to work out what it is.

It also has an effect on one of the torque output values.

 

Share this post


Link to post
Share on other sites

I'll have to do some logging on my FG, would you be willing to list the data (i.e. what the messages are for) for what you've found?

I've been messing with BA, BF & some FG Can-Bus stuff, its cool but sometimes a bit tedious.

Here's my list of what I have so far, I'll update it when I get some more. You've probably identified alot of it already though.

BA-FGX_CanBusID.xlsx

Share this post


Link to post
Share on other sites
On 4/24/2019 at 10:46 AM, TheReaper said:

Hi All,

Out of curiosity, would any of you have any information on the below messages within the FG PCM.

 Currently I have the following on the remaining messages:

0x200 Byte0&1 moves in the same way that 0x097 Byte 3 does however they are inverse (0x097 value increases where 0x200 value decreases) and its 16 bit rather than 8.

The value moves with RPM, and has a jump in the opposite direction and freezes when the engine speed limiter is active.

0x200 Decimal values range from around [email protected] to [email protected] however goes to 386 when the engine speed limiter is active.

0x097 Decimal values range from around [email protected] to [email protected] and doesn’t change when the engine speed limiter is active. (

Both of these numbers are also affected by Injector Duty.

 

0x200 Byte2&3 decreases with RPM between 0rpm and 1100rpm starting with a decimal value of 593 and ending with 240.

 

0x200 Byte6 seems to have some bit information for engine states. (Mask 0x02 – Engine Cranking)

0x12D Byte7 seems to have some bit information for engine states. (Mask 0x04 – Engine Cranking)

 

0x097 Byte5 goes to 0 when the speed limiter is active.

 

Thanks!!

0x200 byte 0-1 => is actual wheel torque / wheel to engine torque factor (powertrain losses I believe)

I imagine the actual wheel torque is calculated from the torque table of load vs rpm you can find in the editor. Try modifying this table and see what you can datalog. This table is obviously different for each engine calibration.

image.png.d88e4d02af79fcb8a577a54253d02701.png

0x200 byte 2 & 3 is the minimum torque before stall or something like that, this is only used at low rpm, Im not sure if this is even used

0x200 byte 6 sets some flags depending on the type of torque maths used that are all ORd together

0x80 == Engine Torque Type

0x0 = Axle Torque

0x40 = Inertial loss is factored in

0x20 = Cat protection has been enabled

byte 7 is some other flags to do with whether the engine is cranking

We never normally need to reverse engineer the can messages so this is not something we normally dig too deeply into. But the way we figure this stuff out is to open the ROM up, annotate all addresses with their known DMRs and table locations, from that you can see roughly what is being packed into where. This takes a very long time to created these annotated assembly files but once you have created them they are useful for figuring out things like this.

Share this post


Link to post
Share on other sites

97 is the similar to 200

bytes 0-1 = engine MBT torque but it is just offset and scaled into a 16 bit integer. You should be able to graph it over the value from msg200 and see it follows the same curve or at least values that match the torque table.

bytes 2-3 are the same but "engine friction torque" I think this is just using the calculated inertial loss (same as msg200)

207 is speed and rpm which is packed and scaled in various ways

427 contains coolant temp, oil pressure, ac pressure, battery volts, odo value, various MIL states, fuel usage etc

623 various hard coded bits regarding number of cylinders and other not so interesting stuff like if its a gas/petrol engine etc.

6F6 is the PATS security stuff for key codes etc, you won't be able to emulate this as it requires various security algorithms to calculate it.

Share this post


Link to post
Share on other sites

Hi Roland,

Thanks for that info - really appreciate it.
I'll be spending some more time on this over the next week or two and will post updates as i have them!

again, thanks for your help!

 

  • Like 1

Share this post


Link to post
Share on other sites

Yep, sure thing, i'm going to put it on git for others when i have it all in place and working.

I have done a little over the last 2 nights:

0x097 - Byte 0&1 - Engine torque / Byte 2&3 - Friction Losses / Byte 4&5 - Engine Torque (Goes to 0 When limiter active) / Byte 6&7 - Engine Torque
I'm not sure what the differences are between the torque in bytes 1&2/4&5 and 6&7 are in this message.

0x120 - Byte 0&1 - Engine Torque minus Reduction Request / Byte 2&3 - Engine Torque minus 0x097 Bye2&3 (Goes to 0 when in idle state)
I'm not sure whats in Byte 4,5,6,7

0x12D - Byte 0 - Engine Speed rate of change? / Byte 1 - Throttle Pedal (MaxValue 200) / Byte 2 - Some Shift value maybe??? / Byte 4&5 - Engine Speed * 4 / Byte 7 - Mask 0x01 Brake State Mask 0x04 Cranking State
I'm not 100% sure of the value in Byte 2, not idea whats in Byte 3, and not sure of all of the bits inside Byte 7 of this message (only some).

0x200 - Byte 0&1 - Engine Torque (With some other modifier in it) / Byte 2&3 (you mentioned minimum torque before stall, not sure) / Byte 4&5 - Engine Torque (With some other modifier in it.) I'm not sure what the additional modifier is in the torque value in this message. I have graphed it, but cant seem to figure it out, it moves with RPM though.

Share this post


Link to post
Share on other sites

Accidentally hit post and didn't mean to on the one above..... please feel free to delete it :)







 

Yep, sure thing, i'm going to put it on git for others when i have it all in place and working.

I have done a little over the last 2 nights:

0x097 - Byte 0&1 - Engine torque / Byte 2&3 - Friction Losses / Byte 4&5 - Engine Torque (Goes to 0 When limiter active) / Byte 6&7 - Engine Torque
I'm not sure what the differences are between the torque in bytes 1&2/4&5 and 6&7 are in this message.

0x120 - Byte 0&1 - Engine Torque minus Reduction Request / Byte 2&3 - Engine Torque minus 0x097 Bye2&3 (Goes to 0 when in idle state)
I'm not sure whats in Byte 4,5,6,7

0x12D - Byte 0 - Engine Speed rate of change? / Byte 1 - Throttle Pedal (MaxValue 200) / Byte 2 - Some Shift value maybe??? / Byte 4&5 - Engine Speed * 4 / Byte 7 - Mask 0x01 Brake State Mask 0x04 Cranking State
I'm not 100% sure of the value in Byte 2, not idea whats in Byte 3, and not sure of all of the bits inside Byte 7 of this message (only some).

0x200 - Byte 0&1 - Engine Torque (With some other modifier in it) / Byte 2&3 (you mentioned minimum torque before stall, not sure) / Byte 4&5 - Engine Torque (With some other modifier in it.) I'm not sure what the additional modifier is in the torque value in this message. I have graphed it, but cant seem to figure it out, it moves with RPM though. I'm also unsure on the minimum torque before stall value.

0x207 - Byte 0&1 - Engine Speed / Byte 2&3 - Engine Speed Rate of Change / Byte 4&5 - Vehicle Speed / Byte 6 - Throttle Position (MaxValue 200) / Byte 7 - TPS Rate of Change

0x230 - Not sure on this one.... Some odd stuff happening in here.

0x425 - Byte 0 - Cruise State Bits / Byte 1&2 - Cruise Set Speed / Byte 3&4 - Boost Pressure / Byte 5 - Mask 0x02 Engine State not cranking / Byte 6&7 - Fuel Flow information
Haven't mapped byte 0 fully and not sure of the other bits within byte 5 so far.

0x427 - Byte 0 - Coolant Temp / Byte 1&2 - A/C Pressure  / Byte 3 - Battery Voltage / Byte 4 - Odometer Counter / Byte 5&6 - Warning States / Byte 7 - Engine Speed counter.
I'm not sure of the logic behind the odometer counter and the engine speed counter on this one. it seems that they follow a similar logic in that they speed up as the corresponding speed increases.

0x44D - Byte 4&5 - Coolant Temp / Byte 6 - Oil Temperature / Byte 7 - Ambient Pressure
I'm not sure on what is in the first 4 bytes of this message.


Any chance you have any info on the ones i have commented on above :P

Share this post


Link to post
Share on other sites

 

Quote

0x097 - Byte 0&1 - Engine torque / Byte 2&3 - Friction Losses / Byte 4&5 - Engine Torque (Goes to 0 When limiter active) / Byte 6&7 - Engine Torque
I'm not sure what the differences are between the torque in bytes 1&2/4&5 and 6&7 are in this message.

One will include frictional losses, eg powertrain and engine (if you go through the editor you will see there is this table:

image.png.9b1d7441abdfe2e40de2def13cf145ca.png

I assume this is subtracted (or added) to the engine torque to produce this second figure. I can't decode the assembly exactly for you as that would take many hours, I can tell you that it references the following IDs though. These can be datalogged by out datalogger when it is released (very soon)

tq_mbt = Torque MBT = Maximum torque that could be produced by the engine
tq_loss = Torque Loss = Torque loss due to engine friction and alternator/power steering etc
tq_brake_s = Torque Actual = Actual torque produced
tq_net_dd = Driver Demand Torque
tq_mbt_dd = Driver Demand MBT Torque
tq_source = Torque Source (one of those 14 different sources)
tq_brk_s_str = Brake Torque (eg at the wheels) BEFORE a trans shift occurs

Bytes 0 and 1 are tq_mbt

Bytes 2 and 3 are tq_loss

Bytes 4 and 5 are some combination of tq_brk_s_str, tq_loss and tq_brake_s. There is a conditional based on whether a gear shift is occuring. I assume it holds last value during a shift or something like that.

Bytes 6 and 7 are tq_mbt_dd

These bytes are packed, scaled and offset as well, you'll need to figure this out yourself.

Quote

0x120 - Byte 0&1 - Engine Torque minus Reduction Request / Byte 2&3 - Engine Torque minus 0x097 Bye2&3 (Goes to 0 when in idle state)
I'm not sure whats in Byte 4,5,6,7

Nothing by the looks of it, they appear uninitialised.

Quote

0x12D - Byte 0 - Engine Speed rate of change? / Byte 1 - Throttle Pedal (MaxValue 200) / Byte 2 - Some Shift value maybe??? / Byte 4&5 - Engine Speed * 4 / Byte 7 - Mask 0x01 Brake State Mask 0x04 Cranking State
I'm not 100% sure of the value in Byte 2, not idea whats in Byte 3, and not sure of all of the bits inside Byte 7 of this message (only some).

Byte 0 appears to be the derivative of the rpm

Byte 1 appears to be TPS %

Byte 2 is something to do with if you are decelerating down a hill

Byte 7 is various bit flags, engine cranking (0x04) , brakes enabled (0x03)

Quote

0x200 - Byte 0&1 - Engine Torque (With some other modifier in it) / Byte 2&3 (you mentioned minimum torque before stall, not sure) / Byte 4&5 - Engine Torque (With some other modifier in it.) I'm not sure what the additional modifier is in the torque value in this message. I have graphed it, but cant seem to figure it out, it moves with RPM though. I'm also unsure on the minimum torque before stall value

I can't help you much more on this. It something to do with engine stalling torque (min stall torque).

0x230 is some combination of the the current gear selected, gear ratio, transmission torque loss and a bunch of other transmission flags. Good luck with this one.,

0x427 odo is a few odo readings. The KAM odo reading they take on the LSB of the value to save space (as they dont need to transmit the whole number). There is some constant used here 0.05129784 to convert the number of ticks or something. I also see 1.609344 here.

0x44D byte 1-3 contains any current MIL codes

Share this post


Link to post
Share on other sites

are you able to see in 0x200 what is also being added to the torque in bytes 0&1 and 4&5 ?
I understand that 2&3 is the minimum stal l torque, but i'm interested to see what the extra value is in the other torque numbers.
I have attached a visual representation of the 'adder' that is in these values. I can see the torque component, and i have stripped that out for the purpose of finding this adder :)

200h odd addition.jpg

Share this post


Link to post
Share on other sites

I can see a few constants in the routine for the 0x200 message. 512 (float) and 0xFFFE

It looks like some float to short (16 bit) conversion routine. I suspect they are clipping the value at 0xFFFE so that it stands out from 0xFFFF which would normally be considered a bad value. The 512 is probably an offset or multiplier.

Share this post


Link to post
Share on other sites

I seem to have it working, albeit i think there are still some numbers that aren't quite right in the messaging.
I have been going through one by one to validate the results on the TCM side of things, however its taking me a lot longer than the first progress that i had made.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


×
×
  • Create New...