VAN bus interfacing (to read car speed and engine RPM Peugeot 206 1.4 HDI 2002)

[eneuro]

i have the OBD PP2000 which is a good help for decoding frames tests

Thanks, for sharing some experience with VAN bus hacking

Probably it will be good idea to buy something like this amazon: PP2000 OBD II Scanner Diagnostic Tool For Citroen Peugeot but unsure if PP2000 software is included and what about any licence keys needed to renew from year to year? 

Another thing is that I've found VAN 9004/9005 between BSI and instrument cluster connected with PP40 center display with ambient temperature, simply date and some warnign messages.
Unsure, how this OBD II tools could have access to this VAN from this connector located in BSI?
Does it capable catch those messages I'm interested in between BSI and instrument cluster?
Schematics which I've found but from UK version so Passenger fuse box (BSI) is on opposite side to my version-steearing wheel on left side 

http://postimg.org/image/6p7t3fu33/

Anyway, I'm soldering today this prototype CAN/VAN connected with 16MHz MPU and will try catch some frames but directly in MPU.
I've successfully tuned MPU to 64MHz PLL divided by 4 in hardware gives 16MHz system clock, but I haven't got crystal for the moment-idea was similar to V-USB try to make calibrations based on watched VAN/CAN bus datalink activity, but it is easy redesign this PCB to add 16MHz clocks on two left pins which now are used in this prototype to test also light sensor based on reverse baised cheap LED diode, which I might need for another project, so for the moment those pins will be used for testing such bidirectional light interface with limited speed, but fully galvanic insulation between car electric system and data receiving visualisation circuit.
I will try detect VAN/CAN frames by adjusting software and reflashing MPU code rather than do it on PC based on logged data.
I have no idea if it works, but we'll see what we get when we connect this thing to showed above audio connector
Mean time trying to get more familar with PP2000 software YT videos to see how it works and determine if it could be helpfull to hack communication between BSI and instrument cluster showed in linked again UK version of Peugeot 206 electric circuit which makes sense, when made teardown some time ago as shown in previous posts, so I feell comfortable to connect MCP2551 there to this audio connector when designed PCB with MPU and MCP2551 will be ready, I hope today, tomorow...

[406dany]

On the OBD connector (for the 406) there is no direct VAN bus access, only different CAN bus (by Kline only) :
ECU , ABS/ESP , BSI , seat/transponder
the BSI make the bridge between CAN bus BSI and VAN bus
with PP2000 i can make some test like : display test / dashboard gauges /  ...
and so i can see the command frame with my interface
but it is not very usefull  for analysing frame on van

( i have buy mine PP2000 (now included in Diagbox) on OBDmore.com
http://www.obdmore.com/index.php?main_page=advanced_search_result&search_in_description=1&zenid=c3ecca369446c140f31034e81e17fdca&keyword=xs+evolution)

At the first time you need a scope to calibrate your software timing with the data on VAN
(timing for 1 bit (no byte) on VAN is 8µs)
with a 16MHZ cycle there is no problem and the E-manchester bit is a good synchro which allow some error delay
hope to read your test result soon...


 

[cs.dk]

but unsure if PP2000 software is included and what about any licence keys needed to renew from year to year? 

I've got Diagbox 5.29 (for some clone interfaces, must run on XP) and Diagbox 7.60 which can run on Win7 - I have them on my webserver, if you will need them. Diagbox includes both Peugeot Planet 2000 and Lexia for Citroën.

I will follow this thread, could be fun to get some data out of my own C5.

[eneuro]

Nice to know where to look for PP2000, while car is not new one and I might need run diagnostics more often 

During soldering this PCB I realized that I've made by mistake SO8W pads for MCP2551 and... it doesn't fit into PCB 
I've already corrected this and I've made also smaller SO8M pads for MPU too and added as an option ablity to connect external clock on pins left pins just by making one more hole to ground.
Probably I will make another fixed PCB on monday, since it doesn't take too much time and messing with this mistaken wide SO8 for MCP2551 , trying to solder its pins to this PCB will not look great, however maybe I will try tricky soldering of MCP2551, since this is prototype, so I could test this thing without external clock, if I managed solder somehow this by slightly extending from one side four pins

Designing also CP2104 based USB interface to be able connect this VAN interface to tablet/laptop to send and visualise some data, but this will be standalone solution and probably optoisolator(s) used to provide galvanic insualtion between those two PCBs 

[eneuro]

Designing also CP2104 based USB interface to be able connect this VAN interface to tablet/laptop...

After reading CP2104 datasheet, I've realized it is really small and not available to source in my favourite reseller, so I've ordered this CP2104 based quite nice looking module, which has among other UART stuff also 4 GPIO pins of CP2104 available, so I can easy connect to my CAN/VAN interface PCB MPU output pins  or add fast optocouplers and make galvanic insulated interface between car CAN/VAN and tablet/laptop



I should have this CP2104 module at the middle of next week in my hands, so it is time to finish VAN/CAN interface PCB shown earlier and write some code for MPU and PC to make data visualisation, etc...

[406dany]

if you want make data visualisation you need com at minimum of 500 Kbauds (for real time logging)
and i don't think that you can find opto so fast ...
there is no real matter to have the GND commun between car and laptop

[eneuro]

there is no real matter to have the GND commun between car and laptop

Not sure about this after looking at MCP2551 block diagram 



Anyway, thanks to Graham Auld links there
http://graham.auld.me.uk/projects/vanbus/
and this article
http://marco.guardigli.it/2010/10/hacking-your-car.html
we have some clue how those VAN bus PSA packets looks like.

I do not need scan and log all VAN packets, so I believe I do not need such huge baudrate to output something to connected USB port, while in final  design I hope MPu will be able make this realtime VAN bus frame analysis and make moving average eg. of engine RPM or vehicle speed, so this thing will otput at lets say 10Hz rate those engine RPM, cat velocity values, so no need to send each VAN bus message 
Even for testing I will try send only unique one from all available identifiers on VAN bus...

I was interested in galvanci insulated MPU from car battery, but it looks like that MCP2551 might need car ground, eg. to compare CANH/CANL voltage levels, but maybe I'm wrong-need investigate this more and make physical tests when this circuit will be soldered, but creating test CAN network wth twisted pair of wires terminated by two 120 Ohm resistors_I will look into physical CAN layer desription for more information, if MCP2551 might work without common ground between its Vss pin and car GND available in this audio connector 

[406dany]

Ok you want just the RPM/speed frame
For no connexion GND car <-> GND laptop hummm... i can try a test on my interface...

Just a shoot of my interface USB/VAN
(sorry i have not draw the electrical schematic...)

[eneuro]

my interface is about a PIC18F2620 (10MHZ*4) , MC2551,
and a usb/RS232 TTL (FTDI) aliasing at  500Kbauds

Is it average VAN total frame bits rate in your car?
Since you wrote it is 8us per bit it means 125kbps and it is possible for car body bus.
However, when we look intoE-Manchester encoding where 4 bits are grouped (three NRZ coded and one Manchester coded) we have 5 TS per 4 bits, so 0.8 bit/TS, not 1 bit/TS, or 0.5bit/TS in classic Manchester 



Anyway, while we know from linked documents how VAN start of frame field looks like, we know what to look for in received logic data from MCP2551 read pin and maybe try synchronize software clock based on this SOF field in VAN protocol



Then we have 12 bit VAN identifier address field E-MAN encoded:

here is a frame of RPM/speed:
824 -W- 18F80000000044   28BA NoAck
0x18F8=6392/10=639,2 rpm
ans speed at 0 km/h

0x824 is IDEN field or something else?
It is exactly 12bit.

639.2 RPM how is it possible such low engine speed?  It is around 900 RPM or so in my car, but ok while we read RPM from car oryginal display at zero vehicle speed, we can try catch frame IDEN, while who knows if Peugeot used the same IDENTs in 406 and mine 206 car? 

When I'll have some catched different VAN frame IDs on those 9004/9005 lines, than by opening doors, looking for dashboard indicators switched on/off I hope I will be able eliminate other frames, but those linked with engine RPM/vehicle speed 

[eneuro]

if you want make data visualisation you need com at minimum of 500 Kbauds (for real time logging)

From description of CP2104 it looks like it will be capable do this real time logging, so we'll see what we get:

The adapter looks like a standard virtual serial port (COM port) to the computer’s operating system, which means it can be used with any software designed to work with a serial port (even a legacy RS-232 port). The CP2104 is a full-speed USB 2.0 device and allows baud rates of up to 2 Mbps.

It could be nice for hacking this protocol use real time log, but later communication can be optoisolated  at lower speed, when we'll be able decode VAN bus frames in real time on MPU based on MCP2551 output 

[406dany]

Well...
yes my VAN bus body car is at 125Kbds also on 9004 and 9005 wires
my interface send 1 byte in ascii (at 500Kbds) to the PC for 4 bits (1 nibble) + E manchester on VAN bus
so in 40µs PIC's usart must send 1 byte+start bit+stop bit to the PC
=> 250Kbs and for no error i works at 500kbs
(as graham auld done on his usb/van monitor)

The usb/RS232 standard don't use 500kbs so i use aliasing for bauds rate by putting a new divisor in the register device parameters

Yes i think it's possible to use the SOF for calibrate timing (SOF include start bit=32+32+16=80µs)
but at start with no calibration how to know that is SOF?
maybe by using the frame interval which is about 150µS (not always...)

The real frame for RPM/speed (i am pretty sure that it is the same on 206) is:
SOF 824818F8000000004428BA EOF
824 :identity
8 :cmd
18F8 :RPM*10
00000 :speed*100
00044 :number iteration
28BA :checksum CRC15
As you wrote 639.2 RPM is very low and the dashboard show 800rpm
i have not yet study this bug (need offset or other multiplycator) ...

[eneuro]

...
8 :cmd
...

Is it hex 4 bit only cmd  ? 
Hopefully, I've found a way to translate using Google those French documents, I hope I will today better understanding of this PSA VAN protocol, which seams look more complicated than pure CAN.

...
18F8 :RPM*10
As you wrote 639.2 RPM is very low and the dashboard show 800rpm
i have not yet study this bug (need offset or other multiplycator) ...

Why not to press accelerator pedal and increae this engine RPM to 1000 RPM, 1200 RPM,1400 RPM,..., 2000 RPM, and record more frames with different RPM values? 

Than additionally at low vehicle speed lets say 50km/h do similar thing, while vehicle speed at given engine RPM and choosen gearbox is linked, so when we know RPM, we can estimate vehicle speed.
For 206 gearbox I've derived formula to calculate vehicle speed, based on choosen gearbox from 1..5 and engine RPM, but I'd like to have also real vehicle speed to double check if trasmission system works correctly -those RPM/speed should be linked if clutch doesn't brake power train between engine to wheel....

[406dany]

"8:cmd"   yes it is the command's nibble
and the 4 bits are:
B3=EXT exention Always 1
B2=RACK Request Acknowledge
B1=R/W Read /write
B0=RTR Remote transmission request (reply in frame)
(normally you never see B0=1 because the reply change it to zero when reply take place in frame ...)

My laptop's batterie is very old and i can't log in car without supply line
so i can't drive with my laptop logging
I can raise up the front wheel but i have no time for the moment...

[eneuro]

My laptop's batterie is very old and i can't log in car without supply line

Connect to Android tablet via USB by writing small app to read VAN bus data and visualise in real time

Anyway, I've soldered pcb with MPu and MCP2551 on board-waiting for CP2104 to have in my hands to log some data and tune MPU code to better understand this tricky VAN bus protocol 

[eneuro]

While waiting for CP2104 based USB to GPIO interface, I've connected in spare time this CAN/VAN to MPU adapter soldered yesterday to 5Vcc and made measurements of input/output of MCP2551 chips with floating CANH/CANL:

Code: [Select]

VCC: 4.99V
CANH: 2.56V
CANL: 2.40V
TXD: ~5V
RXD: ~5V
CANH-CANL: 0.16V
It will be interesting to test what we get, when we connect to CANL/CANH external two wires without shared ground -so lets create test CAN network terminated by two 120 Ohm resistors and from another galvanic insulated power supply lets simulate different CANH/CANL bus states and lets see output of MCP2551.RXD 

[eneuro]

I've in hands CP2104 so I was able connect this MCP2551 with ATTiny85 MPU to CP2104 powered from USB:



CP2104 output marked as 3v3 has 3.45V , according to its datasheet typical value, so never ever relay on PCb makers PCb text markings-use multimeter and check datasheet 

Anyway, I'm not sure if I can connect 5V I/O output from ATTiny85 or RxD from MCP2551 powered from 5Vcc to GPIO pins from CP2551 which is poweded internally from this 3.45VDD ? 
CP2551 datasheet says taht can be up to 5.8V at those GPIO pins, so probably yes..
I wouldn't like to make any voltage shift tricks.
I think I will add 1k resistors between CP2104 GPIOs and MPU or CP2551.RXD pin and see what happends 

Connecting right now this thing to PC Linux to write some software to log raw data on PC...
Update: Yep, it looks like CP2104 is successfully detected looking into Linux dmesg command output:

Code: [Select]

> usb 2-1: new full speed USB device number 10 using uhci_hcd
> usb 2-1: New USB device found, idVendor=10c4, idProduct=ea60
> usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
> usb 2-1: Product: CP2104 USB to UART Bridge Controller
> usb 2-1: Manufacturer: Silicon Labs
> usb 2-1: SerialNumber: 00BE672B
> usbcore: registered new interface driver usbserial
> USB Serial support registered for generic
> usbcore: registered new interface driver usbserial_generic
> usbserial: USB Serial Driver core
> USB Serial support registered for cp210x
> cp210x 2-1:1.0: cp210x converter detected
> usb 2-1: cp210x converter now attached to ttyUSB0
> usbcore: registered new interface driver cp210x
> cp210x: v0.09:Silicon Labs CP210x RS232 serial adaptor driver

I didn't made any customisation of CP2104 so far, so probably its default values there 

Update2: Unfortunatelly, even at latest Linux driver for CP2104 in this module source http://lxr.free-electrons.com/source/drivers/usb/serial/cp210x.c they didn't add support for GPIO ioctl, so no chance without adding those ioctls test example code to set/get CP2104 GPIO pins 

I will try add this support for GPIO under my Linux box, while no plans to use Window$ for serious work and I'd like to use GPIOs under Android too 

[xsara]

Hello,
I'm just writing with excitement to let you guys know that I'm keenly following the progress of this project.
If it can be successfully achieved, it presents a good option for 406/607 owners with a faulty MFD (Multi Function Display). I'd love to upgrade my orange monochrome MFD, which is illegible 90% of the time, for a fancy Android interface 
Heck, if the ability was there, it would be awesome to replicate the vehicle controls (ie windows, climate control, etc) via an external interface!

Looking forward to your updates.

Cheers!
Xsara

[406dany]

Hello,
I'm just writing with excitement to let you guys know that I'm keenly following the progress of this project.
If it can be successfully achieved, it presents a good option for 406/607 owners with a faulty MFD (Multi Function Display). I'd love to upgrade my orange monochrome MFD, which is illegible 90% of the time, for a fancy Android interface 
Heck, if the ability was there, it would be awesome to replicate the vehicle controls (ie windows, climate control, etc) via an external interface!

Looking forward to your updates.

Cheers!
Xsara

I think that it's possible to emulate the display because it's only a slave on the van bus
but for emulating the other control it's not so easy because BSI is master on the bus
I have actualy this problem :
when i send a frame to the dash board for setting the speed at 130km/h (for example) the BSI is alway sending speed at 0km/h so there is a conflict and it's not good ...

i have directly made in the pic a parser of all the frame from van bus body
The parser take the ID of the frame and put the same frame ID at the same memory place
it's work under interrupt so i can independantly read memory with a PC
(there is also a debugger inside the pic which can dump memory page)

I have try to found some other documentation of van bus on the net but it's no easy...
van doc:
http://ebajic.free.fr/Ecole%20Printemps%20Reseau%20Mars%202006/Supports/J%20MERCKLE%20CANopen.pdf

i try to found datasheet on the PPC1008T and MHS29C461 but with no succes

i have found this (for xsara...)
http://milajda22.sweb.cz/Manual_k_ridici_jednotce.pdf

Dany
(sorry for poor school english...)

[406dany]

Hello

I'm still working on this interface VAN
i have solve some problem...

I have made a very basic parser that show data on VAN "confort"
here a screen shoot that show you the "knowledge" data
(the 2 data at the end of each line is ID frame and number of receiving this frame)


I can also send some frames similar at "radio remote control" (and control volume/seek track or station...)
or test frames (see with PP2000) for writing km-counter or setting dashboard's gauges
But there are some data that i don't yet understund ...

The good factor for RPM convert is 8 and not 10 so
824 -W- 18F80000000044   28BA NoAck
0x18F8=6392/8=799 rpm
0x0000=0/100= 0 km/h

rgds
and Merry Christmas

[morcibacsi]

Hi!

I'm started developing a C# application for parsing packets, based on samples what Graham Auld provided (he dumped the packets to a txt file while driving). Unfortunately I'm still waiting for some pieces to arrive for my circuit. Could you be so kind and provide some sample packets to test with?

[406dany]

Hello
you can see some packet of graham here :
http://van-bus.googlecode.com/svn/trunk/bus_captures/graham/
and here it is a packet of my van body car:
(at the end of line : N=no acknowledge / K=acknowledge)
(CMD nible: AW-=0xC / -W-=0x8  / AR-=0xE / ...)

[xsara]

Some amazing stuff going on here, I'm keeping a close eye 

(A belated Merry Christmas to you too, Danny)

[morcibacsi]

Hello
you can see some packet of graham here :
http://van-bus.googlecode.com/svn/trunk/bus_captures/graham/
and here it is a packet of my van body car:
(at the end of line : N=no acknowledge / K=acknowledge)
(CMD nible: AW-=0xC / -W-=0x8  / AR-=0xE / ...)

Thank you! I have found those captures, and they're working fine with my parser (and your attachment is fine too). However there are captures here http://van-bus.googlecode.com/svn/trunk/bus_captures/helpful_soul_number1/ which I'm failing to parse. I suspect that their logger had some defects, and some of the packets are damaged. For example the Speed and RPM packets do not have the Sequence part, and the fuel level and oil temperature part also missing. I hope the errors are occuring because of damaged packets and not because their car had different equipment and some things are disabled in the BSI.

[406dany]

There are some mistake/error in the description of graham's web site
(for example : fuel level, oil temp, RPM divisor ... are not good)
but he had made a very great job !
this is a new Van frames descriptor and it's can help you
(i hope you can understand the format...)

[morcibacsi]

Awesome work! There must be a lot of debugging (trying and comparing) behind this... I can't wait to arrive my parts for my circuit, until then there are a lot to code (I'd like to replace the MFD) At the first glimpse I think I understand the format, thanks again!