Looking for CAN bus information
12-28-2016, 01:54 AM
#18
Similarly I have been looking to get hold of the canbus data for 996 Turbo. Through researched I have managed to track down the following.
For each base address I have added the channel, Byte, Length, Bitmask, Multipler, Divider, Adder
Base Address: 280
RPM,2,2,FFFF,25,600,0
PedalPosition1,4,1,FF,39,10,0
ThrottlePosition,5,1,FF,4,1,0
PedalPosition2,7,1,FF,850,128,0
Base Address 289
EngineTemp,1,1,FF,75,10,-480
CoolantLevelSwitch,2,1,01,1,1,0
Base Address 289
IAT,1,1,FFFF,75,10,-480
ThrottlePosition1,2,1,FFFF,39,10,0
ThrottlePosition2,4,1,FFFF,39,10,0
BarometricPressure,5,1,FFFF,5,1,0
Speed,7,1,FF,128,10,0
Base Address 4E0
CheckEngineLight,0,1,01,1,1,0
FuelUsed,2,2,FFFF,1,10,0
BoostPressure,4,1,FFFF,10,1,0
OilTemp,5,1,FFFF,75,10,-480
For each base address I have added the channel, Byte, Length, Bitmask, Multipler, Divider, Adder
Base Address: 280
RPM,2,2,FFFF,25,600,0
PedalPosition1,4,1,FF,39,10,0
ThrottlePosition,5,1,FF,4,1,0
PedalPosition2,7,1,FF,850,128,0
Base Address 289
EngineTemp,1,1,FF,75,10,-480
CoolantLevelSwitch,2,1,01,1,1,0
Base Address 289
IAT,1,1,FFFF,75,10,-480
ThrottlePosition1,2,1,FFFF,39,10,0
ThrottlePosition2,4,1,FFFF,39,10,0
BarometricPressure,5,1,FFFF,5,1,0
Speed,7,1,FF,128,10,0
Base Address 4E0
CheckEngineLight,0,1,01,1,1,0
FuelUsed,2,2,FFFF,1,10,0
BoostPressure,4,1,FFFF,10,1,0
OilTemp,5,1,FFFF,75,10,-480
12-28-2016, 02:34 AM
#20
here is some more info that I found where someone used can data to drive a 996 instrument cluster in another car: http://www.msextra.com/forums/viewto...?f=123&t=44329
ABS_Status 0x1A0 // 996 - ABS 416 - ESP/ABS/Brakes
Engine_RPM 0x280 // 996 - Motorsteuerger�t 640 - engine control unit RPM 1:1 ratio
Engine_Temp 0x289 // 996 - Motorsteuerger�t 649 - Engine Temp /y=46.14+1.67*x where x is degrees C
Vehicle_Speed 0x2A8 // 996 - Motorsteuerger�t 680 - engine control unit Speed (78270+(47907*kmh))/1000
AT_Line1 0x440 // 996 - Motorsteuerger�t 1088- Tiptronic Gear Position
TempoStat_ctl 0x510 // 996 - Cluster out 1296 - Instrument Cluster Tempostat control
2nd byte of 0x520 is lights and dimming 58d from 996 cluster
if (Rx_id == 0x661)
{
//h661 Radio/Navi, 8 byte, 100ms
//beim RNS-E wird hier zum Beispiel angezeigt, in welchem Mode das Geraet ist
//-h 81 01 12 A0 00 00 00 00 FM/AM
//-h 81 01 12 2F 00 00 00 00 SAT
//-h 81 01 12 A5 00 00 00 00 CD
//-h 81 01 12 A4 00 00 00 00 MP3
//-h 81 01 12 37 00 00 00 00 TV
//-h 81 01 12 3A 00 00 00 00 PHONE
if (Rx_data[3] == 0xA0) //radio active
{
//Set Relay On
PORTE |= 0x01;
}
else
{
//Set Relay Off
PORTE &= ~0x01;
} */
}
ABS_Status 0x1A0 // 996 - ABS 416 - ESP/ABS/Brakes
Engine_RPM 0x280 // 996 - Motorsteuerger�t 640 - engine control unit RPM 1:1 ratio
Engine_Temp 0x289 // 996 - Motorsteuerger�t 649 - Engine Temp /y=46.14+1.67*x where x is degrees C
Vehicle_Speed 0x2A8 // 996 - Motorsteuerger�t 680 - engine control unit Speed (78270+(47907*kmh))/1000
AT_Line1 0x440 // 996 - Motorsteuerger�t 1088- Tiptronic Gear Position
TempoStat_ctl 0x510 // 996 - Cluster out 1296 - Instrument Cluster Tempostat control
2nd byte of 0x520 is lights and dimming 58d from 996 cluster
if (Rx_id == 0x661)
{
//h661 Radio/Navi, 8 byte, 100ms
//beim RNS-E wird hier zum Beispiel angezeigt, in welchem Mode das Geraet ist
//-h 81 01 12 A0 00 00 00 00 FM/AM
//-h 81 01 12 2F 00 00 00 00 SAT
//-h 81 01 12 A5 00 00 00 00 CD
//-h 81 01 12 A4 00 00 00 00 MP3
//-h 81 01 12 37 00 00 00 00 TV
//-h 81 01 12 3A 00 00 00 00 PHONE
if (Rx_data[3] == 0xA0) //radio active
{
//Set Relay On
PORTE |= 0x01;
}
else
{
//Set Relay Off
PORTE &= ~0x01;
} */
}
12-28-2016, 11:02 PM
#21
RL Community Team
Rennlist Member
Rennlist Member
Thread Starter
Thanks guys!
Ok, here are some traces I made of the can bus activity for command 0x280 - which should include engine RPM.
LQQK: 1st question: is your counting 0's based or 1's based for position?
2nd: is is MS byte or LS byte ordering?
3rd: are all numbers hex?
By explanation:
1st col is sample #
2nd is a time stamp relative to start of collection
16 is the length of message in bytes
STD: is standard definition
0x00000280 is the command field
the following are the message bytes,
If I understand the post correctly and assume 1's based counting:
Using the last data row, Bytes 2 & 3 = 0x3a 0x89,
Engine rpm = ((0x3a89 & 0xffff) * 25) / 600 = 624 rpm - could be correct, but I am inclined to think that the 'real' engine rpm = (0x3a89 & 0xffff) / 3, much like the RPM value gotten from the ecu connection
And pedal position would be ((0x13 & 0xff) * 850) / 128 = 126 - not sure what those units would be...
Will play more, thanks!
Ray
Ok, here are some traces I made of the can bus activity for command 0x280 - which should include engine RPM.
LQQK: 1st question: is your counting 0's based or 1's based for position?
2nd: is is MS byte or LS byte ordering?
3rd: are all numbers hex?
Code:
382430 420.002012 16 STD: 0x00000280 1 22 4e 0c 22 0 22 0 382440 420.011998 16 STD: 0x00000280 1 22 5f 0c 23 0 22 0 382448 420.022158 16 STD: 0x00000280 1 22 5f 0c 23 0 21 0 382458 420.033033 16 STD: 0x00000280 1 22 56 0c 23 0 21 0 382466 420.042233 16 STD: 0x00000280 1 22 56 0c 23 0 21 0 382476 420.052268 16 STD: 0x00000280 1 22 56 0c 23 0 21 0 382484 420.062343 16 STD: 0x00000280 1 23 38 0c 23 0 21 0 382495 420.072431 16 STD: 0x00000280 1 23 38 0c 23 0 21 0 382503 420.083229 16 STD: 0x00000280 1 23 f3 0b 23 0 22 0 382514 420.092525 16 STD: 0x00000280 1 23 f3 0b 23 0 22 0 382522 420.102638 16 STD: 0x00000280 1 23 f3 0b 23 0 22 0 382532 420.112649 16 STD: 0x00000280 1 24 16 0c 24 0 22 0 382540 420.122684 16 STD: 0x00000280 1 24 16 0c 24 0 22 0 ... 382890 420.505733 16 STD: 0x00000280 0 2f f3 0e 62 21 21 3d 382898 420.515201 16 STD: 0x00000280 0 31 f3 0e 5a 22 21 37 382908 420.525782 16 STD: 0x00000280 0 31 ce 0f 5c 23 21 39 382916 420.535266 16 STD: 0x00000280 0 33 ce 0f 56 24 21 34 382926 420.545845 16 STD: 0x00000280 0 37 b6 10 57 24 20 34 382934 420.55526 16 STD: 0x00000280 0 37 b6 10 52 24 20 31 382944 420.56534 16 STD: 0x00000280 0 3a 22 11 51 24 20 2f 382953 420.575408 16 STD: 0x00000280 0 3a 22 11 50 24 20 2f 382963 420.585423 16 STD: 0x00000280 0 3d ec 11 4d 24 20 2c 382971 420.596319 16 STD: 0x00000280 0 3d 72 12 4d 24 20 2c 382981 420.605541 16 STD: 0x00000280 0 3f 72 12 4a 24 20 2b 382989 420.615711 16 STD: 0x00000280 0 40 4a 13 47 24 20 29 382999 420.625757 16 STD: 0x00000280 0 41 4a 13 47 24 20 29 383007 420.635856 16 STD: 0x00000280 0 42 52 13 46 24 20 29 383017 420.646566 16 STD: 0x00000280 0 43 48 14 45 24 20 27 383025 420.655853 16 STD: 0x00000280 0 43 48 14 45 24 20 27 383035 420.665883 16 STD: 0x00000280 0 43 9 14 46 24 1f 28 383044 420.676688 16 STD: 0x00000280 0 44 f0 14 45 24 1f 28 ... 383225 420.877587 16 STD: 0x00000280 0 41 a6 20 33 23 20 1c 383236 420.888527 16 STD: 0x00000280 0 41 10 22 31 22 21 1a 383244 420.898264 16 STD: 0x00000280 0 41 cd 22 2f 21 21 19 383254 420.908186 16 STD: 0x00000280 0 41 5e 23 2b 1f 21 16 383262 420.918266 16 STD: 0x00000280 0 41 0e 24 2a 1f 21 15 383272 420.92754 16 STD: 0x00000280 0 40 8b 24 24 1b 21 11 383280 420.937754 16 STD: 0x00000280 0 40 2f 25 23 1a 21 10 383290 420.948604 16 STD: 0x00000280 0 3f 21 26 1e 17 21 0d 383298 420.958443 16 STD: 0x00000280 0 3e 8a 26 1a 13 21 0a 383308 420.968624 16 STD: 0x00000280 0 3e 10 27 16 0f 22 7 383317 420.977838 16 STD: 0x00000280 0 3d 4a 27 13 0c 22 5 383327 420.988858 16 STD: 0x00000280 0 3c 17 28 13 9 22 5 383335 420.998784 16 STD: 0x00000280 0 3a 89 28 13 5 22 5
1st col is sample #
2nd is a time stamp relative to start of collection
16 is the length of message in bytes
STD: is standard definition
0x00000280 is the command field
the following are the message bytes,
If I understand the post correctly and assume 1's based counting:
For each base address I have added the channel, Byte, Length, Bitmask, Multipler, Divider, Adder
Base Address: 280
RPM,2,2,FFFF,25,600,0
PedalPosition1,4,1,FF,39,10,0
ThrottlePosition,5,1,FF,4,1,0
PedalPosition2,7,1,FF,850,128,0
Base Address: 280
RPM,2,2,FFFF,25,600,0
PedalPosition1,4,1,FF,39,10,0
ThrottlePosition,5,1,FF,4,1,0
PedalPosition2,7,1,FF,850,128,0
Engine rpm = ((0x3a89 & 0xffff) * 25) / 600 = 624 rpm - could be correct, but I am inclined to think that the 'real' engine rpm = (0x3a89 & 0xffff) / 3, much like the RPM value gotten from the ecu connection
And pedal position would be ((0x13 & 0xff) * 850) / 128 = 126 - not sure what those units would be...
Will play more, thanks!
Ray
12-28-2016, 11:41 PM
#22
RL Community Team
Rennlist Member
Rennlist Member
Thread Starter
I may have answered some of my own questions:
Was some of the code for the rpm. The data is 0's based, and it is ls byte / ms byte. They use a multiplier of 4, probably the # of cylinders. Not sure where the adder & multiplier values come into play...
this means that (for the previous example, last line of data) - data is 0x89, 0x28
RPM = 0x2889 = (10377 / 3 or 6) = 3459 or 1729 RPM - Will need to rerun these tests when the car is back together...
Ray
Code:
id = Engine_RPM; //0x280 - Motorsteuergerat 640 - engine control unit RPM is 4:1 ratio = outpc.rpm*4
dataLen = 0x08;
data[0] = 0x00;
data[1] = 0x00;
data[2] = (unsigned char)((outpc.rpm*4) & 0x00FF ); //byte 3 = RPM, L
data[3] = (unsigned char)((outpc.rpm*4) /256 ); //byte 4 = RPM, H
data[4] = 0x00;
data[5] = 0x00;
data[6] = 0x00;
data[7] = 0x00;
ECANSendMessage(id, data, dataLen, MSG_STD);
this means that (for the previous example, last line of data) - data is 0x89, 0x28
RPM = 0x2889 = (10377 / 3 or 6) = 3459 or 1729 RPM - Will need to rerun these tests when the car is back together...
Ray
12-29-2016, 12:38 AM
#23
Ray - these are the values that were in a motec template that was shared with me. I will add some screen shots, so you can see the units along with the values.
Additionally, the multiplier and divisor might also be adjusted to support which byte is being referenced. Hold tight and I'll find that information too.
I'm hoping to get a few more inputs, such as steering angle and abs status - so hopefully you can "sniff" those out.
Additionally, the multiplier and divisor might also be adjusted to support which byte is being referenced. Hold tight and I'll find that information too.
I'm hoping to get a few more inputs, such as steering angle and abs status - so hopefully you can "sniff" those out.
05-12-2017, 05:49 AM
#25
Intermediate
I may have answered some of my own questions:
Was some of the code for the rpm. The data is 0's based, and it is ls byte / ms byte. They use a multiplier of 4, probably the # of cylinders. Not sure where the adder & multiplier values come into play...
this means that (for the previous example, last line of data) - data is 0x89, 0x28
RPM = 0x2889 = (10377 / 3 or 6) = 3459 or 1729 RPM - Will need to rerun these tests when the car is back together...
Ray
Code:
id = Engine_RPM; //0x280 - Motorsteuergerat 640 - engine control unit RPM is 4:1 ratio = outpc.rpm*4
dataLen = 0x08;
data[0] = 0x00;
data[1] = 0x00;
data[2] = (unsigned char)((outpc.rpm*4) & 0x00FF ); //byte 3 = RPM, L
data[3] = (unsigned char)((outpc.rpm*4) /256 ); //byte 4 = RPM, H
data[4] = 0x00;
data[5] = 0x00;
data[6] = 0x00;
data[7] = 0x00;
ECANSendMessage(id, data, dataLen, MSG_STD);
this means that (for the previous example, last line of data) - data is 0x89, 0x28
RPM = 0x2889 = (10377 / 3 or 6) = 3459 or 1729 RPM - Will need to rerun these tests when the car is back together...
Ray
05-12-2017, 06:25 AM
#26
Intermediate
Engine Temp
ABS Wheel Speed
The polynomials used in our formulas are to correct the inbuilt gauge inaccuracies
the motec multiplier/divisor/adders listed earlier should be fine for ecu output logging
Code:
id = Engine_Temp; // 0x289
dataLen = 0x08;
data[0] = 0x00;
data[1] = coolant temp is (4614+(167*outpc.clt))/100 - where outpc.clt is degrees C*10
data[2] = 0x00;
data[3] = 0x00;
data[4] = 0x00;
data[5] = 0x00;
data[6] = 0x00;
data[7] = 0x00;
Code:
id = Vehicle_Speed; //0x2A8 - Motorsteuergerat 680 - Vehicle Speed
//(31308 + (19162 * kmh)) / 100; // vehicle speed y=313.082+191.628x ((31308+(19162*x))/100) where x is KMh
dataLen = 0x08;
data[0] = (unsigned char)(((31308 + (19162 * (CoreVars.kmh/10))) / 100) & 0x00FF ); //KMH ,char L
data[1] = (unsigned char)(((31308 + (19162 * (CoreVars.kmh/10))) / 100) >> 8 ); //KMH ,char H
data[2] = data[0]; //repeated for wheel set B
data[3] = data[1]; //repeated for wheel set B
data[4] = data[0]; //repeated for wheel set C
data[5] = data[1]; //repeated for wheel set C
data[6] = data[0]; //repeated for wheel set D
data[7] = data[1]; //repeated for wheel set D
the motec multiplier/divisor/adders listed earlier should be fine for ecu output logging
Last edited by reanimotion; 05-12-2017 at 07:39 AM.
09-22-2019, 01:07 PM
#28
hi everyone. Sorry for grave digging this thread, but I'm on the lookout for the same thing for my 997.
I would like to know if somone ha sa list of CAN id and their functions ? I'm about to start sniffing around, but a quick help would be appreciated.
I would like to know if somone ha sa list of CAN id and their functions ? I'm about to start sniffing around, but a quick help would be appreciated.
02-11-2022, 09:31 AM
#30
@Synoptic were you ever able to get a list of CAN IDs and functions for the 996/997? If yes can you share? I'm working to compile the same
I currently have no spare time to gut the car to get to the canbus wires, but I invite anyone to share what they find here.
Last edited by Synoptic; 02-11-2022 at 09:32 AM.