[Ovmsdev] Hi from a new comer

Michael Balzer dexter at expeedo.de
Thu Dec 31 17:47:59 HKT 2020


welcome :-)

Am 31.12.20 um 00:52 schrieb didier at ernotte.com:
> Hi,
> I am new here, just received my OVMS device, and started to play with it.
> I have a couple of questions :
> 1) Is there anyone around that has started the integration with the 
> Jaguar IPace ? or any JLR products ?

None that I know of.

> 2) I can see that there is multiple CAN bus on the plug (can1, can2, 
> can3). Does the car use the 3 of them, only one, or a mix and we have 
> to listen to all of them ?

Please read: https://docs.openvehicles.com/en/latest/crtd/can_logging.html

The OBD2 port has only one standard CAN bus (on pins 6+14) which is 
connected as can1. Manufacturer specific additional buses may be present 
in your car, it depends on their purposes and your goals if you need to 
use them.

The standard OVMS OBD2 cable connects can2 additionally to pins 12+13, 
which are used by many manufacturers for a secondary CAN bus. If you 
need the third CAN bus as well, you'll need to use the DA26 connector.

If you need to connect to the K-Line or need a fourth CAN bus, you'll 
need to add the K-Line or SWCAN extension boards.

> 3) Is there a detailed step-by-step process to start investigating the 
> data on the bus ? I just plug the cable and expected to see 
> "something" in the RE console, in "discover" mode, out of the box, 
> without results. No a good start... :-(

Sorry, we don't have a reverse engineering guide yet. It's on the list…

If you don't know anything about the car, you'll first need to find the 
right CAN bus and baud rate to access the vehicle (see above).

Be aware there may be no regular transmissions on the buses you can 
access via the OBD port, so simply listening may not be enough.

If you can see frames on some buses, using the RE tool is an option. 
Another is to stream the packets to SavvyCAN for analysis. Both will 
help you to identify related bits & bytes. Next step is then to find out 
which metrics and indicators can be read from the frames. Standard 
procedure is to record changes you see on the bus from actions you do 
with the car, and to correlate changes you see in the car's displays to 
those on the bus. Then you need to decode the values, i.e. how to 
convert the raw values into their respective readings.

Next step is checking for OBD2 or CANopen devices on the bus(es). These 
devices need to be queried actively, so you need to send requests on the 

For CANopen, read: 

We don't have a similar guide for OBD2 yet. Begin by some simple 
standard broadcasts to see if you get any reaction, for example "obdii 
can1 request broadcast 0100" asks all broadcast listeners to tell which 
of the service 01 PIDs in the range 01…20 they support. The responses 
should give you a hint about the device addresses, so you can 
investigate specifically.

Most OBD2 devices won't respond to broadcasts though. To identify them, 
you need to send a test request to all CAN IDs in your assumed ID range. 
The scan tools for this are below "re obdii scan":

OVMS# re obdii scan start ?
Usage: re obdii scan start <bus> <ecu> <start_pid> <end_pid> 
[-r<rxid>[-<rxid>]] [-t<poll_type>] [-x<timeout>]
Give all values except bus and timeout hexadecimal. Options can be 
positioned anywhere.
Default <rxid> is <ecu>+8, try 0-7ff if you don't know the responding ID.
Default <poll_type> is 22 (ReadDataByIdentifier, 16 bit PID).
Default <timeout> is 3 seconds.

Most newer vehicles will support reading 16 bit PIDs by poll type 22. If 
you're lucky, poll type 24 is supported and gives you info on how to 
translate the raw values.

If not you once again need to monitor the response data, correlate 
changes to car data updates and actions and find out how to convert the 

Be aware you may need to activate a diagnostic session with a device 
before actually be able to read data from it. Diagnostic sessions need 
to be kept alive by either sending the session control request once per 
minute or activating the "tester present" signal ("re obdii tester"). 
Once again, you need to find out which session mode you need for a 
device. You can tell if the device supports a session mode by it's response.

> Didier

You'll find more info on CAN reverse engineering and OBD hacking on the 
web. A good starting point is SavvyCAN.

You'll also find more on all of this by browsing the list archives: 

The MG ZS EV team can most probably give you some more valuable hints, 
as they just recently decoded "their" vehicle.


Michael Balzer * Helkenberger Weg 9 * D-58256 Ennepetal
Fon 02333 / 833 5735 * Handy 0176 / 206 989 26

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openvehicles.com/pipermail/ovmsdev/attachments/20201231/259447b2/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 203 bytes
Desc: OpenPGP digital signature
URL: <http://lists.openvehicles.com/pipermail/ovmsdev/attachments/20201231/259447b2/attachment-0001.sig>

More information about the OvmsDev mailing list