February 2013 - OvmsDev - Open Vehicles

Re: [Ovmsdev] OVMS VIN 4E9->4F1->4E1 (was OVMS VIN 4E9->4F1)
by Mark Webb-Johnson 07 Aug '13

07 Aug '13

Michael, OK. I found some old logs you sent me before and these show: 7.628 R11 4E9 E1 80 00 04 6C 00 7.637 R11 514 47 31 52 39 36 45 34 39 8.647 R11 4F1 41 A1 01 A1 00 36 08 88 The 514 looks fine. But, both 4E9 and 4F1 look wrong. In particular, the 4F1 has '41 A1 01 A1 00' - which is what we are seeing for your VIN. But, id #4E1 has: 8.694 R11 4E1 43 55 31 31 36 34 38 39 If the VIN was in 4E1 and 514, that would give us: 8.694 R11 4E1 43 55 31 31 36 34 38 39 7.637 R11 514 47 31 52 39 36 45 34 39 Or, CU116489G1R96E49 for your car. For RScott, his logs show: 41966.094 R11 4E1 42 55 31 30 32 36 38 39 41966.110 R11 514 47 31 52 44 36 45 34 36 Or, BU102389G1RD6E36 for his car. Is that correct? Reading back through the old eMails, I find this from RScott: > The VIN can be constructed by taking the number "1" and converting the CAN IDs 4E9 and 514 to ASCII. So with "4E1 4255313032363839" and "514 4731524436453436", you would end up with 42 55 31 30 32 36 38 39 47 31 52 44 36 45 34 36, where 42 is ASCII for B, 55 is U, etc. So, I think the whole 4E9 was just a typo, as 4E1 is what is mentioned later in the same sentence. I've committed the code with 4E1 into github now. It works ok on my simulator, and hopefully should be ok in your car now. Can you try? Regards, Mark. On 26 Dec, 2012, at 9:12 PM, Mark Webb-Johnson <mark(a)webb-johnson.net> wrote: > Michael, > > I've put this up on my test bench, set to VA vehicle type, and setting my simulator to 500Kbps CAN speed, then transmitting the following three messages once a second: > > ID#206 A0 10 00 00 00 00 00 00 > ID#4F1 42 55 31 30 32 36 38 39 > ID#514 47 31 52 44 D6 45 34 36 > > Then, with the module in SETUP mode, I get: > > S MODULE? > # Module: > VehicleID:TESTCAR > VehicleType:VA > Units:K > Notifications:IP > > DIAG > # DIAG > > # Firmware: 2.1.1/VA/V2 > # SWITCH: 1 > # 12V Line: 14.0 V > # Signal: 0 > > # VIN: BU102689G1RD6E46 (VA) > # SOC: 64% (0 ideal, 0 est miles) > > That all looks ok. > The message from your car is: > > GERMANVOLT rx msg F 2.1.1/V2,A??,24,0,VA,E-Plus > > 00000040 20 6d 73 67 20 46 20 32 2e 31 2e 31 2f 56 32 2c | msg F 2.1.1/V2,| > 00000050 41 a1 01 a1 2c 32 31 2c 30 2c 56 41 2c 45 2d 50 |A...,21,0,VA,E-P| > 00000060 6c 75 73 0a |lus.| > > Your VIN is showing up as 41,A1,01,A1 - as you say: wrong. > > But, the firmware version and car type look ok. Not sure why they would not show up in the App. Perhaps the corrupt VIN# is messing up interpretation of that message? Perhaps the high bit on the A1 is messing it up. > > Not sure what is going on in your car itself. Can you check any captures you have for the exact id#4F1 and id#514 messages you have, and let me know? > > Regards, Mark. > > On 21 Dec, 2012, at 9:33 PM, mikeljo(a)mac.com wrote: > >> Hi, >> >> thanks. >> >> Works. Get the correct infos from my car. >> Implement the SOC calculation from my previous mail. >> >> - GPS ok >> - SOC ok >> >> BUT: >> - no VIN >> - No Car Type >> - no car firmware >> >> Here some Pics from the App: >> >> <IMG_1075.PNG> >> <IMG_1076.PNG> >> <IMG_1077.PNG> >> <IMG_1078.PNG> >> >> >> The App is the 1.3.2 compiled from the git. This is NOT the one from the Store!? >> >> BTW: You see the GSM Signal is -113dBm. When one door is open i got -87dBm. Heavy attenuation. >> I think i must mount the antenna outside the car. GPS is ok. >> >> >> Bye >> michael >> >> >> Am 21.12.2012 um 02:19 schrieb Mark Webb-Johnson <mark(a)webb-johnson.net>: >> >>> Michael, >>> >>> Parameter #14 (PARAM_VEHICLETYPE) holds the selected vehicle type. This can be set either from the smartphone apps, or via the SMS MODULE command. >>> >>> Regards, Mark. >>> >>> On 21 Dec, 2012, at 4:31 AM, mikeljo(a)mac.com wrote: >>> >>>> Hi, >>>> >>>> i checked it out. It compiles without error. >>>> But i think i missed something: how to switch between the cars? I know you do something, but couldn't find the howto. >>>> I found the ROM Parameter "VA" in "vehicle.c", but how to put this in the ROM? >>>> SMS Command? >>>> >>>> Sorry. >>>> >>>> Bye >>>> Michael >>>> >>>> >>>> Am 20.12.2012 um 15:08 schrieb Mark Webb-Johnson <mark(a)webb-johnson.net>: >>>> >>>>> Michael J: >>>>> >>>>> The following commit should fix this: >>>>> >>>>> * 269cd4f (HEAD, origin/master, origin/HEAD, master) Ampera VIN 4E9->4F1 >>>>> >>>>> Can you check the code now in master head, and see if it has everything you need. It builds and compiles on v2 hardware, but you'll need to change the compiler flags to get it building on v1 (just change TESLAROADSTER to VOLTAMPERA). >>>>> >>>>> What was the end result of the SOC range changes? Any ideas on the solution? >>>>> >>>>> Regards, Mark. >>>>> >>>>> On 6 Nov, 2012, at 5:28 AM, mikeljo(a)mac.com wrote: >>>>> >>>>>> Hi mark, >>>>>> >>>>>> do you think at the VIN? >>>>>> >>>>>> 1 + 514 + 4F1 >>>>> >>>> >>> >> >

11 85

Got pebbles
by Mark Webb-Johnson 13 Apr '13

13 Apr '13

Wrist notifications.

3 6

Quick update on Tazzari CAN Logs
by Patrick Kapsch 15 Mar '13

15 Mar '13

Hi guys, I just wanted to give you a quick update on my reverse engineering on the Tazzari Zero CAN-Bus. I've put together the Y-Cable-Adapter to attach the service-console as well as the USB-Interface to the Bus (see picture attached). As my dealer needs to get back his tools I borrowed, I wasn't really able to dive deeply into the messages, but I found the SOC and a charge-status that indicates whether or not the car charges. I will hopefully be able to write down all values that are provided by next week. LevAhR This is the state of charge in percentage Request: 0x78A 75 21 F9 EF Response: 0x775 0A A1 F9 EF 00 00 03 E8 Value 100.0% 03 E8 represent 1000 = 100.0 % SOC ------------------------------------------------------------- Charge Status Values to determine whether the car charges or not. Request: 0x78A 75 21 F6 E0 Response: 0x775 0A A1 F6 E0 00 00 00 63 Value "reset" (not charging) 0x775 0A A1 F6 E0 00 00 00 00 Value "SUV" (charging) Note: there are more than these two values while the charging comes to an end. I'll know them soon. But for now !=reset should do the job for charging true. I'm still searching for a way to tell if the car is parked or not. As far as I know by now there is nothing on the Bus that indicates this. Is a GPS-Based determination generally possible? The OVMS would have to check the coordinates periodically and compare them. A charging process indicates a parked car as well, and could turn of the GPS comparison. Regards, Patrick Kapsch

2 18

HTTP API
by Mark Webb-Johnson 03 Mar '13

03 Mar '13

For some time now I've wanted to offer an HTTP API for OVMS. The existing car<->server and server<->app protocol is cool, but requires going through some hoops (perl, whatever) to handle the encryption and protocol level stuff. An HTTP API would make this much easier to externally script, and would be great for pulling down logs and other such things. I've now completed work re-factoring the ovms_server.pl code to add the framework to support this: Switched to using the AnyEvent::HTTPD cpan module for the base framework. Implemented an HTTP server on tcp/6868. Implemented an HTTPS server on tcp/6869. Support serving of arbitrary files (in httpfiles directory) for HTTP and HTTPS. Implemented syncing of Drupal user accounts (and password hashes) to new ovms_owners table. Extended the protocol to support syncing owners and well as vehicle records. Support syncing ovms_owners table to connected OVMS servers. Moved ovms_utilisation to ovms_historicalmessages as type '*-OVM-Utilisation", with records 0 (car_rx), 1 (car_tx), 2 (app_rx) and 3 (app_tx). The above work has just been PUSHed to github. So, the framework exists. Now for the fun stuff. My thinking is: Authenticate to a vehicle either by vehicle + serverpass, or OVMS username+password. You can get a list of vehicles by providing your OVMS username+password. Use cookies to maintain a session - and time sessions out after a few minutes of inactivity (or on demand logout). Basic functions to retrieve current vehicle status, and historical data. Function to 'connect' to a live vehicle - just like an App, it will keep the connection open for as long as the session lasts, then tell the vehicle you have disconnected. Control functions - just like the apps - start/stop charge, homelink, etc. Support for OVMS protocol, so can convert the data messages to actual real-world JSON. Does anyone want to work with me on this? In particular, anyone with RESTful or other HTTP API experience? Regards, Mark.

4 6

Leaf stuff.
by Nikki Gordon-Bloomfield 28 Feb '13

28 Feb '13

Hi Guys, My lack of coding experience is making digesting OVMS a little slow, but someone has been playing with the CAN Bus on the Leaf to get more detail for battery temps etc.. :) http://www.mynissanleaf.com/viewtopic.php?f=44&t=11676 In addition, this may help anyone brave enough to tinker with the Leaf side of the OVMS too :0 https://docs.google.com/spreadsheet/ccc?key=0An7gtcYL2Oy0dGRaSWl6VTV2eXBQMy… Nikki.

1 0

Re: Ampera remote start/stop function
by David Peilow 28 Feb '13

28 Feb '13

Hi, Have a look at the last post in this thread... http://gm-volt.com/forum/showthread.php?29073-How-to-enable-quot-OnStar-quo… SWCAN? David

1 0

Re: [Ovmsdev] Ampera remote start/stop function
by rgjones＠sbcglobal.net 27 Feb '13

27 Feb '13

FYI I tried to get more logs but keep running into a data overrun problem with my simple 200Mhz ARM based can logger. This even with logging only IDs that meet mask 0x7e0. The vendor sample code I have does not use filters, so the filtering is in SW, but even with writing logs to ramdisk I still see overrun errors. The HW supports filtering and I will try that next, but it seems when onstar does an enquiry there is a huge burst of CAN activity that perhaps will still overrun this low power hardware. I mean The (non masked) logger saw >59,000 lines (many overruns) in just a few seconds. What PC (Windows or preferably Linux) USB/CAN & software do you recommend for capturing logs, setting filters etc? I will try to get a HW filtered logger going next. Sorry for the delay. Regards, Richard --- On Sun, 2/24/13, Mark Webb-Johnson <mark(a)webb-johnson.net> wrote: From: Mark Webb-Johnson <mark(a)webb-johnson.net> Subject: Re: [Ovmsdev] Ampera remote start/stop function To: "OVMS Developers" <ovmsdev(a)lists.teslaclub.hk> Date: Sunday, February 24, 2013, 4:48 PM Richard, Given the volume of data, I suspect this is going to be hard. For the Roadster, one technique we had was to PING the bus at specific points of the test. e.g.; Start log, wait 30 seconds, PING, send unlock command, PING, wait for car's response, PING, wait 30 seconds, Stop log. Save specific log file, with documented PINGs. The PINGs we used were just to transmit a 0 byte CAN bus message on an unused arbitration ID (which would then indirectly also show up in the can bus logs). If you have some way to inject a message directly into the can bus logs, without actually transmitting on the bus, that is also fine. We just need some markers in the files as close as possible to the events they relate to. It looks something like this (Tesla Roadster annotated log extract): 1006.1565 588 00 00 841006.1570 1A0 00 00 00 001006.1573 590 01 00 00 00 00 00 00 001006.4738 NOTE PING: TD11 transmit1006.5559 100 96 E8 00 02 A1 0C 00 00 ->VDS Doors (l-door: closed) (r-door: closed) (chargeport: closed) (pilot: true) (charging: false) (bits E8)1006.8353 343 00 00 04 00 00 0A 20 F01006.8364 344 52 35 50 37 6E 39 6F 3A --- TPMS (f-l 29psi,13C f-r 29psi,15C r-l 39psi,17C r-r 40psi,18C) We kept each individual command in a separate test and log file, for clarity. Using that technique, we get 30 seconds of pre-command normal data, the unlock command and car's response sandwiched between three pings, and then 30 seconds of post-command normal data. By comparing the messages pre, during and post, it is much easier to see what has changed and try to isolate likely candidates for what we are looking for. My best guess is that these commands will be 7E? request/response style, but they could also turn up on normal can arbitration IDs. The commands we are looking for on the Volt/Ampera are: Wake up [onstar status update request] car (can bus is idle, something is sent, then suddenly bus is active and lots of stuff happening). Candidate for this now is 7E4 02 1A A5 00 00 00 00 00.Sleep (this maybe a 2 minute timer, or some other specific command). Does closing the App send a command to immediately shut the bus/car down, or is there a timer involved?Onstar remote door lock (from an awake car).Onstar remote door unlock (from an awake car).Onstar remote start.Onstar remote stop. As Michael J points out, it is also useful if you can give us what the car / app shows at each point. Such as for the remote start cabin pre-heat, what is the ambient and/or cabin temperature show in the car and on the app? Regarding Michael J's suggestions for filters, I agree. In particular a filter on just IDs 7E? (16 arbitration IDs) would be very useful and would reduce volume and overruns. But, it is also useful to get a full dump as well. I realise that this is a lot of time-in-the-car for you, but am encouraged by the first results you got. Perhaps we should just concentrate on the easier #1 through #4 to start with (wake, sleep, lock, unlock)? Regards, Mark. On 25 Feb, 2013, at 7:50 AM, Richard G Jones wrote: Wow that's great decoding work.Sorry about the overruns.Would it help to get another capture, with several iterations? Sent from my phablet, scuse the typos Mark Webb-Johnson <mark(a)webb-johnson.net> wrote: I've been working through the logs (if anyone else needs a look, let me know). I started by converting to crtd format, so I could use some of my tools on it. Looking at a bunch of other logs provided by volt/ampera drivers, we've so far seen 108 unique can arbitration IDs: 096 097 098 0AA 0B1 0B9 0BA 0BB 0BC 0BD 0C1 0C4 0C5 0C7 0C9 0D1 0D3 0F1 101 120 12A 130 135 137 139 140 148160 17D 182 185 186 1A1 1A3 1C3 1C4 1C5 1C6 1DF 1E1 1E5 1E9 1EB 1ED 1EF 1F1 1F3 1F4 1F5 1FB 200 202 204 206214 222 224 226 228 230 236 238 287 2C3 2C7 2F1 2F9 32A 32C 348 34A 3C1 3C9 3CB 3D1 3DC 3DD 3E3 3E9 3ED 3F13F9 3FB 3FC 451 4C1 4C5 4C7 4C9 4CB 4D1 4D7 4D9 4E1 4E9 4F1 500 514 52A 530 589 770 772 773 778 77D 77F 787 Looking at your logs, I see five new ones have shown up: 22A 362 385 7E4 7EC 22A is jumping all over the place. 362 is all zeros. 385 is zeros up until 10:56:05.178, when it changes to show what may be temperature, and then at 10:57:47.007 it seem to switch back to zeros. The 7E4 and 7EC ones are the most interesting, as they are OBDII style request/response. Here are the relevant logs: 10:44:47.323 R11 7E4 02 1A A5 00 00 00 00 00 10:44:47.335 R11 7EC 04 5A A5 01 03 AA AA AA 10:44:47.533 R11 7E4 03 22 83 77 00 00 00 00 10:44:47.536 R11 7EC 06 62 83 77 06 0A 2D AA 10:44:47.744 R11 7E4 02 1A A4 00 00 00 00 00 10:44:47.746 R11 7EC 10 09 5A A4 1C 1C 1C 1C 10:44:47.762 R11 7E4 30 00 00 00 00 00 00 00 10:44:47.766 R11 7EC 21 1C 1C 1C AA AA AA AA 10:44:48.622 R11 7EC 07 62 41 AB 00 00 00 00 10:44:49.105 R11 7E4 03 22 41 AC 00 00 00 00 10:44:49.187 R11 7E4 03 22 41 AB 00 00 00 00 10:44:50.011 R11 7E4 03 22 43 9B 00 00 00 00 10:44:50.309 R11 7E4 03 22 83 E1 00 00 00 00 10:44:50.680 R11 7E4 03 22 83 75 00 00 00 00 10:44:50.683 R11 7EC 06 62 83 75 06 0A 2D AA 10:44:50.757 R11 7E4 03 22 41 A6 00 00 00 00 10:44:52.575 R11 7E4 03 22 43 89 00 00 00 00 Note that 7E4 is the Hybrid Powertrain Control Module B, and 7EC is the reply to that request. OBDII standard requests are:0x01 - Request Current Powertrain Diagnostic Data0x02 - Request Powertrain Freeze Frame Data0x03 - Request Emission-Related Diagnostic Trouble Codes0x04 - Clear/Reset Emission-Related Diagnostic Information0x05 - Request Oxygen Sensor Monitoring Test Results0x06 - Request On-Board Monitoring Test Results for Specific Monitored Systems0x07 - Request Emission-Related Diagnostic Trouble Codes Detected During Current or Last Completed Driving Cycle0x08 - Request Control of On-Board System, Test or Component0x09 - Request Vehicle Information0x0A - Request Emission-Related Diagnostic Trouble Codes with Permanent StatusGMLAN enhanced services are: 0x10 - Initiate Diagnostics0x12 - Read Failure Record0x1A - Read Diagnostic ID (DID)0x20 - Return To Normal0x22 - Read Data By Parameter ID (PID)0x23 - Read Memory Address0x27 - Security Access0x28 - Disable Normal Communications0x2C - Define Dynamic Data Packet ID (DPID)0x2D - Define PID by Memory Address0x34 - Request Download0x36 - Transfer Data0x3B - Write DID0x3E - Tester Present0xA2 - Report Programming State0xA5 - Enter Programming Mode0xA9 - Check Codes0xAA - Read DPID0xAE - Device ControlSo, what we are seeing is: 10:44:47.323 R11 7E4 02 1A A5 00 00 00 00 00==> Read diagnostic ID A5 10:44:47.335 R11 7EC 04 5A A5 01 03 AA AA AA==> Respond diagnostic ID A5 is 0103 10:44:47.533 R11 7E4 03 22 83 77 00 00 00 00==> Request extended PID 8377 10:44:47.536 R11 7EC 06 62 83 77 06 0A 2D AA ==> Respond extended PID 8377 is 060A2D 10:44:47.744 R11 7E4 02 1A A4 00 00 00 00 00==> Read diagnostic ID A4 10:44:47.746 R11 7EC 10 09 5A A4 1C 1C 1C 1C ==> Weird response - seem shifted over one. But, presumably a response to diagnostic ID A4. Maybe corrupt in the log? 10:44:47.762 R11 7E4 30 00 00 00 00 00 00 00==> Bizarre. Corrupt? 10:44:47.766 R11 7EC 21 1C 1C 1C AA AA AA AA ==> Bizarre. Corrupt? 10:44:48.622 R11 7EC 07 62 41 AB 00 00 00 00 ==> Response to an extended PID request for 41AB, value 000000 10:44:49.105 R11 7E4 03 22 41 AC 00 00 00 00==> Extended PID request for pid 41AC 10:44:49.187 R11 7E4 03 22 41 AB 00 00 00 00==> Extended PID request for pid 41AB 10:44:50.011 R11 7E4 03 22 43 9B 00 00 00 00==> Extended PID request for pid 439B 10:44:50.309 R11 7E4 03 22 83 E1 00 00 00 00 ==> Extended PID request for pid 83E110:44:50.680 R11 7E4 03 22 83 75 00 00 00 00==> Extended PID request for pid 8375 10:44:50.683 R11 7EC 06 62 83 75 06 0A 2D AA==> Respond extended PID request for pid 8375, value 060A2D 10:44:50.757 R11 7E4 03 22 41 A6 00 00 00 00==> Extended PID request for pid 41A6 10:44:52.575 R11 7E4 03 22 43 89 00 00 00 00==> Extended PID request for pid 4389 The log file has a large number of 'data overrun errors' around 10:44:48 and 10:44:49 - I suspect that a few of few of the requests/replies were lost around that time. The start (10:44:47) of the log looks ok. Looking at the idle can bus from 10:41, waking up at 10:44 is interesting: 10:41:37.203 R11 2C3 06 59 06 A0 06 A0 CA 0010:41:37.203 R11 3D1 01 36 80 00 00 00 00 0010:41:37.203 R11 3E9 00 00 00 00 00 00 00 0010:44:47.323 R11 7E4 02 1A A5 00 00 00 00 0010:44:47.335 R11 7EC 04 5A A5 01 03 AA AA AA10:44:47.353 R11 1EB 02 52 It certainly looks like the 7E4 02 1A A5 00 00 00 00 00 woke things up. I'll keep looking, but it seems that the log file is inconsistent as the logger got overloaded. Regards, Mark On 23 Feb, 2013, at 3:13 AM, rgjones(a)sbcglobal.net wrote: Hello Folks, I just captured CAN data during onstar commands for remote start/stop lock/unlock. Below are my notes. Where should I send the log file? Regards, Richard San Diego 2013 Volt #119292 Fri Feb 22, 2013 10am PST VIN: 1g1re6e49du119292 Car plugged in, locked, finished charging (green led blinking) walk up to car fob - unlock open passenger door - get in close passenger door. 10:41 start android onstar app request status update (push refresh icon on app) 10:43 - app shows doing refresh see CAN activity 10:44 app finally updates - 120V battery fully charged 36 mile ev range 152 fuel range Oil life remaining 86% odo 3955 miles 10:45 can updates stop onstart remote door lock 1052 - sent lock cmd 1052 locked - lots of can 1053 remote start sent. failed as key in vehicle 1054 1054 remote unlock 1054 done 1055 leave via passenger door, close it. keyfob lock 1055 leave key out of range of the car 1055 remote start req 1056 app says "cabin temp being set for optimal comfort" lots of CAN Dash still off, but orange engine light is on. 1057 send cancel engine start. 1057 - engine light off - app says done -rw-r--r-- 1 root root 17471412 2013-02-22 10:59 volt_130222_1_CAN_log.txt Fri Feb 22, 2013 10am PST VIN: 1g1re6e49du119292 Car plugged in, locked, finished charging (green led blinking) walk up to car fob - unlock open passenger door - get in close passenger door. 10:41 start android onstar app request status update (push refresh icon on app) 10:43 - app shows doing refresh see CAN activity 10:44 app finally updates - 120V battery fully charged 36 mile ev range 152 fuel range Oil life remaining 86% odo 3955 miles 10:45 can updates stop onstart remote door lock 1052 - sent lock cmd 1052 locked - lots of can 1053 remote start sent. failed as key in vehicle 1054 1054 remote unlock 1054 done 1055 leave via passenger door, close it. keyfob lock 1055 leave key out of range of the car 1055 remote start req 1056 app says "cabin temp being set for optimal comfort" lots of CAN Dash still off, but orange engine light is on. 1057 send cancel engine start. 1057 - engine light off - app says done -rw-r--r-- 1 root root 17471412 2013-02-22 10:59 volt_130222_1_CAN_log.txt gzip volt_130222_1_CAN_log.txt tattler:~# tail volt_130222_1_CAN_log.txt 10:58:02.055852 S. id=0x000001c4 dat=0xca:0x62:0xc1:0x10:0x04:0x00:0x03:0xfe 10:58:02.057282 S. id=0x000001c5 dat=0x2c:0x03:0x2c:0x03:0x2e:0x01 10:58:02.058671 S. id=0x000001f4 dat=0x00:0x00:0x00:0x00:0x00:0x00 10:58:02.060073 S. id=0x00000287 dat=0xc1:0x00 10:58:02.062044 S. id=0x000002c3 dat=0x06:0x5b:0x06:0xa0:0x06:0xa0:0xca:0x00 10:58:02.062468 S. id=0x000000bc dat=0x37:0x00:0x00:0x40:0x00:0x00:0x00:0x00 10:58:02.062785 S. id=0x000000aa dat=0x2c:0x03:0x2c:0x03:0x04:0x53:0xfb:0x00 10:58:02.063088 S. id=0x000000c9 dat=0x00:0x00:0x00:0x27:0x00:0x10:0x08:0x00 10:58:02.063392 S. id=0x000001ed dat=0x01:0x90:0x00:0x00:0x00:0x00:0x18:0x01 10:58:02.063691 S. id=0x000001ef dat=0x00:0x00:0x00:0x00 gzip volt_130222_1_CAN_log.txt -rw-r--r-- 1 root root 1888643 2013-02-22 10:59 volt_130222_1_CAN_log.txt.gz --- On Sat, 2/16/13, Mark Webb-Johnson <mark(a)webb-johnson.net> wrote: From: Mark Webb-Johnson <mark(a)webb-johnson.net> Subject: Re: [Ovmsdev] Ampera remote start/stop function To: "OVMS Developers" <ovmsdev(a)lists.teslaclub.hk> Date: Saturday, February 16, 2013, 12:03 AM Rens, The car-side technical discussion is going on here: http://gm-volt.com/forum/showthread.php?12958-CAN-bus-reading-remote-viewin… We're after pretty much the same things as the DashDaq people, so there is a lot of overlap. >From the App, it is no problem. We can use HomeLink for testing at the moment, and implement something properly when we know it is feasible. The problem is that we need CAN bus dumps while OnStar / KeyFob pre-heat and remote start/stop is commanded. For that, we need someone with a Volt in the USA and CAN-USB logger to help us try to find the commands. Regards, Mark. On 16 Feb, 2013, at 7:56 AM, Rens Meijer <r.meijer(a)atlantis-it.nl> wrote: Hello, Last week I received the OVMS V2 module to monitor my Ampera. I already had an OVMS V1 module to monitor the Tesla Roadster, so it works nicely from 1 app. In winter I like the remote start/stop function of the Ampera to pre-heat the car.I found this Youtube that in the US it is possible with the OnStar system to remote start/stop the car. See at 2.21 in the movie.http://www.youtube.com/watch?v=IOJMVbQnNIU&sns=emHas somebody already made a CAN bus log during the remote start/stop by using the remote control? If you are able to find the sequence, how easy would it be to configure the current home buttons in the app to implement the start/stop function?I would like to hear your thoughts on this? Best Regards, Rens _______________________________________________ OvmsDev mailing list OvmsDev(a)lists.teslaclub.hk http://lists.teslaclub.hk/mailman/listinfo/ovmsdev -----Inline Attachment Follows----- _______________________________________________ OvmsDev mailing list OvmsDev(a)lists.teslaclub.hk http://lists.teslaclub.hk/mailman/listinfo/ovmsdev _______________________________________________ OvmsDev mailing list OvmsDev(a)lists.teslaclub.hk http://lists.teslaclub.hk/mailman/listinfo/ovmsdev -----Inline Attachment Follows----- _______________________________________________ OvmsDev mailing list OvmsDev(a)lists.teslaclub.hk http://lists.teslaclub.hk/mailman/listinfo/ovmsdev

4 5

Tips needed for reverse engineering CAN bus
by Matt Beard 26 Feb '13

26 Feb '13

I am considering doing some work on an OVMS version for the iMiev/iOn/C-Zero, but am puzzled as to how the existing versions reverse engineered the CAN bus. I have lots of info about reading the status from the CAN bus, and I think this would allow all available features, but I wouldn't know where to start on the write-side. How have the current versions reverse engineered the commands required for setting features? Without an ability to set features there is little gained over the existing support and so little point doing the work. Matt Beard

2 1

Re: [Ovmsdev] Ampera remote start/stop function
by Richard G Jones 25 Feb '13

25 Feb '13

Wow that's great decoding work. Sorry about the overruns. Would it help to get another capture, with several iterations? Sent from my phablet, scuse the typosMark Webb-Johnson <mark(a)webb-johnson.net> wrote: I've been working through the logs (if anyone else needs a look, let me know). I started by converting to crtd format, so I could use some of my tools on it. Looking at a bunch of other logs provided by volt/ampera drivers, we've so far seen 108 unique can arbitration IDs: 096 097 098 0AA 0B1 0B9 0BA 0BB 0BC 0BD 0C1 0C4 0C5 0C7 0C9 0D1 0D3 0F1 101 120 12A 130 135 137 139 140 148 160 17D 182 185 186 1A1 1A3 1C3 1C4 1C5 1C6 1DF 1E1 1E5 1E9 1EB 1ED 1EF 1F1 1F3 1F4 1F5 1FB 200 202 204 206 214 222 224 226 228 230 236 238 287 2C3 2C7 2F1 2F9 32A 32C 348 34A 3C1 3C9 3CB 3D1 3DC 3DD 3E3 3E9 3ED 3F1 3F9 3FB 3FC 451 4C1 4C5 4C7 4C9 4CB 4D1 4D7 4D9 4E1 4E9 4F1 500 514 52A 530 589 770 772 773 778 77D 77F 787 Looking at your logs, I see five new ones have shown up: 22A 362 385 7E4 7EC 22A is jumping all over the place. 362 is all zeros. 385 is zeros up until 10:56:05.178, when it changes to show what may be temperature, and then at 10:57:47.007 it seem to switch back to zeros. The 7E4 and 7EC ones are the most interesting, as they are OBDII style request/response. Here are the relevant logs: 10:44:47.323 R11 7E4 02 1A A5 00 00 00 00 00 10:44:47.335 R11 7EC 04 5A A5 01 03 AA AA AA 10:44:47.533 R11 7E4 03 22 83 77 00 00 00 00 10:44:47.536 R11 7EC 06 62 83 77 06 0A 2D AA 10:44:47.744 R11 7E4 02 1A A4 00 00 00 00 00 10:44:47.746 R11 7EC 10 09 5A A4 1C 1C 1C 1C 10:44:47.762 R11 7E4 30 00 00 00 00 00 00 00 10:44:47.766 R11 7EC 21 1C 1C 1C AA AA AA AA 10:44:48.622 R11 7EC 07 62 41 AB 00 00 00 00 10:44:49.105 R11 7E4 03 22 41 AC 00 00 00 00 10:44:49.187 R11 7E4 03 22 41 AB 00 00 00 00 10:44:50.011 R11 7E4 03 22 43 9B 00 00 00 00 10:44:50.309 R11 7E4 03 22 83 E1 00 00 00 00 10:44:50.680 R11 7E4 03 22 83 75 00 00 00 00 10:44:50.683 R11 7EC 06 62 83 75 06 0A 2D AA 10:44:50.757 R11 7E4 03 22 41 A6 00 00 00 00 10:44:52.575 R11 7E4 03 22 43 89 00 00 00 00 Note that 7E4 is the Hybrid Powertrain Control Module B, and 7EC is the reply to that request. OBDII standard requests are: 0x01 - Request Current Powertrain Diagnostic Data 0x02 - Request Powertrain Freeze Frame Data 0x03 - Request Emission-Related Diagnostic Trouble Codes 0x04 - Clear/Reset Emission-Related Diagnostic Information 0x05 - Request Oxygen Sensor Monitoring Test Results 0x06 - Request On-Board Monitoring Test Results for Specific Monitored Systems 0x07 - Request Emission-Related Diagnostic Trouble Codes Detected During Current or Last Completed Driving Cycle 0x08 - Request Control of On-Board System, Test or Component 0x09 - Request Vehicle Information 0x0A - Request Emission-Related Diagnostic Trouble Codes with Permanent Status GMLAN enhanced services are: 0x10 - Initiate Diagnostics 0x12 - Read Failure Record 0x1A - Read Diagnostic ID (DID) 0x20 - Return To Normal 0x22 - Read Data By Parameter ID (PID) 0x23 - Read Memory Address 0x27 - Security Access 0x28 - Disable Normal Communications 0x2C - Define Dynamic Data Packet ID (DPID) 0x2D - Define PID by Memory Address 0x34 - Request Download 0x36 - Transfer Data 0x3B - Write DID 0x3E - Tester Present 0xA2 - Report Programming State 0xA5 - Enter Programming Mode 0xA9 - Check Codes 0xAA - Read DPID 0xAE - Device Control So, what we are seeing is: 10:44:47.323 R11 7E4 02 1A A5 00 00 00 00 00 ==> Read diagnostic ID A5 10:44:47.335 R11 7EC 04 5A A5 01 03 AA AA AA ==> Respond diagnostic ID A5 is 0103 10:44:47.533 R11 7E4 03 22 83 77 00 00 00 00 ==> Request extended PID 8377 10:44:47.536 R11 7EC 06 62 83 77 06 0A 2D AA ==> Respond extended PID 8377 is 060A2D 10:44:47.744 R11 7E4 02 1A A4 00 00 00 00 00 ==> Read diagnostic ID A4 10:44:47.746 R11 7EC 10 09 5A A4 1C 1C 1C 1C ==> Weird response - seem shifted over one. But, presumably a response to diagnostic ID A4. Maybe corrupt in the log? 10:44:47.762 R11 7E4 30 00 00 00 00 00 00 00 ==> Bizarre. Corrupt? 10:44:47.766 R11 7EC 21 1C 1C 1C AA AA AA AA ==> Bizarre. Corrupt? 10:44:48.622 R11 7EC 07 62 41 AB 00 00 00 00 ==> Response to an extended PID request for 41AB, value 000000 10:44:49.105 R11 7E4 03 22 41 AC 00 00 00 00 ==> Extended PID request for pid 41AC 10:44:49.187 R11 7E4 03 22 41 AB 00 00 00 00 ==> Extended PID request for pid 41AB 10:44:50.011 R11 7E4 03 22 43 9B 00 00 00 00 ==> Extended PID request for pid 439B 10:44:50.309 R11 7E4 03 22 83 E1 00 00 00 00 ==> Extended PID request for pid 83E1 10:44:50.680 R11 7E4 03 22 83 75 00 00 00 00 ==> Extended PID request for pid 8375 10:44:50.683 R11 7EC 06 62 83 75 06 0A 2D AA ==> Respond extended PID request for pid 8375, value 060A2D 10:44:50.757 R11 7E4 03 22 41 A6 00 00 00 00 ==> Extended PID request for pid 41A6 10:44:52.575 R11 7E4 03 22 43 89 00 00 00 00 ==> Extended PID request for pid 4389 The log file has a large number of 'data overrun errors' around 10:44:48 and 10:44:49 - I suspect that a few of few of the requests/replies were lost around that time. The start (10:44:47) of the log looks ok. Looking at the idle can bus from 10:41, waking up at 10:44 is interesting: 10:41:37.203 R11 2C3 06 59 06 A0 06 A0 CA 00 10:41:37.203 R11 3D1 01 36 80 00 00 00 00 00 10:41:37.203 R11 3E9 00 00 00 00 00 00 00 00 10:44:47.323 R11 7E4 02 1A A5 00 00 00 00 00 10:44:47.335 R11 7EC 04 5A A5 01 03 AA AA AA 10:44:47.353 R11 1EB 02 52 It certainly looks like the 7E4 02 1A A5 00 00 00 00 00 woke things up. I'll keep looking, but it seems that the log file is inconsistent as the logger got overloaded. Regards, Mark On 23 Feb, 2013, at 3:13 AM, rgjones(a)sbcglobal.net wrote: Hello Folks, I just captured CAN data during onstar commands for remote start/stop lock/unlock. Below are my notes. Where should I send the log file? Regards, Richard San Diego 2013 Volt #119292 Fri Feb 22, 2013 10am PST VIN: 1g1re6e49du119292 Car plugged in, locked, finished charging (green led blinking) walk up to car fob - unlock open passenger door - get in close passenger door. 10:41 start android onstar app request status update (push refresh icon on app) 10:43 - app shows doing refresh see CAN activity 10:44 app finally updates - 120V battery fully charged 36 mile ev range 152 fuel range Oil life remaining 86% odo 3955 miles 10:45 can updates stop onstart remote door lock 1052 - sent lock cmd 1052 locked - lots of can 1053 remote start sent. failed as key in vehicle 1054 1054 remote unlock 1054 done 1055 leave via passenger door, close it. keyfob lock 1055 leave key out of range of the car 1055 remote start req 1056 app says "cabin temp being set for optimal comfort" lots of CAN Dash still off, but orange engine light is on. 1057 send cancel engine start. 1057 - engine light off - app says done -rw-r--r-- 1 root root 17471412 2013-02-22 10:59 volt_130222_1_CAN_log.txt Fri Feb 22, 2013 10am PST VIN: 1g1re6e49du119292 Car plugged in, locked, finished charging (green led blinking) walk up to car fob - unlock open passenger door - get in close passenger door. 10:41 start android onstar app request status update (push refresh icon on app) 10:43 - app shows doing refresh see CAN activity 10:44 app finally updates - 120V battery fully charged 36 mile ev range 152 fuel range Oil life remaining 86% odo 3955 miles 10:45 can updates stop onstart remote door lock 1052 - sent lock cmd 1052 locked - lots of can 1053 remote start sent. failed as key in vehicle 1054 1054 remote unlock 1054 done 1055 leave via passenger door, close it. keyfob lock 1055 leave key out of range of the car 1055 remote start req 1056 app says "cabin temp being set for optimal comfort" lots of CAN Dash still off, but orange engine light is on. 1057 send cancel engine start. 1057 - engine light off - app says done -rw-r--r-- 1 root root 17471412 2013-02-22 10:59 volt_130222_1_CAN_log.txt gzip volt_130222_1_CAN_log.txt tattler:~# tail volt_130222_1_CAN_log.txt 10:58:02.055852 S. id=0x000001c4 dat=0xca:0x62:0xc1:0x10:0x04:0x00:0x03:0xfe 10:58:02.057282 S. id=0x000001c5 dat=0x2c:0x03:0x2c:0x03:0x2e:0x01 10:58:02.058671 S. id=0x000001f4 dat=0x00:0x00:0x00:0x00:0x00:0x00 10:58:02.060073 S. id=0x00000287 dat=0xc1:0x00 10:58:02.062044 S. id=0x000002c3 dat=0x06:0x5b:0x06:0xa0:0x06:0xa0:0xca:0x00 10:58:02.062468 S. id=0x000000bc dat=0x37:0x00:0x00:0x40:0x00:0x00:0x00:0x00 10:58:02.062785 S. id=0x000000aa dat=0x2c:0x03:0x2c:0x03:0x04:0x53:0xfb:0x00 10:58:02.063088 S. id=0x000000c9 dat=0x00:0x00:0x00:0x27:0x00:0x10:0x08:0x00 10:58:02.063392 S. id=0x000001ed dat=0x01:0x90:0x00:0x00:0x00:0x00:0x18:0x01 10:58:02.063691 S. id=0x000001ef dat=0x00:0x00:0x00:0x00 gzip volt_130222_1_CAN_log.txt -rw-r--r-- 1 root root 1888643 2013-02-22 10:59 volt_130222_1_CAN_log.txt.gz --- On Sat, 2/16/13, Mark Webb-Johnson <mark(a)webb-johnson.net> wrote: From: Mark Webb-Johnson <mark(a)webb-johnson.net> Subject: Re: [Ovmsdev] Ampera remote start/stop function To: "OVMS Developers" <ovmsdev(a)lists.teslaclub.hk> Date: Saturday, February 16, 2013, 12:03 AM Rens, The car-side technical discussion is going on here: http://gm-volt.com/forum/showthread.php?12958-CAN-bus-reading-remote-viewin… We're after pretty much the same things as the DashDaq people, so there is a lot of overlap. From the App, it is no problem. We can use HomeLink for testing at the moment, and implement something properly when we know it is feasible. The problem is that we need CAN bus dumps while OnStar / KeyFob pre-heat and remote start/stop is commanded. For that, we need someone with a Volt in the USA and CAN-USB logger to help us try to find the commands. Regards, Mark. On 16 Feb, 2013, at 7:56 AM, Rens Meijer <r.meijer(a)atlantis-it.nl> wrote: Hello, Last week I received the OVMS V2 module to monitor my Ampera. I already had an OVMS V1 module to monitor the Tesla Roadster, so it works nicely from 1 app. In winter I like the remote start/stop function of the Ampera to pre-heat the car. I found this Youtube that in the US it is possible with the OnStar system to remote start/stop the car. See at 2.21 in the movie. http://www.youtube.com/watch?v=IOJMVbQnNIU&sns=em Has somebody already made a CAN bus log during the remote start/stop by using the remote control? If you are able to find the sequence, how easy would it be to configure the current home buttons in the app to implement the start/stop function? I would like to hear your thoughts on this? Best Regards, Rens _______________________________________________ OvmsDev mailing list OvmsDev(a)lists.teslaclub.hk http://lists.teslaclub.hk/mailman/listinfo/ovmsdev -----Inline Attachment Follows----- _______________________________________________ OvmsDev mailing list OvmsDev(a)lists.teslaclub.hk http://lists.teslaclub.hk/mailman/listinfo/ovmsdev _______________________________________________ OvmsDev mailing list OvmsDev(a)lists.teslaclub.hk http://lists.teslaclub.hk/mailman/listinfo/ovmsdev

2 1

Ampera remote start/stop function
by Rens Meijer 25 Feb '13

25 Feb '13

Hello, Last week I received the OVMS V2 module to monitor my Ampera. I already had an OVMS V1 module to monitor the Tesla Roadster, so it works nicely from 1 app. In winter I like the remote start/stop function of the Ampera to pre-heat the car. I found this Youtube that in the US it is possible with the OnStar system to remote start/stop the car. See at 2.21 in the movie. http://www.youtube.com/watch?v=IOJMVbQnNIU&sns=em Has somebody already made a CAN bus log during the remote start/stop by using the remote control? If you are able to find the sequence, how easy would it be to configure the current home buttons in the app to implement the start/stop function? I would like to hear your thoughts on this? Best Regards, Rens

4 5