1. Attachments are working again! Check out this thread for more details and to report any other bugs.

Pseudo code, strategy for CAN PHEV control methods?

Discussion in 'Prius PHEV Plug-In Modifications' started by lesdit, Apr 21, 2011.

  1. lesdit

    lesdit New Member

    Joined:
    Apr 15, 2011
    32
    13
    0
    Location:
    United States
    Vehicle:
    2006 Prius
    Model:
    N/A
    I would like to know if any of you would like to discuss and learn with me the nature of controlling the Prius systems using CAN bus mods to allow optimal PHEV driving.

    ... pause to let shriek of PIS and PICC coders subside .....:D

    OK, I am somewhat familiar with micro controller programming, and just got a 06 Prius and would like to PHEV it. I like doing things right, and so far have not decided on buying a system for 10 grand, or doing my own, or just using a battery charger system like the Enginer and live with it's issues.

    Anybody want to discuss a more open source, or open pseudo code source project to control CANbus filtering of the packets that control the ICE and the two electric motors MG1 MG2 ? We need to explore how the power split is controlled ( this allows control over how fast we let MG1 spin during high speed driving, for example ) and which messages are altered to keep the ICE off, etc.
    There is a forum user here , "peef" (sp?) that has apparently decoded most of this in his own PHEV system, but I'm not sure he has the inclination to share his findings here, perhaps for business reasons.

    Maybe start with a list of questions ?
    A list of known commands, and what they do ? ( there is a list I saw somewhere )
    Explore what does not work, or throws error codes if tried ?

    I'll bet that the pseudo code to run a CAN bus PHEV is really rather simple, once you know the basic 'lay of the land'.
     
    1 person likes this.
  2. lesdit

    lesdit New Member

    Joined:
    Apr 15, 2011
    32
    13
    0
    Location:
    United States
    Vehicle:
    2006 Prius
    Model:
    N/A
    Aww, come on, I know not all of you are clerks and cashiers !
     
  3. Floyd2

    Floyd2 progressio per sententia

    Joined:
    Aug 23, 2009
    106
    23
    0
    Location:
    Netherlands, Europe
    Vehicle:
    2006 Prius
    Model:
    II
    Not a clerk nor a cashier. I did some industrial PLC programming as an intern in the past but that was very basic and routine stuff and a very long time ago.

    I bought an ELM327 interface december last year. Similar to this one, but the older 1.3a version: OBD Diagnose Interface ELM327 USB CAN VAG BMW Audi ALU - eBay, Computergestützte Diagnose, Handmess- Testgeräte, Werkzeuge, Auto Motorrad Teile. (Eindtijd 26-apr-11 11:05:30 CEST)
    I was told the software that comes with these gadgets were really bad (haven't tried it myself yet). So I started programming very simply in VB6, made a virtual COM port via USB and my intention was to put the laptop in the car, connect it to the CAN bus via the interface and see if I could get any relevant data that was specifically interesting to me on the screen. Somehow I never got that far, little spare time and at the time it was freezing cold over here.
    I have a transciever with CAT (Computer Aided Tuning) so I could test my homebrew program without having to go out in the cold, and check if I had a COM port connect and switch between transmit and receive. CAT uses the 7,N,2 protocol so I made the bits, parity and stop variable in the program using comboboxes and including the possibility to add a handshake like Xon/Xoff to the protocol.
    So I could basically press the Push To Talk button of my transciever with a mouse click. To my surprise that worked straight away so I added more buttons which switched to different frequencies in a few millisecond intervals. And got that working as well. But that is where my experiments ended.

    I assume the ELM327 (and the 323 and ELM5) will use the standard 8,N,1 protocol. So it's reasonably easy to start, now it's a matter of figuring out how the OBD2-CAN bus protocol works and getting the data we need.

    Soon I will have some more time on my hands and temperatures are nice right now. I also read pEEF's stuff but I don't think he will share the details. But I'm game if you can tell me a little more about how to intercept CAN ODB2 data. Always eager to learn and I don't mind sharing the source at all.

    If you don't mind starting off in a simple language evironment like VB6.0 we could figure out what data we need, how to intercept it, where to get it from and at a later stage see if and how it can be influenced. At least that would be a start.

    What exactly is your objective: allowing the car to drive at a higher speed in pure EV mode? Personally I would like that too but don't know if that is possible.

    I will try to get the ELM327 to work first thing next week. Laptop on the passenger seat and see if I can get some data off the bus using the standard software first. If you're interested going down this road let me know, okay?

    If you already have some kind of interface and you can use VB6 it is quite straight forward: use the MSComm control to connect to the virtual comm port. From there it's all a mystery to me...
     
    1 person likes this.
  4. lesdit

    lesdit New Member

    Joined:
    Apr 15, 2011
    32
    13
    0
    Location:
    United States
    Vehicle:
    2006 Prius
    Model:
    N/A
    Hi Floyd2,
    Yes , my goal would be to understand and implement the can bus messages to allow more EV like driving.
    I am getting an idea of the microcontroller hardware needed. The Atmel AVR series seems to be a good source. They have some evaluation boards that have a couple of can bus ports. I recently got some AVR dev system parts to use to test, but have not ordered the can versions yet.
    I'm not certain yet, but it seems like inserting a micro in between the engine ECU and the hybrid (main) control unit might be enough.
    From what I have gleaned from various posts, you intercept the hybrid computer's mesage to the engine ECU asking for power, and tell the engine ECU a request for zero power instead. So that keeps the ICE from burning fuel.
    The battery controller accepts no commands, and just broadcasts it's data including the state of charge (SOC). I read that if you follow right away a message of more SOC ( say 79% ) , the first message is effectively ignored. So now the hybrid controller thinks the battery is too full and it needs to lower the SOC by using more battery to move the car. Might also have to falsify the max current the battery says it can provide as well.

    Maybe you can do some sniffing of the messages to see the hybrid controller asking for engine power, to verify this functionality?

    If it's only simple spoofing as above, then the coding should be pretty simple. Transitioning from one driving mode to another can be 'mixed in' to go between modes either transparently or under driver command via switch or even sensing a switch or a stab at the gas pedal to signal a desire to change modes.

    I have a Honda Insight which I am selling, but I just wanted to mention how the MIMA control 'hack' that is used on the Honda to override the battery usage is not secret and the circuit and design principals are shared. Considering how many more Prius there are on the road, it is a little bit odd that more information is not out there for public consumption. I guess those that tinker with the Prius just like to play with the cards closer to the chest, so to speak.
     
    1 person likes this.
  5. lesdit

    lesdit New Member

    Joined:
    Apr 15, 2011
    32
    13
    0
    Location:
    United States
    Vehicle:
    2006 Prius
    Model:
    N/A
    I don't know how the CAN <-> ODB works. I did read something about the serial port version of the sniffers may not be fast enough to capture all of the traffic?

     
  6. ccdisce

    ccdisce Active Member

    Joined:
    Oct 10, 2010
    259
    187
    0
    Location:
    Stone Mtn GA USA
    Vehicle:
    2008 Prius
    Model:
    N/A
    I know a little on how CAN works and am learning more as I use an Arduino UNO and a CAN shield. The shield manufacturer has a demo .PDE CAN program probably written in C which may help with the learning process.

    The transition to LIN will have to wait while I learn.
     
    1 person likes this.
  7. lesdit

    lesdit New Member

    Joined:
    Apr 15, 2011
    32
    13
    0
    Location:
    United States
    Vehicle:
    2006 Prius
    Model:
    N/A
    Does the Arduino let you use more than one of the CAN shields at the same time ?
    For the spoofing, you need >1 ports.

     
  8. ccdisce

    ccdisce Active Member

    Joined:
    Oct 10, 2010
    259
    187
    0
    Location:
    Stone Mtn GA USA
    Vehicle:
    2008 Prius
    Model:
    N/A
    It could but not easily as ther are no jumpers that you can move around to change cs , int etc on the CAN -BUS shield that I am using.

    The SiLabs and Microchip CAN demo boards have 2 CAN interfaces which can be interconnected to form a bus OR kept separte to form a BRIDGE.
     
    2 people like this.
  9. Floyd2

    Floyd2 progressio per sententia

    Joined:
    Aug 23, 2009
    106
    23
    0
    Location:
    Netherlands, Europe
    Vehicle:
    2006 Prius
    Model:
    II
    Sound like a good way to trick the Prius in stopping it sending fuel Lesdit, it might just work. It also seems a good idea if you take the firmware road and I stick to the software approach. We can still exchange knowledge that way. Like you said; there are so many Prius on the road yet so little information to be found.

    I know a little about the ATtiny AVR, as a matter of fact there is a chip like that in front of me on the table. I wanted to use it to make a robot lawn mower using an old kid’s car, but it’s another unfinished project due to the lack of time.

    This afternoon I had some time and put the laptop in the car. The reviews were right, the software provided with the ELM interface is basically worthless. For some reason they don’t recognize the virtual com port. So I downloaded an evaluation version of PCMScan and it connected to the port immediately. The problem is that this program is not really suited for hybrids like the Prius. The only CAN PID it is able to show is the rpm of the ICE, it shows current values and average value. So at least I know the ELM interface works.
    I used a baudrate of 9600, haven’t tried 38400 yet but that should probably work as well. It detects the CAN 11-bits identifiers. Three ECU’s are seen by the software: at $7E8 an Engine Controller, $7EA an unknown module and at $7EB another unknown module. To my surprise the first one is indicating OBD compliance: EOBD (Europe) standard and the last one as OBD-II (California ARB ). I hope the difference between US en EU Prius will not pose a problem, I expect not.

    The terminal function of this program only works in the registered version. So I think it is best to write my own program in Visual Basic.

    I used the same VB code as for my transceiver program, made some minor adjustments to it and put the laptop in the car, hooked up the ELM device to the OBD bus and: I set in to COM1: (in my case) and protocol 8,N,1. It worked like a charm. Don’t you love it when that happens. ;)

    In case someone is interested in the VB6 code I will explain a little here. The basic layout of the main form consist of several buttons (Combo_Click1 to 5) in which the speed, amount of bits, parity, com port, amount of stop bits, and handshake can be selected, they are given the variables: CANspeed, CANdata, CANpariteit, CANstop, CANhandshake . The Connect button has the following code:


    Please ignore the remarks, they are in Dutch. The form has two images on top of each other. As soon as the connection is made the top image (Image2) is made transparent (Image2.Visible = False) and the blue Toyota logo below is shown. Also a sound is heard to indicate the connection to the serial port has been successfully made. As soon as the connection to the chosen port is made these settings are written in a CANconfig.ini file. Next time it will automatically use these last used values.

    So the connection to the serial port is working. I still need to add a function to determine if there is any communication with the CAN bus through the port, that will be my next step.
    A simple ‘atdt’ like you use to wake up a modem will not be much use. There already is enough traffic running over the CAN bus, I now have to figure out what to send and what I should expect as a reply.

    But at least I started with this project again, hopefully some more to come within the next couple of days. Attached some screenshots of the program sofar. The TX and RX button can be removed and I think I will add two indicators that turn from red to green if connection to the ELM device and CAN bus have been established.

    [​IMG]
    At startup

    [​IMG]
    Connection established

    CAN-quest seems like a nice title, hereby claimed as a trademark. :p If it is this easy to establish a connection to the comm port it makes you wonder why they added that crappy software with the ELM. On the upside it's fun to make something yourself.

    @ Ccdicse: I have no experience with C(+) but some routines can be incorporated in VB. Since the next step is to send an signal over the CAN bus, can you tell me what would be a good way to check if there is a connection to the CAN bus?
    I will use a syntax like MSComm1.Output = "message to can bus" & vbCr and txtDisplay.Text = MSComm1.Input to see what is returned.
     
    1 person likes this.
  10. mrbigh

    mrbigh Prius Absolutum Dominium

    Joined:
    Sep 6, 2005
    3,686
    699
    2
    Location:
    Long Island, NY
    Vehicle:
    Other Electric Vehicle
    Here there's my contribution to the cause and as fallow, are some 2nd gen Prius CAN parameters for you to play around:
    CAN030 byte 5 brake position
    CAN520 byte 4 X 3C8 byte 5 fuel flow
    CAN039 byte 1 ICE temp
    CAN03B bytes 1,2 main battery current
    CAN03B bytes 3,4 main battery voltage
    CAN244 byte 7 throttle
    CAN3C8 byte 3 ICE rpm
    CAN3CA byte 3 speed
    CAN3CB byte 1 maximum charge current
    CAN3CB byte 2 maximum discharge current
    CAN3CB byte4 SOC
    CAN3CB byte 6 highest battery temperature
    CAN526 byte 2 VVTi
    CAN52C byte 2 coolant temperature
    CAN5A4 byte 2 gas tank
     
    2 people like this.
  11. Floyd2

    Floyd2 progressio per sententia

    Joined:
    Aug 23, 2009
    106
    23
    0
    Location:
    Netherlands, Europe
    Vehicle:
    2006 Prius
    Model:
    II
    Thanks Mrbigh, it might be best to start with a simple variable like: brake position. Any idea how you would format them in a terminal program? That's what I'm trying to figure out.
     
  12. vincent1449p

    vincent1449p Active Member

    Joined:
    May 24, 2004
    894
    331
    0
    Location:
    Singapore
    Vehicle:
    2012 Prius c
    2 people like this.
  13. Floyd2

    Floyd2 progressio per sententia

    Joined:
    Aug 23, 2009
    106
    23
    0
    Location:
    Netherlands, Europe
    Vehicle:
    2006 Prius
    Model:
    II
    Thanks Vincent, very informative spreadsheet too. It's way past midnight here but first thing tomorrow I will try sending to these adresses and see what is returned. Don't know if they can be sent in hex or have to be converted to decimal first.

    Problem is the battery of my laptop is really old and will last 10 minutes at most, so I will have to do the programming inside and if possible correct the first time. :)

    I will let you know how it turns out.
     
  14. vincent1449p

    vincent1449p Active Member

    Joined:
    May 24, 2004
    894
    331
    0
    Location:
    Singapore
    Vehicle:
    2012 Prius c
    I'm not familiar with your program but according to the ELM327 manual that I've read online, it can communicate with a PC in hex (not dec) using any terminal programs (HyperTerminal, ZTerm, etc). Since you're communicating with CAN bus, I think 9600 is too slow to be of any use. I suggest you change to 38400 baud instead.
     
  15. lesdit

    lesdit New Member

    Joined:
    Apr 15, 2011
    32
    13
    0
    Location:
    United States
    Vehicle:
    2006 Prius
    Model:
    N/A
    Wow, some momentum on this thread , good !:cheer2:

    On the hardware front, I have found that this chip:
    http://ww1.microchip.com/downloads/en/DeviceDoc/21801F.pdf

    is a very good candidate for interfacing to the CAN bus. It connects to the micro with the common SPI bus, an often used bus for micro interconnects. Also good news is that the MPC2515 is available in 18 pin dip ( easy to solder ) , and only costs $2 USD ! It has built in filters to ignore unwanted data too.

    My question to those who may have looked at the traffic on the Can so far, how busy is the bus, as in how many messages per second are there on the wire ? ( I'm not talking about the 1Mbit bit rate, but the higher level message rate ).

    I'm estimating the hardware cost to make a CAN spoof micro to be under $100, even if I use expensive parts. If the message rate is slow enough I migh even be able to use a zx-24 to run it all, that micro is super easy to use , like a basic stamp, but is much much faster.
     
    2 people like this.
  16. vincent1449p

    vincent1449p Active Member

    Joined:
    May 24, 2004
    894
    331
    0
    Location:
    Singapore
    Vehicle:
    2012 Prius c
    I 've not looked at CAN traffic but according to Attila Vass, there are about 1650~1700 message/sec.

    The new 2004 Toyota Prius : My CAN Project
     
    1 person likes this.
  17. Floyd2

    Floyd2 progressio per sententia

    Joined:
    Aug 23, 2009
    106
    23
    0
    Location:
    Netherlands, Europe
    Vehicle:
    2006 Prius
    Model:
    II
    There was a nice momentum but it seems to grid to a halt at the software front: I still have no clue in which format the CAN protocol expects to receive a request. Really frustrating, you would expect that someone must have tried this before or that some kind of information would be on the internet. I found a few questions on some forums but no one seems to have figured it out. Or maybe they did but never bothered to post it.

    HyperTerminal is no good, it keeps asking all kind of irrelevant personal information, very annoying. RealTerm is a lot better, user friendly and all settings can be changed. I set the speed to 38400 which seems to be the max for the ELM.
    Sending a hex value as a value doesn’t seem to do anything, when sending it in ASCCI the RX button briefly blinks so it seems the CAN bus (or ELM327?) is responding. Unfortunately shown as an ASCII or ANSI character on the terminal screen so that is not much use either.

    Tomorrow I will try it directly from my own VB program, see if I can any response from the CAN bus. If anyone can find an example or code snippet in VB please let me know.
     
  18. Floyd2

    Floyd2 progressio per sententia

    Joined:
    Aug 23, 2009
    106
    23
    0
    Location:
    Netherlands, Europe
    Vehicle:
    2006 Prius
    Model:
    II
    Found that the ELM327 datasheet contains detailed instructions on how to connect and about the OBD message formats, why didn't I think of that that before? It's 59 pages so this may take a while. :eek:

    Datasheet ELM327: http://www.elmelectronics.com/DSheets/ELM327DSF.pdf

    I wasn't even that far off comparing it with a modem, you can use similar 'AT' commands.

    @Lesdit: RealTerm has a PicProm feature, don't know if you can use that for the microcontrollers you mentioned but it may be worth having a look.
     
  19. lesdit

    lesdit New Member

    Joined:
    Apr 15, 2011
    32
    13
    0
    Location:
    United States
    Vehicle:
    2006 Prius
    Model:
    N/A
    I'm not understanding the ODB that the elm is supposed to be reading fully. Is all of the CAN Bus traffic also present on the ODB port ? The Elm document mentioned it reading six different message types. I wonder what that means.

    Somewhere I saw mentioned where in the Prius the actual Can Bus is accessible as the 2 wires. Anybody know of a link that describes the physical layout of the network ?
     
  20. vincent1449p

    vincent1449p Active Member

    Joined:
    May 24, 2004
    894
    331
    0
    Location:
    Singapore
    Vehicle:
    2012 Prius c
    Hi Floyd2,

    That is the same ELM327 manual that I was talking about. You can find some of the AT commands in this thread:

    http://priuschat.com/forums/gen-ii-prius-modifications/80206-canbus-pids.html

    http://priuschat.com/forums/gen-iii...gging-obdii-can-data-any-recommendations.html