VAN bus

[auldy]

Hi guys, I'm new to the forum - somone suggested I joined after seing my VAN bus decoding work.

I've built some hardware capable of capturing the VAN bus data in my 52 plate 406, it was originally just to get my COM2000 radio remote to talk to my Pioneer head unit but I was irriated by the lack of generally avaliable information about it on the web.

If you're interested my fulll explanation is on my website http://graham.auld.me.uk/projects/vanbus/ where there are pages detailing my USB VAN monitor and stuff...

I have some more information about the packets floating about on the bus that I still need to format and put online, much of this info I can't take credit for as it is all based on info I've scrabbled together from a French forum thread, google cached pages and the wayback machine. It could be early next week before I get more info up on my website as I'm a bit busy this weekend.

I'm really looking to find anyone else interested in looking into the VAN bus with a view to decoding all that floats around it!

I can only go so far with my own vehicle as I suspect many features/packet contents are model specific, even having other people confirm what I think I know is true on other Pugs/Renults/Citroens would be good...

Any takers?

[teamster1975]

Welcome auldy!
Brilliant project, I know mjb will be interested!
It doesn't really help me because I've got a D8.

[Captain Jack]

55 plate 406??? That's a first...

[auldy]

Oh yeah - It would appear that I am a bit of a mong! It's taken several mentions for me to realise my car is a 52 plate not a 55, I am a bit cr*p at remembering reg plates. Doh!

[mjb]

Brilliant project, I know mjb will be interested!

That's why I emailed the guy and told him to get his arse on here

It doesn't really help me because I've got a D8.

The D8 trip computer gets fuel consumption data from the ECU and text information from the stereo over VAN bus Think there's a few more systems that use it too, like the immobiliser

[mjb]

Hi guys, I'm new to the forum - somone suggested I joined after seing my VAN bus decoding work.

Welcome

I'm really looking to find anyone else interested in looking into the VAN bus with a view to decoding all that floats around it!

Thankfully I'm a dab hand at reverse engineering stuff

I can only go so far with my own vehicle as I suspect many features/packet contents are model specific, even having other people confirm what I think I know is true on other Pugs/Renults/Citroens would be good...

Renaults are completely different, but Pugs and Citroens are very closely related companies - part of the PSA Group. The Xantia is pretty much exactly the same car as the 406 D8 and the Mk.1 C5 is very close to the D9 406

As far as 406s go,
D8 = 1996 - 1999. Nice simple electricals, with VAN bus only in a couple of places where digital data is required (trip computer, stereo display, etc). Diagnostic socket is either proprietary or OBD-style, but the protocol's not been worked out. I suspect it may just be VAN,
D9 = 1999 - 2004. In March 2001 they introduced multiplexed controls. All interior buttons go straight to the BSI either directly or using VAN bus (ie the COM2000 stalks). Under-bonnet stuff speaks CAN bus, as does the OBD socket I understand. All cars have fly-by-wire throttle. 1999-2001 cars lack the COM2000 thankfully, but still have all controls routed through the BSI. Depending on the ECU in use (which depends on the engine type), the diag socket may use CAN or the unknown protocol.

[auldy]

Regarding Renaults I have no experience with them but I read somewhere that they had involvement in VAN along with PSA. Dunno if they ever actually used it - this of course could be internet fudd.

Funny you should mention the OBD as soon after getting my 406 while I was still trying to sell the old 405 I tried getting something to work with the OBD port - once more info I could find was sketchy and often not consistent. I gathered that the D9 HDI's used KWP2000 protocol which was more or less the 10.4k or so k line serial with a two byte key for waking up the ECU, my ELM interface fails to connect however. Sadly my garage is not attached to the house and lacks power so I find it difficult to properly debug these things as my only option really is a 10M mains lead out to the road on a nice day to get the 'scope connected up. Grr!

I've abandoned the OBD for the time being as my most of the things I wanted are on the VAN anyway.

Looking at the haynes diags and matching them to the wiring in my car though I still think its KWP2000 for the OBD as the connections match the pins defined for Kline...

I am curious if anyone knows about the other pins in the OBD connector... things like the cooling fan line are quite straight forward but the likes of the wires to the ABS & power seats I wonder if they are simple DC controls or if they hide a serial bus of some sort?

I managed to download half of a Peugeot Planet software CD image - obviously corrupt but looking through the image by hand I found lots of interesting text about the VAN and configurable options - a non corrupt CD image would be nice, as would the whole interface

But I digress;

Last night I took another look at my capture file and was able to decode a few more packets, this time to do with the sat-nav unit, I've added a page to my site listing the message ID's and roughly what data is in them (that I know about). I'll get the detailed info for each message up after the weekend. Sadly I shall be spending my weekend replacing the handbrake cable to the left wheel if it stays dry

[auldy]

I've updated the info on my VAN pages:
http://graham.auld.me.uk/projects/vanbus/protocol.html now has links to another page that details the data sent by/requsted from each IDEN I know about so far...

[mjb]

ARGH I've GOT to make me an interface from your schematic! You don't fancy etching a pcb for me do you I've never gotten around to trying to do one before, and I doubt trying to do one for smd components would be a sane first attempt

One thing to consider (I haven't looked at this yet) is that some of your undecoded data may be a time delta, perhaps from 1999-01-01 00:00:00 which my trip computer defaults to?

have you figured out the checksum yet, or have I got something to play with tomorrow?

[auldy]

I was considering if it would be worth getting a few more boards milled and selling the PCB's populated or not. As you say though, the soldering is a bit tricky if you're not practiced at fine SMT work so I should probably be thinking about selling finished boards as the USB-serial chip is not avaliable in anything but SMT. I'll have a look at component costs this week and see how viable it is for me to put some together.

Hadn't thought of a time delta, perhaps.

The checksum is detailed in the Atmel datalink controller datasheet http://atmel.com/dyn/resources/prod_doc ... oc7615.pdf

This field is a 15 bit CRC checksum defined by the following generator
polynomial g(x) of order 15:
g(x) = x15 + x11 + x10 + x9 + x8 + x7 + x4 + x3 + x2 + 1
The division is done with a rest initialized to 0x7FFF, and an inversion of the CRC bits is performed
before transmission.

If you are familliar with the CRC8 checksum used in the Dallas one-wire protocol it's similar only it uses 15 bits rather than 8.
This can be implimented fairly easily in hardware with shifting and XORing.

I've not got round to checking I can calculate checksums made from 15 bit CRC's correctly but it does need doing at some point. Particularly because on the line it's the LSB that is missing (replaced by the ACK segment) whereas it would seem that during calculation it's the MSB that is not implimented. I suspect that the CRC is left shifted before transmission but that is yet to be checked.

I've got another few hundred K of log files taken tonight where I'm looking for key insertion & position, cabin courtesy lights and electric window control so with any luck I should have another update once I've looked at them tomorrow evening.

[mjb]

[quote="auldy"]I was considering if it would be worth getting a few more boards milled and selling the PCB's populated or not. As you say though, the soldering is a bit tricky if you're not practiced at fine SMT work[quote]
hand-soldering stuff of any size to pcb's ain't too hard - it's trying to solder wires to smd chips because you can't make pcb's that's the killer (and way above my skill level )

[auldy]

ahh sorry, I misunderstood you.
If you're feeling flush there are always the ssop28 adapter boards from farnell http://uk.farnell.com/roth-elektronik/r ... dp/1426166
Alternatively I can get a few more PCB's of my design milled off if you are happy you can source and populate the components. I could probably supply those for £2.50 posted if you're interested?

[mjb]

Alternatively I can get a few more PCB's of my design milled off if you are happy you can source and populate the components. I could probably supply those for £2.50 posted if you're interested?

Absolutely! I'll take 2 of them.

Do you get them made up somewhere, or do you do them yourself?

[auldy]

I occasionally have the opportunity to put small boards on with other panels... I'll sort you a couple out ASAP

[mjb]

Just looking through my kernel source...

/usr/src/sys/dev/usb/usbdevs:

Code: Select all

vendor FTDI             0x0403  Future Technology Devices
product FTDI SERIAL_8U232AM     0x6001  8U232AM Serial

/usr/src/sys/dev/usb/uftdi.c:

Code: Select all

static int
uftdi_match(device_t self)
{
        if (uaa->vendor == USB_VENDOR_FTDI &&
            (uaa->product == USB_PRODUCT_FTDI_SERIAL_8U100AX ||
             uaa->product == USB_PRODUCT_FTDI_SERIAL_8U232AM ||
....
                return (UMATCH_VENDOR_PRODUCT);

SWEET I don't have to use Linux or port a badly written driver from it! Think I'll get me a Farnell order in today