The simplest of the three Caterham OBD port diagnostic protocols we know about is what I’ve called MBE-Broadcast.
As soon as the car is put into ignition switch position 2, the ECU starts to spit out a this stream of data on the CAN bus. Unlike the OBD-II protocol and the MBE-ISOTP protocol, this a not a request/response protocol…. the car “broadcasts” these CANbus frames all the time with no provocation from anything other than turning the car on.
The protocol is very simple and consists of individual CAN bus frames where the first byte is a message type. After the message byte are up to 7 more bytes containing the ECU data, as follows:
| CAN Bus Frame | ||||||||
| Byte Number | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
| Data Type | Message Type | D0 | D1 | D2 | D3 | D4 | D5 | D6 |
MBE-Broadcast CAN Bus Protocol Key Information
From Simon in Birmingham, Alabama, USA (sf4018 on Blatchat)…
Huge thanks to Simon for supplying this info. It had been on my list to take a look at but he knocked it out of the park with this analysis!
Simon also provided this info on his car in case it is useful for anyone else (he has a 420R Left-Hand-Drive):
MAP Sensor Technical Data (Bosch p/n 0261230044):
- Pressure Range: 0.1-1.15 Bar (i.e. measures vacuum)
- Voltage Limitation: 380-4700mV
MAP Scaling:
Extrapolating the technical data:
| Volts | Bar | kPa | Dec |
| 0.00 | 0.00 | 0 | 0 |
| 0.38 | 0.10 | 10 | |
| 4.70 | 1.15 | 115 | |
| 5.00 | 1.22 | 122 | 255 |
So scaling is 122/255 for kPA. Or 1.22/255 for Bar. So the scaling is correct, but doesn’t match what I was seeing from the CANbus sniffer (it was showing 200kPA/2 Bar when stopped which makes no sense).
Operation:
- Engine
- Stopped:
- ~ 1.0 Bar
- Engine Idling: 0.1-0.2 Bar (Throttle valve is closed, creating a vacuum).
- Throttle Open: Pressure increases with throttle position 0.1à0.9 Bar.
Example MBE-Broadcast Communication
Here’s some example CAN bus frames that we’ll decode from a running car. Notice that they are about 10ms apart and therefore they repeat every 80ms ms.
Time CAN ID Data 23.622742805 0x0cbb0001 ff 00 00 00 00 00 00 00 23.632726855 0x0cbb0001 ff 00 00 00 00 00 00 00 23.642685921 0x0cbb0001 ff 44 00 00 00 00 00 00 23.652859619 0x0cbb0001 ff b3 00 00 00 00 00 00 23.662872375 0x0cbb0001 04 b3 ff 28 00 00 00 00 23.673586904 0x0cbb0001 03 27 00 0d 00 0d 00 00 23.682952338 0x0cbb0001 02 87 87 00 df 35 00 00 23.692835008 0x0cbb0001 01 56 67 06 4a 6d a9 44 23.703545091 0x0cbb0001 ff 00 00 00 00 00 00 00 23.712846871 0x0cbb0001 ff 00 00 00 00 00 00 00 23.722881278 0x0cbb0001 ff 44 00 00 00 00 00 00 23.733459089 0x0cbb0001 ff aa 00 00 00 00 00 00 23.742902975 0x0cbb0001 04 aa ff 28 00 00 00 00 23.752933955 0x0cbb0001 03 27 00 0d 00 0d 00 00 23.763345214 0x0cbb0001 02 87 87 00 bf 35 00 00 23.772954746 0x0cbb0001 01 56 63 06 4a 6e b2 44
Unfortunately we don’t know yet what the messages starting with 0xff mean, hopefully we can come back to this post and update that info later.
Lets concentrate on the ones we know something about:
23.662872375 0x0cbb0001 04 b3 ff 28 00 00 00 00 23.673586904 0x0cbb0001 03 27 00 0d 00 0d 00 00 23.682952338 0x0cbb0001 02 87 87 00 df 35 00 00 23.692835008 0x0cbb0001 01 56 67 06 4a 6d a9 44
We only know anything at the moment about message types 1, 2 and 4:
Message Type 4:
| Byte 0 | Byte 1 | Byte 2 | Byte 3 | Byte 4 | Byte 5 | Byte 6 | Byte 7 |
| 4 | BAT2 | ? | ? | ||||
| Values | 0xb3 |
Message Type 2:
| Byte 0 | Byte 1 | Byte 2 | Byte 3 | Byte 4 | Byte 5 | Byte 6 | Byte 7 |
| 2 | ? | MAP | |||||
| Values | 0x35 |
Message Type 1:
| Byte 0 | Byte 1 | Byte 2 | Byte 3 | Byte 4 | Byte 5 | Byte 6 | Byte 7 |
| 1 | CT | RPML | RPMH | TP | CEL | BAT | IAT |
| Values | 0x56 | 0x67 | 0x06 | 0x4a | 0x6d | 0xa9 | 0x44 |
Now feeding those values into the offset and scale table:
| Data List | |||||
| Data Variable | Units | Scale | Value | Result | |
| TP | Throttle Position | % | 100/255 | 0x4a | 29% |
| CEL | Calculated Engine Load | % | 100/255 | 0x6d | 42% |
| CT | Coolant Temp | C | (160/255)-30 | 0x56 | 23.9C |
| RPM | Engine Speed | RPM | (256*H)+L | 0x667 | 1639 |
| IAT | Intake Air Temp | C | (160/255)-30 | 0x44 | 12.67C |
| MAP | Manifold Pressure | kPA | 120/255 | 0x35 | 24.9kPA |
| BAT | Battery Volts | V | (16/255)+2.5 | 0xa9 | 13.1V |
This compares well with the data taken in the same packet capture and requested by Easimap using the MBE ISOTP protocol:
RT_BAROFUELCOMP=3.5294 ( Barometric Pressure Fuel Compensation ) RT_CRANKCOUNT=1.414e+04 - ( Crank Count ) RT_ENGINERUNTIME=3.9094e+04 Hours ( ERT ) RT_THROTTLEANGLE1(RAW)=1.4583 V ( Throttle Angle 1 (Raw) ) RT_AIRTEMP1(LIM)=13.07 ( Air Temp ) RT_COOLANTTEMP1(LIM)=23.914 ( Coolant Temp ) RT_COOLANTFUELFACTOR=21.828 ( Coolant Fuel Factor ) RT_AIRTEMPFUELFACTOR=4.3351 ( Air Temp Fuel Factor ) RT_THROTTLEANGLEINCREASING=1.4583 V ( Throttle Angle Increasing ) RT_TPSFUEL+TRIMBANK1=3.8709 ms ( TPS Fuel + Trim ) RT_TPSVSSPEEDIGN+TRIM1=16.513 ( TPS vs Speed Ign + Trim ) RT_THROTTLESITE1=6.8392 Site ( Throttle Site 1 ) RT_BAROSCALEDLIM=1.04 Bar ( Baro Pressure ) RT_ENGINESPEED=1639.0 RPM ( Engine Speed ) RT_BATTERYVOLTAGE(LIM)=13.281 V ( Battery Voltage ) RT_BATTERYVOLTAGECOMP=0.31295 ms ( Battery Voltage Comp ) RT_MAPPINGPOT1LIM=0.0015259 ( Mapping Pot 1 ) RT_MAPPINGPOT2LIM=0.0015259 ( Mapping Pot 2 )
Battery, RPM and the temperature readings match up well. But I’m not so sure about the barometric pressure readings, that’ll take a bit more investigation.
Leave a Comment