{"id":5004,"date":"2019-09-15T16:16:54","date_gmt":"2019-09-15T15:16:54","guid":{"rendered":"https:\/\/www.purplemeanie.co.uk\/?p=5004"},"modified":"2020-08-13T15:00:04","modified_gmt":"2020-08-13T14:00:04","slug":"ecu-diagnostics-part-9-the-easimap-protocol-theory","status":"publish","type":"post","link":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/15\/ecu-diagnostics-part-9-the-easimap-protocol-theory\/","title":{"rendered":"ECU Diagnostics – part 9 : The Easimap Protocol Theory"},"content":{"rendered":"\n

Ok. so we’ve set ourselves up to be able to look at what is going on with a Caterham diagnostics port, we’ve talked a bit about the theory of what we might see from the port and we’ve also seen that Easimap talks to the ECU using a higher level protocol called ISO 15765-2 (ISOTP)<\/a>. We also saw how Easimap is asking the ECU for its model and serial number<\/a>.<\/p>\n\n\n\n

Easimap Data Request Protocol<\/h3>\n\n\n\n

At about this time, we also made a bit of a leap in our understanding of the communications between Easimap and the car.<\/p>\n\n\n\n

We’d seen how Easimap sending 0x04000d to the car gave a response of the model and serial numbers (0xe4000d23394134626535333000). Notice how the first byte of the request is 0x04 and the first byte of the response is 0xe4. Seemed to me as though the response was echoing the 4 and setting some higher order bits creating a response code of 0xe4… Hmm…<\/p>\n\n\n\n

If we look further down the communications that Easimap sends to the car (with the default gauges and pages set in Easimap) then we can also see some patterns.<\/p>\n\n\n\n

It seemed to me that the first byte of the model\/serial request was going to be a message type (0x04 means get some config data).<\/p>\n\n\n\n

Looking through the next communications we see Easimap send:<\/p>\n\n\n\n

0x0100000000126667a8a9<\/pre>\n\n\n\n
and gets a response of:<\/p>\n\n\n\n
0x81aaaa1600<\/pre>\n\n\n\n
If we think back to the 0x04 and 0xe4, request\/response, of the model\/serial exchange then this new exchange looks like a request\/resonse of 0x01\/0x81. That’s the same sort of pattern… a request of 0x01 and a response with the topmost bit set. That’s starting to make sense, but what of all the other data?<\/p>\n\n\n\n
It was at about this time that James (Aerobod) had been looking at his car and had seen a pattern where there was an Lowest Significant Byte (LSB) and Most Significant Byte (MSB) being sent periodically that matched some of the data he was looking for.<\/p>\n\n\n\n
It then dawned on me that my previous hunch about pages and addresses in the EC2 files was starting to make sense. If we look at our request to the car of:<\/p>\n\n\n\n
0x0100000000126667a8a9<\/pre>\n\n\n\n
then the first byte we know about (0x01) and then there are some more bytes of 0x00 with a 0x12 next, that could a page. Then there are sequences of similar numbers 0x66 followed by 0x67, then 0xa8 followed by 0xa9. They could be addresses.<\/p>\n\n\n\n
I searched the EC2 file for 0x6667 and 0xa8a9 but there wasn’t anything that made sense.<\/p>\n\n\n\n
It then occurred to me that perhaps the pages and addresses in the EC2 file weren’t being used exactly as written in the file. And if James’ thinking about LSB and MSB was right then perhaps the 0x6667 was the LSB of the address in the EC2 file followed by the same LSB+1.<\/p>\n\n\n\n
With the data we have above that would mean we needed to look in the EC2 file for a variable with a page of 0x12 and address LSB of 0x66. A quick search in our EC2 file turns up:<\/p>\n\n\n\n
[RT_IGNITIONADVANCEBANK1]\nNumber of Dimensions = 0\nPage = 12\nAddress = 6766\nBytes per Cell = 2\n0 = SCALE_NADV<\/pre>\n\n\n\n
Some of the right data was present, the 12, 66 and 67 were there. And it seemed to indicate that this was related to Ignition Advance Bank1. Ok, that could be, our Caterhams could have something like that in them.<\/p>\n\n\n\n
Next was to look at the response from the car:<\/p>\n\n\n\n
0x81aaaa1600<\/pre>\n\n\n\n
We know that 0x81 is the response type for a request of 0x01. That leaves data of 0xaaaa1600. That’s probably 0xaaaa and 0x1600. Neither seemed to make much sense for an Ignition Advance Bank 1 response. It could be right, it could be wrong.<\/p>\n\n\n\n
At this point I also started to pull apart the test.lsn file I’d found in the Easimap configuration directories on the PC. That file seemed to be the setup Easimap was using to say what gauges and displays to put on the screen for each “page” of the software display. It had a section like this:<\/p>\n\n\n\n
[Parameters]\nRT_THROTTLESITE1, Throttle Position|Throttle Position Limits and Default Setup, Throttle Site 1\nRT_BATTERYVOLTAGECOMP, Fuel|Voltage Fuel Compensation, Battery Voltage Comp\nRT_ENGINESPEED, Engine Speed Setup & Limiter, Engine Speed\nRT_IGNITIONADVANCEBANK1, Ignition, Ignition Advance\nRT_TPSVSSPEEDIGN+TRIM1, Ignition, TPS vs Speed Ign + Trim\nRT_INJECTIONTIMEA, Fuel, Final Injection Time\nRT_COOLANTTEMP1(LIM), Sensors|Coolant Temperature, Coolant Temp\nRT_AIRTEMP1(LIM), Sensors|Air Temperature, Air Temp\nRT_MAPPINGPOT1LIM, Mapping Box|Mapping Pot 1, Mapping Pot 1\nRT_MAPPINGPOT2LIM, Mapping Box|Mapping Pot 2, Mapping Pot 2\nRT_COOLANTFUELFACTOR, Fuel|Coolant Temperature Compensation, Coolant Fuel Factor\nRT_BATTERYVOLTAGE(LIM), Sensors|Battery Voltage, Battery Voltage\nRT_AIRTEMPFUELFACTOR, Fuel|Air Temperature Compensation, Air Temp Fuel Factor\nRT_DUTYCYCLEA, Fuel|Duty Cycle, Duty Cycle\nRT_TPSFUEL+TRIMBANK1, Fuel, TPS Fuel + Trim\nRT_SOFTCUTTIME, Engine Speed Setup & Limiter, Soft Cut\nRT_HARDCUTTIME, Engine Speed Setup & Limiter, Hard Cut\nRT_THROTTLEANGLE1(RAW), Throttle Position|Throttle Position Limits and Default Setup, Throttle Angle 1 (Raw)\nRT_ENGINERUNTIME, Data Logging, ERT\nRT_ECUSTATUS, Fault Conditions, ECU Status\nRT_BAROSCALEDLIM, Sensors|Barometric Pressure, Baro Pressure\nRT_THROTTLEANGLEINCREASING, Throttle Position|Throttle Position Limits and Default Setup, Throttle Angle Increasing\nRT_BAROFUELCOMP, Fuel|Barometric Pressure Fuel Compensation, Barometric Pressure Fuel Compensation\nRT_CRANKCOUNT, Development, Crank Count<\/pre>\n\n\n\n
That was clearly a list of variables (in upper case) that Easimap was going to request data for from the car.<\/p>\n\n\n\n
And an obvious candidate for a search in there was RT_ENGINESPEED, or Engine RPMs. I knew that I’d not had the car engine running when I did my packet captures, so there was a good chance that if I found the request for RPM then I could see a response of with zeros back from the car.<\/p>\n\n\n\n
Looking in the EC2 file, you can find definition of RPM variable as:<\/p>\n\n\n\n
[RT_ENGINESPEED]\nNumber of Dimensions = 0\nPage = F8\nAddress = 237C\nBytes per Cell = 2\n0 = SCALE_ENGINESPEED<\/pre>\n\n\n\n
Ok. So, we’ll looking for a request with a page of 0xf8 and an address that’s either 0x237c or possibly 0x7c7d.<\/p>\n\n\n\n
Looking through the CAN bus as ISOTP output again we find this request:<\/p>\n\n\n\n
0100000000f83031363744454c4d4e4f50515a5b5c5d646a6b7c7d9e9fa0a1d8d9dadb<\/pre>\n\n\n\n
and this response:<\/p>\n\n\n\n
814e39094a9c52b886e8844e39a80d70a000b04f00005695800900800080<\/pre>\n\n\n\n
In the request there’s the 0x01 at that start that is some kind of data request and the corresponding 0x81 in the response. We then see 0xf8 after the 4 x 0x00’s. Ok, that’s looking good, we’re looking for a page of 0xf8 for RT_ENGINESPEED.<\/p>\n\n\n\n
We can also see that 3\/4 of the way along the request we can see 0x7c7d. If we break the request down into the bit at the start (pre-amble) of 0x0100000000f8 and then the pairs that could be LSB\/MSB combinations, then we get this:<\/p>\n\n\n\n
0100000000f8\n3031\n3637\n4445\n4c4d\n4e4f\n5051\n5a5b\n5c5d\n64\n6a6b\n7c7d\n9e9f\na0a1\nd8d9\ndadb<\/pre>\n\n\n\n
That’s all looking good for the LSB\/MSB theory of LSB\/LSB+1 and shows us that 0x7c7d is 19 bytes into the data section. I also took note that some data being requested has only one byte of request information… I’ll need to remember that later.<\/p>\n\n\n\n
Now if we look at the response from the car and break it down like the request data and slot in the request data on the left:<\/p>\n\n\n\n
 Request         Response\n 0100000000f8 =  81\n 3031         =  4e39\n 3637         =  094a\n 4445         =  9c52\n 4c4d         =  b886\n 4e4f         =  e884\n 5051         =  4e39\n 5a5b         =  a80d\n 5c5d         =  70a0\n 64           =  00\n 6a6b         =  b04f\n[7c7d         =  0000]\n 9e9f         =  5695\n a0a1         =  8009\n d8d9         =  0080\n dadb         =  0080<\/pre>\n\n\n\n
Then… low and behold… where I’ve put brackets around the line, we can see that our theory about RT_ENGINESPEED needing a request of 0x7c7d is returning 0x0000 in exactly the right spot in the response… showing that the car isn’t running.<\/p>\n\n\n\n
That’s good enough for me… I think my theory is as good as I’m going to get, I need to write some code to test this out.<\/p>\n","protected":false},"excerpt":{"rendered":"
Ok. so we’ve set ourselves up to be able to look at what is going on with a Caterham diagnostics port, we’ve talked a bit about the theory of what we might see from the port and we’ve also seen that Easimap talks to the ECU using a higher level protocol called ISO 15765-2 (ISOTP). […]<\/p>\n","protected":false},"author":1,"featured_media":5042,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[20],"tags":[34],"class_list":["post-5004","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ecu-diagnostics","tag-ecu-diagnostics"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Part-9-Banner.png","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p8yl38-1iI","jetpack-related-posts":[{"id":4943,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/07\/ecu-diagnostics-part-5-the-correlator-dead-end\/","url_meta":{"origin":5004,"position":0},"title":"ECU Diagnostics – part 5 : The Correlator Dead-end","author":"John Martin","date":"September 7, 2019","format":false,"excerpt":"Hopefully this is a quick post... The story so far is that: We've got a test bench made of a Raspberry Pi, CAN bus decoder board and an OBD Y-cableThe Raspberry Pi can \"sniff\" all the packets sent between the car's ECU and something that can talk to the car,\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":4726,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/08\/31\/ecu-diagnostics-part-1-introduction\/","url_meta":{"origin":5004,"position":1},"title":"ECU Diagnostics – part 1 : Introduction","author":"John Martin","date":"August 31, 2019","format":false,"excerpt":"So here we go for a marathon series of posts. I'll update this page with links to the completed posts as they come along... IntroductionECUs, OBD and CANTest SetupWireshark Patching and OBD-II ResultsThe Correlator Dead-EndReading MaterialECU Maps and MappingEasimap uses ISOTP (sort of)The Easimap Protocol TheoryDecoding EC2 FilesLogic Analyzer on\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":5008,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/15\/ecu-diagnostics-part-8-easimap-uses-isotp\/","url_meta":{"origin":5004,"position":2},"title":"ECU Diagnostics – part 8 : Easimap uses ISOTP (sort of)","author":"John Martin","date":"September 15, 2019","format":false,"excerpt":"Ok, that's enough of the theory about mapping. Lets get back to what Easimap is doing when it talks to the car. When we left this subject last we had got to the point where we could see what Easimap was sending and receiving on the CAN bus, but we\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/CANBus-Header-Diagram.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/CANBus-Header-Diagram.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/CANBus-Header-Diagram.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/CANBus-Header-Diagram.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/CANBus-Header-Diagram.png?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":5155,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/20\/ecu-diagnostics-part-13-3-mbe-isotp\/","url_meta":{"origin":5004,"position":3},"title":"ECU Diagnostics – part 13.3 : MBE-ISOTP","author":"John Martin","date":"September 20, 2019","format":false,"excerpt":"SUMMARY We now understand the communications protocol used by Easimap (the Windows software supplied by the ECU manufacturer) and can use it to ask the ECU for whatever data the car has to offer. We can then manipulate the responses we get back from the car and format them to\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":4769,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/01\/ecu-diagnostics-part-3-test-setup\/","url_meta":{"origin":5004,"position":4},"title":"ECU Diagnostics – part 3 : Test Setup","author":"John Martin","date":"September 1, 2019","format":false,"excerpt":"Ok, so we have an OBD port\/connector on our cars that connects directly to the ECU. How are we going to figure out how to talk the right communications protocols to the car to get at its internal data? We need a test rig to do some experiments with. If\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/Test-Setup-Diagram.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/Test-Setup-Diagram.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/Test-Setup-Diagram.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/Test-Setup-Diagram.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/Test-Setup-Diagram.png?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":5086,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/16\/ecu-diagnostics-part-12-osi-7-layers-for-caterham-diagnostics\/","url_meta":{"origin":5004,"position":5},"title":"ECU Diagnostics – part 12 : OSI 7 Layers for Caterham Diagnostics","author":"John Martin","date":"September 16, 2019","format":false,"excerpt":"Communications protocols are often called protocol stacks... they're layers, or stacks, of different protocols... one layered on top of the other from lowest level (hardware\/physical) to highest level (software application). This is where the OSI 7 Layer model comes in... it standardises how we think about the layers and allows\u2026","rel":"","context":"In "ECU Diagnostics"","block_context":{"text":"ECU Diagnostics","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/ecu-diagnostics\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=1050%2C600&ssl=1 3x"},"classes":[]}],"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/5004","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=5004"}],"version-history":[{"count":0,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/5004\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/media\/5042"}],"wp:attachment":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=5004"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/categories?post=5004"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/tags?post=5004"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}