{"id":5004,"date":"2019-09-15T16:16:54","date_gmt":"2019-09-15T15:16:54","guid":{"rendered":"https:\/\/www.purplemeanie.co.uk\/?p=5004"},"modified":"2026-05-28T11:49:52","modified_gmt":"2026-05-28T10:49:52","slug":"ecu-diagnostics-part-9-the-easimap-protocol-theory","status":"publish","type":"post","link":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/15\/ecu-diagnostics-part-9-the-easimap-protocol-theory\/","title":{"rendered":"ECU Diagnostics – part 9 : The Easimap Protocol Theory"},"content":{"rendered":"\n

Ok. so we’ve set ourselves up to be able to look at what is going on with a Caterham diagnostics port, we’ve talked a bit about the theory of what we might see from the port and we’ve also seen that Easimap talks to the ECU using a higher level protocol called ISO 15765-2 (ISOTP)<\/a>. We also saw how Easimap is asking the ECU for its model and serial number<\/a>.<\/p>\n\n\n\n

Easimap Data Request Protocol<\/h3>\n\n\n\n

At about this time, we also made a bit of a leap in our understanding of the communications between Easimap and the car.<\/p>\n\n\n\n

We’d seen how Easimap sending 0x04000d to the car gave a response of the model and serial numbers (0xe4000d23394134626535333000). Notice how the first byte of the request is 0x04 and the first byte of the response is 0xe4. Seemed to me as though the response was echoing the 4 and setting some higher order bits creating a response code of 0xe4… Hmm…<\/p>\n\n\n\n

If we look further down the communications that Easimap sends to the car (with the default gauges and pages set in Easimap) then we can also see some patterns.<\/p>\n\n\n\n

It seemed to me that the first byte of the model\/serial request was going to be a message type (0x04 means get some config data).<\/p>\n\n\n\n

Looking through the next communications we see Easimap send:<\/p>\n\n\n\n

0x0100000000126667a8a9<\/pre>\n\n\n\n
and gets a response of:<\/p>\n\n\n\n
0x81aaaa1600<\/pre>\n\n\n\n
If we think back to the 0x04 and 0xe4, request\/response, of the model\/serial exchange then this new exchange looks like a request\/resonse of 0x01\/0x81. That’s the same sort of pattern… a request of 0x01 and a response with the topmost bit set. That’s starting to make sense, but what of all the other data?<\/p>\n\n\n\n
It was at about this time that James (Aerobod) had been looking at his car and had seen a pattern where there was an Lowest Significant Byte (LSB) and Most Significant Byte (MSB) being sent periodically that matched some of the data he was looking for.<\/p>\n\n\n\n
It then dawned on me that my previous hunch about pages and addresses in the EC2 files was starting to make sense. If we look at our request to the car of:<\/p>\n\n\n\n
0x0100000000126667a8a9<\/pre>\n\n\n\n
then the first byte we know about (0x01) and then there are some more bytes of 0x00 with a 0x12 next, that could a page. Then there are sequences of similar numbers 0x66 followed by 0x67, then 0xa8 followed by 0xa9. They could be addresses.<\/p>\n\n\n\n
I searched the EC2 file for 0x6667 and 0xa8a9 but there wasn’t anything that made sense.<\/p>\n\n\n\n
It then occurred to me that perhaps the pages and addresses in the EC2 file weren’t being used exactly as written in the file. And if James’ thinking about LSB and MSB was right then perhaps the 0x6667 was the LSB of the address in the EC2 file followed by the same LSB+1.<\/p>\n\n\n\n
With the data we have above that would mean we needed to look in the EC2 file for a variable with a page of 0x12 and address LSB of 0x66. A quick search in our EC2 file turns up:<\/p>\n\n\n\n
[RT_IGNITIONADVANCEBANK1]\nNumber of Dimensions = 0\nPage = 12\nAddress = 6766\nBytes per Cell = 2\n0 = SCALE_NADV<\/pre>\n\n\n\n
Some of the right data was present, the 12, 66 and 67 were there. And it seemed to indicate that this was related to Ignition Advance Bank1. Ok, that could be, our Caterhams could have something like that in them.<\/p>\n\n\n\n
Next was to look at the response from the car:<\/p>\n\n\n\n
0x81aaaa1600<\/pre>\n\n\n\n
We know that 0x81 is the response type for a request of 0x01. That leaves data of 0xaaaa1600. That’s probably 0xaaaa and 0x1600. Neither seemed to make much sense for an Ignition Advance Bank 1 response. It could be right, it could be wrong.<\/p>\n\n\n\n
At this point I also started to pull apart the test.lsn file I’d found in the Easimap configuration directories on the PC. That file seemed to be the setup Easimap was using to say what gauges and displays to put on the screen for each “page” of the software display. It had a section like this:<\/p>\n\n\n\n
[Parameters]\nRT_THROTTLESITE1, Throttle Position|Throttle Position Limits and Default Setup, Throttle Site 1\nRT_BATTERYVOLTAGECOMP, Fuel|Voltage Fuel Compensation, Battery Voltage Comp\nRT_ENGINESPEED, Engine Speed Setup & Limiter, Engine Speed\nRT_IGNITIONADVANCEBANK1, Ignition, Ignition Advance\nRT_TPSVSSPEEDIGN+TRIM1, Ignition, TPS vs Speed Ign + Trim\nRT_INJECTIONTIMEA, Fuel, Final Injection Time\nRT_COOLANTTEMP1(LIM), Sensors|Coolant Temperature, Coolant Temp\nRT_AIRTEMP1(LIM), Sensors|Air Temperature, Air Temp\nRT_MAPPINGPOT1LIM, Mapping Box|Mapping Pot 1, Mapping Pot 1\nRT_MAPPINGPOT2LIM, Mapping Box|Mapping Pot 2, Mapping Pot 2\nRT_COOLANTFUELFACTOR, Fuel|Coolant Temperature Compensation, Coolant Fuel Factor\nRT_BATTERYVOLTAGE(LIM), Sensors|Battery Voltage, Battery Voltage\nRT_AIRTEMPFUELFACTOR, Fuel|Air Temperature Compensation, Air Temp Fuel Factor\nRT_DUTYCYCLEA, Fuel|Duty Cycle, Duty Cycle\nRT_TPSFUEL+TRIMBANK1, Fuel, TPS Fuel + Trim\nRT_SOFTCUTTIME, Engine Speed Setup & Limiter, Soft Cut\nRT_HARDCUTTIME, Engine Speed Setup & Limiter, Hard Cut\nRT_THROTTLEANGLE1(RAW), Throttle Position|Throttle Position Limits and Default Setup, Throttle Angle 1 (Raw)\nRT_ENGINERUNTIME, Data Logging, ERT\nRT_ECUSTATUS, Fault Conditions, ECU Status\nRT_BAROSCALEDLIM, Sensors|Barometric Pressure, Baro Pressure\nRT_THROTTLEANGLEINCREASING, Throttle Position|Throttle Position Limits and Default Setup, Throttle Angle Increasing\nRT_BAROFUELCOMP, Fuel|Barometric Pressure Fuel Compensation, Barometric Pressure Fuel Compensation\nRT_CRANKCOUNT, Development, Crank Count<\/pre>\n\n\n\n
That was clearly a list of variables (in upper case) that Easimap was going to request data for from the car.<\/p>\n\n\n\n
And an obvious candidate for a search in there was RT_ENGINESPEED, or Engine RPMs. I knew that I’d not had the car engine running when I did my packet captures, so there was a good chance that if I found the request for RPM then I could see a response of with zeros back from the car.<\/p>\n\n\n\n
Looking in the EC2 file, you can find definition of RPM variable as:<\/p>\n\n\n\n
[RT_ENGINESPEED]\nNumber of Dimensions = 0\nPage = F8\nAddress = 237C\nBytes per Cell = 2\n0 = SCALE_ENGINESPEED<\/pre>\n\n\n\n
Ok. So, we’ll looking for a request with a page of 0xf8 and an address that’s either 0x237c or possibly 0x7c7d.<\/p>\n\n\n\n
Looking through the CAN bus as ISOTP output again we find this request:<\/p>\n\n\n\n
0100000000f83031363744454c4d4e4f50515a5b5c5d646a6b7c7d9e9fa0a1d8d9dadb<\/pre>\n\n\n\n
and this response:<\/p>\n\n\n\n
814e39094a9c52b886e8844e39a80d70a000b04f00005695800900800080<\/pre>\n\n\n\n
In the request there’s the 0x01 at that start that is some kind of data request and the corresponding 0x81 in the response. We then see 0xf8 after the 4 x 0x00’s. Ok, that’s looking good, we’re looking for a page of 0xf8 for RT_ENGINESPEED.<\/p>\n\n\n\n
We can also see that 3\/4 of the way along the request we can see 0x7c7d. If we break the request down into the bit at the start (pre-amble) of 0x0100000000f8 and then the pairs that could be LSB\/MSB combinations, then we get this:<\/p>\n\n\n\n
0100000000f8\n3031\n3637\n4445\n4c4d\n4e4f\n5051\n5a5b\n5c5d\n64\n6a6b\n7c7d\n9e9f\na0a1\nd8d9\ndadb<\/pre>\n\n\n\n
That’s all looking good for the LSB\/MSB theory of LSB\/LSB+1 and shows us that 0x7c7d is 19 bytes into the data section. I also took note that some data being requested has only one byte of request information… I’ll need to remember that later.<\/p>\n\n\n\n
Now if we look at the response from the car and break it down like the request data and slot in the request data on the left:<\/p>\n\n\n\n
 Request         Response\n 0100000000f8 =  81\n 3031         =  4e39\n 3637         =  094a\n 4445         =  9c52\n 4c4d         =  b886\n 4e4f         =  e884\n 5051         =  4e39\n 5a5b         =  a80d\n 5c5d         =  70a0\n 64           =  00\n 6a6b         =  b04f\n[7c7d         =  0000]\n 9e9f         =  5695\n a0a1         =  8009\n d8d9         =  0080\n dadb         =  0080<\/pre>\n\n\n\n
Then… low and behold… where I’ve put brackets around the line, we can see that our theory about RT_ENGINESPEED needing a request of 0x7c7d is returning 0x0000 in exactly the right spot in the response… showing that the car isn’t running.<\/p>\n\n\n\n
That’s good enough for me… I think my theory is as good as I’m going to get, I need to write some code to test this out.<\/p>\n","protected":false},"excerpt":{"rendered":"
Develops a theory for the Easimap request and response protocol by analysing Caterham MBE ECU messages captured from the CAN bus.<\/p>\n","protected":false},"author":1,"featured_media":5042,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[20],"tags":[58,66,34,60],"class_list":["post-5004","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ecu-diagnostics","tag-can-bus","tag-caterham","tag-ecu-diagnostics","tag-mbe"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Part-9-Banner.png","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p8yl38-1iI","jetpack-related-posts":[{"id":5112,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/20\/ecu-diagnostics-part-13-three-diagnostic-protocols-in-the-mbe-9a4-ecu\/","url_meta":{"origin":5004,"position":0},"title":"ECU Diagnostics – part 13 : Three Diagnostic Protocols in the MBE 9A4 ECU","author":"John Martin","date":"September 20, 2019","format":false,"excerpt":"Introduces the three diagnostic protocols found on the Caterham MBE 9A4 ECU: MBE-Broadcast, OBD-II, and the MBE ISO-TP protocol used by Easimap.","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":5086,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/16\/ecu-diagnostics-part-12-osi-7-layers-for-caterham-diagnostics\/","url_meta":{"origin":5004,"position":1},"title":"ECU Diagnostics – part 12 : OSI 7 Layers for Caterham Diagnostics","author":"John Martin","date":"September 16, 2019","format":false,"excerpt":"Maps the Caterham diagnostics stack onto the OSI model, from CAN bus hardware through MBE ISO-TP layers up to Python tooling and applications.","rel":"","context":"In "ECU Diagnostics"","block_context":{"text":"ECU Diagnostics","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/ecu-diagnostics\/"},"img":{"alt_text":"Layered diagram mapping the MBE ECU protocol stack to OSI layers and CAN bus.","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":4726,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/08\/31\/ecu-diagnostics-part-1-introduction\/","url_meta":{"origin":5004,"position":2},"title":"ECU Diagnostics – part 1 : Introduction","author":"John Martin","date":"August 31, 2019","format":false,"excerpt":"Introduction and index for the Caterham ECU diagnostics series, covering MBE ECU traffic, CAN bus, OBD-II, ISO-TP, test setup, protocol decoding, and supporting Python and Wireshark tooling.","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":5155,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/20\/ecu-diagnostics-part-13-3-mbe-isotp\/","url_meta":{"origin":5004,"position":3},"title":"ECU Diagnostics – part 13.3 : MBE-ISOTP","author":"John Martin","date":"September 20, 2019","format":false,"excerpt":"Describes the MBE ISO-TP style protocol used by Easimap to request data from the Caterham ECU and turn the responses into useful diagnostics.","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":4943,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/07\/ecu-diagnostics-part-5-the-correlator-dead-end\/","url_meta":{"origin":5004,"position":4},"title":"ECU Diagnostics – part 5 : The Correlator Dead-end","author":"John Martin","date":"September 7, 2019","format":false,"excerpt":"Records an abandoned attempt to correlate Easimap data with CAN bus captures while reverse-engineering the Caterham MBE ECU protocol.","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":4769,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/01\/ecu-diagnostics-part-3-test-setup\/","url_meta":{"origin":5004,"position":5},"title":"ECU Diagnostics – part 3 : Test Setup","author":"John Martin","date":"September 1, 2019","format":false,"excerpt":"Sets up the Caterham ECU diagnostics test rig using the OBD port, Raspberry Pi, PiCAN interface, Easimap, and CAN bus capture hardware.","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"Diagram linking Raspberry Pi, PiCAN, MBE 9A4 ECU, and a laptop running Easimap.","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/Test-Setup-Diagram.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/Test-Setup-Diagram.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/Test-Setup-Diagram.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/Test-Setup-Diagram.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/Test-Setup-Diagram.png?resize=1050%2C600&ssl=1 3x"},"classes":[]}],"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/5004","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=5004"}],"version-history":[{"count":1,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/5004\/revisions"}],"predecessor-version":[{"id":11509,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/5004\/revisions\/11509"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/media\/5042"}],"wp:attachment":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=5004"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/categories?post=5004"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/tags?post=5004"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}