{"id":5119,"date":"2019-09-20T09:00:48","date_gmt":"2019-09-20T08:00:48","guid":{"rendered":"https:\/\/www.purplemeanie.co.uk\/?p=5119"},"modified":"2025-01-31T13:08:20","modified_gmt":"2025-01-31T13:08:20","slug":"ecu-diagnostics-part-13-1-mbe-broadcast","status":"publish","type":"post","link":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/20\/ecu-diagnostics-part-13-1-mbe-broadcast\/","title":{"rendered":"ECU Diagnostics – part 13.1 : MBE-Broadcast"},"content":{"rendered":"\n

The simplest of the three Caterham OBD port diagnostic protocols we know about is what I’ve called MBE-Broadcast.<\/p>\n\n\n\n

As soon as the car is put into ignition switch position 2, the ECU starts to spit out a this stream of data on the CAN bus. Unlike the OBD-II protocol and the MBE-ISOTP protocol, this a not a request\/response protocol…. the car “broadcasts” these CANbus frames all the time with no provocation from anything other than turning the car on.<\/p>\n\n\n\n

The protocol is very simple and consists of individual CAN bus frames where the first byte is a message type. After the message byte are up to 7 more bytes containing the ECU data, as follows:<\/p>\n\n\n\n

CAN Bus
Frame<\/td>		<\/td><\/td><\/td><\/td><\/td><\/td><\/td><\/td><\/tr>
Byte
Number<\/td>		0<\/td>1<\/td>2<\/td>3<\/td>4<\/td>5<\/td>6<\/td>7<\/td><\/tr>
Data
Type<\/td>		Message
Type<\/td>		D0<\/td>D1<\/td>D2<\/td>D3<\/td>D4<\/td>D5<\/td>D6<\/td><\/tr><\/tbody><\/table>
Where D0-D6 are the data bytes<\/figcaption><\/figure>\n\n\n\n

MBE-Broadcast CAN Bus Protocol Key Information<\/h3>\n\n\n\n

From Simon in Birmingham, Alabama, USA (sf4018 on Blatchat)…<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Huge thanks to Simon for supplying this info. It had been on my list to take a look at but he knocked it out of the park with this analysis!<\/p>\n\n\n\n

Simon also provided this info on his car in case it is useful for anyone else (he has a 420R Left-Hand-Drive):<\/p>\n\n\n\n

MAP Sensor Technical Data (Bosch p\/n 0261230044):<\/strong><\/p>\n\n\n\n

  • Pressure Range: 0.1-1.15 Bar (i.e. measures vacuum)<\/li>
  • Voltage Limitation: 380-4700mV<\/li><\/ul>\n\n\n\n

    MAP Scaling:<\/strong><\/p>\n\n\n\n

    Extrapolating the technical data:<\/p>\n\n\n\n

    Volts<\/strong><\/td>Bar<\/strong><\/td>kPa<\/strong><\/td>Dec<\/strong><\/td><\/tr>
    0.00<\/span><\/td> 0.00<\/span><\/td>0<\/span><\/td> 0<\/span><\/td><\/tr>
    0.38<\/span> <\/span><\/td>0.10<\/span> <\/span><\/td>10<\/span><\/td><\/td><\/tr>
    4.70<\/span> <\/span><\/td>1.15<\/span> <\/span><\/td>115<\/span><\/td><\/td><\/tr>
    5.00<\/span><\/td>1.22<\/span> <\/span><\/td>122<\/span><\/td>255<\/span><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    So scaling is 122\/255 for kPA. Or 1.22\/255 for Bar. So the scaling is correct, but doesn\u2019t match what I was seeing from the CANbus sniffer (it was showing 200kPA\/2 Bar when stopped which makes no sense).<\/p>\n\n\n\n

    Operation:<\/strong><\/p>\n\n\n\n

    • Engine<\/li>
    • Stopped:<\/li>
    • ~ 1.0 Bar<\/li>
    • Engine Idling: 0.1-0.2 Bar (Throttle valve is closed, creating a vacuum).<\/li>
    • Throttle Open: Pressure increases with throttle position 0.1\u00e00.9 Bar.<\/li><\/ul>\n\n\n\n

      Example MBE-Broadcast Communication<\/h3>\n\n\n\n

      Here’s some example CAN bus frames that we’ll decode from a running car. Notice that they are about 10ms apart and therefore they repeat every 80ms ms.<\/p>\n\n\n\n

      Time         CAN ID     Data\n23.622742805 0x0cbb0001 ff 00 00 00 00 00 00 00\n23.632726855 0x0cbb0001 ff 00 00 00 00 00 00 00\n23.642685921 0x0cbb0001 ff 44 00 00 00 00 00 00\n23.652859619 0x0cbb0001 ff b3 00 00 00 00 00 00\n23.662872375 0x0cbb0001 04 b3 ff 28 00 00 00 00\n23.673586904 0x0cbb0001 03 27 00 0d 00 0d 00 00\n23.682952338 0x0cbb0001 02 87 87 00 df 35 00 00\n23.692835008 0x0cbb0001 01 56 67 06 4a 6d a9 44\n23.703545091 0x0cbb0001 ff 00 00 00 00 00 00 00\n23.712846871 0x0cbb0001 ff 00 00 00 00 00 00 00\n23.722881278 0x0cbb0001 ff 44 00 00 00 00 00 00\n23.733459089 0x0cbb0001 ff aa 00 00 00 00 00 00\n23.742902975 0x0cbb0001 04 aa ff 28 00 00 00 00\n23.752933955 0x0cbb0001 03 27 00 0d 00 0d 00 00\n23.763345214 0x0cbb0001 02 87 87 00 bf 35 00 00\n23.772954746 0x0cbb0001 01 56 63 06 4a 6e b2 44<\/pre>\n\n\n\n
      Unfortunately we don’t know yet what the messages starting with 0xff mean, hopefully we can come back to this post and update that info later.<\/p>\n\n\n\n
      Lets concentrate on the ones we know something about:<\/p>\n\n\n\n
      23.662872375 0x0cbb0001 04 b3 ff 28 00 00 00 00 \n23.673586904 0x0cbb0001 03 27 00 0d 00 0d 00 00 \n23.682952338 0x0cbb0001 02 87 87 00 df 35 00 00 \n23.692835008 0x0cbb0001 01 56 67 06 4a 6d a9 44<\/pre>\n\n\n\n
      We only know anything at the moment about message types 1, 2 and 4:<\/p>\n\n\n\n
      Message Type 4:<\/p>\n\n\n\n
      Byte 0<\/td>Byte 1<\/td>Byte 2<\/td>Byte 3<\/td>Byte 4<\/td>Byte 5<\/td>Byte 6<\/td>Byte 7<\/td><\/tr>
      4<\/td>BAT2<\/td>?<\/td>?<\/td> <\/td> <\/td> <\/td> <\/td><\/tr>
      Values<\/td>0xb3<\/td> <\/td> <\/td> <\/td> <\/td> <\/td> <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      Message Type 2:<\/p>\n\n\n\n
      Byte 0<\/td>Byte 1<\/td>Byte 2<\/td>Byte 3<\/td>Byte 4<\/td>Byte 5<\/td>Byte 6<\/td>Byte 7<\/td><\/tr>
      2<\/td> <\/td> <\/td> <\/td>?<\/td>MAP<\/td> <\/td> <\/td><\/tr>
      Values<\/td> <\/td> <\/td> <\/td> <\/td>0x35<\/td> <\/td> <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      Message Type 1:<\/p>\n\n\n\n
      Byte 0<\/td>Byte 1<\/td>Byte 2<\/td>Byte 3<\/td>Byte 4<\/td>Byte 5<\/td>Byte 6<\/td>Byte 7<\/td><\/tr>
      1<\/td>CT<\/td>RPML<\/td>RPMH<\/td>TP<\/td>CEL<\/td>BAT<\/td>IAT<\/td><\/tr>
      Values<\/td>0x56<\/td>0x67<\/td>0x06<\/td>0x4a<\/td>0x6d<\/td>0xa9<\/td>0x44<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      Now feeding those values into the offset and scale table:<\/p>\n\n\n\n
      Data List<\/strong><\/td> <\/td> <\/td> <\/td><\/tr>
       <\/td>Data Variable<\/strong><\/td>Units<\/strong><\/td>Scale<\/strong><\/td>Value<\/strong><\/td>Result<\/strong><\/td><\/tr>
      TP<\/td>Throttle Position<\/td>%<\/td>100\/255<\/td>0x4a<\/td>29%<\/td><\/tr>
      CEL<\/td>Calculated Engine Load<\/td>%<\/td>100\/255<\/td>0x6d<\/td>42%<\/td><\/tr>
      CT<\/td>Coolant Temp<\/td>C<\/td>(160\/255)-30<\/td>0x56<\/td>23.9C<\/td><\/tr>
      RPM<\/td>Engine Speed<\/td>RPM<\/td>(256*H)+L<\/td>0x667<\/td>1639<\/td><\/tr>
      IAT<\/td>Intake Air Temp<\/td>C<\/td>(160\/255)-30<\/td>0x44<\/td>12.67C<\/td><\/tr>
      MAP<\/td>Manifold Pressure<\/td>kPA<\/td>120\/255<\/td>0x35<\/td>24.9kPA<\/td><\/tr>
      BAT<\/td>Battery Volts<\/td>V<\/td>(16\/255)+2.5<\/td>0xa9<\/td>13.1V<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      This compares well with the data taken in the same packet capture and requested by Easimap using the MBE ISOTP protocol:<\/p>\n\n\n\n
      RT_BAROFUELCOMP=3.5294 ( Barometric Pressure Fuel Compensation )\nRT_CRANKCOUNT=1.414e+04 - ( Crank Count )\nRT_ENGINERUNTIME=3.9094e+04 Hours ( ERT )\nRT_THROTTLEANGLE1(RAW)=1.4583 V ( Throttle Angle 1 (Raw) )\nRT_AIRTEMP1(LIM)=13.07 ( Air Temp )\nRT_COOLANTTEMP1(LIM)=23.914 ( Coolant Temp )\nRT_COOLANTFUELFACTOR=21.828 ( Coolant Fuel Factor )\nRT_AIRTEMPFUELFACTOR=4.3351 ( Air Temp Fuel Factor )\nRT_THROTTLEANGLEINCREASING=1.4583 V ( Throttle Angle Increasing )\nRT_TPSFUEL+TRIMBANK1=3.8709 ms ( TPS Fuel + Trim )\nRT_TPSVSSPEEDIGN+TRIM1=16.513 ( TPS vs Speed Ign + Trim )\nRT_THROTTLESITE1=6.8392 Site ( Throttle Site 1 )\nRT_BAROSCALEDLIM=1.04 Bar ( Baro Pressure )\nRT_ENGINESPEED=1639.0 RPM ( Engine Speed )\nRT_BATTERYVOLTAGE(LIM)=13.281 V ( Battery Voltage )\nRT_BATTERYVOLTAGECOMP=0.31295 ms ( Battery Voltage Comp )\nRT_MAPPINGPOT1LIM=0.0015259 ( Mapping Pot 1 )\nRT_MAPPINGPOT2LIM=0.0015259 ( Mapping Pot 2 )<\/pre>\n\n\n\n
      Battery, RPM and the temperature readings match up well. But I’m not so sure about the barometric pressure readings, that’ll take a bit more investigation.<\/p>\n","protected":false},"excerpt":{"rendered":"
      The simplest of the three Caterham OBD port diagnostic protocols we know about is what I’ve called MBE-Broadcast. As soon as the car is put into ignition switch position 2, the ECU starts to spit out a this stream of data on the CAN bus. Unlike the OBD-II protocol and the MBE-ISOTP protocol, this a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[51,20],"tags":[34],"class_list":["post-5119","post","type-post","status-publish","format-standard","hentry","category-caterham-blog","category-ecu-diagnostics","tag-ecu-diagnostics"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p8yl38-1kz","jetpack-related-posts":[{"id":5112,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/20\/ecu-diagnostics-part-13-three-diagnostic-protocols-in-the-mbe-9a4-ecu\/","url_meta":{"origin":5119,"position":0},"title":"ECU Diagnostics – part 13 : Three Diagnostic Protocols in the MBE 9A4 ECU","author":"John Martin","date":"September 20, 2019","format":false,"excerpt":"This one's just a short post to introduce the next three posts. In our investigations of the MBE 9A4 ECU we've found three different diagnostics protocols supported on the OBD port. The following three posts will summarise what we've learnt about each protocol and will be updated with new information\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":5134,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/20\/ecu-diagnostics-part-13-2-obd-ii\/","url_meta":{"origin":5119,"position":1},"title":"ECU Diagnostics – part 13.2 : OBD-II","author":"John Martin","date":"September 20, 2019","format":false,"excerpt":"The OBD-II diagnostic protocol is well defined and information about it can be found\u00a0in On-board Diagnostics. It's a mish-mash of many diffrerent standards, both physical and electrical, that I'll refer to as OBD-II. There's also a complete breakdown of the Services and PIDs (see below) that can be found in\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":4726,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/08\/31\/ecu-diagnostics-part-1-introduction\/","url_meta":{"origin":5119,"position":2},"title":"ECU Diagnostics – part 1 : Introduction","author":"John Martin","date":"August 31, 2019","format":false,"excerpt":"So here we go for a marathon series of posts. I'll update this page with links to the completed posts as they come along... IntroductionECUs, OBD and CANTest SetupWireshark Patching and OBD-II ResultsThe Correlator Dead-EndReading MaterialECU Maps and MappingEasimap uses ISOTP (sort of)The Easimap Protocol TheoryDecoding EC2 FilesLogic Analyzer on\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":4765,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/08\/31\/ecu-diagnostics-part-2-ecu-obd-and-can\/","url_meta":{"origin":5119,"position":3},"title":"ECU Diagnostics \u2013 part 2 : ECU, OBD and CAN","author":"John Martin","date":"August 31, 2019","format":false,"excerpt":"ECU Caterhams, like all modern cars, have an Engine Control Unit (ECU) - a black box full of electronics, controlled by a microprocessor that manages how the engine runs. \u00a0And because it has a microprocessor it means it runs some software to control everything. It also connects to a bunch\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/9A4.jpg?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":5086,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/16\/ecu-diagnostics-part-12-osi-7-layers-for-caterham-diagnostics\/","url_meta":{"origin":5119,"position":4},"title":"ECU Diagnostics – part 12 : OSI 7 Layers for Caterham Diagnostics","author":"John Martin","date":"September 16, 2019","format":false,"excerpt":"Communications protocols are often called protocol stacks... they're layers, or stacks, of different protocols... one layered on top of the other from lowest level (hardware\/physical) to highest level (software application). This is where the OSI 7 Layer model comes in... it standardises how we think about the layers and allows\u2026","rel":"","context":"In "ECU Diagnostics"","block_context":{"text":"ECU Diagnostics","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/ecu-diagnostics\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":4943,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/07\/ecu-diagnostics-part-5-the-correlator-dead-end\/","url_meta":{"origin":5119,"position":5},"title":"ECU Diagnostics – part 5 : The Correlator Dead-end","author":"John Martin","date":"September 7, 2019","format":false,"excerpt":"Hopefully this is a quick post... The story so far is that: We've got a test bench made of a Raspberry Pi, CAN bus decoder board and an OBD Y-cableThe Raspberry Pi can \"sniff\" all the packets sent between the car's ECU and something that can talk to the car,\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=1400%2C800&ssl=1 4x"},"classes":[]}],"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/5119","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=5119"}],"version-history":[{"count":1,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/5119\/revisions"}],"predecessor-version":[{"id":10695,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/5119\/revisions\/10695"}],"wp:attachment":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=5119"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/categories?post=5119"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/tags?post=5119"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}