VAN bus interfacing (to read car speed and engine RPM Peugeot 206 1.4 HDI 2002)

[morcibacsi]

I've Saleae logic analyser so maybe it is time to try sniff some VAN (CAN signals) from Peugeot 206 HDI (the same as thread author pointed out at the begining), but a there any some kind of database to compare with?

The publicly available "database" is Graham's page, what you've linked and the VAN_frames.txt which was attached somewhere in this forum. They are good for a start but they have a lot of assumptions and lot of the information is just wrong.

Isn't this comunication encrypted somehow and similar within lets say Peugeot 206 line starting from 2002 year model I own?

It is not encrypted. It is the same for the 406, 206, 307 and for Citroen C5, Picasso and most probably for every cars made by PSA. It doesn't really make sense to implement the same thing for every model in a different way inside the same company.
The only difference I have found is the packet with iden number 4FC which was extended at some point in time by a few bytes, but the others seems to be the same.

I can also try write AVR MPU code to filter out other messages on VAN bus, but howto recognize those one related to engine RPM and gearbox output speed?
Maybe when we see some real data captured myself therer will be something similar to what you already did, however I saw there were some differencies in what you captured in comparision to this information mentioned in this thread: http://graham.auld.me.uk/projects/vanbus/protocol.html   ?

If you write yourself the AVR code you can try to sniff the VAN comfort bus, or you also can sniff the VAN body bus which wasn't really discovered (be careful though as the airbag ecu is also on that network). You just have to sit into the car, and look for changes inside the data coming in and try to figure out what changes when you press the pedals. That is how I (and Graham and the french guys back in 2003) did it. Again regarding the info on Grahams page it is really a very good start, but don't trust it blindly in some places it is very far from the actual meanings. Maybe some day I will share my findings.

However if you want the lowest level IMO the CAN network on the ECU is what you need to investigate.

[adv]

  

Thanks a million, I'm in a hurry to try that !

May I ask you a stupid question. I already ordered an ESP32 and a SN65HVD230 board, but the repo where you put the ino file to play with RDS display mentions usage of an arduino and both TSS463C & REMQ 0339.

May I use the ino file with ESP32+SN65HVD230 board ?

If so, this is by reverse the // on the following lines, Am I right ?

Code: [Select]

const int SCK_PIN = 25;
const int MISO_PIN = 5;
const int MOSI_PIN = 33;
//const int VAN_PIN = 32; //ESP32
const int VAN_PIN = 7; //Pro Mini
Thank you

[morcibacsi]

So to wrap up. I have 3 (+1 for Saleae Logic analyzer but that is another story) repositories with VAN bus related stuff:

No.	Repository	MCU	IC	Description
1.	Arduino TSS463C VAN interface library	Basically every MCU should work which is supported by the Arduino framework (Uno/Nano/Pro Mini/ESP32 was tested but others may also work)	TSS463C + Remq0933 (or MCP2551*)	These chips were used inside the car by PSA. Can read the bus and safely write messages to it.
2.	ESP32 RMT peripheral Vehicle Area Network (VAN bus) reader	Only ESP32 is supported	SN65HVD230, MCP2551 was tested but other CAN transceivers may also work	This repository is only for reading the bus.
3.	ESP32 RMT peripheral Vehicle Area Network (VAN bus) writer	Only ESP32 is supported	SN65HVD230, MCP2551 was tested but other CAN transceivers may also work	This is only a proof of concept that the ESP32 is able to generate the VAN packets, however using it is not recommended at all. To safely write on the bus arbitration logic have to be implemented. The TSS463 chip supports arbitration from hardware but this repository does not implement it.

So if you would like to write to the display you need to build the TSS463+Remq0933* schematics.

*The Remq0933 can be replaced by an MCP2551 also, a schematic will be uploaded onto the repository somewhere in the near future.

[Kotman]

Hi everybody!
Amazing work all of You!!! I really can't find more information about how to use RD3+EMF-B without car. But I have poor English and not understand totally right many things.
I have working RD3+EMF-B. Of course I hear beep sound without a car every 2-3 seconds. Bagou91 wrote:"I use the morcibacsi 's library https://github.com/morcibacsi/arduino_tss463_van: It works fine for send frame ID E24 and 8A4 on VAN: I can to use RD3 without BSI. RD3, EMF-B display and Arduino interface (TSS463+driver Alcatel2840) are connected."
But I can't find final shematic diagram of this solution to repeat it. I'm newbee in understanding IC-buses, such I2C, I2S, etc. I understand that VAN bus is very hard to learning, but I have the aim, some equipment and time.
Is it real to get scheme for repeating this solution to make working RD3 without BSI? I have CAN-module MCP2515+TJA1050, Arduino Uno+Leonardo, RD3+EMF-B+Citroen XsaraII.
Thank You!

[beduino]

It is not encrypted. It is the same for the 406, 206, 307 and for Citroen C5, Picasso and most probably for every cars made by PSA.

Not encrypted by PSA is good news 

BTW, "PSA" means this big company PSA Groupe  ?

It is interesting whether maybe there is some kind of "black box" hidden in some cars which store those messages lets say a few days/hours back to investigate in the case in accident?
Looks like with cheap hardware it could be now easy possible to make something like this... 

[morcibacsi]

Hi,

I have working RD3+EMF-B. Of course I hear beep sound without a car every 2-3 seconds. Bagou91 wrote:"I use the morcibacsi 's library https://github.com/morcibacsi/arduino_tss463_van: It works fine for send frame ID E24 and 8A4 on VAN: I can to use RD3 without BSI. RD3, EMF-B display and Arduino interface (TSS463+driver Alcatel2840) are connected."

You can send the VIN number to the radio like this:

Code: [Select]

// Send VIN like this:
void SendE24()
{
    uint8_t packet[17] = { 0x56, 0x46, 0x33, 0x33, 0x48, 0x4E, 0x46, 0x55, 0x42, 0x37, 0x31, 0x33, 0x37, 0x35, 0x35, 0x36, 0x31 };
    //uint8_t packet[17] = { 'V', 'F', '3', '3', 'H', 'N', 'F', 'U', 'B', '7', '1', '3', '7', '5', '5', '6', '1' } //this also works
    VANInterface->set_channel_for_transmit_message(4, 0xE24, packet, 17, 0);
}

// And the 8A4 like this:
void SendExternalTemperature(int temperature)
{
    uint8_t packet[7] = { 0x0F, 0x07, 0x00, 0x00, 0x00, 0x00, temperature * 2  + 0x50};
    VANInterface->set_channel_for_transmit_message(6, 0x8A4, packet, 7, 0);
}



I really can't find more information about how to use RD3+EMF-B without car.

I have attached the wiring to have the radio and display working on the bench. The TSS463C schema is also attached however you can find that (and another one with a different ic) on the github page of the library.

A CAN module with MCP2515+TJA1050 won't work, you need to build the TSS463C circuit to send on the VAN bus.

[Kotman]

Big thanks, morcibacsi!
I'll try Your recommendations for result. I use the same wiring of LCD.

[adv]

Hello morcibacsi and all VAN fans 

Thank you sir for your schem with the TSS463C + MCP2551 as I wasn't able to find a REMQ0339 from Alcatel.

FYI: I found a REMQ0114, it is also labelled Alcatel 2840 and the one I found seems wired with exact same components from your schem (with 51ohms and 4,3k resistors arround), but finally I'm not sure they are the same ones...
question for you: are you sure REMQ0339 is well the reference of this chip and not like a kind of datecode like YYWW (year code + week code) so the corect reference is simply Alactel 2840 ?

At least I'm sure it will work with MCP2551 and just ordred few ones on Ali. I see you can even find Atmel TSS463C, found mine in an old diesel fuel Eolys additive calculator.

A little picture to show you:



Thanks and regards guys !

[morcibacsi]

Maybe you are right and it is a date code and Alcatel 2840 is the real part number (I already wrote about it on the github page of the library). You can definitely use that. However I used the MCP2551 with my latest design as it requires much less components.

Edit: Yes, TSS463C can be found on aliexpress, they aren't fake.

[beduino]

I have attached the wiring to have the radio and display working on the bench.

I'd like to connect small external video camera when car is not used - when voltage on battery will drop below some level camera will be shutdown to do not discharge car battery too low - during the day small solar PV panel will try to charge car battery to floating voltage using small charge current eg. when not used for many days or just to keep at voltage as close to floating 13.8V as possible.
Just looking for a way to connect small 10W PV solar panel to keep car battery at floating 13.8V and in this wiring shown in this picture attached by you  VAN_Radio_MFD.png we have +12V marked yellow and red - which is difference between those two?
Do we have here access to car battery directly (probably fuse only) on one of those pins in radio connector when car doors closed and BSI shutdown ?

[morcibacsi]

Red: VAN +
Yellow: Permanent 12V

[reggaester]

Maybe you are right and it is a date code and Alcatel 2840 is the real part number (I already wrote about it on the github page of the library). You can definitely use that. However I used the MCP2551 with my latest design as it requires much less components.

Edit: Yes, TSS463C can be found on aliexpress, they aren't fake.

What is this board? Is made by you or it can be found somewhere?

[morcibacsi]

What is this board? Is made by you or it can be found somewhere?

It is a shield for the ESP32 devboard designed by me. It contains a TSS463 and two CAN transceivers. The schematics will be released on github soon.

[Demir]

hi  I have a problem
l have18pin dispilay socket , but new order 12 pin display socket .
is there a connection diagram.
18 to 12
https://uploads.tapatalk-cdn.com/20191216/922e07d9dd4b10d81b5f87a3f86bb10b.jpg

[Demir]

https://i.imgyukle.com/2019/12/17/Rl4dPS.png
pin to pin

[morcibacsi]

hi  I have a problem
l have18pin dispilay socket , but new order 12 pin display socket .
is there a connection diagram.
18 to 12
https://uploads.tapatalk-cdn.com/20191216/922e07d9dd4b10d81b5f87a3f86bb10b.jpg

What kind of car do you have? Which display would like to replace, and what is the replacement display? Without further info (maybe pictures about both displays) we can't help.

[mane]

Awesome stuff here and great work reversing the van bus.

I have a classic car, where I fitted Citroen C2 electric steering rack. To control that rack, it uses an ECU. Luckily, I found out that this ECU is also used in this training platform that Exxotest sells : https://exxotest.com/wp-content/uploads/2018/03/GU_MT-DAE_EN.pdf this was very good resource to check the pins of ecu.

That document mentions CAN bus, but when looking the signals coming out from those with oscilloscope, it's lower voltage than can bus, and hooking up can-bus monitor does not register any messages. So it must be VAN bus.

That power steering ECU requires RPM and speed messages from bus to function properly. If I could send those signals to ecu, I would have a working electric power steering.

Found out in this thread that speed & rpm are sent in one message, like this 824818F8000000004428BA

Looking at @morcibacsi:s work with the library, I ordered Arduino ESP32 and SN65HVD230 can module. But just after purchasing, I read the note in github that "does not contain any bus arbitratrion logic. So I don't recommend to use it in a car.". Not sure what that means and what would it require to write that logic. This ECU is the only VAN device in that network, so probably there is not much traffic going on there.. Maybe it could work just by plain sending that message on repeat (with actual speed & rpm of course).

What do you think guys? Would that work?

[morcibacsi]

That power steering ECU requires RPM and speed messages from bus to function properly. If I could send those signals to ecu, I would have a working electric power steering.

Found out in this thread that speed & rpm are sent in one message, like this 824818F8000000004428BA

The VAN bus related data which was reverse engineered is focusing on the comfort related stuff. (air conditioning, speedometer, radio, multifunction display, cd-changer, parking radar, and navigation unit). Basically for the stuff which provides some information to the driver.
So most probably this info won't be good for the power steering as it is more related to safety/car control.

The packet descriptions can be found on this page: http://pinterpeti.hu/psavanbus/PSA-VAN.html (this has more packets identified compared to Graham Auld's page)

But you can be sure if you identify the wires going to the power steering. The VAN bus has to have 2 wires (VAN HIGH, and VAN LOW as it is a differential protocol) similar to CAN bus. If you have an oscilloscope you can check the signals going on the wires if it matches the signal described on this site then it is a VAN bus: http://graham.auld.me.uk/projects/vanbus/lineprotocol.html. The various VAN networks have different speeds but on the oscilloscope or on a logic analyzer the SOF signals and identifier parts look exactly the same (but with different timings of course). So it can be recognized if it is VAN or not.

Looking at @morcibacsi:s work with the library, I ordered Arduino ESP32 and SN65HVD230 can module. But just after purchasing, I read the note in github that "does not contain any bus arbitratrion logic. So I don't recommend to use it in a car.". Not sure what that means and what would it require to write that logic. This ECU is the only VAN device in that network, so probably there is not much traffic going on there.. Maybe it could work just by plain sending that message on repeat (with actual speed & rpm of course).

That library with the sn65hvd230 for writing can't work in a car, it needs a major rework, but as i have a working library with the TSS463 I won't spend time on that.

You need to build this hardware: https://github.com/morcibacsi/PSAVanCanBridgeHW/tree/v1.4 and use this library: https://github.com/morcibacsi/arduino_tss463_van to safely write on a VAN bus.

[adv]

Hello Peter, and other VANs aficionados 

Peter, the diagram with TSS463C + MCP2551 make reference to a "IRQ" pin on the TSS but the code doesn't, I remind you that I'm interested about the RDS display.
How should I manage that. Honestly I did not tested yet because I still wait som SO16 adapater to DIP...

What should we do in this case ?
drive to GND ? Vcc ?

Thank you for your help 

[morcibacsi]

The TSS can raise an interrupt on reception but I've never implemented that feature. I just wanted to have a kind of feature-complete board, so if needed that can be added to the library later. You can leave it unconnected, it doesn't matter.

[adv]

Understood ! Thank you. 

[mane]

That power steering ECU requires RPM and speed messages from bus to function properly. If I could send those signals to ecu, I would have a working electric power steering.

But you can be sure if you identify the wires going to the power steering. The VAN bus has to have 2 wires (VAN HIGH, and VAN LOW as it is a differential protocol) similar to CAN bus. If you have an oscilloscope you can check the signals going on the wires if it matches the signal described on this site then it is a VAN bus: http://graham.auld.me.uk/projects/vanbus/lineprotocol.html. The various VAN networks have different speeds but on the oscilloscope or on a logic analyzer the SOF signals and identifier parts look exactly the same (but with different timings of course). So it can be recognized if it is VAN or not.

Got the CAN working when I checked what was the shortest pulse with oscilloscope. 4us translates to 250 000 bits per second.

Found out it's sending two messages. Id 495 with data of two bytes. This is probably steering angle. Id 795 has 6 bytes of data. I think this might be some status message of power steering ecu state. It comes once a second.

Problem now, is that this ECU should send 5V to torque sensor, to be able to receive the steering angle back on sensor signal port. But checking with multimeter, it's only 1.6V. I have two ECUs, but they both have the same voltage. Not sure if this is a problem.. Or should the voltage go up to 5V when ECU is receiving correct can messages (related to speed & rpm)

Any help would be appreciated

[reggaester]

Hi @morcibacsi
I have some questions for you:
1. what is the module marked on the picture?
2. if I understand correctly after submitting this project(https://github.com/morcibacsi/PSAVanCanBridgeHW/tree/v1.4) I get a full van command translator for the can bus so that rd45 and emf c will work in 307 from 02-05?
3. are you planning to sell assembled projects ready to install in car?

Sorry for my bad English

[morcibacsi]

1. That blue little board is a 5V->3.3V logic level converter which can be bought on aliexpress. Just like this: https://www.aliexpress.com/item/32216849765.html
2. Exactly. That is the board I am using now inside my Peugeot 307 from 2004 with an RD45 and a type C display. The files inside the src/Gerber folder are the files which are needed by manufacturing companies like allpcb.com to create the PCB for you.
3. Not really. There is little to no demand for these boards. There was a poll on a french forum on how many people would buy if it was available, and only 3 people voted yes. Creating pieces one by one does not really worth it. Also creating a product would require a more professional board design, and I would have to have some sort of support for the units which I wouldn't like to do. Thats why I released all the information. This way anybody can build it for their own responsibility.

[reggaester]

thx for reply.
Can I find TSS463C in vdo rd3 to desolder it? except aliexpress, it can't be bought anywhere, and the waiting time for shipments from aliexpress is very long. Does rd45 connected with this bridge connect to pp2000 to enter the vin number?

and finally when any new youtube video?
Greetings from Poland morcibacsi