Rabbit DIY ECU – Connecting to Vehicle CAN
CAN bus is found in every road vehicle sold in Australia from 2006, along with the OBD2 protocols that have standardised vehicle diagnostics. The OBD2 protocols (also known as SAE J1979) provide a common language used by scan-tools to communicate fault codes and provide information useful for diagnostics and monitoring.
This standardisation has been key to the success of some great low cost interface tools like the ELM327 shown here. Free and low cost software connecting through these interface devices are run on Linux, Windows, Android and IOS. Lately I have been using DashCommand on Android for doing development work with the Rabbit DIY ECU install into the L98 VE Commodore. You can see it run here.
When modifying the engine control system of a modern vehicle, information is power! The more information you can provide to your fuel injection and timing calculations, the finer the tune can be. This can mean getting close to factory like emissions, or being able push the safe lean limits of AFR to get maximum horsepower. Another important factor for some (me included) is installing your DIY ECU system piggy-back style but trying to avoid the OEM ECU being upset and triggering the check engine lamp. A piggy-back install allows the DIY ECU to take over fuel and spark outputs but leaves the OEM ECU in place to keep the drive-by-wire throttle, alternator and fuel pump control, cruise control and entertainment system running just like factory. Some level of integration between the DIY and OEM systems over CAN is probably going to be needed to make all this happen. And a huge bonus of making the connection is that a lot of wiring work can be avoided because most sensor values can be read right from the CAN bus. For the physical connection the easiest way to connect for a cabin install is via the standard J1962 connector. On a side note, pretty much all CAN bus software tools come with a warning that you should be aware of the safety and other aspects of tinkering with CAN – you should take heed of these and be aware of how you can and can’t modify your car where you live!
Periodic Messages & the CAN Database There are a few different ways data flows over CAN. The simplest, and most common flow of data is periodic broadcast of messages. For example, the ABS controller might broadcast distance travelled by each road wheel every 10 milliseconds. The engine control ECU can compare distance travelled by each wheel to detect wheel spin and reduce power. There is no complicated protocol at work here – all these messages can be interpreted with a CAN database that describes which CAN message contains what data. You might have guessed that there is a standardised way of listing this information, the DBC file which you can read about here at Hackaday. The good news for the DIYer is that there are heaps of tools available to view the periodic messages. Kvaser tools aren’t the cheapest out there but get you up and running quickly with CAN DIY work. Here is how the list of periodic broadcast messages might look in Kvaser CanKing. You can see that each CAN message contains between 1 and 8 bytes of data, and has a unique identifier.
The downside of getting information from periodic broadcasts is that there is a limit to what is broadcast, and that the data is not standard. CAN is nowhere near as fast as say USB, Ethernet or WIFI, so only essential data is broadcast in this way. For the Rabbit DIY ECU install into the L98 VE Commodore, I found coolant and air temperature were available. By reading these temperatures from the CAN bus, I was able to avoid having to splice a couple of wires into the engine wiring harness. Some data like airflow and throttle position are also available on CAN bus, but I still wired in for these inputs because a fast, hardwired input is still better for those critical inputs.
OBD2 Mode 1
Going to the next level of CAN programming is a little more tricky. If you aren’t seeing the data you need on the periodic broadcast then you need to ask for the data, and this is where OBD2 comes in. OBD2 Mode 1 gives us a mechanism to retrieve quite a few interesting parameters from the ECU that can help our piggy-back installation. There are many data variables in the OEM ECU that have common and unique variable numbers, known as PIDs. An example of data with a PID attached is PID 6 Short Term Fuel Trim (STFT). This number describes how much additional fuel is being added or subtracted when the OEM ECU is running in closed loop mode. The ECU will incrementally add fuel when it sees a lean oxygen sensor reading, and incrementally reduce fuel when it sees a rich oxygen sensor reading. So how to ask for the PID 6 data using Mode 1? It’s pretty simple really – just a sequence of numbers 2, 1, 6. The 2 means expect 2 bytes to follow, 1 meaning Mode 1 and 6 meaning PID 6. The only extra bit of information you need is the message ID 2016 which happens to be the diagnostic address for the OEM ECU.
The response is 3, 65, 6, 125. The last data number (125) is the STFT. The zero reading for STFT is 128, so in this case the OEM ECU is reducing the fuel amount a little. So how does this help our installation? Getting back to the start of the post I talked about installing the Rabbit DIY ECU piggy-back and avoiding triggering the check engine lamp. STFT going out of range rich or lean is pretty much the first fault you will see after taking fuel injector control away from the OEM ECU! The OEM ECU will be trying to add or subtract fuel but the readings from the exhaust oxygen sensors will make no sense. But by knowing exactly what the OEM ECU is attempting to do by snooping on the STFT, the Rabbit DIY ECU can respond to keep it happy and try to avoid triggering the check engine lamp. Rabbit DIY ECU CAN Connection The Rabbit DIY ECU uses the SN65HVD232 transceiver IC and can connect to just about any vehicle fitted with a standard 2-wire CAN bus. For stand alone installs in older cars and motorbikes, the Rabbit DIY ECU can communicate over CAN for tuning, data-logging and real time gauges.
I usually code the Rabbit DIY ECU using Atmel Studio and debug with the Atmel ICE debugger. Below is a code snippet of how you can send a CAN message with the ECUHost OS and these tools:
This code is for sending the Mode 1 message described above.
