PROCEEDINGS OF THE INSTITUTE OF VEHICLES 5(109)/2016

Transcription

1 PROCEEDINGS OF THE INSTITUTE OF VEHICLES 5(109)/2016 Krzysztof Rokicki 1, Mateusz Witkowski 2 METHODS OF OBTAINING OF LIVE DATA RELATED WITH DYNAMICS OF VEHICLE, BASED ON DATA RECEIVED FROM ON-BOARD DIAGNOSTIC SYSTEMS 1. Introduction On-board diagnostic systems of cars allow to watch live selected operating parameters. Some of these parameters associated with the operation of the engine and the automatic transmission has been normalized. Among these parameters are Eg. vehicle speed, engine speed, lambda values, the temperature of the engine coolant, etc. Access to the data is possible in real time through the diagnostic connector of the vehicle, using one of the communication protocols. Standards describe only the selected parameters, and then only for the engine controller. Almost all the electronic systems of the vehicle can send data on the selected operating parameters, but these data are not covered by the standards. This article presents how can access the data from the controller ABS / ESP, which relate to the behavior of the vehicle on the road - the speed and acceleration. 2. Acquisition and analysis of data 2.1. Data acquisition from ABS/ESP The module of the ABS / ESP is responsible for the vehicle features such as: preventing wheel lock during braking of the vehicle, preventing wheel slip during vehicle acceleration, Stability Control in vehicles equipped with ESP, vehicle braking or emergency braking of the vehicle in cars equipped with systems Adaptive Cruise Control or Forward Collision Warning The ABS / ESP module, in order to carry out their tasks, it must have of all the data about the vehicle speed and the track of the vehicle. On the basis of these data performs its basic tasks. These data are derived from the wheel speed sensors at each wheel. Data on the track and driving trajectory derived from ESP sensor that registers: longitudinal acceleration of the vehicle, the lateral acceleration of the vehicle, angular velocity of the vehicle in the vertical axis. It is measured as the angle of the steering wheel. Most of these data may be live preview via an external diagnostic scanner. These data can also be used for other purposes, Eg. the test of vehicle dynamics and others Access to the data Access to these data is possible via the vehicle diagnostic connector (DLC), using one of the communication protocols. Standard OBD II in the document SAE J1962 describes the diagnostic connector for communication between the controllers in the vehicle and the external diagnostic scanner. It is a 16-pin connector (2 rows x 8 pins). OBD II connector must be located inside the vehicle, the center console and the driver's side. 1 Krzysztof Rokicki, M.Sc. Eng.; Institute of Vehicles, Warsaw University of Technology 2 Mateusz Witkowski, M.Sc. Eng.; Institute of Vehicles, Warsaw University of Technology 83

2 The document SAE J1962 defines the pins in the connector (fig. 1): VPW (SAE-J1850) Battery ground 5. Sensor ground 6. CAN-H (ISO and SAE-J2234) 7. K line KWP2000, ISO (ISO and ISO ) PWM (SAE-J1850) PWM (SAE-J1850) CAN-L (ISO and SAE-J2234) 15. L line KWP2000 (ISO ) 16. Battery +12 V SAE-J1850 VPW SAE-J1850 PWM ISO / ISO CAN ISO Fig. 1. Data Link Connector (DLC) pinouts For vehicles produced in the past 10 years, the current standard of communication is via CAN-Bus. It enables diagnostic communication with the engine control unit, but also in many vehicles, with all the other control units and electronic modules in the car, including ABS / ESP. Presented in this article tests were performed on the Jeep Grand Cherokee This vehicle is equipped with Bosch ABS / ESP system. The control unit of the ABS / ESP is communicating with an external diagnostic device diagnostic module by FCMCGW module (Gateway), diagnostic CAN-bus and diagnostic connector DLC (fig. 2). 84

3 Fig. 2. Jeep Grand Cherokee CAN bus circuit schematic [1] Diagnostic data are transmitted using a data transmission protocol ISO-TP, which is described by ISO [2]. ISO-TP, is an international standard for sending data packets over a CAN-Bus, especially Diagnostic CAN in vehicles. The protocol allows for the transport of messages that exceed the eight byte maximum payload of CAN frames. ISO-TP segments longer messages into multiple frames, adding metadata that 85

4 allows the interpretation of individual frames and reassembly into a complete message packet by the recipient. Diagnostic commands are exchanged between the controller of ABS / ESP and Diagnostic Scanner using a diagnostic protocol Keyword Protocol 2000 (KWP2000) [3]. KWP2000 is a communications protocol used for on-board vehicle diagnostics systems (OBD). This protocol covers the application layer in the OSI model of computer networking. The protocol is standardized by International Organization for Standardization as ISO KWP2000 also covers the session layer in the OSI model, in terms of starting, maintaining and terminating a communications session. To receive data from a vehicle with the actual data from the controller of the ABS / ESP, we must have the following data: CAN-IDs for Request and Response in Diagnostic Session of ABS/ESP module Parameters ID of searched parameters (Eg. Wheels speed) These data can be obtained by analyzing the communication between the vehicle and diagnostic scanner, looking over the speed data of each of the wheels. The process of identification of the parameters sent via CAN networks between ABS/ESP module and Diagnostic Scanner is easier thanks to the nature of operation of these networks the data sent via such networks is not encrypted and can be received by all the modules connected to the network. Thus it is possible to connect an additional node whose task will be to eavesdrop on the traffic. In this case all the traffic are diagnostic commands transmitted between ABS/ESP module and diagnostic scanner. To collect of communication data can be used any CANbus sniffer. When the CAN-bus sniffer is switched to the CAN network, the recorded data stream can contain the following frames: 0x x785 0A x x Analysis of data When we use the ISO-TP protocol, we find that these frames give two messages: Request: (Parameters ID) Response: In the case when the vehicle travels at a speed of 100km/h we get: Request: Response: Next problem which needs to be resolved is the relevant interpretation of the transmitted data [4]. Knowledge from the areas of mechatronics and car telematics, as well as familiarity with the tasks fulfilled by respective modules in the data exchange network in the examined vehicle are indispensable here. Advanced diagnostic software, enabling the operating parameters of respective modules to be viewed via the OBDII onboard diagnostic system, may also prove useful here. When we use the KWP2000 protocol, we find that bytes are response for request, and data of response are 8 bytes: (values are in hex). 86

5 Each two of this data are speed measured for each vehicle wheel. 0x2710 = (dec). In our case, speed of vehicle was 100km/h, therefore, each two bytes provide information about the speed with an accuracy of 0.01 km/h. Similarly, analyzing diagnostic communication between the vehicle and the diagnostic scanner, looking over the data from the sensor ESP. Performing similar operations as above, it can register the sample data: Request: Response: A FA 00 2C 10 At the same time, diagnostic scanner provides data: Steering Angle Sensor Position: 7.0 Yaw Sensor: 2.9 Deg/s Pressure Sensor: bar Lateral Acceleration: G Longitudinal Sensor: 0.16 G Analyzing some cases, you can get information about which byte carries which information, and what scaling have been applied. 3. Summary The presented method of obtaining data from electronic systems can be used to retrieve data from various systems in the vehicle. This method is particularly easy to use in vehicles equipped with diagnostic CAN-bus. Data recorded from the vehicle may be used for model validation, testing the behavior of the vehicles, the analysis of driver behavior or registration data by the black box. References: [1] Chrysler Wiring Diagrams, FCA. [2] ISO :2016 Road vehicles -- Diagnostic communication over Controller Area Network (DoCAN) -- Part 2: Transport protocol and network layer services. [3] ISO Road vehicles Diagnostic systems Keyword Protocol 2000 [4] Rokicki K., Szczurowski K.: Methods of identification of data transmitted in the in-vehicle CAN-BUS networks, w: Proceedings of the 20th International Conference on Methods and Models in Automation and Robotics, 2015, ss Abstract The paper presents a method to extract data from the on-board diagnostics system of the vehicle. The focus was set on current data provided by the controller of ABS / ESP, such as the rotational speed of each wheel of the vehicle, longitudinal acceleration of the vehicle, the lateral acceleration of the vehicle, the angular velocity of the vehicle in the horizontal plane and the angle of the steering wheel. These data can be used eg. To study the dynamics of vehicles, verification of models, etc. The methods partly based on reverse engineering, and partly on the standards describing the diagnostic communication between the vehicle and the external diagnostic scanner KWP2000 and ISO-TP. The results of this method of obtaining data was shown on the example of the vehicle Jeep Grand Cherokee from Keywords: OBD, reverse engineering, vehicle speed 87

6 METODY POZYSKIWANIA DANYCH RZECZYWISTYCH RUCHU POJAZDU Z SYSTEMU DIAGNOSTYKI POKŁADOWEJ Streszczenie Praca przedstawia metodę pozyskiwania danych z systemu diagnostyki pokładowej pojazdu. Skupiono się na danych rzeczywistych udostępnianych przez sterownik systemu ABS/ESP, takich jak: prędkości obrotowe każdego z kół pojazdu, przyspieszenie wzdłużne pojazdu, przyspieszenie poprzeczne pojazdu, prędkość kątowa pojazdu w płaszczyźnie poziomej oraz kąt położenia kierownicy. Dane te mogą być wykorzystywane np. do badań dynamiki pojazdów, weryfikacji modeli itd. Przedstawione metody częściowo bazują na inżynierii odwrotnej, a częściowo na normach opisujących komunikację diagnostyczną pomiędzy pojazdem, a zewnętrznym skanerem diagnostycznym. W pracy przedstawiono wyniki zastosowania tej metody pozyskiwania danych na przykładzie pojazdu Jeep Grand Cherokee z roku Słowa kluczowe: OBD, inżynieria odwrotna, prędkość pojazdu 88