Heavy Vehicle Event Data Recorders. NTSS

Transcription

1 Heavy Vehicle Event Data Recorders NTSS

2 HOW EVENTS GET SET IN AN ENGINE CONTROL MODULE NTSS

3 Overview Vehicle Speed Data Vehicle Networking J1708/J1587 J1939 and Controller Area Networks Synchronized Testing Results Network Data, EDR Data, and GPS Data Out-of-service brakes Review of TUCRRC Website Content Digital Forensics for HVEDRs NTSS

4 Electronic Control Modules A computerized system that controls the operation of different aspects of the vehicle. Engine Control Module (ECM) Electronic Brake Controller (EBC) Automatic Transmission Controller Body Controller GPS and Telematics Unit Collision Avoidance Systems Potentially a dedicated Event Data Recorder Definition in SAE J2728: An electronic control unit (ECU) is an electronic subsystem that manages the functions of a vehicle system or components. ECUs are often called electronic control modules, or ECMs, or simply modules. NTSS

5 We can t work with this one NTSS

6 Missing Data?? NTSS

7 Event Data Types of ECM Data Sudden deceleration (e.g. decrease of 7 mph/s) Last Stop trigger Diagnostic trigger Fault Freeze Frame Data Historical Data Recorded by ECM for Use Configuration Data Programmed into ECM NTSS

8 Pavement to EDR Data Wheels Turn VSS Signal Generated ECM Calculates Speed Data Transmitted on Network NTSS

9 Sensing Speed A magnetic pick-up uses variable reluctance to sense the rotation of the tailshaft. Tailshaft Magnetic Pickup Tailshaft Transmission Tone Ring Transmission NTSS

10 Vehicle Speed Sensor 16 Tooth Tone Ring NTSS

11 Pavement to EDR Data Wheels Turn VSS Signal Generated ECM Calculates Speed Data Transmitted on Network NTSS

12 Speed Sensing In Action NTSS

13 Peak to-peak, Vpp Describing a Signal 1000 edaq-ddec6testingwithhathaway.sie - ToneRing@WheelSpeed.RN_1 WheelSpeed(millivolts) Period, T Frequency (Hz) = 1/T Time(secs) NTSS

14 Amplitude Describing a Signal (Cont.) 1000 edaq-ddec6testingwithhathaway.sie - ToneRing@WheelSpeed.RN_1 WheelSpeed(millivolts) Offset DC Value or Mean Value Time(secs) NTSS

15 Actual Vehicle Speed Sensor Signals Wire pierce near the sensor Record with the Analog In feature of the edaq. Exhaust Signal Wires NTSS

16 Example of Actual Speed Sensor Signal Speed (MPH) VSS Tone Ring Signal (0.1 V) GPS Based Vehicle Speed (MPH) VSS Check Pulses Time(secs) NTSS

17 Example of Actual Speed Sensor Signal (Zoomed) Speed (MPH) VSS Tone Ring Signal (0.1 V) GPS Based Vehicle Speed (MPH) x: y: n: x: y: dx:0.037 x:255.3 y: n: pulses in seconds with 2.93 gears and 19.5 inch radius = 23.7 mph (GPS = mph) x: y: dx:0.04 dy: Time(secs) NTSS

18 Example of Actual Speed Sensor Signal (Starting) 10 VSS Tone Ring Signal (0.1 V) GPS Based Vehicle Speed (MPH) 5 Speed (MPH) Time(secs) NTSS

19 Example of Actual Speed Sensor Signal (Stopping) 10 VSS Tone Ring Signal (0.1 V) GPS Based Vehicle Speed (MPH) 5 0 Speed (MPH) Gap shows tire stick-slip when finishing Time(secs) NTSS

20 Speed Sensing Observations Amplitude of the signal increases with speed. Frequency of the signal increases with speed. Peak to Peak may go from 10 mv to over 10 V. May not be referenced to common ground. NTSS

21 Pavement to EDR Data Wheels Turn VSS Signal Generated ECM Calculates Speed Data Transmitted on Network NTSS

22 Determining Speed A Signal Conditioning chip converts the analog signal into a pulse train. NTSS

23 Determining Speed (Cont.) The ECM counts the number of pulses in a given unit of time, say 0.1 seconds. The number of pulses is converted to a distance using pulses per mile (ppm). Example: 60 pulses in 0.1 seconds. 60 pulses 0.1 sec mile pulses 3600 sec 1 hour = 74.1 mph NTSS

24 Getting Pulses Per Mile Ask the Engine Control Module: J1587 PID 228: Speed Sensor Calibration Software output (DDDL shown here) x 16 x 492 = ppm NTSS

25 Confirming Pulses Per Mile Physically Inspect the Vehicle Component Information (maybe in the glovebox) Tells what components to expect 3.70 NTSS

26 Axle Tag Shows Gear Ratio Tag may not be readable. This one says RATIO Look for signs of repair. NTSS

27 Estimate Rolling Radius Method 1: Level and Tape Measure Measure from center to ground of drive wheels Typical ~ inches Circumference = x 2 x radius, which has units of inches per revolution Method 2: Mark the drive wheels and direct measure circumference Put grease on the tread and measure the spacing of the grease mark on the pavement NTSS

28 Looking Up Rolling Radius Example:Google michelin truck tire data book om/catalogs/pdf%20c atalogs/michelin.pdf Other manufacturers have similar data NTSS

29 Looking Up Rolling Radius NTSS

30 Measuring Rolling Radius SAE J1025 to get Revolutions per mile Long distance controlled tests 1.5% Accuracy According to the Michelin Truck Tire Service Manual, The accuracy of the tire revolutions per mile number is +/- 1% NTSS

31 Calculating Revs Per Mile Multiply by the gear ratio and number of teeth to get Pulses Per Mile (492)(3.7)(16) = ppm NTSS

32 What if our rolling radius estimate is off? If Rolling Radius = 20.5 inches, 600 pulses in 1 second gives mph If Rolling Radius is 19.5 inches, 600 pulses in 1 second gives mph Difference of 3.59 mph is about 5%. Differences magnitudes are less for lower speeds Pavement type and tread geometry have minor effects NTSS

33 Other Factors Affecting Speed Heavier Load -> Smaller Rolling Radius -> Lower Speed Low Tire Pressure -> Smaller Rolling Radius -> Lower Speed Treadwear -> Smaller Rolling Radius -> Lower Speed Tire Slip When Braking -> Less Revolutions -> Lower Speed Tire Slip Under Power -> More Revolutions -> Higher Speed NTSS

34 Pavement to EDR Data Wheels Turn VSS Signal Generated ECM Calculates Speed Data Transmitted on Network Sine Sine Time 0.1 NTSS

35 Simulating Our Own Speeds Use a function generator to insert signals on the Vehicle Speed Sensor (VSS) circuit. Only frequency matters NTSS

36 Result: Truck-in-a-box NTSS

37 Overall System NTSS

38 Pavement to EDR Data Wheels Turn VSS Signal Generated ECM Calculates Speed Data Transmitted on Network NTSS

39 Simplify Wiring Heavy Vehicle Networks Enables multiple systems on one bus Data sharing between ECUs External interface with 6 or 9-pin connector NTSS

40 Network Standards SAE J1708 and J1587 Based on a 9600 baud RS-485 connection Similar to the serial port on a computer Phased out, but still on the road (DDEC 4 and 5, Cat ADEM3) SAE J1939 Based on a 250,000 baud Controller Area Network (CAN) connection CAN is used on passenger cars too. NTSS

41 J1708 Network Messages Speed signals are interpreted and broadcast as serial messages in frames. J1708 Frame: MID: Message Identifier 128 (0x80) for Engine 183 (0xB6) for Off-board Programming Station PID: Parameter Identification 84 (0x54) for Road Speed 190 (0xBE) for Engine Speed MID PID DATA Checksum NTSS

42 Interpreting J1708 Data Use J1587 as the roadmap NTSS

43 Example Speed Data J1708 Hex Serial Data is found in a log file: Line Abs Time(Sec) Rel Time (Sec) Er Tx Description MID PID DATA F F J1708 $ MID: Engine PID: Road Speed Determine Decimal (55 in this case) Multiply by 0.5 (27.5 in this case) Append units from J1587: 27.5 mph NTSS

44 Converting Hex to Decimal Excel: =HEX2DEC( 37 ) Windows Calculator: NTSS

45 There are 10 types of people in this world: Those that understand binary and those that don t. NTSS

46 Why does this matter? The SAE Standards explain many of the parameters in the EDR reports. Can not expect better than 0.5 mph accuracy on J1708 based vehicles. Network traffic reflects ECU computed data If network traffic is accurate, then EDR data is likely accurate. Network data is the source for telematics units (e.g. Qualcomm). Enables assessment without the need to set events. More data samples NTSS

47 Controller Area Networks Controller Area Network (CAN) serial bus introduced by Bosch in 1986 A 2-wire bus with multi-master capability with Collision Detection, Arbitration, and Error Checking Result: nearly 100% data integrity in harsh environments Implemented using CAN transceiver hardware Motorola / Microchip Amtel Freescale Semiconductors NTSS

48 CAN Messages 29-bit Identifier (Arbitration) Control Field Data Field Error Checking Data typically transferred up to 8 bytes at a time NTSS

49 SAE J1939 Built on CAN at 250,000 bits/s Fast enough for real-time control Uses the message identifier to define purpose. Defines everything from physical connections to diagnostic applications. Provides the basis for understanding and interpreting some of the data. NTSS

50 J1939 Connector (9-Pin) Pin A: Battery (-) Pin B: Battery (+) Pin C: CAN High Pin D: CAN Low Pin E: CAN Shield Pin F: J1708 (+) Pin G: J1708 (-) Pin H: OEM Use or 2 nd CAN High Pin J: OEM Use or 2 nd CAN Low NTSS

51 Data Acquisition and APPLICATIONS TO HEAVY VEHCILES NTSS

52 Vehicle Description 2008 Freightliner Single Drive Axle DDEC VI equipped Detroit Diesel Series 60 Engine Eaton 10 Speed Manual 2.93:1 Rear Axle Ratio NTSS

53 Component Information NTSS

54 Procedure Training Facility Driving (i.e. Closed Course) Straight line runs with at least 2 hard brake events Multiple Configurations Bobtail Single Pup Twin Pups Record while hitching and releasing pups NTSS

55 Correlated Data Gathering Simultaneously obtain Tone Ring (VSS) Signals J1939 Network Traffic (e.g. Wheel-based Vehicle Speed) J1708 Network Traffic (e.g. Road Speed) GPS Based Speeds (Vbox 3i and egps-200) Tape Switch on Brake Pedal Brake Chamber Pressures Perform multiple hard braking events Download HVEDR Data NTSS

56 Instrument Setup NTSS

57 Instrument Setup (cont.) NTSS

58 Details on Instrumentation with links: NTSS

59 Speed Spikes and Noise Nice signals give predictable and reliable results. Higher speeds Lab Simulated Sine Waves -1 Real Signals may not be nice at low speeds Compromised circuit Drive train rattle Vibration DC with Uniform Noise -1.6 Longer sample times smooth out noise DC with Uniform Noise Sine with Uniform Noise NTSS Time Time Sine

60 Speed Spikes at Shift Points WhBsVehSp(km/h) WheelSpeed(millivolts) speed_raw3d(km/h) edaq-ddec6testingwithhathaway.sie - GPS@speed_raw3d.RN_8 edaq-ddec6testingwithhathaway.sie - ToneRing@WheelSpeed.RN_8 edaq-ddec6testingwithhathaway.sie - OnMotion@WhBsVehSp.RN_ Time(secs) External GPS Tone Ring Signal J1939 Speed NTSS

61 Speed Spikes at Shift Points WhBsVehSp(km/h) WheelSpeed(millivolts) speed_raw3d(km/h) edaq-ddec6testingwithhathaway.sie - GPS@speed_raw3d.RN_8 edaq-ddec6testingwithhathaway.sie - ToneRing@WheelSpeed.RN_8 edaq-ddec6testingwithhathaway.sie - OnMotion@WhBsVehSp.RN_ Time(secs) External GPS Tone Ring Signal J1939 Speed NTSS

62 Signal Noise When Slow Some Event Records may show unphysical speed spikes (i.e. 0-55mph in 1 second). The speed sensing circuit automatically increases sensitivity with lower amplitudes More susceptible to noise Can happen with impulses that cause drivetrain rattle NTSS

63 Tone Ring Noise From Trailer Connection WhBsVehSp(km/h) WheelSpeed(millivolts) speed_raw3d(km/h) edaq-ddec6testing.sie - GPS@speed_raw3d.RN_11 edaq-ddec6testing.sie - ToneRing@WheelSpeed.RN_11 edaq-ddec6testing.sie - OnMotion@WhBsVehSp.RN_ Time(secs) External GPS Tone Ring Signal J1939 Speed NTSS

64 Speed Comparison egps-200 from edaq Vbox 3i GPS J1939 Network Wheel-based Vehicle Speed (Tone Ring) Front Axle Speed (Electronic Brake Controller) J1708 Network Road Speed DDEC Reports NTSS

65 Speed Records 60 J1939: Wheel-Based Vehicle Speed J1939: Front Axle Speed GPS: VBOX 3i GPS: egps-200 J1708: Road Speed 50 Speed (mph) Time(secs) NTSS

66 Speed Records Hard Brake 60 J1939: Wheel-Based Vehicle Speed J1939: Front Axle Speed GPS: VBOX 3i GPS: egps-200 J1708: Road Speed 50 Speed (mph) Time(secs) NTSS

67 Zoom on Speed Feature 18 J1939: Wheel-Based Vehicle Speed J1939: Front Axle Speed GPS: VBOX 3i GPS: egps-200 J1708: Road Speed x: y: n: x: y: n: x: y: n: x: y: n:31022 x: y:10 n: Speed (mph) Time(secs) NTSS

68 Compare Tone Ring Signal to ECM Calculated Speed WheelSpeed(millivolts) RoadSpeed(mph) edaq-ddec6testing.sie - ToneRing@WheelSpeed.RN_2 edaq-ddec6testing.sie - OnMotion@RoadSpeed.RN_ Time(secs) NTSS

69 Speed (mph) Engine Speed (rpm) DDEC Reports Data DDEC Reports Speed DDEC Reports RPM Hard Brake Time (sec) 0 NTSS

70 Speed (mph) Engine Speed (rpm) Merge DDEC Data with Network Data DDEC Reports Speed Wheel-based Vehcle Speed DDEC Reports RPM J1939 RPM Hard Brake Time (sec) 0 NTSS

71 Speed Data Observations Network speed data are about 0.1 second be hind tone ring signal. GPS units tracked each other around 0.2 mph difference Front Axle Speed over reported speed Likely reduced rolling radius from treadware From the Electronic Brake controller Road Speed (J1708) and Wheel-based Vehicle Speed (J1939) show drops in speed NTSS Tire slip from braking

72 Air Pressure Transducer (Front Axle) NTSS

73 Air Pressure Transducer (Rear Axle) NTSS

74 Air Pressure for ABS Braking BrakePressLR(PSI) edaq-ddec6testing.sie - OnMotion@BrakePressLR.RN_2 edaq-ddec6testing.sie - OnMotion@BrakePressRR.RN_2 edaq-ddec6testing.sie - OnMotion@BrakePressLF.RN_2 edaq-ddec6testing.sie - OnMotion@BrakePressRF.RN_2 edaq-ddec6testing.sie - OnMotion@FAxSp.RN_2 edaq-ddec6testing.sie - OnMotion@WhBsVehSp.RN_ Time(secs) NTSS

75 Left Rear Brake Pressure with Wheel-Based Speed WhBsVehSp(km/h) edaq-ddec6testing.sie - OnMotion@WhBsVehSp.RN_2 edaq-ddec6testing.sie - OnMotion@BrakePressLR.RN_2 Increase in pressure causes wheel slip and decrease in measured speed Time(secs) NTSS

76 Bobtail Braking Results J1939 brake switch status lags tape switch by 0.07 seconds. 15 psi builds in that time. 40 psi (average operational pressure) lags by 0.25 psi Data show the pressure modulation from the ABS system. Front axle pressures tracked each other. No modulation needed. NTSS

77 where Determining Drag Factor f = [ (v2 v1) / (t2 t1) ] / g v1 is speed at time t1 v2 is speed at time t2 g is the acceleration due to gravity in the same units of v/t. Example: g = 32.2 ft/s x 3600 sec/hour 5280 ft/mile = mph/s NTSS

78 edaq-ddec6testing.sie - GPS@speed_3d.RN_2 DV Acceleration is the slope Dt speed_3d(km/h) a = (v2-v1) / (t2 t1) Time(secs) NTSS

79 Drag Factor Results Run Description v1 (km/h) v2 (km/h) t1 (sec) t2 (sec) Drag Factor 2a First hard brake - tactor b Second hard brake - tractor a Third hard brake - tractor b Fourth hard brake - tractor a First hard brake with single trailer b Second hard brake with single trailer a Third hard brake with single trailer Adding trailers made the drag factor increase from about 0.35 to b Fourth hard brake with single trailer a First hard brake with two trailers b Second hard brake with two trailers a Third hard brake with two trailers b Fourth hard brake with two trailers NTSS

80 Rear Brake Pressures: Bobtail 120 edaq-ddec6testing.sie - OnMotion@WhBsVehSp.RN_2 edaq-ddec6testing.sie - OnMotion@BrakePressRR.RN_2 edaq-ddec6testing.sie - OnMotion@BrakePressLR.RN_2 100 WhBsVehSp(km/h) Time(secs) NTSS

81 Rear Brake Pressures: Single Pup 120 edaq-ddec6testing.sie - OnMotion@WhBsVehSp.RN_6 edaq-ddec6testing.sie - OnMotion@BrakePressRR.RN_6 edaq-ddec6testing.sie - OnMotion@BrakePressLR.RN_6 100 WhBsVehSp(km/h) Time(secs) NTSS

82 Rear Brake Pressures: Two Pups 100 edaq-ddec6testing.sie - OnMotion@WhBsVehSp.RN_9 edaq-ddec6testing.sie - OnMotion@BrakePressRR.RN_9 edaq-ddec6testing.sie - OnMotion@BrakePressLR.RN_9 80 WhBsVehSp(km/h) Time(secs) NTSS

83 Push Rod Stroke - OK NTSS

84 Push Rod Stroke - Bad) NTSS

85 Remove Emergency Brake Line Newer Bolt NTSS

86 This fell to the ground NTSS

87 A Dime to Block the Line NTSS

88 Observations When the dime was removed no pressure would hold when the parking brake was Dime prevented an air leak from a defective chamber Service brake worked to depress the spring to release the brake Pressures were high/normal in the brake line No Pressure modulation since no wheel slip. Push rod stroke was almost double on the defective brake No pushrod stroke when parking brake was set NTSS

89 Setting a Speed Triggered Event in an ECM A predefined threshold, say 7 mph/s, must be exceeded to trigger an event. If an ECM sees a change in speed of that amount, then a braking event is recorded. Threshold value is found in the Configuration data. NTSS

90 Fault Codes Fault code data can also be recorded. Faults may occur as part of a crash Example: loss of accelerator pedal signal when a pusher bus or RV runs into a tree. Timing of fault information is not certain yet Fault Freeze Frame Data is often recorded too. NTSS

91 Freeze Frame Data A list of recorded parameters at the time a diagnostic trouble code was captured. Consists of Suspect Parameter Number (SPN) Fault Mode Indicator (FMI) Occurrence Count Engine Torque Mode Boost Engine Speed Engine Load Engine Coolant Temperature Vehicle Speed Maybe More Manufacturer Specific Data NTSS

92 Cummins Insite Example NTSS

93 Failure Mode Indicators 32 possible values describing how a parameter became bad as defined in J Uses a Signal Range to divide FMI to severity levels: NTSS

94 Examples: Failure Mode Indicator FMI=3 - Voltage Above Normal, Or Shorted To High Source FMI=4 - Voltage Below Normal, Or Shorted To Low Source FMI=9 - Abnormal Update Rate FMI=12 - Bad Intelligent Device Or Component Software should interpret these numbers NTSS

95 Fault Data in Reconstruction Timing of fault data is actively being researched. Freeze frame data may be used as a lower bound Fault data should be tied to physical evidence Gouge in the oil-pan from a wreck corresponds to a loss of oil pressure. Need to use the non-free software to get freeze frame data. NTSS

96 Historical Data Describes mileage, times, and fuel uses. Attribution is hard (i.e. unknown drivers) There are many counters used in recording historical data. ECM time: Amount the ECM was on Engine time: Amount the Engine was turning Trip data may be different than lifetime data. NTSS

97 Configuration Data Used to verify speeds from RPM. Shows power settings. Gives governor limits. Shows road speed limits. Configuration data is programmed from the shop or manufacturer. NTSS

98 Consortium Website All data from crash testing and this presentation will be available at Credentials User: TUCRRCmember Password: TUCRRCpassword NTSS

99 Safe Travels and Fair Winds. THANK YOU NTSS