[carrrl]

Hey people,

I've been poking around the 500e CAN bus in my spare time, trying to decipher messages for custom behavior, data collection (like performance and battery health over time), and remote control. I believe I've identified 30+ messages, but want to confirm before sharing widely and going further down this rabbit hole. Any chance someone is willing to collect and share a minute or two of logs? You can PM me with an attachment if you aren't comfortable sharing publicly. Here is what would be helpful:

No adapter:

• Connect the logger directly to the ODB-II port (I believe this is CAN-C?)
• 500k speed
• Make sure car is "ready"
• Take note of any metrics you have access to: % charge and GOM from cluster. Pack voltage, Soc, SoH-R, SoH-C, ODO, 12v from AlfaOBD or Multiecuscan would be extra helpful.

Yellow adapter (requires a physical Alfa/Fiat yellow adapter or direct wire like it does):

• Connect the logger to OBD-II through a yellow adapter (I think this is CAN-B?)
• 50k speed
• Make sure car is "ready"
• Perform some actions inside the cabin (change gear, turn climate on/off, turn various lights on/off, press SWC buttons, open doors)
• Write down which actions you did

Any format is fine. Here is a snippet (of pressing vol- on steering wheel) if you need an example of what I am looking for:

Timestamp;Type;ID;Data
24034253896;1;6284000;0000000000000000
24034253896;1;6284000;4000000000000000
24034253897;1;6284000;0000000000000000

Thanks for any help/consideration. Also, if you've already done some of this work I'd be happy to help or compare notes. I'd love to get this all documented for tinkerers, apps, and integrations.

 

[Dutchlincoln]

wich logger do you (safely) use?
Any layout for the different can bus cables? (green/yellow/blue?) Where to get these?

 

[carrrl]

wich logger do you (safely) use?
Any layout for the different can bus cables? (green/yellow/blue?) Where to get these?

Passive logging is very safe AFAIK, just records signals that are going out either way. I use a CL2000 which is purpose built for easy logging and has very little sending capabilities and a dedicated "silent" mode ensures it sends nothing. You could also piece together much cheaper options (Pi + a CAN shield.)

For the adapters, I have this set but only use yellow so far. One yellow cable description says: "Female pin 6 to male pin 1 - Female pin 14 to male pin 9 - Female pin 7 to male pin 12"

 

[Dutchlincoln]

wow, thats a bit steep for rarely usage...

 

[carrrl]

wow, thats a bit steep for rarely usage...

I get that. Pi and CAN shield is cheaper like I mentioned. Ultimately I have limited time to work on this project. I’d rather focus on results not worry about the right hardware/software or if I made a mistake and made my car unsafe.

 

[ga2500ev]

Seems to me that a Raspberry PI coupled with an ELM327 bluetooth adapter might be the right tools for the job. I have both. If I ever get a minute, I may dig into some testing to see if the two can be hooked up. There are a few sites that discusses how to connect the two for OBD. I'm aware that the 500e doesn't use that protocol. But it seems like connecting the two then using WireShark to get data could be a cheaper workable plan.

ga2500ev

 

[carrrl]

Great to hear!

There are about 2k messages a second on CAN-C at idle and most Bluetooth adapters can handle around 100. If you do get up and running, let me know. ELM327 spec allows for filtering at device level so I could give you some PIDs I am more confident in which should allow you to capture/confirm.

Coincidentally I started down this path too (Mac + BT ELM327) since my high speed device failed. Ultimately I want a phone app + a the BT adapter since most people already have or can get setup cheaply.

Just before my good logger died I was able to do remote lock/unlock and precondition. Just need my replacement to come in so I can confirm I wasn’t dreaming 😄.

 

[Dutchlincoln]

wow, lock unlock and precondition are some major things to have actually!

 

[ShiftEvolve]

I'll be following this thread. I'm happy to see people starting to look into this stuff.

I've been doing some reading leaning about reverse engineering this car. I currently don't have a logger, but may eventually build or buy something. Looks like you could even do it with an Arduino and a CAN shield.

 

[ga2500ev]

Communication is the problem with an Arduino. You end up needing a laptop with a serial interface or adding a WiFi shield to get connectivity.

A Raspberry Pi is better connected with both WiFi and Bluetooth on board. I just bought this CAN shield for it:

Amazon.com: RS485 CAN HAT for Raspberry Pi 4B/3B+/3B/2B/B+/A+/Zero/Zero W/WH,Allow Long-Distance Communication via RS485/CAN Function Onboard CAN Controller MCP2515 via SPI Interface Transceiver SN65HVD230: Computers & Accessories

I figure I can get the full 500 kbps speed using a direct connection instead of a bluetooth dongle for about the same price. I'll have to dig up one of the 12V to USB 5V power supplies I bought a while ago as the OBD2 port offers straight battery power.

If someone is starting with nothing the following list:

• Raspberry Pi Zero W : $10
• CAN Shield : $17
• 12v - 5V DC-DC converter $5 (example: Amazon.com: KOOBOOK 2Pcs DC-DC 6-24V 12V/24V to 5V 3A CAR USB Charger Module DC Buck Step Down Converter: Home Improvement)
• OBD2 connector $7-12. I picked up this one: Amazon.com: OBD2 16Pin to DB9 Serial Port Adapter Cable: Computers & Accessories though it's limited to the primary 6/14 pin 500 kbps CAN bus. A full 16 pin one can access the 1/9 pin 50 kbps CAN C bus too.
• microSD card for the Pi
• various USB and HDMI cables for setup and power.

Should be enough to get started. Less than $50 in parts to get a unit that can sit in the car and connect to the house wifi for remote access.

ga2500ev

 

[Wavelength]

Guys,

If your really interested in this then I would be happy to help out. But using the PI and some hats is silly. It's really easy to get a CAN buss controller from Microchip which makes most of the car CPU's you see today. We link that to a BLE BT module put the **** thing on a circuit board and start from there.

Sure BT is slow, but it's really freaken easy to use. The CPU just has to send only the information required, not every message which is usually nothing we care about anyway.

The great thing is Microchip also has BT modules with BLE and example IOS and Android apps. You can easily link the CAN->BLE inside of Harmony their app building tool. I am old school and don't really care for Harmony. But I have developed a boat load of products with the Microchip controllers and have good engineers at Microchip which would be willing to help out.

You can get the connectors, IC's and everything else at DigiKey.com... don't freaken buy electronic parts at Amazon. DigiKey is the largest distributor of electronics in the world. They don't care if you spend a thousand or a 100.

CAN | Microchip Technology

CAN bus solutions for embedded applications include Microcontrollers, Digital Signal Controllers, Microprocessors, and Interface & Connectivity products.

www.microchip.com

I have Altium here and have at least 20 of the BT modules in profiles already. It would take me maybe an hour to lay the **** PCB out.

Maybe look at some plastic enclosures and base the size and stuff off of them. DigiKey has like 17K plastic enclosures in stock.

The whole thing would probably cost less than $20-$30 to make. You really want a PI+HAT hanging off your ODB port?

Thanks,
Gordon

 

[Wavelength]

Did a little digging and someone over at CCS (they write compilers for Microchip CPU) suggested not to waste your time on the CAN buss and instead use the ELM controllers which basically talk through a UART port.

OBD – Elm Electronics

www.elmelectronics.com

All BT modules do the same, so really any controller with two UART ports, heck could be an 8 bit controller at 32MHz could easily do the job.

If we know the specific IEE protocol for the CAN buss in question in the 500e then you can pick the ELM controller and if someone knows the pin out of the 500e ODB (it's here somewhere because I have seen it before) then it would be pretty easy to design this.

Thanks,
Gordon

 

[carrrl]

@Wavelength We are at the stage where hundred or thousands of messages are coming in a second, 99.9% of which I have no idea what they contain. The other 0.1% I have a good guess. Having a high speed, logging focused setup is the only sane way to figure out which messages are useful and what they contain.

I agree at the end of the day a cheap, sleek, low throughput device is what you’d leave installed.

 

[ga2500ev]

This is a discussion of development vs production in my estimation. A Pi and a Hat offers a plug and play development solution so that we can get to the core of the problem: decoding the CAN network messages to get the information and commands we want from the 500e.

The no design, no software developement, and instant WiFi connectivity I propose gets to that goal a lot faster than starting development with chip level stuff from scratch. I've been in the Microchip PIC world on and off for more than 20 years. I find that when I need to get something done, using a Pi or an Arduino as a starting platform gets me much father along than trying to develop a custom board from scratch.

As I posted above, I had no problem with the ELM327 and Bluetooth approach. I decided on a full speed hat at Carrrl's recommendation. Once we know exactly what we're looking for, we can revisit using the slower connection.

I'm game for an "all of the above" approach to this so that everyone can pick their own level of entry.

ga2500ev

 

[ga2500ev]

This is the best connector image I could find quickly. Essentially there are two CAN buses. The standard 6/14 500 kbps and a secondary 1/9 50 kbps.

Everything else is unpopulated as shown in the lower left corner of the image.

ga2500ev

 

[ga2500ev]

Here's a 5 minute youtube describing how to start sniffing a canbus using a Linux distribution like one would use if running on a Raspberry Pi.

A really useful document in this area is the Car Hacker's Handbook. It outlines all the connectivity along with a bunch of Linux based tools that can be run directly on the Raspberry Pi for CAN decoding. Chapter 5 is a must read.

A condensed crash course version of that chapter can be found here. Also OpenGarages has a video demonstrating the process of Reverse engineering the CanBus using the tools outlined in the document:

ga2500ev

 

[braus]

Hello
I am a new user of the 500e

But i have a CANAlyser(PC-Based Software) an the OBDLinkMX Dongle (Bluetooth). I use the CANAlyzer in my job with industrial products(other dongels).
Do some one know if they can work together and how.
If yes I will have a look to it and I will organize the necessary Adapters (yelllow,...)

I can programm in CANAlyzer very easy Filters to have look to the needed ID's.
And log Files with all ID's.
May be a dedicated automobile filter can help to get a good filter for starting the sniffing.

best regards
braus

 

[twinturboz]

I got the AlfaOBD software but a lot of the functions and modules pop up with a warning I need specific colored cables? Is this is what I need? I find these on eBay for like $25

 

[carrrl]

@twinturboz I linked to some above that work for me. Can’t speak for these. I imagine if they are Alfa/Fiat adapters they should work.

Yellow is needed to get to most things inside the car (SWC, doors, climate, remote UConnect features, etc) though some of that data is also available without it on CAN-C.

I’ve sniffed Multiecuscan (using a splitter, ELM327, and the CL2000) and it is directly connecting to ECUs rather than consuming data already on the bus. I assume AlfaOBD is the same. Haven’t ventured down the direct to ECU path yet but you should be able to see everything it does.

Either way those apps are a good way to narrow down your hunt. Which bus, what does their data look like, etc.

 

[twinturboz]

@twinturboz I linked to some above that work for me. Can’t speak for these. I imagine if they are Alfa/Fiat adapters they should work.

Yellow is needed to get to most things inside the car (SWC, doors, climate, remote UConnect features, etc) though some of that data is also available without it on CAN-C.

I’ve sniffed Multiecuscan (using a splitter, ELM327, and the CL2000) and it is directly connecting to ECUs rather than consuming data already on the bus. I assume AlfaOBD is the same. Haven’t ventured down the direct to ECU path yet but you should be able to see everything it does.

Either way those apps are a good way to narrow down your hunt. Which bus, what does their data look like, etc.

Yes the application states it’s for use with Fiat and Alfa multi scan use.