[carrrl]

One snag on cansniffer (tool from videos above) - looks like 29bit PID support was only recently added. On Ubuntu 20.04 cansniffer is blank for 500e (but candump shows correct data.) After building from source it works correctly.

 

[vortexblue]

Joining this thread to learn - as a long-time hot-rodder, this is the level of stuff I'm hoping to explore with this car.

 

[carrrl]

I’ve made good progress on passive signals and recently started figuring out requesting specific data. That’s more time consuming (and feels sort of sketchy) so I’d rather focus on what people would use - what is most interesting?

I imagine the EV basics? SoC, range, SoH, speed, motor RPM, 12v, etc. For the most part I’m able to see what the common apps are doing, but each data point takes time to figure out and test.

 

[ga2500ev]

I’ve made good progress on passive signals and recently started figuring out requesting specific data. That’s more time consuming (and feels sort of sketchy) so I’d rather focus on what people would use - what is most interesting?

I imagine the EV basics? SoC, range, SoH, speed, motor RPM, 12v, etc. For the most part I’m able to see what the common apps are doing, but each data point takes time to figure out and test.

Actions are as interesting as information. Locking/unlocking doors. Preconditioning. Starting/stopping the charger.

Then status on those items would be equally as important. That would be battery voltages, state of charge, individual cell information.

ga2500ev

 

[carrrl]

Here is what I've got so far. As mentioned in the notes:

• This is a WIP and probably has lots of errors.
• It's is a living document so things will be added/removed/updated over time.
• If you die or destroy your vehicle, thats on you.
• A sample size of 1 means it works on my car, software, and hardware but hasn't been confirmed anywhere else.

 

[ga2500ev]

Awesome! Thanks!

I'm going to try to set aside some time to validate some of these items.

ga2500ev

 

[carrrl]

Does anyone know which protocol CAN-B uses? It's 50k, but all the software I’ve encountered “just works” if you know the speed. Trying to use something now that wants to know the exact protocol.

I've determined CAN-C is happy with ISO 15765-4 (CAN 29/500)

 

[carrrl]

Update for those looking to go Raspberry Pi route - here is a setup I built that sniffs both CAN-B and CAN-C at same time at full speed. Also works for the final install.

• Raspberry Pi 4 (but any should work)
  • Install can-utils from source
• Waveshare "2-Channel Isolated CAN FD" hat
  • Setup docs here
  • Move 120Ω resistor jumpers to OFF
  • Move voltage jumper to 3.3v
• OBD-II pigtail (triple check wiring/pins on these things with a multimeter)
  • CAN-B = 1/9 H/L
  • CAN-C = 6/14 H/L
  • Ground = 4/5

Moving forward I'll probably be building against this setup. Next steps are to filter messages into a database, show in a UI (HDMI to head unit), and figure out power management so it doesn't smoke the 12v when parked.

 

[carrrl]

Been using the above setup for 2 weeks, works great. Overall I've found that there is a lot more to this project than simply finding the requests/responses/format - a lot of it needs be validated over days and miles. This lead me to build out the software stack to support that. Very easy to see when a formula or datapoint is wrong when it's live updating on the head unit.

Here is the foundation:
python-can - read/write to the CAN bus with little effort, even in our car. supports virtual devices for bench testing.
couchdb - easy to use database with GUI admin, but most importantly, it has a web API built in. easy to pull, replicate.
web app - simple HTML, CSS, Javascript app consumes the couchdb data to make a UI. No backend, internet, or fancy stuff.

Obligatory screenshot. Data is live, but some formulas not right. Still working out the layout/data visualization, but taking inspiration from Tesla and Bolt:

Current features:

• Speed, gear, soc, range estimates, steering wheel lines, gauges, and a line at the bottom thats supposed to represent how aggressive you are driving. Consistent speeds, it levels out, hard launch/stops create the color spikes.
• Dark main panel switches when charging, parked, or driving. Current setup is HDMI only so the screen is not touchable, so relies on automated switching.
• Car overlays for doors/trunk open, placeholder for TPMS once I figure it out
• History panel shows kW used/added but I plan on making it more useful with m/kw, historical temps, speed, and aggressiveness to sort of represent an energy "score"
• Tied into my aftermarket blindspot/cross traffic alerts to show yellow warnings to left/right behind car

I'll eventually share the source once the project matures a bit - had a bug just this morning showing me at 102mph on residential streets

 

[ga2500ev]

Question: Do you need the double CANBus setup to get access to everything with your app? What would be missing if only the high speed CAN (1/9) can be accessed?

ga2500ev

 

[carrrl]

The above linked spreadsheet is the best place to start. I am currently using both busses but data points sometimes exist on both. AlfaOBD and Multiecuscan also give an idea of what data is on the bus. If it requires a yellow adapter it’s on the slower bus. No adapter is high speed.

That said it’s all a work in progress. As I figure more out you might be able to pick one or the other depending on your project. Nerdy battery stuff? C. Remote precondition and light shows? B. etc..

 

[billatq]

Anything special needed for remote climate? I’d love to do that with an ELM dongle.

 

[carrrl]

You need a yellow adapter since it’s on CAN-B. Then it’s all about configuring the ELM327 and sending the command. Does the dongle stay active all the time or does it eventually shut down? Power management could get annoying. Similarly the CAN bus shuts down shortly after you exit the vehicle. Not entirely sure if you need to wake it up in a special way, but sending the command twice seemed to work for me in my initial testing.

 

[billatq]

You need a yellow adapter since it’s on CAN-B. Then it’s all about configuring the ELM327 and sending the command. Does the dongle stay active all the time or does it eventually shut down? Power management could get annoying. Similarly the CAN bus shuts down shortly after you exit the vehicle. Not entirely sure if you need to wake it up in a special way, but sending the command twice seemed to work for me in my initial testing.

Thanks. I've already got a yellow adapter, so I'll give it a go. Seems fun, though I'll probably need to rig up a smaller adapter to leave it connected all the time. I'll play with it a bit and report back.

 

[WilliamFiatee]

@carrrl I have been looking into the remote commands and wanted to confirm remote unlock would be 0x0c41401f with payload 74. Also, can this command work when inside the car? Or does the car need the nodes to be in a previous sleep state? Thank you.

William

 

[carrrl]

The bus actually needs to be awake, so you may need to send it twice to ensure it’s actually unlocked. First command wakes it up, second time it unlocks.

It may work when in the vehicle but probably not while in gear. Preconditioning for example doesn’t work if the car is already on.

 

[billatq]

I found that I was partially able to get an OBDLink SX to work.

For the passive CAN-C stuff, it works just fine to do something like:

ATD // reset to default
ATZ // close what's open
ATL1 // show linefeeds so it's easier interactively
ATSP7 // 29-bit 500k canbus
ATAL // long addressing
ATH1 // Show the header while doing stuff

ATCRA0C10A040 // Estimated range address
ATMA // Monitor with that filter

Where I'm running into trouble (and this is likely my understanding of ELM327) is getting the CAN-B bus to monitor at all. I set to the protocol "C" on the ELM, which should switch into the 50-kbit mode, and set the 2E parameter to 60, which should allow for 29-bit addressing, but nothing shows up with monitoring.

Monitoring aside, I also don't seem to be able to get PIDs to do anything interesting, and this might also be an ELM327 issue. For example, if I do something like:

// Try to set to 18da44f1
> ATCP 18
> ATSH DA 44 F1
// Try to request the PID for 12V
> 03 22 A0 10
18 DA F1 44 03 7F 03 11

I do get a response back, but it doesn't seem to match what I'd expect from the example, and it's the same response for the three options that are there against the same address.

I do know that the OBDLink SX has worked for me in the past on the CAN-C bus with multiecuscan, so I think that the adapter is good.

 

[robotarmy]

Hi,

I'm interested in helping with the effort to decode some of the Fiat 500e CANBUS messages.

I know work has gone into this in the past, obviously for MultiECUScan, AlfaOBD and the my500e telematics add-on.

There's also a tool which appears to be able to extract and reflash the non-volatile memory in the inverter -

- AFAIK the 500e also uses this Bosch Invcon 2.3.

It'd be great if there were some place that was a central resource for this type of thing where knowledge could be shared, instead of what seems to be the current practice of everyone trying to keep hold of their IP and sell some product. It would go a long way to enabling the goals of the 'right to repair' movement as well! I'm a big fan of the my500e telematics add-on, and I'm glad it exists, for sure, but it shouldn't cost what it does (and if it didn't take whoever made it so much work to reverse engineer the codes, I'm sure it wouldn't!)

My main interest is understanding, in detail, the messages around the inverter, and other EV components (BPCM, OBCM, etc).

I'm trying to avoid the current situation of any inverter fault code seeming to effectively scrap these awesome cars.

Any ideas on where this info should go?

R

I found that I was partially able to get an OBDLink SX to work.

For the passive CAN-C stuff, it works just fine to do something like:

ATD // reset to default
ATZ // close what's open
ATL1 // show linefeeds so it's easier interactively
ATSP7 // 29-bit 500k canbus
ATAL // long addressing
ATH1 // Show the header while doing stuff

ATCRA0C10A040 // Estimated range address
ATMA // Monitor with that filter

Where I'm running into trouble (and this is likely my understanding of ELM327) is getting the CAN-B bus to monitor at all. I set to the protocol "C" on the ELM, which should switch into the 50-kbit mode, and set the 2E parameter to 60, which should allow for 29-bit addressing, but nothing shows up with monitoring.

Monitoring aside, I also don't seem to be able to get PIDs to do anything interesting, and this might also be an ELM327 issue. For example, if I do something like:

// Try to set to 18da44f1
> ATCP 18
> ATSH DA 44 F1
// Try to request the PID for 12V
> 03 22 A0 10
18 DA F1 44 03 7F 03 11

I do get a response back, but it doesn't seem to match what I'd expect from the example, and it's the same response for the three options that are there against the same address.

I do know that the OBDLink SX has worked for me in the past on the CAN-C bus with multiecuscan, so I think that the adapter is good.

 

[cuijpertjes]

I got my setup (OBD BLE module with yellow cable) working fine, but the range is poor. Anyone has any hints on how to improve? (I did open the OBD module, but can't tell whether it is a SMD antenna or a PCB trace antenna - both seem present...)

Oh, after spending some time to figure out how to find an ECU that can tell the voltage while the ignition key is not in... I figured the voltage on the OBD module (request with ATRV) is the same as the car...

Maurice

 

[Zviad]

Hey people,

I've been poking around the 500e CAN bus in my spare time, trying to decipher messages for custom behavior, data collection (like performance and battery health over time), and remote control. I believe I've identified 30+ messages, but want to confirm before sharing widely and going further down this rabbit hole. Any chance someone is willing to collect and share a minute or two of logs? You can PM me with an attachment if you aren't comfortable sharing publicly. Here is what would be helpful:

No adapter:

• Connect the logger directly to the ODB-II port (I believe this is CAN-C?)
• 500k speed
• Make sure car is "ready"
• Take note of any metrics you have access to: % charge and GOM from cluster. Pack voltage, Soc, SoH-R, SoH-C, ODO, 12v from AlfaOBD or Multiecuscan would be extra helpful.

Yellow adapter (requires a physical Alfa/Fiat yellow adapter or direct wire like it does):

• Connect the logger to OBD-II through a yellow adapter (I think this is CAN-B?)
• 50k speed
• Make sure car is "ready"
• Perform some actions inside the cabin (change gear, turn climate on/off, turn various lights on/off, press SWC buttons, open doors)
• Write down which actions you did

Any format is fine. Here is a snippet (of pressing vol- on steering wheel) if you need an example of what I am looking for:

Timestamp;Type;ID;Data
24034253896;1;6284000;0000000000000000
24034253896;1;6284000;4000000000000000
24034253897;1;6284000;0000000000000000

Thanks for any help/consideration. Also, if you've already done some of this work I'd be happy to help or compare notes. I'd love to get this all documented for tinkerers, apps, and integrations.

Hi,
I have the Fiat 500e vehicle and try to do some specific actions.
For example: Stop charging on 80%, Start AC remotely, Monitor vehicle via mobile phone and so on.

It seems that you already started to do the similar things. Will be much appreciate if you can share some experience.
As soon as I will get connection to CAN BUS, I also is ready to share logs and other information per your interest.

I have two ELM327 bluetooth dongles (one is normal, another is modified as "Yellow adapter") and they work correctly via android mobile phone and also on PC - Alfa OBD, Multiecuscan. I think to connect the wires to RX and TX pins and then connect them to PC serial port and log all exchange.
Trying to connect to dongle via OBD2 terminal is succeeded - for first testing purposes, but I wasn't able to get the response from CAN BUS. Can you share some initialization commands for ELM327 to get for example the SOC of the battery?

Thank you in advance.