Serial Decoding question - Pico Technology (2024)

Re: Serial Decoding question

• Quote

Postby Steve Smith » Tue Nov 20, 2018 10:25 am

Decoding CAN into human readable data can be challenging at best and a nightmare at worst.

Without the relevant data base (.dbc file) that remains proprietary information of the vehicle manufacturer, attempting to fully decode all CAN data remains “an adventure”

With that said, there are a number of ways to identify specific Nodes/ECU’s present on the network using PicoScope, requiring an element of reverse engineering

N.B these techniques are not without question and certainly not definitive in answers

CAN Decoding using OBD-II PIDs

With reference to https://en.wikipedia.org/wiki/OBD-II_PIDs#Service_09 we can use OBD-II as a source to begin deciphering CAN data

To obtain VIN via CAN, we need to send the following data (09 02 Hex) from our scan tool to the Engine ECU (This assumes your vehicle uses the CAN Protocol to request OBD-II data)

Mode or Service 09 (Hex) = Request Vehicle information
Standard PID 02 (Hex) = Can I have VIN (Data Bytes returned = 17)

In order to set up PicoScope to allow sufficient time to send the request for VIN (from the Scan Tool) whilst simultaneously capturing CAN data, use the following setting.

Capture CAN data with 2 MS at 100 ms/div.
This gives you 32 buffers with a total capture time of 32 seconds (using PicoScope 4425)
100 ms/div x 10 divisions per buffer = 1000 ms (1 second) sweep time per buffer
1 second buffer x 32 buffers = 32 seconds of capture time
Here we ensure sufficient resolution to decode on math channel A-B
https://www.picoauto.com/library/traini ... onus-class

Use the relevant High Impedance probes (TA375) x 10 attention for increased bandwidth up to 100 MHz (CAN Hi Channel A CAN Lo Channel B)

Whilst capturing CAN data use a generic OBD Scan tool to request VIN data, once VIN has been obtained, stop PicoScope and save the data.

Here we used the DrewTech MongoosePro ISO/CAN 2 OBD lead (from our NVH kits) to obtain VIN using the J2534 ToolBox software included with the Mongoose lead https://www.picoauto.com/products/noise ... h-overview

In order to minimise and reduce constantly changing CAN traffic, have the ignition switched on (with battery support) but engine off during the VIN and CAN acquisitions

Decode the captured CAN data on math channel A-B and ensure “All buffers” selected in the decode table (Decode in Hex)

Within the Decode table search field, type 09 02 (Service 09 PID 02) and select DATA as your chosen search column

The above image highlights the data containing 09 02 and the associated ID for this data is 7 DF

7 DF is therefore our Scan Tool. Double click on this row of data (Buffer 12 Packet 165) to zoom in on the CAN Frame in the graph view.

Now change the Hex decode format to ASCII as the VIN is returned from the Engine ECU in American Standard Code (ASCII) https://en.wikipedia.org/wiki/OBD-II_PIDs#Service_09
Scroll down the data column to find the VIN revealed in multiple data packets.

In the example below the VIN: WBA/3K52020/F580489 is revealed at:
Buffer 12 packet 170 (WBA)
Buffer 12 packet 177 (!3K52020)
Buffer 12 packet 187 (“F580489)

If we note the above packet numbers (170, 177 & 187) and revert back to the Hex format from ASCII we can see the ID for these data fields is 7 E8 which translate into Engine ECU. Be aware the Engine ECU will have other ID’s and not just 7 E8
To simplify the view of the decoded data we could create a Link file by clicking on the Link button and select Create Template within the decode table. You will now be prompted to name and save a .CSV file to a location on your PC. There is a great article here https://www.picotech.com/library/oscill ... l-analysis discussing serial decoding and creating a link file

Open the newly saved link file and begin to populate the cells with the relevant data.

For example:
In the ID column type 7 DF and in the adjacent column ID Description type SCAN TOOL
In the ID column type 7 E8 and in the adjacent column ID Description type ENG ECU
In the Data column type the Hex data found in the decode table “Packet 170”, 10 14 49 02 01 57 42 41 and in the column Data Description type VIN START WBA.

Repeat this process for all known ID’s and Data fields to create a more concise link file and then save all entries

With the link file created (and resaved to PC) return to the decode table of the psdata file and click on the Link button and select “Open”. Locate and select the above link file, then click “Open”. Your decode table (within PicoScope) will now populate with the human readable data you have entered into the link file.
Identifying other ECU’s on the CAN network can be achieved by disconnecting ECU’s whilst searching for the missing ID’s.

For example:
Capture 32 buffers of CAN data (where there are no reported faults) using the settings mentioned at the start of this post. Once captured select “All Buffers” and click on the Export button. This will export the decode table in .csv format for you to use the search, filtering and sorting functions of Excel.

Now capture another 32 buffers of CAN data but now with one CAN ECU disconnected. Ensure the disconnected CAN ECU does not contain a termination resister or serve as a link to other CAN ECU’s. Those ECU’s that link to other CAN ECU’s will normally have 4 x CAN wires (2 x twisted pairs) within their multiple/connectors. Disconnecting these ECU’s will result in a multitude of missing CAN ID’s! Once again, click on the Export button to export the decode table to Excel

Below is an example of a Mercedes Benz with the ABS ECU disconnected.
The decode table was exported with the ABS ECU connected (left column) and ABS ECU disconnected (right column)

Excel was then used to remove duplicate ID’s from the ID columns, then list all remaining ID’s in numerical order. Finally Excel is used to compare both columns and list missing ID’s.

Here we narrow down the relevant ID’s associated with the missing ABS ECU, but be aware, this is not an exact science and could result in revealing ID’s that have no relevance to ABS!

Moving onto to data logging with a third party network analyser.
There is a great video here https://youtu.be/Csn2pV3yQu8 that looks at a number of techniques in which to reveal ECU’s and data relevant to the CAN network via Intrepid Control Systems “Vehicle Spy” logging tool & software

This technique described in the video to identify the ABS ECU using the brake pedal signal could be used in a similar fashion with PicoScope. Here you would need to capture CAN data on channels A and B, then utilise channel C to capture the brake light off/on signal directly at the brake light switch. Try to capture a number of brake light off/on events in one buffer to simplify the analysis of CAN data

You could use the brake light off/on event to correlate changing data fields within the decode table. It would be interesting to see how soon such a high priority message is physically transmitted on the CAN bus once the brake pedal signal changes from off to on. I have not tried this myself but will make this an exercise to review the practicalities of such a technique

So as you can see, there are a number of routes to translating CAN data and identifying ECU’s present on the network, but it is challenging and most certainly time consuming without the relevant .dbc link file

I hope this helps, take care…….Steve