Reverse engineering my gauges

General discussion about interfacing with the CAN bus
Post Reply
nate42
How the heck did I end up here?
Posts: 2
Joined: 2018 Mar 11 14:11

Reverse engineering my gauges

Post by nate42 » 2018 Mar 11 15:31

I've changed the ECU to aftermarket model, Link Fury to be precise, this silenced the gauges on the car. New ECU can output CAN messages, I just need to know what kind...

Background and what I know already

Car in question is 2012 Caterham R300 with Italian EFI Technology ECU from the factory. One of the first Euro emissions/regulations approved Caterhams.

I have five gauges: Speed, RPM, Fuel level, Coolant temperature and Oil pressure. They are made by Caerbont Automotive Instruments http://www.caigauge.com/

Using Lawicell CANUSB dongle and usb-utils/Wireshark in Ubuntu Linux I've managed to record canbus traffic with the old ECU. Just power on, engine not running because engine setup has changed a bit. From there I found this kind of packages:

Identifier: 0x00040000
Data 8 bytes: 00 00 00 00 f7 4b 18 62

Identifier: 0x02010000
Data 3 bytes: 00 00 9c

Identifier: 0x03040000
Data 8 bytes: 0f 8d aa ff ff ff ff ff
0f 8d ab ff ff ff ff ff

Identifier: 0x14010000
Data 6 bytes: 00 00 00 00 30 01

What should I do next? Are there any other options than the hard way? By hard way I mean heating the coolant sensors, putting oil pressure sensor under pressure, drain the gas tank, etc and while doing those things record canbus traffic with old ECU and see what bytes change.

All ideas on how to continue are welcome!

p38lightning
How the heck did I end up here?
Posts: 1
Joined: 2013 Dec 22 00:37

Re: Reverse engineering my gauges

Post by p38lightning » 2018 Apr 04 19:31

Hi nate42,
Hmmm, the hard way...however there are a few tricks to make it a bit easier.

For simple sensors just monitor the frames and unplug a sensor. The applicable data should go to "00" or "ff". If multiple data goes to "00" or "ff" then you've at least narrowed down the data to monitor when running the car.
As for converting the HEX data to "real" numbers, it is usually based on the range the sensor has to read to.
For example, ECT will run from -40degC (OBD default for a disconnected sensor) and up to 120degC or so - meaning that the temperature range fits within a single byte at a 1degC resolution. So when you find a suspected temperature data byte just do a direct HEX to DEC conversion - if the number looks right it probably is (though you can point a laser thermometer at the block and confirm it).
RPM will be 2 bytes due to the size of the number, etc.
Hope this helps and let us know how you go.

nate42
How the heck did I end up here?
Posts: 2
Joined: 2018 Mar 11 14:11

Re: Reverse engineering my gauges

Post by nate42 » 2018 Apr 25 03:10

I'm ashamed to inform that I couldn't find time to complete this task. I took the easy way and swapped the gauges. Bought DASH2 PRO, shift lights are useful as the gearing is quite short on these cars.

Image

This was really easy to setup and shows CAN data from the Link Fury ECU we use. It is road legal and all the wiring was ready for it from the OEM gaiges. Last thing to do is to replace those round gauges on the dash.
Image

For that I've found VDO Singleviu gauges. They have CAN built in, so they can also show data straight from the ECU. If these work as they advertise these will be the future of ECU swaps on older cars where these fit the style.

Image

Dash2 pro already arrived and worked as promised straight out the box. I will report back how it goes with Singleviu gauges.

Post Reply