Question about FIAT CAN protocol

General messages
Post Reply
sv095
Posts: 4
Joined: 01 Mar 2012, 13:13

Question about FIAT CAN protocol

Post by sv095 » 01 Mar 2012, 13:38

Hi!
I have tested Multiecuscan, but since I just want to sniff and analyze the CAN bus traffic, and I suppose that you know more than me about Fiat CAN bus protocols, I want to make you a question.

My car is a Fiat Grande Punto 2008. I use an ELM327 chip, I have tried the AT MA command (Monitor All), and I have read some interesting data, and I am now trying to decipher the STRUCTURE of the frames.

I have something like this (with headers turned on: AT H1):
[...]
00 30 A0 02 40 00 00 00 00 01 00 0C
0A 18 A0 01 01 00 80 63 01 24 19 00
06 18 A0 01 00 29 03 2F 00 18 58 00
06 28 A0 01 00 21 00 80 00 20 00 20
0A 28 A0 01 00 00 2D E0
00 1C A0 06 38 2A CA 1B 3B A9 FD 9D
00 14 A0 06 3B 6C B9 81 38 FB 0A 1B
02 10 A0 06 FF 02 FF 00 00 00 00 00
08 10 A0 00 00 FF 08 00
00 30 A0 02 40 00 00 00 00 01 00 0D
0A 18 A0 02 01 00
06 18 A0 01 00 27 03 46 00 18 58 00
06 28 A0 01 00 21 00 80 00 20 00 20
00 1C A0 06 08 2A CA 1B 0B A9 FD 9D
00 14 A0 06 0B 6C B9 81 08 FB 0A 1B
02 10 A0 06 FF 03 FF 00 00 00 00 00
08 10 A0 00 00 FF 0C 00
[...]

The first four bytes seem to be the header, however I have read that the headers of CAN 15765-2 frames (29 bits extended identifiers) have this structure:
Description - Number of Bits
SOF - 1
Arbitration Field - 32
Control Field - 6
(39 Bits preceding data)
Data Field - 0…64 0…64 data bits
CRC Field - 16
ACK Field - 2
End of Frame Field - 7
Interframe Space - 3
(28 Bits succeeding data)

And obviously, my frames are quite different from this structure...
I have read that maybe, Fiat uses RAW CAN protocol instead of ISO 15765... but I don't know anything about raw CAN

can you help me? what are these frames? is a proprietary protocol?
I am doing a researching work, and I need to know this kind of information...

Thank you!

ARomeo
Posts: 86
Joined: 06 Jan 2010, 10:45

Re: Question about FIAT CAN protocol

Post by ARomeo » 05 Mar 2012, 20:38

see attachment
Attachments
Fiat .pdf
(252.4 KiB) Downloaded 2627 times

sv095
Posts: 4
Joined: 01 Mar 2012, 13:13

Re: Question about FIAT CAN protocol

Post by sv095 » 06 Mar 2012, 08:56

Thank you!
I have read that, but I think it is not what I was looking for... I mean, the PDF describes the Fiat 9141 protocol but that protocol was used in 1999, my car is 2008... I think my car does not use that protocol... I think it uses some propretary protocol from Fiat, running over the CAN bus... but I am not sure, and I would like to know that because I am doing a research work and I have to explain the protocol or at least the structure of the frames

sv095
Posts: 4
Joined: 01 Mar 2012, 13:13

Re: Question about FIAT CAN protocol

Post by sv095 » 15 Mar 2012, 13:20

I have been making some discoveries.

I think FIAT Grande Punto uses protocol UDS or ISO 14229 for diagnostics, over protocol ISO 15765, and then over ISO 11898-2 (used in Data Link and Phisical layers), and what I see when monitoring the traffic are raw CAN frames (ISO 11898), although the frames are encoded using a proprietary protocol to encode the headers and data fields.

It is like, for example, ICMP<IP<Ethernet frames, where Ethernet is ISO11898, IP is ISO15765 and ICMP is ISO14229

I am not 100% sure, so I would like someone to tell me whether I am wrong or not.

acab
Posts: 18
Joined: 16 Aug 2012, 00:33

Re: Question about FIAT CAN protocol

Post by acab » 16 Aug 2012, 00:39

i make diy canusb
and try sniff c-can(500kbit) from motor can bus.

i have some info in attached files

if anybody have more info about fiat c-can - please pm me. i have some questions ;)


040 7 immo code response
041 7 immo code request
046 8 asr 0
081 8 mot sel
0C2 6 ge
146 8 asr 1
166 8 asr 2
361 8 mot 1
3A1 8 mot 2
560 8 status b-can
561 8 status c-ncm
562 2 status c-nfr
566 8 status c-nfr
5A0 4 vehicle speed and odometer
66A 0 RTR
680 8 end of line configuration
6A0 6 time + date
6A0 0 RTR
6AA 0 RTR
t6A 0 RTR
Attachments
alfa_romeo_c_can_before_ign.txt
(409.8 KiB) Downloaded 1213 times
alfa_romeo_c_can_after_ign.txt
(738.85 KiB) Downloaded 1005 times

ilpollicenero
Posts: 1
Joined: 31 Jan 2017, 10:03

Re: Question about FIAT CAN protocol

Post by ilpollicenero » 31 Jan 2017, 10:12

sv095 wrote:Hi!

The first four bytes seem to be the header, however I have read that the headers of CAN 15765-2 frames (29 bits extended identifiers) have this structure:
Description - Number of Bits
SOF - 1
Arbitration Field - 32
Control Field - 6
(39 Bits preceding data)
Data Field - 0…64 0…64 data bits
CRC Field - 16
ACK Field - 2
End of Frame Field - 7
Interframe Space - 3
(28 Bits succeeding data)

And obviously, my frames are quite different from this structure...
I have read that maybe, Fiat uses RAW CAN protocol instead of ISO 15765... but I don't know anything about raw CAN

Thank you!
The sniffed data do not correspond to the structure because it seems they are in HEX format but the structure refers to bits

acab
Posts: 18
Joined: 16 Aug 2012, 00:33

Re: Question about FIAT CAN protocol

Post by acab » 07 Feb 2020, 00:07

I still need contributors, because for me hard to investigate all packets...

https://github.com/pompushko/fca-canbus-monitor?files=1

can2sky
Posts: 1
Joined: 31 Mar 2020, 10:35

Re: Question about FIAT CAN protocol

Post by can2sky » 31 Mar 2020, 10:37

acab wrote:
07 Feb 2020, 00:07
I still need contributors, because for me hard to investigate all packets...

https://github.com/pompushko/fca-canbus-monitor?files=1

Hi, acab. How can i message you? About cooperation

htevents
Posts: 9
Joined: 12 Feb 2019, 08:22

Re: Question about FIAT CAN protocol

Post by htevents » 30 Apr 2020, 12:11

also want to jump into this thread, I also want to know a pretty detailed list of the CAN messages/ID's.
I want to create a full digital/LCD instrument cluster for my Punto 1.3Mjet 12+ and need to know what ID's tell what to the cluster, for example: What ID/message will turn on the Engine check light, the turn signal indicators, ABS light, etc.

So the list should look a bit like this:
ID: .. .. .. .. ..
Function: Engine checklight ON

ID: .. .. .. .. ..
Function: Left Turn signal ON/OFF

Etc.

Did someone already record ID's like this? Does somebody know if a list like this exists and if yes where?

I am based in the Netherlands, maybe someone with a bit more knowledge of the CAN system wants to help me out with this, to build this cool project?

Post Reply