PROCEEDINGS OF THE INSTITUTE OF VEHICLES 5(109)/2016
Krzysztof Rokicki1, Mateusz Witkowski2
METHODS OF OBTAINING OF LIVE DATA RELATED WITH DYNAMICS
OF VEHICLE, BASED ON DATA RECEIVED FROM ON-BOARD
DIAGNOSTIC SYSTEMS
1. Introduction
On-board diagnostic systems of cars allow to watch live selected operating
parameters. Some of these parameters associated with the operation of the engine and the
automatic transmission has been normalized. Among these parameters are Eg. vehicle
speed, engine speed, lambda values, the temperature of the engine coolant, etc. Access to
the data is possible in real time through the diagnostic connector of the vehicle, using
one of the communication protocols. Standards describe only the selected parameters,
and then only for the engine controller. Almost all the electronic systems of the vehicle
can send data on the selected operating parameters, but these data are not covered by the
standards. This article presents how can access the data from the controller ABS / ESP,
which relate to the behavior of the vehicle on the road - the speed and acceleration.
2. Acquisition and analysis of data
2.1. Data acquisition from ABS/ESP
The module of the ABS / ESP is responsible for the vehicle features such as:
• preventing wheel lock during braking of the vehicle,
• preventing wheel slip during vehicle acceleration,
• Stability Control in vehicles equipped with ESP,
• vehicle braking or emergency braking of the vehicle in cars equipped with
systems Adaptive Cruise Control or Forward Collision Warning
The ABS / ESP module, in order to carry out their tasks, it must have of all the data
about the vehicle speed and the track of the vehicle. On the basis of these data performs
its basic tasks. These data are derived from the wheel speed sensors at each wheel. Data
on the track and driving trajectory derived from ESP sensor that registers: longitudinal
acceleration of the vehicle, the lateral acceleration of the vehicle, angular velocity of the
vehicle in the vertical axis. It is measured as the angle of the steering wheel. Most of
these data may be live preview via an external diagnostic scanner. These data can also be
used for other purposes, Eg. the test of vehicle dynamics and others.
2.2. Access to the data
Access to these data is possible via the vehicle diagnostic connector (DLC), using
one of the communication protocols. Standard OBD II in the document SAE J1962
describes the diagnostic connector for communication between the controllers in the
vehicle and the external diagnostic scanner. It is a 16-pin connector (2 rows x 8 pins).
OBD II connector must be located inside the vehicle, the center console and the driver's
side.
1
2
Krzysztof Rokicki, M.Sc. Eng.; Institute of Vehicles, Warsaw University of Technology
Mateusz Witkowski, M.Sc. Eng.; Institute of Vehicles, Warsaw University of Technology
83
The document SAE J1962 defines the pins in the connector (fig. 1):
1. 2. “+” VPW (SAE-J1850)
3. 4. Battery ground
5. Sensor ground
6. CAN-H (ISO 15765-4 and SAE-J2234)
7. „K” line KWP2000, ISO (ISO 9141-2 and ISO 14230-4)
8. 9. 10. “-” PWM (SAE-J1850)
11. 12. “+” PWM (SAE-J1850)
13. 14. CAN-L (ISO 15765-4 and SAE-J2234)
15. „L” line KWP2000 (ISO 14230-4)
16. Battery +12 V
SAE-J1850 – VPW
SAE-J1850 – PWM
ISO 9141-2 / ISO 14230-4
CAN – ISO 15765
Fig. 1. Data Link Connector (DLC) pinouts
For vehicles produced in the past 10 years, the current standard of communication is
via CAN-Bus. It enables diagnostic communication with the engine control unit, but also
in many vehicles, with all the other control units and electronic modules in the car,
including ABS / ESP. Presented in this article tests were performed on the Jeep Grand
Cherokee 2008. This vehicle is equipped with Bosch ABS / ESP system. The control
unit of the ABS / ESP is communicating with an external diagnostic device diagnostic
module by FCMCGW module (Gateway), diagnostic CAN-bus and diagnostic connector
DLC (fig. 2).
84
Fig. 2. Jeep Grand Cherokee 2008 - CAN bus circuit schematic [1]
Diagnostic data are transmitted using a data transmission protocol ISO-TP, which is
described by ISO 15765-2 [2]. ISO-TP, is an international standard for sending data
packets over a CAN-Bus, especially Diagnostic CAN in vehicles. The protocol allows
for the transport of messages that exceed the eight byte maximum payload of CAN
frames. ISO-TP segments longer messages into multiple frames, adding metadata that
85
allows the interpretation of individual frames and reassembly into a complete message
packet by the recipient.
Diagnostic commands are exchanged between the controller of ABS / ESP and
Diagnostic Scanner using a diagnostic protocol Keyword Protocol 2000 (KWP2000) [3].
KWP2000 is a communications protocol used for on-board vehicle diagnostics systems
(OBD). This protocol covers the application layer in the OSI model of computer
networking. The protocol is standardized by International Organization for
Standardization as ISO 14230. KWP2000 also covers the session layer in the OSI model,
in terms of starting, maintaining and terminating a communications session.
To receive data from a vehicle with the actual data from the controller of the ABS /
ESP, we must have the following data:
 CAN-IDs for Request and Response in Diagnostic Session of ABS/ESP module
 Parameters ID of searched parameters (Eg. Wheels speed)
These data can be obtained by analyzing the communication between the vehicle
and diagnostic scanner, looking over the speed data of each of the wheels. The process
of identification of the parameters sent via CAN networks between ABS/ESP module
and Diagnostic Scanner is easier thanks to the nature of operation of these networks –
the data sent via such networks is not encrypted and can be received by all the modules
connected to the network. Thus it is possible to connect an additional node whose task
will be to eavesdrop on the traffic.
In this case all the traffic are diagnostic commands transmitted between ABS/ESP
module and diagnostic scanner. To collect of communication data can be used any CANbus sniffer. When the CAN-bus sniffer is switched to the CAN network, the recorded
data stream can contain the following frames:
0x784
0x785
0x784
0x785
02 21 01
0A 61 01 00 00 00 00 00
30 00 00
00 00 00
2.3. Analysis of data
When we use the ISO-TP protocol, we find that these frames give two messages:
Request: 21 01
(Parameters ID)
Response: 61 01 00 00 00 00 00 00 00 00
In the case when the vehicle travels at a speed of 100km/h we get:
Request: 21 01
Response: 61 01 27 10 27 10 27 10 27 10
Next problem which needs to be resolved is the relevant interpretation of the
transmitted data [4]. Knowledge from the areas of mechatronics and car telematics, as
well as familiarity with the tasks fulfilled by respective modules in the data exchange
network in the examined vehicle are indispensable here. Advanced diagnostic software,
enabling the operating parameters of respective modules to be viewed via the OBDII onboard diagnostic system, may also prove useful here.
When we use the KWP2000 protocol, we find that 61 01 bytes are response for 21
01 request, and data of response are 8 bytes: 27 10 27 10 27 10 27 10 (values are in hex).
86
Each two of this data are speed measured for each vehicle wheel. 0x2710 = 10000
(dec). In our case, speed of vehicle was 100km/h, therefore, each two bytes provide
information about the speed with an accuracy of 0.01 km/h.
Similarly, analyzing diagnostic communication between the vehicle and the
diagnostic scanner, looking over the data from the sensor ESP. Performing similar
operations as above, it can register the sample data:
Request: 21 02
Response: 61 02 00 A0 05 04 FA 00 2C 10
At the same time, diagnostic scanner provides data:
Steering Angle Sensor Position: 7.0
Yaw Sensor: 2.9 Deg/s
Pressure Sensor: 12.74 bar
Lateral Acceleration: 0.044 G
Longitudinal Sensor: 0.16 G
Analyzing some cases, you can get information about which byte carries which
information, and what scaling have been applied.
3. Summary
The presented method of obtaining data from electronic systems can be used to
retrieve data from various systems in the vehicle. This method is particularly easy to use
in vehicles equipped with diagnostic CAN-bus. Data recorded from the vehicle may be
used for model validation, testing the behavior of the vehicles, the analysis of driver
behavior or registration data by the black box.
References:
[1]
Chrysler Wiring Diagrams, FCA. https://www.techauthority.com/
[2]
ISO 15765-2:2016 Road vehicles -- Diagnostic communication over Controller
Area Network (DoCAN) -- Part 2: Transport protocol and network layer services.
[3]
ISO 14230 Road vehicles – Diagnostic systems – Keyword Protocol 2000
[4]
Rokicki K., Szczurowski K.: Methods of identification of data transmitted in the
in-vehicle CAN-BUS networks, w: Proceedings of the 20th International
Conference on Methods and Models in Automation and Robotics, 2015, ss. 946949
Abstract
The paper presents a method to extract data from the on-board diagnostics system
of the vehicle. The focus was set on current data provided by the controller of ABS /
ESP, such as the rotational speed of each wheel of the vehicle, longitudinal acceleration
of the vehicle, the lateral acceleration of the vehicle, the angular velocity of the vehicle
in the horizontal plane and the angle of the steering wheel. These data can be used eg. To
study the dynamics of vehicles, verification of models, etc. The methods partly based on
reverse engineering, and partly on the standards describing the diagnostic
communication between the vehicle and the external diagnostic scanner KWP2000 and
ISO-TP. The results of this method of obtaining data was shown on the example of the
vehicle Jeep Grand Cherokee from 2008.
Keywords: OBD, reverse engineering, vehicle speed
87
METODY POZYSKIWANIA DANYCH RZECZYWISTYCH RUCHU POJAZDU
Z SYSTEMU DIAGNOSTYKI POKŁADOWEJ
Streszczenie
Praca przedstawia metodę pozyskiwania danych z systemu diagnostyki pokładowej
pojazdu. Skupiono się na danych rzeczywistych udostępnianych przez sterownik
systemu ABS/ESP, takich jak: prędkości obrotowe każdego z kół pojazdu,
przyspieszenie wzdłużne pojazdu, przyspieszenie poprzeczne pojazdu, prędkość kątowa
pojazdu w płaszczyźnie poziomej oraz kąt położenia kierownicy. Dane te mogą być
wykorzystywane np. do badań dynamiki pojazdów, weryfikacji modeli itd.
Przedstawione metody częściowo bazują na inżynierii odwrotnej, a częściowo na
normach opisujących komunikację diagnostyczną pomiędzy pojazdem, a zewnętrznym
skanerem diagnostycznym. W pracy przedstawiono wyniki zastosowania tej metody
pozyskiwania danych na przykładzie pojazdu Jeep Grand Cherokee z roku 2008.
Słowa kluczowe: OBD, inżynieria odwrotna, prędkość pojazdu
88