CAN Integration: Multiplexing & CRC (Rolling counters)

[Goingnowherefast]

Hey guys, 

 

As this is my first post I'll do a brief introduction. My name is Will and I'm doing a complete reverse engineering and CAN controls integration on the Porsche 987/997 platform. We're actually sponsored by Link and most of the controls are already sorted and working like OEM. There's two signals that I want to send out that change depending on the cycle. Those are: 

1. CRC Rolling counter - this counter goes from 1 -> 2 -> 3 at a rate of 25 Hz while the actual CAN message refreshes at 100 Hz. Meaning, I have to update the counter once every 4 messages cycles. 

2. Mux (Multiplexer) - this is a bit more complex. However, I'm lucky enough to have access to a standalone car that is already running an OE aftermarket ECU and everything works (mostly). This has to cycle from 0 -> 37 (physical). 0 when CRC is 1 or 2, 37 when counter is 3. 

 

Has anyone accomplished something similar? Let me know how you did it. Otherwise, I'll keep digging and update the post if I figure it out. 

Thanks, 

-Will 

[Adamw]

1. This sounds more like just a frame counter rather than a CRC?  A CRC usually uses all bytes in an algorithm with a polynomial applied so it generates a value that is only true for the speciifc set of bytes.  If it is just a counter that increments by 1 for every 4th send and rolls back to zero once you hit 255 you can just use a timer.   Example below I just modified from one of my files.  For this example you would just send Math block 2 output in the CAN message where the counter needs to be.  0-255 at 25Hz would take 10.2sec. So we set up a timer to reset every 10.2sec.  We then multiply that time by 25 to get an integer that increments by 1, 25 times per second.  Pic below looks like it skips at around 10 but that is just the way I have recorded the gif.  

 

2. Need a better description of how this counter works.  What happens when counter is 4 do we restart?  so 0, 0, 37, 0, 0, 37...?

 

[Goingnowherefast]

18 hours ago, Adamw said:

1. This sounds more like just a frame counter rather than a CRC?  A CRC usually uses all bytes in an algorithm with a polynomial applied so it generates a value that is only true for the specific set of bytes.  If it is just a counter that increments by 1 for every 4th send and rolls back to zero once you hit 255 you can just use a timer.   Example below I just modified from one of my files.  For this example you would just send Math block 2 output in the CAN message where the counter needs to be.  0-255 at 25Hz would take 10.2sec. So we set up a timer to reset every 10.2sec.  We then multiply that time by 25 to get an integer that increments by 1, 25 times per second.  Pic below looks like it skips at around 10 but that is just the way I have recorded the gif.  

2. Need a better description of how this counter works.  What happens when counter is 4 do we restart?  so 0, 0, 37, 0, 0, 37...?

 

Wow, Thanks Adam. This is honestly epic feedback. Having dealt with ~5+ other standalones at this point I can say that at least anecdotally, Link's support has been absolutely top notch. Answers/details in red. 

1. Yep, in this case it's just a frame counter. I thought there was a CRC in another message, but upon further review of the CAN trace it looks like it's just a counter also. I've attached the CAN trace of both "Count1" and "Mux1" which will paint a better picture of how the two interact and what I'm looking to emulate. 

To recap: 

When "Count1" = 0, "Mux1" = 0 

When "Count1" = 1, "Mux1" = 0 

When "Count1" = 2, "Mux1" = 0 

When "Count1" = 0, "Mux1" = 0x25 (37 in decimal) 

2. Hopefully this was answered in #1. To expand a bit more on this platform, Porsche shares the controls and most modules between the 987 Boxster/987 Cayman/997 911/997 Turbo S etc. In order for PSM to function correctly (as well as mitigate any CANbus errors from each module) the values sent on "Mux2" must match what the controllers are looking for as far as model code, transmission code, engine code etc. Mux2 is a bit more complex, so maybe it's better to talk about that over email or the phone. There's also a good bit of proprietary information concerning the table I've created with all the models/transmissions/options etc. 

 

 

[Adamw]

Ok, counter 1 will just need the timer2 changed to 0.16s to make the count cycle 0-3 instead of 0-255.

For the mux there are several ways you could do this, below is the option I usually go for as it allows fairly complicated sequences to be generated:

I would use a math block to divide our "counter 1" by 3, with decimal places set to 0.  This will give us a 0 result for counts 0,1&2, and a 1 result for a count of 3.  

Now if we consider our MUX decimal value of "37", in binary it is 00100101. 

 

So in our CAN message we can just place the "math block 3" which generates a "0 or 1" in the 3 bit positions where we would have a 1 in Binary to generate dec 37.  

 

Broadcast result (counter in first byte, mux in 2nd):

 

Note also if you have relatively complete CAN information for these vehicles we could likely hardcode this into the firmware as a preconfigured stream in the dropdown selection if you were happy for every user to have access to it.  

 

 

[Goingnowherefast]

On 12/14/2022 at 4:34 PM, Adamw said:

Ok, counter 1 will just need the timer2 changed to 0.16s to make the count cycle 0-3 instead of 0-255.

For the mux there are several ways you could do this, below is the option I usually go for as it allows fairly complicated sequences to be generated:

I would use a math block to divide our "counter 1" by 3, with decimal places set to 0.  This will give us a 0 result for counts 0,1&2, and a 1 result for a count of 3.  

Now if we consider our MUX decimal value of "37", in binary it is 00100101. 

So in our CAN message we can just place the "math block 3" which generates a "0 or 1" in the 3 bit positions where we would have a 1 in Binary to generate dec 37.  

Broadcast result (counter in first byte, mux in 2nd):

Note also if you have relatively complete CAN information for these vehicles we could likely hardcode this into the firmware as a preconfigured stream in the dropdown selection if you were happy for every user to have access to it.  

Epic stuff. Thanks for the reply. All makes perfect sense, and I think I have both multiplexers set up now. However, I don't have an ECU on-hand yet so I'm working to acquire one so I can actually take some CAN logs to ensure it's outputting what I want. Thanks again for the help.