independent wheel speed

[prototux]

independent wheel speed

[Lanchon]

ok i saw this: https://git.prototux.net/reverse-engineering/psa/canbus/-/issues/140
those messages would be on LS.CONF?

[Lanchon]

and i found this, yay!! https://git.prototux.net/reverse-engineering/psa/canbus/-/issues/92

but it only provides the average of the front wheels... strange. i don't think a single sensor is before the differential. individual wheel speeds must be available for ABS to work, am i right?

44D VROUES_ABR_44D_REGIME_MOYEN_ROUES_AV_HS1_44D
44D VROUES_ABR_44D_VITESSE_VEH_ROUES_AV_HS1_44D

i don't know much french. could it be that the first item is the average and the last the difference?

thanks!

EDIT:
now i found this: https://git.prototux.net/reverse-engineering/psa/canbus/-/issues/73

:)))

[prototux]

Hello,

Sorry, i wasn't at my computer, but for the TPMS and wheel data:

• the 0x50F and 0x60F are the ones for the TPMS, they're on the IS bus and AFAIK they aren't forwarded to CONF, so no direct mean to have the raw data on the CONF bus
• • the 0x50F has state bits (front left, front right, rear left and rear right respectively, one per byte)
• • the 0x60F has raw data for each wheel (need to dig deeper to get the reverse engineering we've done on this, on our discord channel)
• there's the 0x1E1 on the CONF that seems to be the TPMS data re-formatted for consumption by the EMF, it's an equivalent to the 0x50F, not the raw data)
• there's also the 0x1B4 that gives speed data, but it doesn't give individual wheel data
• IIRC there's no frame that gives the 4 wheel individually, the most precise is the 0x44D and 0x30D

I'll dig deeper tomorrow about what i can find about these :)

[Lanchon]

thank you very much for your help!!

yes, i had found 0x30D. but according to this it does provide all wheels; why do you say it doesn't?

there's also counters in 0x0E6. counters would be even better than speed for this application. but i don't understand: does it report front or rear wheels? or are there two versions of the frame? what is the meaning of 0E6 (C4(B7))? what are those parenthesis?

tire pressure info should most surely be forwarded to CONF because the stock stereo/nav can be configured to display an info page for it. but i don't care about it: it seems the main display in the instrument panel should be able to display tire faults in a useful way as BSI gets fed individual statuses for tires via 0x50F. absolute tire pressure approximations from indirect TPMS would be really bad quality anyway and i'm glad i don't need to generate/fake those when all i really care about is detecting faults.

i spent part of the day today preping to tap onto the bus, i hope to be logging traffic soon.

[Lanchon]

success!!! im on HS.IS. 0x30D gives me the 4 wheel speeds and im also able to get the steering position, so i have everything i need at a minimum already.

no sign of 0x0E6 on IS. 0x44D is strange there is a fourth number that is typically slightly higher than twice the other 3. it cant be a sum then, IDK. but 30D is what i need anyway.

thanks for adding 50F in detail, that will sure help with reporting.

[prototux]

Great! the C4(B7) is because autowp (the main source for this frame) got it from a citroen C4 (with the code B7)

I'll try to document 0x30D, 0x0E6 and 0x44D after i've finished to implement isotp for the next version of libpsa :)

In the meantime, don't hesitate to join the discord chan, we discuss the finding there before they're documented (as the yaml files are done "when we have time to"). The link is in the README file.

[prototux]

I've just found out, you probably can have the wheel pressure data (almost the same format as 0x50F) on the CONF bus, at 0x3A1, as well as 0x052 (rear wheels) and 0x1D2 (front wheels) :)

[Lanchon]

i joined the discord chan, but i'll reply to this here anyway.

I've just found out, you probably can have the wheel pressure data (almost the same format as 0x50F) on the CONF bus, at 0x3A1, as well as 0x052 (rear wheels) and 0x1D2 (front wheels) :)

thank you! i could not find any docs on those frames so far. yes, it must be on CONF because the radio is supposed to show tire status.

i've bad news. as i told u earlier, i was able to access steering position and individual wheel speeds on the HS.IS bus. this is enough to build my TPMS model.

but i need two other things:

1. a way to configure (ie: reset) the TPMS using existing inputs.
2. a way to display the tire status and alert on failure.

my existing microcontroller board only has one can port, so i can't tap both IS and CONF at the same time.

the reset procedure (1) can be implemented using a sequence of discreet inputs (such as break pedal push) from the very few that are available on the IS bus (most user interaction is CONF-only); this is not great but acceptable.

i was hoping to implement the display (2) by sending 0x50F frames, and maybe also 0x60F, and expected the instruments to show faults. i successfully injected IS frames (tested with tachometer) but all 0x50F and 0x60F frames are ignored: nothing shows on the instrument panel. :(((

this is either because: 1) the BSI does not forward my frames to CONF, 2) the instrument panel ignores the CONF messages, 3) both of the former, or 4) because 0x50F and 0x60F are meant to be on the CONF bus o begin with.

1, 2 and 3 could be PSA selectively not enabling software in the BSI/instruments of the car did not include TPMS from factory, possibly to thwart efforts like mine. could this be possible?

4 would be strange because indirect TPMS needs access to ABS/ESP sensors in IS. but maybe indirect TPMS was not foreseen in AEE2004 and the only available TPMS (direct from transducer) would make more sense in CONF.

• is there a way to know for certain whether 0x50F and 0x60F belong to IS, CAR or CONF?
• is there a way to access CAR/CONF from IS or DIAG?
• is there comfortable access to CONF (other than removing the stereo)? i'm using the OBD2 port for now.

not all is lost, i could still use a relay to switch from IS to CONF on tire failure to report. if the instrument panel displays the failure... really ugly.

or i could simulate failure of some other component (eg, ABS/ESP) so that the BSI uses the display to make you stop driving.

or i could just BEEP BEEP BEEP...