997 CAN BUS wizards wanted

Thank you! I know that getting this stuff is a lot of work, so I appreciate sharing the info. This is 100% DIY for me, so I dont have a massive database of cars to look at info.

It started as a 2007 Cayman S.

The info I have is listed as 9*7, so I would hope that it would be right for you.
If you want to PM me where you find something like Throttle Position or RPM I'll check against my file and can confirm.

Message 0x600 looks like the main climate control one
Byte 0 bit 3 AC switch
Byte 2 Refrigerant pressure 0-50.8 bar

Edited to add. 0x600 is a climate control unit message, 0x246 is an engine controller message. If I had to guess I would say that 0x600 would be used as the request and 0x246 is an output of the current status. Only a guess though, I've never played with these messages myself.

MC

I think you are right. 0x600 is 100% AC controls ( haven't mapped, but I logged while playing with controls and noted several bytes changing in 0x600).

I worked with AIM Sportline on the ECU to dash config and they won't give me any of the converted data. They sent me a locked CAN template ;(

Made it easier to get going, but I can't see those details.

I am confident that wheel speeds are 0x24a, byte 0/2/4/6 (FL/FR/LR/RR) if that helps.

Clutch seems to be 0x242

I will reply back if 0x624 works. I will sniff at the latest this weekend and look for that change when turning the AC on.

(saw your edit)

I looked at a raw log file I had a screen grab of, and I think you are right. Since the factory ECU is just sitting there (not controlling engine) 0x246 was not transmitted, only a bunch of 0x600

Im a MechE, so only working knowledge (but growing) of this.

JordonMusser said:

Clutch seems to be 0x242

Click to expand...

I can't see anything specific to the clutch, but an 'interlock' is mentioned which could well be it. That message does contain engine speed and throttle position amongst other things.

JordonMusser said:

I am confident that wheel speeds are 0x24a, byte 0/2/4/6 (FL/FR/LR/RR) if that helps.

Click to expand...

They are, but the lsb is not part of the wheel speed, so ignore that. Scaling is 0.02km/h per bit.

It sounds like you are on to the right things. I log all of my CAN bus data using a Race Technology data logger and Analysis software. I can log all of the raw CAN bus data and then pick it apart in the software as well as decoding live if required (I work at Race Technology which helps).

If you want me to confirm / deny or give pointers on messages just drop me a note and I'll help out where I can. I know what reverse engineering this stuff is like. I spend ages doing it on my 996 turbo years ago.

MC

Thank you. I will play a bit with further confidence (since my hunches are backed by some of your data).


Since I left the factory ECU in for now I made it easy on myself since the car starts/runs etc.

Eventually I would want to have the Motec transmit required messages so I can remove the factory ECU completely, but then is a few iterations down the road.

The only thing that will speed that up is if ABS requires messages to function (I moved the factory gauge cluster connector to under the dash, so I can plug it in to verify things like ABS/Airbag warnings quickly with out pulling out Durametric. Which I plan to do soon.

Hi Jordan, this is a super cool project and glad to see someone else doing a power-train swap digging through 9x7 CAN data!

I'm funny enough in the same boat as you doing a swap in an 06 Cayman and trying to get my A/C back. I worked through a lot of the CAN integration last summer and got close but could never get the A/C bits to play nicely.

I'm curious if you've made any progress on this since its been almost exactly a year. If not I'm willing to help make another push on this since there's a few DME signals I'm still hunting for.


I'll also share what I've been using to date for what its worth to folks.

I wanted to use the original instrument cluster where possible, and then add a second display for additinal information. So while I have the original DME, I've taken it our of the vehicle and am emulating the messages it would have been transmitting using a new powertrain supervisory controller and gateway that I've added.
Thats transmitting 4 higher priority and rate DME messages, and 3 lower priority and rate (presumably diagnostic) messages.

Here's what that looks like:
https://photos.app.goo.gl/mJn3wz8s9Lfz3gWU6

For Mux1 I'm transmitting the following:
Counter=0 Data=0
Counter=1 Data=0
Counter=2 Data=0
Counter=3 Data=0x25

For Mux2 the counter is the same, but all data is 0

I've put together a DBC with the specific message formatting and signal scaling that I'm using currently.

https://www.dropbox.com/s/gifv8lpcjqoj4l4/987_DRIVE_CAN_R1.dbc?dl=0

If I start broadcasting this once I sense ignition come on, and stop when it goes away, this gets me to a point where I have no CEL, I can use the instrument cluster, and I believe the ABS and airbags are both working normally. Which is great and has allowed me to use the car in a limited capacity for the past year.

Where I'm still limited:
-I want to find and understand the rest of the A/C control parameters
-I want to find and use the fan request signal that the DME sends the to front body controller for controlling the radiator fans
-I want to figure out how to convince the instrument cluster that the charging system is perfectly fine. After driving a bit, the instrument cluster currently throws an alarm for a charging system fault. It then repeats this every 10 minutes or so.

Here's where I left off with A/C signal work,

https://photos.app.goo.gl/FgUHZrdXLXuGwN759

Tyler

Hi Tyler, if you need any info on specific 997 DME messages, post details of the ones you need and I'll see what I can do to help. I only have DME info though.

MC

Hi MC,

Thanks for the tip you posted about Byte 0, bit 4 being about the AC compressor. I played with that some today and found that its recognized as "CAN compressor shutdown" within the climate control module. Asserting that bit sets compressor shutdown to "no" clearing the bit sets it to "yes". I'll need to update that DBC with this and the PSM data that's in this thread.

This feels like I'm one step closer now to having a climate control module that will transmit compressor requests when appropriate again. For some reason the module still lists "compressor status" as "inoperable" though no faults are stored. So the mystery continues for now...

As for specific DME messages - I'd have three requests:

1) the signal/s controlling the front end fan speed. Which are perhaps the same as or based on parameters A110_Air conditioner radiator fan request, and A120_Engine radiator fan request in the DME.

2) The compressor request bit and message that is received by the DME

3) a raw unfiltered CAN log from a perfectly happy car with working A/C that's been loved and still has all its bits. Through the full key cycle if possible, but I'll take any length log

Much of the pain for me stems from never having this car in a running state, which means I don't have log data that I can use as a baseline for stimulus even without knowing what most of it means.

Thank you for any help you can provide with these!

edit: double post...

Hopefully this will help you a bit.

Message 0x441 Bytes numbered 1-8

Byte 1, bit 7. Alternator control, 0 = off, 1 = on.
Byte 2, bottom 7 bits are requested fan speed, 0-100, resolution 1%
Byte2, msb. Engine running faster than 40rpm



Message 0x246
Byte 1, bit 4. Compressors on/off
Byte 1, bit 5. Compressor fault

I don't have any standard data I'm afraid, but I'll check with a colleague to see if he has any.

MC

Between deMort and MC, you are in very good hands indeed :thumb:

Wow, wow, wow, It must be Christmas in July! Thanks MC, That helped allot.

I spent some time playing with the parameters you provided and found...

Message 0x441 Bytes numbered 1-8

Byte 1, bit 7 definitely is the alternator status, and I had been blindly transmitting this bit as set based on the best baseline data I had from my DME. That baseline data was sourced with a bunch of spaghetti wiring trying to simulate sensors and loads on the DME so I'm not entirely surprised it had this bit set, and it leaves me wondering what else I've assumed in my baseline that could be working against me.

I explored the rest of Byte 1 and found that almost all of the bits appear to trigger alerts that show in the instrument cluster info menu.

Bit 7 is "Warning battery/generator"
Bit 6 is "engine oil pressure too low"
Bit 5 has no response in the cluster, unused?
Bit 4 is "failure of engine compartment blower" and flashes the red overtemp light at top of the ECT gauge scale
Bit 3 is "reduced engine power"
Bit 2 flashes yellow fuel reserve light at bottom of fuel gauge scale
Bit 1 turns the CEL on steady and says "check engine visit workshop"
Bit 0 flashes the CEL and says "Check engine visit workshop"

Byte 2 MSB has a cluster response as well, it seems to switch the cluster into/out of its bulb test mode.

Byte 2 bits 0-6 work exactly as you said they would which is hugely helpful. Interestingly I noticed a variable delay between when I'd change the signal from the DME and when the PWM from the front control module would start to change. Sometimes it would be within 1 second, sometimes it would take as much as 20 seconds. It seems that its not a latency problem, and that there is some kind of filtering going on inside the front module. This doesn't really matter since nothing is going to change in this cooling system in 20 seconds but if you set these and don't see an immediate response, it could just be this.

Message 0x246 Bytes numbered 1-8

Byte 1, bit 5 unfortunately doesn't appear to clear the "inoperable" compressor status in the climate control module. Bit 4 continues to function as status. I've toggled every other bit in this byte without seeing any immediate change in the climate system.

I'm wondering at this point though if my A/C issues might be within the climate control module itself. Due to the prefix of "CAN" being explicitly added to many of the climate controls parameters in PIWIS, I'd guess that anything without this is an internal parameter of the climate control module. The "compressor status" parameter that's currently set to "inoperable" isn't listed as a CAN parameter. Interestingly the "Engine running signal" isn't listed as a CAN parameter either... I haven't been able to get the engine running signal to change, so I'm not sure I trust it at this point, I even put the stock DME back in and disabled my stimulus and it still listed "present" with no engine running.

So what "compressor stats" and "engine running signal" mean, and how they're derived remain a mystery.

One other thing I'd like to sort out at some point would be the link between PSM and the DME. I'd be looking for the torque limit request that gets sent to the DME during a PSM intervention, though I suspect this would fall into the bin of standard data?

Tyler

Sounds like you are making some good progress there.

0x441 Byte 2, bit 7 shows the then engine is doing more than 40rpm
Byte 1, bit 5 is oil temperature sensor failure

0x246 is a cyclic message transmitted by the Motronic and received by the display and what looks like the OBDII port gateway.

Byte 1
Bits 0-2 are to do with gear indication
Bit 3 is kickdown active

The Komfort module receives the following messages
0x140 airbag
0x14A Bytes 3 and 4 except 3.0. Engine speed
0x24A 3.0 Sport mode
0x440 2.4-2.7 Gear lever position

It transmits message 0x600
byte 1 bit 3 is AC switch status
Byte 2 bits 5-7 are fan speed
Byte 3 is refrigerant pressure
I wonder if the ECU needs to see the correct pressure and AC switch status to do anything?

For the traction control stuff, take a look at message 0x14A
Byte 1 bit 4 is EXP intervention
Byte 1 bit 2 is ABS activated
Bytes 5 and 6 are slow and fast torque request,
Byte 8 is lateral acceleration

MC

Tyler, did you make any progress? I've got a CAN log from a fully functioning 987.1 if you still need one.