search

prototux / PSA-RE

PSA (Peugeot/Citroen/DS) electronics architecture reverse engineering.
https://discord.gg/DPthrN2cbS
Apache License 2.0
64 stars 16 forks source link

independent wheel speed #2

Closed Lanchon closed 2 years ago

Lanchon commented 3 years ago

hi,

i have an Argentine 408 (AEE2004.full) without TPMS and i would like to add a computer to it that acts as an indirect TPMS.

inputs

relative tire inflation can be inferred from the relative speeds of the wheels alone. underinflation of only some wheels can always be detected this way. break info can optionally be used to help halt calculations when breaking to allow for skidding (but wheel locking/skidding can be inferred by sudden high rotational acceleration alone). steering wheel/heading/gyro rate can optionally be included in the calculations to compensate for the expected difference in wheel speeds when turning (but turning can be inferred from wheel speed alone too). GPS info can optionally be included to detect simultaneous underinflation of all wheels.

outputs

questions

1) the main question is: do you know how to obtain separate wheel speeds from the buses? it seems it can be done according to this, but i don't know the format of the downloadable binary config (.REF) files. i suppose wheel speeds are reported on the HS.IS bus, but using which message(s)? 2) it is enough to trigger the TPMS dashboard alarm, but it would be nice to also be able to report inferred tire pressures for each wheel via the entertainment unit display. any idea of the involved messages?

thank you very much for your help.

Lanchon commented 3 years ago

ok i saw this: https://git.prototux.net/reverse-engineering/psa/canbus/-/issues/140 those messages would be on LS.CONF?

Lanchon commented 3 years ago

and i found this, yay!! https://git.prototux.net/reverse-engineering/psa/canbus/-/issues/92

but it only provides the average of the front wheels... strange. i don't think a single sensor is before the differential. individual wheel speeds must be available for ABS to work, am i right?

44D VROUES_ABR_44D_REGIME_MOYEN_ROUES_AV_HS1_44D
44D VROUES_ABR_44D_VITESSE_VEH_ROUES_AV_HS1_44D

i don't know much french. could it be that the first item is the average and the last the difference?

thanks!

EDIT: now i found this: https://git.prototux.net/reverse-engineering/psa/canbus/-/issues/73

:)))

prototux commented 3 years ago

Hello,

Sorry, i wasn't at my computer, but for the TPMS and wheel data:

I'll dig deeper tomorrow about what i can find about these :)

Lanchon commented 3 years ago

thank you very much for your help!!

yes, i had found 0x30D. but according to this it does provide all wheels; why do you say it doesn't?

there's also counters in 0x0E6. counters would be even better than speed for this application. but i don't understand: does it report front or rear wheels? or are there two versions of the frame? what is the meaning of 0E6 (C4(B7))? what are those parenthesis?

tire pressure info should most surely be forwarded to CONF because the stock stereo/nav can be configured to display an info page for it. but i don't care about it: it seems the main display in the instrument panel should be able to display tire faults in a useful way as BSI gets fed individual statuses for tires via 0x50F. absolute tire pressure approximations from indirect TPMS would be really bad quality anyway and i'm glad i don't need to generate/fake those when all i really care about is detecting faults.

i spent part of the day today preping to tap onto the bus, i hope to be logging traffic soon.

Lanchon commented 3 years ago

success!!! im on HS.IS. 0x30D gives me the 4 wheel speeds and im also able to get the steering position, so i have everything i need at a minimum already.

no sign of 0x0E6 on IS. 0x44D is strange there is a fourth number that is typically slightly higher than twice the other 3. it cant be a sum then, IDK. but 30D is what i need anyway.

thanks for adding 50F in detail, that will sure help with reporting.

prototux commented 3 years ago

Great! the C4(B7) is because autowp (the main source for this frame) got it from a citroen C4 (with the code B7)

I'll try to document 0x30D, 0x0E6 and 0x44D after i've finished to implement isotp for the next version of libpsa :)

In the meantime, don't hesitate to join the discord chan, we discuss the finding there before they're documented (as the yaml files are done "when we have time to"). The link is in the README file.

prototux commented 3 years ago

I've just found out, you probably can have the wheel pressure data (almost the same format as 0x50F) on the CONF bus, at 0x3A1, as well as 0x052 (rear wheels) and 0x1D2 (front wheels) :)

Lanchon commented 3 years ago

i joined the discord chan, but i'll reply to this here anyway.

I've just found out, you probably can have the wheel pressure data (almost the same format as 0x50F) on the CONF bus, at 0x3A1, as well as 0x052 (rear wheels) and 0x1D2 (front wheels) :)

thank you! i could not find any docs on those frames so far. yes, it must be on CONF because the radio is supposed to show tire status.

i've bad news. as i told u earlier, i was able to access steering position and individual wheel speeds on the HS.IS bus. this is enough to build my TPMS model.

but i need two other things:

  1. a way to configure (ie: reset) the TPMS using existing inputs.
  2. a way to display the tire status and alert on failure.

my existing microcontroller board only has one can port, so i can't tap both IS and CONF at the same time.

the reset procedure (1) can be implemented using a sequence of discreet inputs (such as break pedal push) from the very few that are available on the IS bus (most user interaction is CONF-only); this is not great but acceptable.

i was hoping to implement the display (2) by sending 0x50F frames, and maybe also 0x60F, and expected the instruments to show faults. i successfully injected IS frames (tested with tachometer) but all 0x50F and 0x60F frames are ignored: nothing shows on the instrument panel. :(((

this is either because: 1) the BSI does not forward my frames to CONF, 2) the instrument panel ignores the CONF messages, 3) both of the former, or 4) because 0x50F and 0x60F are meant to be on the CONF bus o begin with.

1, 2 and 3 could be PSA selectively not enabling software in the BSI/instruments of the car did not include TPMS from factory, possibly to thwart efforts like mine. could this be possible?

4 would be strange because indirect TPMS needs access to ABS/ESP sensors in IS. but maybe indirect TPMS was not foreseen in AEE2004 and the only available TPMS (direct from transducer) would make more sense in CONF.

not all is lost, i could still use a relay to switch from IS to CONF on tire failure to report. if the instrument panel displays the failure... really ugly.

or i could simulate failure of some other component (eg, ABS/ESP) so that the BSI uses the display to make you stop driving.

or i could just BEEP BEEP BEEP...