Porsche 987.2 / 997.2 CAN bus data

[jaytee]

I've been working on and off on capturing and decoding the CAN bus data from my 2012 Porsche Cayman R. Since I've made some progress, I wanted to share the steps I've taken so far and solicit feedback & ideas from those that know far more about this (almost everyone ) .

I'll start with the hardware setup in this post, then follow up with some of the analyses approaches and results.

I picked up a $25 CAN-to-USB adapter (canable.io) and setup a Raspberry Pi to perform data capture using the slcand interface. It works great, except I quickly realized the Pi does not include an RTC. I went this route because the ODBII/RCP3 cable rarely worked on my car and the RCP3 outputted nonstandard number and log formats for straight CAN data.

To interface with the car, I spliced in a CAN tap in the driver's side footwell, ran it through the dash to the passenger's footwell, and terminated it with a DT connector. I included CANH, CANL, and power (todo: connect the power source in the fusebox).

I also created wiring harnesses for the USB-to-CAN adapter and the RCP3 (using ethernet).

For data reference, I installed Win7 on an older MacBook Pro (VM solutions were very messy and inconsistent) to run the Durametric software.

With my current setup, I can simultaneously capture raw CAN bus data and labeled data through Durametric. Happy to share more information if anyone is thinking of the same approach.

-Jeff

[jaytee]

Here's a work-in-progress summary of the PIDs - will try to update this as I test and confirm.

PID numbers are decimal, and bytes are numbered 0 -> 7.

As of Sept 25:

PID 194 Steering Angle
Bytes 0 & 1, little endian, signed, X 0.045 (seems to mirror the E46 M3 config; multiplier needs to be tested)

PID 194 Steering rate of change
Bytes 2 & 3, little endian, signed, X 0.045 (multiplier needs to be tested)

PID 330 Vehicle Speed (kph)
((Byte 3 * 256) + Byte 2) / 100 - tracks to GPS speed

PID 578 RPM
((Byte 3 * 256) + Byte 2) / 4

PID 578 TPS (%) - Actual (e.g., if you have cruise control on; may also show throttle moderation by stability control)
Byte 5 / 255

PID 581 Engine temp (coolant)
Byte 1 - 93 (seems odd?)

PID 582 Pedal value (%) - Throttle requested by gas pedal
Byte 3 / 255

PID 586 Individual wheel speeds
LF (Bytes 0,1), RF (Bytes 2,3), LR (Bytes 4,5), RR (Bytes 6,7) = ((Odd Byte * 256) + Even Byte)/100 (little endian)

PID 1089 Engine oil temp
Byte 5 - 60

PID 1098 Individual Wheel Speed (kph) ???
??

PID 1100 Vehicle Speed (kph)??
((Byte 2 * 256) + Byte 1) / 100 - Reads ~2.75 kph when stopped - speedo speed?

PID 1282 Unknown temps (coolant or oil?)
Byte 5 & Byte 6

[jaytee]

The following data should be available with a direct CAN connection:

• RPM
  Pedal position sensor
  Throttle position sensor
  Front left wheel speed
  Front right wheel speed
  Rear left wheel speed
  Rear right wheel speed
  Vehicle speed
  Engine coolant temperature
  Oil temperature
  Oil pressure
  Steering angle
  Steering speed
  Brake switch
  Engaged gear
  Fuel level
  Kick down sensor
  Atmospheric sensor
  Fuel temperature
  Engine temperature
  Brake switch
  Brake pressure

The CAN connection through the OBDII port provides less information. Digging through the wiring diagrams, the car has a gateway that gathers data from various busses and filters it before outputting it to the OBDII connector.

The CAN information should apply to the Porsches with the Siemens EMS SDI 3.1 ECU:

• 911 (997.2) Carrera models 2008-2011
  911 (997.2) Turbo, GT2 and GT2 RS 2010-2012
  Boxster S (987.2) 2009-2012
  Cayman S & R (987.2) 2009-2012
  Not the GT3 or GT3RS cars

[jaytee]

Here's a chart of what I believe is RPM: Byte 3 (dark orange) is the most significant byte and Byte 2 (light orange) the lower.

Green is RPM decoded: ((Byte 3 * 256) + Byte 2)/4

[brentp]

Hi Jeff, this is great! Classic reverse engineering. Did you have a chance to map these into RaceCapture CAN channels yet?

[jaytee]

Hi Jeff, this is great! Classic reverse engineering. Did you have a chance to map these into RaceCapture CAN channels yet?

Thanks Brent!

Haven't had a chance to map them into the RCP3 yet. I have a few more updates to build into my analysis tools that will hopefully lead to a handful of additional PIDs.

May post a couple charts here for some help decoding a couple that I'm stuck with.

[jaytee]

Hi Jeff, this is great! Classic reverse engineering. Did you have a chance to map these into RaceCapture CAN channels yet?

Pretty excited - even though only a few are mapped, I have a much better understanding of the CAN data and what to look for.

Just fired up my RCP3 and configured what I have so far. The following seem to work, just need a final verification against observed:

- Steering angle
- RPM
- Individual wheel speeds
- Engine temp (with a strange formula: -93?)

Work in progress:

- TPS - works in data, but not in RCP3
- Vehicle speed - reads 2.75kph when stopped, but seems to trace GPS speed (lower than speedo)
- MAF or MAP
- Oil temp
- Oil pressure
- Brake pressure
- Intake temp (nice to have)
- Ambient temp (nice to have)
- Fuel level (nice to have)

[jaytee]

Added oil temp above!

[jaytee]

Updated vehicle speed above. Found two possible sources: one may be actual, the other speedo display.

[VPD]

Jaytee,

How was your progress in the last year since you posted? Working through reverse engineering and trading notes in the 987.1 CAN mapping thread I noticed many of the channels you posted are similar if not identical to those on the 987.1 even though we have different ECU's. In retrospect it makes sense, why would Porsche change all that CAN info if they don't have to when switching from Bosch to Siemens.

That said, I tried the individual wheel speed ID you posted that I had not yet reversed myself and it worked, except the scaling seemed off maybe. So I have a few questions, did you revise your scaling and how exactly did you input the formula? Maybe I misunderstand but I don't see a way using the standard mapping options for a formula like that (or the vehicle speed one), did you use Lua scripting?

I'm happy to share what I've got if it helps you.

[andreahmed]

Hi Jaytee,

I'm looking to do the same as you did.

I have a peak can usb device, and I don't know how to connect it to the can bus of the Porsche. Did you connect it using the OBDII cable inside porsche ?

[mcenhillk]

The CAN-Bus is on the OBD-II connector. You'll need a cable/adapter/both to get CAN low from OBD-II pin 14 to DB-9 pin 2 and CAN high from OBD-II pin 6 to DB-9 pin 7.

https://en.wikipedia.org/wiki/On-board_ ... _connector
https://www.peak-system.com/PCAN-USB.199.0.html?&L=1

You will want to check my work, I'm only about two sips into my first cup of coffee.

Kevin

[andreahmed]

Thanks for your reply,
but when I connect Peak Can using OBD connector, I don't get any can bus data, only obdII data.

[brentp]

If you have a solid mapping, please post your RC config file here and we can add it as a preset. Include a pic of your car as well to be featured in the preset!

[XuYL]

Hello Jaytee，

Thanks for your sharing about the CAN bus data.

I'm going to monitor the oil temperature and oil pressure on my 987.2 S.
The tool is Vactor VN1630A with CANalyzer on WIN10.
CAN connection is not available when I plug the tool into the OBD2 interface using 500k baudrate, the CAN monitoring shows nothing.
Is the CAN connection not available without authorization after netgate?
Or I should use UDS service 22 to request the data?

Thanks!
Yilun.