ECU Diagnostics – part 13.1 : MBE-Broadcast

The simplest of the three Caterham OBD port diagnostic protocols we know about is what I’ve called MBE-Broadcast.

As soon as the car is put into ignition switch position 2, the ECU starts to spit out a this stream of data on the CAN bus. Unlike the OBD-II protocol and the MBE-ISOTP protocol, this a not a request/response protocol…. the car “broadcasts” these CANbus frames all the time with no provocation from anything other than turning the car on.

The protocol is very simple and consists of individual CAN bus frames where the first byte is a message type. After the message byte are up to 7 more bytes containing the ECU data, as follows:

CAN Bus Frame        
Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7
Message Data 0 Data 1 Data 2 Data 3 Data 4 Data 5 Data 6

MBE-Broadcast CAN Bus Protocol Key Information

From Simon in Birmingham, Alabama, USA (sf4018 on Blatchat)…

CAN Message Layout          
Baud Rate: 500k, Little Endian (Intel)        
CAN ID: 0x0CBB0001          
Data Frequency: 10ms, Repeat Interval 80ms
Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7
4 BAT2 ? ?        
3 ?   ?        
2       ? MAP    
1 CT RPML RPMH CEL TP BAT IAT

And here’s the key to the green coloured cell from the table above.

Data List  
  Data Variable Units Scale
TP Throttle Position % 100/255
CEL Calculated Engine Load % 100/255
CT Coolant Temp C (160/255)-30
RPM Engine Speed RPM (256*H)+L
IAT Intake Air Temp C (160/255)-30
MAP Manifold Pressure kPA 122/255
BAT Battery Volts V (16/255)+2.5
Not Found:    
ITA Ignition Timing Advance Deg ?

Huge thanks to Simon for supplying this info. It had been on my list to take a look at but he knocked it out of the park with this analysis!

Simon also provided this info on his car in case it is useful for anyone else (he has a 420R Left-Hand-Drive):

MAP Sensor Technical Data (Bosch p/n 0261230044):

  • Pressure Range: 0.1-1.15 Bar (i.e. measures vacuum)
  • Voltage Limitation: 380-4700mV

MAP Scaling:

Extrapolating the technical data:

Volts

Bar

kPa

Dec

0.00

0.00

0

0

0.38

0.10

10

 

4.70

1.15

115

 

5.00

1.22

122

255

So scaling is 122/255 for kPA. Or 1.22/255 for Bar. So the scaling is correct, but doesn’t match what I was seeing from the CANbus sniffer (it was showing 200kPA/2 Bar when stopped which makes no sense).

Operation:

  • Engine Stopped: ~ 1.0 Bar
  • Engine Idling: 0.1-0.2 Bar (Throttle valve is closed, creating a vacuum).
  • Throttle Open: Pressure increases with throttle position 0.1à0.9 Bar.

Example MBE-Broadcast Communication

Here’s some example CAN bus frames that we’ll decode from a running car. Notice that they are about 10ms apart and therefore they repeat every 80ms ms.

Time         CAN ID     Data
23.622742805 0x0cbb0001 ff 00 00 00 00 00 00 00
23.632726855 0x0cbb0001 ff 00 00 00 00 00 00 00
23.642685921 0x0cbb0001 ff 44 00 00 00 00 00 00
23.652859619 0x0cbb0001 ff b3 00 00 00 00 00 00
23.662872375 0x0cbb0001 04 b3 ff 28 00 00 00 00
23.673586904 0x0cbb0001 03 27 00 0d 00 0d 00 00
23.682952338 0x0cbb0001 02 87 87 00 df 35 00 00
23.692835008 0x0cbb0001 01 56 67 06 4a 6d a9 44
23.703545091 0x0cbb0001 ff 00 00 00 00 00 00 00
23.712846871 0x0cbb0001 ff 00 00 00 00 00 00 00
23.722881278 0x0cbb0001 ff 44 00 00 00 00 00 00
23.733459089 0x0cbb0001 ff aa 00 00 00 00 00 00
23.742902975 0x0cbb0001 04 aa ff 28 00 00 00 00
23.752933955 0x0cbb0001 03 27 00 0d 00 0d 00 00
23.763345214 0x0cbb0001 02 87 87 00 bf 35 00 00
23.772954746 0x0cbb0001 01 56 63 06 4a 6e b2 44

Unfortunately we don’t know yet what the messages starting with 0xff mean, hopefully we can come back to this post and update that info later.

Lets concentrate on the ones we know something about:

23.662872375 0x0cbb0001 04 b3 ff 28 00 00 00 00 
23.673586904 0x0cbb0001 03 27 00 0d 00 0d 00 00 
23.682952338 0x0cbb0001 02 87 87 00 df 35 00 00 
23.692835008 0x0cbb0001 01 56 67 06 4a 6d a9 44

We only know anything at the moment about message types 1, 2 and 4:

Message Type 4:

Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7
4 BAT2 ? ?        
Values 0xb3            

Message Type 2:

Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7
2       ? MAP    
Values         0x35    

Message Type 1:

Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7
1 CT RPML RPMH TP CEL BAT IAT
Values 0x56 0x67 0x06 0x4a 0x6d 0xa9 0x44

Now feeding those values into the offset and scale table:

Data List      
  Data Variable Units Scale Value Result
TP Throttle Position % 100/255 0x4a 29%
CEL Calculated Engine Load % 100/255 0x6d 42%
CT Coolant Temp C (160/255)-30 0x56 23.9C
RPM Engine Speed RPM (256*H)+L 0x667 1639
IAT Intake Air Temp C (160/255)-30 0x44 12.67C
MAP Manifold Pressure kPA 120/255 0x35 24.9kPA
BAT Battery Volts V (16/255)+2.5 0xa9 13.1V

This compares well with the data taken in the same packet capture and requested by Easimap using the MBE ISOTP protocol:

RT_BAROFUELCOMP=3.5294 ( Barometric Pressure Fuel Compensation )
RT_CRANKCOUNT=1.414e+04 - ( Crank Count )
RT_ENGINERUNTIME=3.9094e+04 Hours ( ERT )
RT_THROTTLEANGLE1(RAW)=1.4583 V ( Throttle Angle 1 (Raw) )
RT_AIRTEMP1(LIM)=13.07 ( Air Temp )
RT_COOLANTTEMP1(LIM)=23.914 ( Coolant Temp )
RT_COOLANTFUELFACTOR=21.828 ( Coolant Fuel Factor )
RT_AIRTEMPFUELFACTOR=4.3351 ( Air Temp Fuel Factor )
RT_THROTTLEANGLEINCREASING=1.4583 V ( Throttle Angle Increasing )
RT_TPSFUEL+TRIMBANK1=3.8709 ms ( TPS Fuel + Trim )
RT_TPSVSSPEEDIGN+TRIM1=16.513 ( TPS vs Speed Ign + Trim )
RT_THROTTLESITE1=6.8392 Site ( Throttle Site 1 )
RT_BAROSCALEDLIM=1.04 Bar ( Baro Pressure )
RT_ENGINESPEED=1639.0 RPM ( Engine Speed )
RT_BATTERYVOLTAGE(LIM)=13.281 V ( Battery Voltage )
RT_BATTERYVOLTAGECOMP=0.31295 ms ( Battery Voltage Comp )
RT_MAPPINGPOT1LIM=0.0015259 ( Mapping Pot 1 )
RT_MAPPINGPOT2LIM=0.0015259 ( Mapping Pot 2 )

Battery, RPM and the temperature readings match up well. But I’m not so sure about the barometric pressure readings, that’ll take a bit more investigation.

One Reply to “ECU Diagnostics – part 13.1 : MBE-Broadcast”

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.