Categories
ECU Diagnostics

ECU Diagnostics – part 13.1 : MBE-Broadcast

The simplest of the three Caterham OBD port diagnostic protocols we know about is what I’ve called MBE-Broadcast.

As soon as the car is put into ignition switch position 2, the ECU starts to spit out a this stream of data on the CAN bus. Unlike the OBD-II protocol and the MBE-ISOTP protocol, this a not a request/response protocol…. the car “broadcasts” these CANbus frames all the time with no provocation from anything other than turning the car on.

The protocol is very simple and consists of individual CAN bus frames where the first byte is a message type. After the message byte are up to 7 more bytes containing the ECU data, as follows:

CAN Bus
Frame
Byte
Number
01234567
Data
Type
Message
Type
D0D1D2D3D4D5D6
Where D0-D6 are the data bytes

MBE-Broadcast CAN Bus Protocol Key Information

From Simon in Birmingham, Alabama, USA (sf4018 on Blatchat)…

Huge thanks to Simon for supplying this info. It had been on my list to take a look at but he knocked it out of the park with this analysis!

Simon also provided this info on his car in case it is useful for anyone else (he has a 420R Left-Hand-Drive):

MAP Sensor Technical Data (Bosch p/n 0261230044):

  • Pressure Range: 0.1-1.15 Bar (i.e. measures vacuum)
  • Voltage Limitation: 380-4700mV

MAP Scaling:

Extrapolating the technical data:

VoltsBarkPaDec
0.00 0.000 0
0.38 0.10 10
4.70 1.15 115
5.001.22 122255

So scaling is 122/255 for kPA. Or 1.22/255 for Bar. So the scaling is correct, but doesn’t match what I was seeing from the CANbus sniffer (it was showing 200kPA/2 Bar when stopped which makes no sense).

Operation:

  • Engine
  • Stopped:
  • ~ 1.0 Bar
  • Engine Idling: 0.1-0.2 Bar (Throttle valve is closed, creating a vacuum).
  • Throttle Open: Pressure increases with throttle position 0.1à0.9 Bar.

Example MBE-Broadcast Communication

Here’s some example CAN bus frames that we’ll decode from a running car. Notice that they are about 10ms apart and therefore they repeat every 80ms ms.

Time         CAN ID     Data
23.622742805 0x0cbb0001 ff 00 00 00 00 00 00 00
23.632726855 0x0cbb0001 ff 00 00 00 00 00 00 00
23.642685921 0x0cbb0001 ff 44 00 00 00 00 00 00
23.652859619 0x0cbb0001 ff b3 00 00 00 00 00 00
23.662872375 0x0cbb0001 04 b3 ff 28 00 00 00 00
23.673586904 0x0cbb0001 03 27 00 0d 00 0d 00 00
23.682952338 0x0cbb0001 02 87 87 00 df 35 00 00
23.692835008 0x0cbb0001 01 56 67 06 4a 6d a9 44
23.703545091 0x0cbb0001 ff 00 00 00 00 00 00 00
23.712846871 0x0cbb0001 ff 00 00 00 00 00 00 00
23.722881278 0x0cbb0001 ff 44 00 00 00 00 00 00
23.733459089 0x0cbb0001 ff aa 00 00 00 00 00 00
23.742902975 0x0cbb0001 04 aa ff 28 00 00 00 00
23.752933955 0x0cbb0001 03 27 00 0d 00 0d 00 00
23.763345214 0x0cbb0001 02 87 87 00 bf 35 00 00
23.772954746 0x0cbb0001 01 56 63 06 4a 6e b2 44

Unfortunately we don’t know yet what the messages starting with 0xff mean, hopefully we can come back to this post and update that info later.

Lets concentrate on the ones we know something about:

23.662872375 0x0cbb0001 04 b3 ff 28 00 00 00 00 
23.673586904 0x0cbb0001 03 27 00 0d 00 0d 00 00 
23.682952338 0x0cbb0001 02 87 87 00 df 35 00 00 
23.692835008 0x0cbb0001 01 56 67 06 4a 6d a9 44

We only know anything at the moment about message types 1, 2 and 4:

Message Type 4:

Byte 0Byte 1Byte 2Byte 3Byte 4Byte 5Byte 6Byte 7
4BAT2??    
Values0xb3      

Message Type 2:

Byte 0Byte 1Byte 2Byte 3Byte 4Byte 5Byte 6Byte 7
2   ?MAP  
Values    0x35  

Message Type 1:

Byte 0Byte 1Byte 2Byte 3Byte 4Byte 5Byte 6Byte 7
1CTRPMLRPMHTPCELBATIAT
Values0x560x670x060x4a0x6d0xa90x44

Now feeding those values into the offset and scale table:

Data List   
 Data VariableUnitsScaleValueResult
TPThrottle Position%100/2550x4a29%
CELCalculated Engine Load%100/2550x6d42%
CTCoolant TempC(160/255)-300x5623.9C
RPMEngine SpeedRPM(256*H)+L0x6671639
IATIntake Air TempC(160/255)-300x4412.67C
MAPManifold PressurekPA120/2550x3524.9kPA
BATBattery VoltsV(16/255)+2.50xa913.1V

This compares well with the data taken in the same packet capture and requested by Easimap using the MBE ISOTP protocol:

RT_BAROFUELCOMP=3.5294 ( Barometric Pressure Fuel Compensation )
RT_CRANKCOUNT=1.414e+04 - ( Crank Count )
RT_ENGINERUNTIME=3.9094e+04 Hours ( ERT )
RT_THROTTLEANGLE1(RAW)=1.4583 V ( Throttle Angle 1 (Raw) )
RT_AIRTEMP1(LIM)=13.07 ( Air Temp )
RT_COOLANTTEMP1(LIM)=23.914 ( Coolant Temp )
RT_COOLANTFUELFACTOR=21.828 ( Coolant Fuel Factor )
RT_AIRTEMPFUELFACTOR=4.3351 ( Air Temp Fuel Factor )
RT_THROTTLEANGLEINCREASING=1.4583 V ( Throttle Angle Increasing )
RT_TPSFUEL+TRIMBANK1=3.8709 ms ( TPS Fuel + Trim )
RT_TPSVSSPEEDIGN+TRIM1=16.513 ( TPS vs Speed Ign + Trim )
RT_THROTTLESITE1=6.8392 Site ( Throttle Site 1 )
RT_BAROSCALEDLIM=1.04 Bar ( Baro Pressure )
RT_ENGINESPEED=1639.0 RPM ( Engine Speed )
RT_BATTERYVOLTAGE(LIM)=13.281 V ( Battery Voltage )
RT_BATTERYVOLTAGECOMP=0.31295 ms ( Battery Voltage Comp )
RT_MAPPINGPOT1LIM=0.0015259 ( Mapping Pot 1 )
RT_MAPPINGPOT2LIM=0.0015259 ( Mapping Pot 2 )

Battery, RPM and the temperature readings match up well. But I’m not so sure about the barometric pressure readings, that’ll take a bit more investigation.

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.