Thursday, April 19, 2012

Adventures in SW-Can/GMLan Land - Part II

After reading Brads' blog over on GTOSoft about converting a generic ELM327 device to SWCan I figured I'd give it a shot myself using a cheapy ELM327 clone and document everything ( in what turned out to be this ridiculously long Blog post), including all the stupid mistakes I'd undoubtedly would be making.


Step 1 - Getting the Device
So I figured I would try out the SW-Can conversion on one of the cheapest most common ELM327 clones available. A quick look on EBay turns up hundreds of these. Since I figured I would always have my device connected to a computer, and at this point did not care about having a mobile app to display info etc etc I decided I would go with the standard USB Version. These can be had for less than $20 USD.

Generic ELM327 Clone
 Most pictures on Ebay show this device coming with a mini-cd with drivers/software etc, but mine simply came with some instructions on where to download drivers (if needed - which they weren't) and get some free and/or trial software. Another interesting point is that ELM officially states their latest version is 1.4b, and there is NO version 1.5, however on Ebay people are selling version 1.5 units, which upon closer inspection apparently are more like official version 1.2. The one I purchased had a large 'version 1.4' in the image, but of course after hooking it up to my PC and getting the version string out it says: Version 1.5.. Ebay + clone made in China != truth in advertising!

I figured I would plug it in and see if it would at least work with the Hi-Speed CAN in my G8 (which it's supposed to), but surprise, surprise - it did not work! Well let's crack this thing open to see what the deal is.



Step 2 - Let's see what's inside
Looking at the device it's an integrated box/connector unit with a single USB cable coming out the back. I was hoping it wasn't a case that snaps closed with plastic tabs, but luckily after running my finger over the sticker I could feel where there were some screw holes to open it.

Sticker Removed, exposing the screw holes

Back Cover removed
It was nice to see that both the USB and OBD2 Connector plug into the PCB with a connector, which saves me from having to desolder a bunch of stuff. Obviously this is a generic board used for several models since there were a bunch of unused pads and other areas.

Both OBD2 and USB Plug into the board

Top of the PCB

Bottom of the PCB
 Looking at the board, I took an inventory of any large ICs - I found the following:
  • PIC18F25K80 - MCU
  • MCP2551 - Hi-Speed Can Transceiver
  • FT232RL - USB Uart Chip
 Wait a minute! Weren't we supposed to find an ELM327 here? The ELM327 is a product of 'Elm Electronics', but if you look at the actual data-sheet of an ELM327 on page 74 you will see that it is basically listed as being 18F2480 chip. It's the firmware & command set that makes it an ELM327.
Here we have a 18F25K80, which obviously is a chip from the same family.
 
Location of the Can Transceiver
The Can Transceiver which we will be replacing is the MCP2551 and can be found on the bottom of this particular board. Just like Brad's protoboard, we will be soldering our protoboard to pads 1-4 , and then solder the SW-Can wire to Pin 1 on the actual OBD2 connector.

Pin 1 is not connected - this is where we will connect the SWCan line


Step 3 - Why won't this %$#!#& thing work right now?
This is an interesting side-note I wanted to at least mention. While I did not really care that it did not function on the Hi-Speed CAN Bus, I was curious at least as to why it would not work. After some digging I ran across a Fiat Community of all places where there is a long thread (28 pages currently) about these devices and reasons for them not working on a high speed CAN Bus.

It appears that these clones simply put a 120 Ohm resistor between the Can-H and Can-L Pins. However looking at the ELM327 Datasheet again on page 67 where the default schematic is listed you can see that instead of a single terminating resistor you need a different setup all together.

120 Ohm resistor between pin 6 &7 on the MCP2551? Why, surely you jest!
People have reported having success finding that 120 Ohm resistor and taking it off the board, or people have actually taken the time not only remove that resistor but also added R32/C8 & R33/C9 to the board. If yours isn't working check out the FAULTY ELM 327 INTERFACES DE-MYSTIFIED (READ HERE) link to see how to possibly fix it for your particular clone.


Step 4 - Getting the components & designing a new schematic
Now that I had my ELM327 device it was time to whip up a prototype board and get the components needed to do this. I obviously could see what Brad's components were: 2x Resistors, an Inductor, a Capacitor and the TH8055. I soon found out that the TH8055 is no longer produced, but in it's place there is now a TH8056. Ok , so we use the new part and keep the rest the same right? Not so fast....

I decided to compare the TH8055 datasheet to the TH8056 datasheet and found some interesting differences in their suggested schematics.
TH8055 Reference Schematic

TH8056 Reference Schematic
The main points of change seem to be:
  1. The 220 pf Capacitor connecting the SWCAN line to ground, now is a 100pf value
  2. A 1K resistor now runs parallel to the 47 uH inductor on the SWCan line
  3. The Load resistor connecting pin 6 and 7 is now 6.4K instead of 9.1K (not used in Brad's design)
  4. VBat (pin 5) now connects to CanH (pin 7) through a 100pF capacitor.
  5. The Resistor connecting Pin 4 (RxD) to the 5V regulator is now 2.7k instead of 2.5k Ohm
Some of these changes may not be totally necessary and are more there for ESD protection etc, but I figured I would apply these changes to Brad's schematic and come up with a schematic for the TH8056 that 'should' work. Again - excuse the bad schematic drawing skills ;)



Next it was time to get the supporting parts to build this onto a little prototyping board. As I was searching Digi-Key (Mouser did not seem to carry the TH8056) I ran into a SMD Based protoboard called a 'surfboard' by a company called Capital Advanced. This particular board (the 9801) had a SOIC-8 layout which would fit the TH8056 just perfectly. I hadn't planned on using SMD components, but it was a perfect excuse to turn this into 'Adventures in SMD components' as well !

The Protoboard "Surfboard" 9801
Based on this I decided to order anywhere from 10-50 of each resistor/capacitor etc since a) They're super cheap and b) I figured with how tiny they are you never know if you're going to lose them and c) The fact my soldering skills are sub-par I figured I would probably need to build 5 boards at least before I had one that would be acceptable & functioning ! ;)



Step 5 - Building a Protoboard
Once I had all the parts I figured I'd try my hand at getting some of these small components on the board. I opted for 1206 size (which according to a lot of SMD fans is still 'large' - hilarious - most people brag online about how 'large' things are, but in EE forums people brag about the smallest components they can hand solder...LOL), because that is what the Surfboard was made for. Also I didn't really want to go smaller because this was my first time dealing with surface mount components. As you can see from the picture these things are TINY!
1206 size Resistor - This is a LARGE one??
The datasheet for the 9081 Surfboard has a nice black & white image of the pad layout so I decided to print a few of these on a sheet of paper together with the schematic so I could draw up a decent way of layout the board without having to redo it everything.

Don't mind the wrinkles - this piece of paper has been places!

This didn't really work out too well for revision 1 since I tried to cram 3 components (+ a wire) onto 1 mid length pad. I realized this wasn't going to work after getting them on there and it looked like this (check top right):

Hey look it's amateur hour! BOOOH You Suck!
Another problem I had was that as I was trying to solder the components they kept moving. Even with me soldering on 1 side first and then trying to do the other they kept sliding about. It really makes me want to try the 'toaster oven' soldering method if I keep working with these SMD components. I read up on a few things and some people (and even the SurfBoard site) mention sticking the components down first with 'something' first (tack, super glue etc).

For my 2nd try I figured I'd use some (NON-CONDUCTIVE! ;) ) superglue with a needle to get the components in place first - and THEN solder them. Just sticking them on with glue gave a much nicer & neat result

Tacking the components with a little drop of Superglue
Next up I had several connections I need to make using 'jumper wires', or at least connect adjacent pads. In my list Digi-Key Order I had actually included some 0 Ohm resistors since I figured that would be a clean way to make some of these connections. (probably not what die-hard electronics people would use so apologies for this blasphemy, but it works for me!) E.g. in the previous picture you can see 2 0-Ohm resistors near the bottom of the SOIC pads, and one connection the top right 'pin 8' to what will be the ground connection.

For other parts though it still seemed a bit tricky if not impossible to use these 0-Ohm resistors to connect some pads. For instance - looking at the far right in the previous picture you can see a resistors, inductor and capacitor , and they all needed to interconnect, but squeezing in two more 0-Ohm resistors would simply not be possible. Looking around my desk I found a paperclip which had some kind of serration pattern on it. It matched the distance of the pads quite well, so I straightened it out and cut off little segments and soldered these in place to connect the pads!


Ah Paperclip - you come to the rescue once again!
Now we're getting somewhere! Includes Paperclip pieces ;)
After soldering on all components, connecting pieces and wiring it was ready to connect this to the main board and the OBD2 Connector. As mentioned previously the SWCan line would go to Pin 1 on the OBD2 Plug, while the Rest (+5V,GND, CANTx and CANRx) would connect to the pads where the now removed MCP2551 chip had resided.


Everything all hooked up and ready to go!
Step 6 - The (smelly & smokey) results
It was a bit of a struggle to get everything back in the case, but I managed to route the wiring that wraps around the board along the side to make it fit.. The plain backside of the proto board faces down so there's no worried about shorting anything, but I stuck a piece of plastic in between anyway just in case. I'll probably shrinkwrap the whole board to avoid any kind of problems. (In fact I may make another board and try to clean up a few messy areas, use some better wiring etc). The housing actually closes again (though it's tight) so you are left with a stock looking unit that now does SWCAN... technically that is, if I haven't screwed anything up, and of course you need to kick it into the right mode to start talking to your car.


Ready to test!

Ok lets hook up the USB Port and see if we didn't blow anything up:
  • Plug cable into PCB *check*
  • Plug USB Cable into PC *check*
  • Smell something burning *check* 
  • See smoke coming from proto-pcb *check*
  • Let expletives fly while yanking the cord out *check!*
WHAT THE?!?  ooookay.. so depending on how keen your eye is in the second to last picture above you may spot a stupid Pre-Electronics 101 mistake.. I was in rush to get the wiring done before going home for the day and unlike my schematic where +voltage is usually on top, and Ground on the bottom, on the actual PCB Board the GROUND was on the top right, and the +5 supply bottom right... Dumbass IDIOT me hooked up the wiring reverse and *poof* buh-bye TH8056..  and THAT boys & girls is why it's always best to get some spare parts! lol (of course I basically bought enough to build probably about 10 boards minus the TH8056s.. only got 2 of those - and now one ;) )

Step 7 - Try again!

Ok let's do this again....Besides hooking things up wrong, having to make another protoboard was a nice excuse for some more soldering practice and changing a few things I wasn't 100% happy with. For one the paperclip leads I made just didn't fit right. Instead now I snipped off the legs of a transistor I found 'somewhere' which worked much better. Also instead of rushing things and only tacking half my components down, I pre-placed EVERYTHING (instead of only half the components) with little dots of glue which gave a much neater result. Again I used the 0-Ohm resistors as jumps where I could to clean up the connectors and make it easier to connect the wiring to the board (using the longer pads)

Board #3 - super neat , let's hope I don't ruin it soldering!

Not Half Bad...if I may say so myself

Oh hey look - Correct polarity XD
A quick plug in to the PC showed the power on sequence on the LEDS without any dramatic visual or smelly effects. Excellent! Next was trying to connect it to the car and getting it to communicate.
I used realterm for now and set the connection rate to 38400. Based on comments I know this is too slow and will cause a buffer overflow unless you filter for a specific header, but for an initial test I didn't care. The ELM327 (& clones) doesn't officially support the 33.3kbps canbus, but it does support a 'user-mode' where you can force these settings. Based on Brad's findings he uses the following commands to initiate communication:

  • AT WS - Quick Reset of device
  • AT L1 - Turn on LineFeeds after each line
  • AT H1 - Show Complete message including headers
  • AT PP 2C SV 40 - Set Programmable Parameter '2C' to value 0x40
  • AT PP 2C ON - Turn Programmable Parameter '2C' ON
  • AT PP 2D SV 0F - Set Programmable Parameter '2D' to value 0x0F
  • AT PP 2D ON - Turn Programmable Parameter '2D' ON
  • AT PP 2A OFF - Turn Programmable Parameters '2A' OFF
  • AT WS - Quick Reset to restart with the above settings
  • AT SP B - use 'User Protocol B'
  • AT R0 - Do not wait for responses when sending commands
  • AT CAF 0 - Turn off CAN AutoFormatting
  • AT L1 - Turn on LineFeeds after each line
  • AT H1 - Show Complete message including headers
  • ATMA - Enter Bus Monitoring mode
A closer look at the programmable parameters in the ELM327 datasheet we can see exactly what is being set:
'2A' - Can Error Checking - Turned Off
'2C' - Protocol B Options : 0x40 = 1000000 binary, so bit 6 is 'data length' and the ELM327 sheet shows a value of '1' means we are dealing with a variable data length
'2D' - Protocol B Baud Rate: 0x0F ; The baud rate is calculated as 500/value = target kbps. So in this case we have 500/15 = 33.3333 kbps

This time when I hooked up the device to the OBD Port and followed the above steps.. SUCCESS! Glorious data streamed across my terminal screen, until of course the expected buffer error occurred. However that's an easy fix with some baud rate tweaks on the computer side etc.

So if you're interested in making your own SWCan device out of a generic clone for less than $10 it's definitely do-able! I may actually make a few more protoboards, or even a few whole devices if anyone's interested in buying them - especially since I've got spare-parts a plenty!

Now the interesting part comes with either talking to the car, or figuring out what certain button presses are. If you are interested to see what people have already figured out about this , check out the carmodder site here where a bunch of smart people hang out ;)

5 comments:

  1. hey there, a couple questions...

    have you tried data logging/talking to things like the brake controller and the like to look at sensor inputs and such? on top of that, what do think of using your modded reader to get such information?

    ReplyDelete
  2. My device is identical, but with BT instead of USB.

    It uses a Hanlynn HL1009 http://www.hanlynn.com/en/node/110 to provide direct bluetooth connectivity.

    Thanks for this write up!

    ReplyDelete
  3. Hi JD Davison,

    You talk about Hanlynn1009, have you got a datasheet of this part?

    ReplyDelete
  4. I don't - but it shouldn't be too hard to find one online.
    The HL1009 just provides the com port over blueooth.

    ReplyDelete
  5. Ok TY, I haven't found anyone.
    My HL1009 refuse the pairing code so i want to assign a new.

    ReplyDelete