What exactly is it that makes the car business tick? Toms not sure, but he did take a look under the hood to see just how challenging it can be to service a car thats loaded with silicon.
Why is this odd game played with car purchases? I think the persistence of the lets-make-a-deal approach is a result of high prices and the fact that most people mistakenly think theyre savvy negotiators.
Recently, I took the plunge and bought a new Chevy van. I put up an admirable fight (hint: bring your own bad guy, aka, your wife), but sincerely doubt the dealer lost money on the deal. Anyway, purchasing the new van is the reason Im suddenly on this car computing kick. As youll see, the collision of modern technology and the somewhat bizarre ways of the car business makes a trip under the hood of a modern car worthwhile.
Testimony to the fact that times have changed, when I ordered shop manuals for the van, I discovered almost 600 pages devoted to the subject of engine controls versus a mere 200 for engine mechanical.
Interest piqued, I poked around under the dash and found, as you will on any 96 or later vehicle, the Data Link Connector (DLC) shown in Figure 1, which serves as a gateway into the vehicles LAN.
|
| Figure 1Although the protocols (J1850, ISO, CAN) vary, at least the pin description and form factor of the Data Link Connector have been standardized. As a result, the trend is towards universal test equipment, such as scan tools that work with any car. |
Note that out of the 16 pins, only the power, ground, and data line(s) (whether J1850, ISO, or CAN) are strictly specified (in SAE J1962). In GM vehicles, the single-wire version of J1850 uses pin 2. The rest of the pins are available for proprietary use by each manufacturer.
When you take your car for service, a scan tool gets plugged into the DLC. As youll see, this allows the repair technician to quickly and easily get a good picture of what is, and what has been, going on under the hood.
Perusing the shop manuals further, I found that my van incorporates all manner of electronic sensors and sub-systems that operate under the watchful direction of the Vehicle Control Module (VCM, see Photo 1).
|
| Photo 1With 16.67 MHz 68K, a half-megabyte of flash memory, and 160 I/Os, the Delphi Vehicle Control Module is where silicon meets the road. |
According to the specs I found at Delphi (the spinout of formerly captive GM parts-supplier, Delco), my VCM incorporates a 16.7-MHz 32-bit microcontroller (MC68332), a healthy half-megabyte of flash memory, and 6 KB of RAM.
With 160 I/O connections, the to-do list for the VCM is certainly full. Practically on a rev-by-rev basis (i.e., hundreds of hertz), the VCM deals with the myriad of sensors and actuators responsible for low-level control of the powertrainspark timing, fuel/air mixture, transmission shift points, and so on. Furthermore, the VCM continuously runs reality checks to detect component failures and compensate as best it can (i.e., limp home).
On a higher plane, the VCM coordinates activity across the powertrain as a whole, notably getting the engine, transmission, and brakes to work as a team. For example, as you travel over hill and dale, the VCM will update transmission shift characteristics depending on the circumstances, such as whether youre towing a trailer at the time.
One fine morning I started the new van and left it idling while I ran back in the house. Upon jumping back behind the wheel, the "Service Engine Soon" message was glaring at me from the infamous malfunction indicator lamp.
With only about 500 miles on the clock, I wasnt exactly a happy camper. According to the owners manual, driving the vehicle with the MIL on could lead to costly repairs that may not be covered by my warranty.
Thats just perfect. Though the van seemed to be running fine, the ominous wording left little choice but to make a trip to the dealer.
Fortunately, it turned out to be a false alarm. The repair technician hooked up a scan tool to the DLC and extracted Diagnostic Trouble Code (DTC) P0141, meaning the VCM felt that one of the oxygen sensors wasnt heating up properly. I dont know if the technician performed the intricate diagnosis of the oxygen sensor called for in the manual or just cleared the DTC (extinguishing the MIL), but the problem hasnt popped up since.
Nevertheless, the episode prompted me to investigate further. Not to impugn anyones integrity, but forewarned is forearmed. When I go in for repairs, I like to be clued in and prepared to some extent.
I started cruising the Internet and found myself immersed in the regulatory depths of the Environmental Protection Agency (EPA) and the California Air Resources Board (CARB). It turns out that one of the VCMs most important roles is that of smog buster (i.e., continuously monitoring and tweaking operation to minimize air pollution). If the VCM thinks something isnt kosher, it turns on the MIL.
Of course, everyone supports clean air, but be assured the advocacy is not all altruism on the part of car manufacturers. EPA and CARB may walk softly, but they carry a big stick.
In September 98, for example, CARB ordered the recall of 330,000 Toyota and Lexus cars to replace onboard computers that failed to detect gas vapor leaks under normal driving conditions. At a cool $250 each, that adds up to more than $80 million. Rather a strong incentive to get it right next time.
Indeed, vapor leaks are considered a major pollution no-no, so modern vehicles have sophisticated EVAP (evaporative) systems that recycle fuel vapors. Its up to the onboard computer to ensure that the fuel system doesnt leak, and thats why something so simple as not tightening the gas cap can turn on the MIL.
Another suspect to watch out for is misfire, incomplete combustion that not only pumps raw gas out the tailpipe, but can damage the catalytic converter. The VCM goes to great effort to detect misfire by statistically sampling variations in crankshaft speed and using camshaft position to isolate the problem to a single cylinder. To complicate matters, something as common as bouncing over a pothole can feedback through the drivetrain and mimic misfire. So, in the most advanced implementations, misfire detection is qualified by a "rough road" input from the brake or suspension module.
Even when all is well, a lot of pollution occurs in the first few minutes after a cold start. The challenge for the VCM is to achieve reliable starts and smooth idling without just throwing extra gas at the problem (as with yesteryears choke).
Thats why oxygen sensors have heaters. They need to be up to proper operating temperature before the VCM can enter the closed loop mode that continuously varies the fuel/air mix to achieve maximum performance and fuel economy with minimum smog.
Thanks to the regulatory might of the EPA and CARB, the name of the game when it comes to onboard computing is OBD II, the second-generation on-board diagnostics mandated by law since model year 96.
While wandering around on the Internet, I perceived what appeared to be a tug-of-war between the various players who have high stakes on the table. The car companies seem biased toward keeping the inner workings a deep, dark secret. Meanwhile, the aftermarket repair shops are alarmed at the prospect of cars that can only be fixed by an authorized dealer.
Striking a balance between the two are the regulators. They want the procedures and tools needed to fix a smoker widely accessible, yet understand its not reasonable to expect manufacturers to disclose all. For example, the VCM not only controls the engine, transmission, and such, but also plays a role in theft prevention (e.g., disables starter in absence of a valid key signal).
Frankly, none of them seem too eager to let the lowly consumer have a clue. In particular, the regulators look askance at the emergence of power chips and such, going so far as to demand sophisticated countermeasures to prevent homebrew hot-rodding (i.e., reprogramming) of VCMs.
OBD II is the compromise solution. It openly standardizes (in SAE J1979) access via the DLC to the real-time (RPM, temp, vacuum, etc.) and historic freeze-frame information deemed necessary to correct emissions-related problems. It also defines the mechanism for retrieving and clearing DTCs (i.e., find out why the MIL went on and turn it off).
|
| Photo 2PC-based scan tools use software (in this case, OBD2TOOL from Baum Tools), running on a PC to offer more flexibility and features at a lower cost than hand-held units. |
With the emergence of standards, as a trip to your local auto parts store will confirm, the average shade tree mechanic now has access to scan tools that were formerly the domain of dealers only. These are typically hand-held units that cost $200 or so, and get by with a keypad and small LED display or LCD screen.
There are also PC-based solutions on the market that offer pretty screens, hard-disk data logging, printed reports, and so on (see Photo 2). Generally, they use a converter dongle that connects the J1850 DLC to the PCs serial port. Because the price is about the same as the hand-held units, these are likely to have more appeal for computer literate types. I discovered some interesting units available from Baum Tools, B&B Electronics, and Ease Simulations.
Whether hand-held or PC-based, these units are generally intended for hood-up inspection, maintenance, and repair. Indeed, as one suppliers documentation notes, theres no easier way to end up in a ditch than trying to drive while youre fiddling around with one of these gadgets.
I was intrigued by the possible on-the-road applications. All I needed was a simple J1850-to-RS-232 adapter with enough brain power to get online.
Fortunately, I stumbled across an outfit called Multiplex Engineering, which offers such a gadget for less than $100 (see Photo 3). It was time to try my hand at a little high-horsepower hacking.
![]() |
| Photo 3The Multiplex Engineering mux interface acts as a gateway between the vehicle network and anything with an RS-232 serial port. |
Though Multiplex Engineering will take an order for a single unit, be advised that they primarily deal with OEMs, rather than end users. Thus, documentation is rather sparse and deals mainly with the basics of establishing J1850 communications. Just as an Ethernet chip datasheet doesnt teach you about TCP/IP, the documentation tells you a lot about how to talk over J1850, but little about what to say.
Thus, the mux interface by itself isnt a substitute for the higher priced turnkey PC-based scan tools. However, if you arent afraid to get your hands dirty, it is a good alternative to rolling your own (e.g., starting from scratch with one of the J1850 chips described last month) for applications where a PC is overkill.
With that in mind, I decided to have a go at it and see if I could get a BASIC SBC to have a meaningful J1850 dialog with my van.
The first step was to establish basic communication on the RS-232 side. This sounds simple enough, but RS-232 hook-ups invariably involve more hassles than they should, and this time was no exception.
No problem with the 19.2-KB, 8N1 part, but I did have to ponder a bit about the handshaking lines. The unit is wisely optoisolated to keep load dumps and the like at bay.
To accomplish this, the RS-232 port is powered from the host via the DTR and RTS lines. So, whatever you hook up must connect these lines and be capable of driving them to opposite RS-232 polarity, which means you need three distinct transmitters (TX, DTR, RTS) along with a receiver (RX). The SBCs MAX-232 chip has only two transmitters, so there wasnt a way to cut and jump around the problem.
Whenever I need to make an RS-232 connection, I reach into my stockpile of MAX-235 chips. Yes, the 28-pin wide DIP is bulky, but its also much handier for prototyping than a tiny surface-mount package. Otherwise, with five transmitters and receivers, a single 5-V supply, and no external components (except for a 1.0-µF power supply bypass capacitor), the MAX-235 is definitely the Cadillac of RS-232 chips.
Because Im going upscale with RS-232, why not go for the gusto with the display as well? Once again, reaching back into the trusty group of gadgets Ive used before (Circuit Cellar 31, "Smart LEDs: The Hard Way, the Soft Way, and the Right Way"), I came up with the HP DSP-2501, 8-character bit-mapped LED display.
It isnt cheap, and the parallel interface demands a lot of I/O lines, but the display quality is unsurpassed compared to the inferior LCD. Is it sunlight readable, you ask. Well, if it werent for the software dimming feature, youd practically need sunglasses to look at it.
Not surprisingly, the HP unit, at full throttle with 280 individual LEDs (eight characters, each 5 × 7), calls for a high-octane power supply. In fact, the datasheet has cautionary language about limiting the total power (i.e., number of LEDs on at once), lest things get a little too hot to handle.
Fortunately, theres no shortage of engine-on power in automotive apps, considering the typical cigarette lighter outlet can deliver 100 W or so. For the few watts of 5 V or more required by the SBC and display, I might have been able to get by with a plain linear regulator, but it would have been iffy. Even under normal conditions (about 14 V, according to the vans voltmeter), the regulator would get hot, not to mention coping with worst-case spikes. So, I took the easy way out with a fully-loaded 15-W DC/DC converter featuring 9- to 18-V input and overvoltage, thermal, and reverse polarity protection.
|
| Photo 4The old and new. Though seemingly analog, the dial gauges in the instrument panel are driven digitally. Even the radio is connected to the VCM, so the faster you go, the louder it gets. |
Time to buckle up and hit it. The Multiplex Engineering mux interface puts a wrapper (i.e., destination, command, number of J1850 bytes, checksum) around the raw J1850 messages. One nice feature is that your software only needs to deal with a simple checksum because the mux interface handles the J1850 CRC. Another simplifier is fixed-length packets, with unused bytes zeroed.
Care for an example? To find out the current, RPM requires sending the following J1850 packet:
68, 6A, F1, 01, 0C, 8B
The first three bytes are the J1850 header, 01 is the code for mandated OBD II diagnostics, 0C specifies RPM, and 8B is the J1850 CRC.
So, what you need to send to the mux interface is:
20, 02, 05, 68, 6A, F1, 01, 0C, 00, 00, 00, 00, 00, 00, D7
The first byte (20) is an address associated with a particular mux interface. The next (02) is a command to send a J1850 VPW message. The third byte is a count of the J1850 packet length, not counting the CRC. The next five bytes are the J1850 packet (minus CRC) followed by six bytes of zero pad (recall the maximum J1850 packet length is 11 bytes). The fifteenth and last byte is the checksum of all bytes except the first.
Coming back on J1850, you expect to see something like the following, where HH and LL are the high and low bytes of the RPM:
48, 6B, 41, 01, HH, LL, CRC
Oh, by the way, dont forget its actually RPM × 4, or you might end up with gray hair, like someone I know.
In turn, the mux interface will return the following, where CHK is the checksum depending on the RPM:
40, 82, 48, 6b, 41, 01, HH, LL,
00,00, 00, 00, 00, 00, 00, CHK
Refer to Listing 1 to see the BASIC embodiment of all this. Without further ado, as you can see in Photo 4, I was successful in my quest to make the J1850 connection.
| Listing 1Notice that mystery messages (third byte not equal 48 hex) are simply ignored. |
PROGRAM J1850Tach
INTEGER rpm,i,j
INTEGER response(14)
STRING rpm_str
CONST leds=~$c038~
BEGIN
/* Mux interface msg to request RPM */
DATA $20,2,5,$68,$6a,$f1,1,$c,0,0,0,0,0,0,$d7
OUT 0,$74 /* '180 ASCI0 19.2K 8N1 */
OUT 2,$20
OUT 4,0
FOR i=0 TO 7
OUT leds+i,ASC(" ")
NEXT i
OUT leds,ASC("R")
OUT leds+1,ASC("p")
OUT leds+2,ASC("m")
loop:
/* Send request RPM msg */
FOR i=1 TO 15
READ j
DO
UNTIL BAND(INP(4),2)<>0
OUT 6,j
NEXT i
/* Receive RPM response msg */
FOR i=1 TO 14
DO
UNTIL BAND(INP(4),$80)<>0
response(i)=INP(8)
NEXT i
/* Throw away mystery msgs */
IF response(3)<>$48 THEN GOTO loop
/* Convert RPM to 3 or 4 digit string, display on LEDs */
rpm = ((response(8)*256)+response(9))/4
rpm_str = STR$(rpm)
IF LEN(rpm_str)=10 THEN rpm_str=MID$(rpm_str,1,4)
ELSE rpm_str=CONCAT$(" ",MID$(rpm_str,1,3))
FOR i=0 TO 3
OUT leds+4+i,ASC(MID$(rpm_str,i+1,1))
NEXT i
WAIT 6 /* Spec requires 100ms min between msgs */
GOTO loop
|
Thats not to say Ive completely mastered all the mysteries. If you look closely at the program, youll see I had to resort to a bit of ad hoc hacking to make it work. In particular, I discovered that it was best to adopt a policy of listening only for the stuff I wanted to hear.
For example, when sending a command from the SBC, I discovered the Multiplex Engineering unit isnt happy if you dawdle between bytes and will complain by sending back an error message. I was able to stop that by streamlining the inner loop of code that sends the message (by pre-computing the checksum). Considering that the BASIC SBC Im using is fairly fast (its a compiled, rather than interpreted, BASIC), watch out for this if youre using something slower.
The good news is I was no longer getting back stuff when I didnt expect it. The bad news is I was getting some stuff back that I didnt expect. Every now and then the RPM came back 0000. Curiosity aroused, I probed further to take a closer look at the incoming messages.
Sure enough, as shown in Figure 2, some strange activities were taking place. In particular, every now and then Id get an odd packet that apparently is a valid diagnostic response as far as J1850 is concerned, but certainly doesnt contain the proper RPM info. While youre thinking about that, also note that even in the valid RPM packets, theres a third mystery byte following the two RPM bytes called for by the SAE spec. Following the if-in-doubt, throw-it-out approach, I finally got my digital J1850 tach working like a charm.
What does all this mean? Why do car dealers buy so many balloons? Seems to me the car biz is just bizarre, both at the showroom and under the hood.
40 82 48 6B 10 41 0C 0A E0 23 00 00 00 9F 40 82 48 6B 10 41 0C 0A D9 9C 00 00 00 11 40 82 48 6B 10 41 0C 0A FE 48 00 00 00 E2 40 82 A8 FF 29 03 F0 00 00 00 00 00 00 45 40 82 48 6B 10 41 0C 0A DC F5 00 00 00 6D 40 82 48 6B 10 41 0C 0A E6 6D 00 00 00 EF 40 82 48 6B 10 41 0C 0A EE 85 00 00 00 0F 40 82 48 6B 10 41 0C 0A F3 C9 00 00 00 58 40 82 E8 FF 10 03 B3 00 00 00 00 00 00 2F 40 82 48 6B 10 41 0C 0A F9 1B 00 00 00 B0 40 82 48 6B 10 41 0C 0A F4 9A 00 00 00 2A 40 82 48 6B 10 41 0C 0A E9 D6 00 00 00 5B |
| Figure 2The first few captured messages illustrate a valid RPM response. For example, in the first line, 0AE0 hex represents 4× the RPM (i.e., RPM = 2784/4 = 696). The purpose of the following byte (e.g., 23 hex in the first line), not to mention the intermittent mystery messages (third byte not equal 48), remains to be determined. |
I though historically resistant to change, I think the silicon revolution will inexorably work its magic on the car business. The manufacturers will realize that the car network isnt about the old-fashioned proprietary, dealer-only strategy. Rather, as with PCs, it is a great platform for neat features and services that they (and third-parties) will be glad to provide and encourage eventually.
What might the future hold? Remote diagnosis and even repair. Car black boxes that eliminate courtroom finger-pointing after an accident. A key for teen drivers that doesnt let them burn rubber. Dial-up smog checks in which the car testifies to its own cleanliness (no need to pay for a tailpipe proctologist). Stolen cars that not only report their location, but stop running or, for kicks, automatically chauffeur the miscreant to the police station.
You may laugh, but click over to the Dearborn Group to check out their Gryphon Ethernet & TCP/IP Road Wide Web server.
I realize all this sounds rather visionary (as in "Toms having visions again "), but when it comes to silicon its never a question of if, only whenand whether it comes in leather.
Tom Cantrell has been working on chip, board, and systems design and marketing in Silicon Valley for several years. You may reach him by e-mail at tom.cantrell@circuitcellar.com or by telephone at (510) 657-0264.
RESOURCES
Diagnostic RS-232 Multiplex
Interface
Multiplex Engineering
(805) 964-6802
Fax: (805) 964-0890
www.multiplex-enginering.com
OBD2Scan PC-based Scan Tool
Baum Tools Unlimited, Inc.
(800) 848-6657
Fax: (941) 927-1612
www.baumtools.com
AutoTap PC-based Scan Tool
B&B Electronics
(815) 433-5100
Fax: (815) 433-5105
www.autotap.com
Ease PC Scan Tool
Ease Simulation, Inc.
(570) 465-9060
Fax: (570) 465-9061
www.easesim.com
Vehicle Control Module (VCM)
Delphi Automotive Systems
(248) 813-2000
Fax: (248) 813-2670
www.delphiauto.com
Gryphon Ethernet & TCP/IP Multiplex
Server
Dearborn Group Inc.
(248) 488-2080
Fax: (248) 488-2082
www.dgtech.com.
© Circuit Cellar, The Magazine for Computer Applications. Reprinted with permission. For subscription information call (860) 875-2199, email subscribe@circuitcellar.com or on our web site at www.circuitcellar.com.