Toyota BEANs, Multiplex etc

[George]

so in fact, you only need to run Nissan speedo/tacho via CAN? That's quite easy

You can actually find some info on the web. Like I did when installing 4gr-fse into Mazda RX-8. It also uses CAN for instrument cluster. It even uses CAN RPM data to power on/off electronic power steering.

I think I can fabricate appropriate converter

[dumbass]

I want to put a tacho rpm pulse from an ls1 ecu into a module which then connects to nissan can system which then gets tacho working in dash which is can
Once that's working I need to do air con and water temp gauge working in dash to

But the tacho is main thing for now

[George]

As I said, I see nothing impossible. A minimum test setup would be the proper data logs and a target instrument cluster.

There's some solution to your problem other than running a CAN converter. You may just leave factory ECU and fool it so it outputs the valid information to its digital lines.

[George]

upd: problem solved. DID & MID fields were needed to properly calculate the CRC. Each packet needed a different initialization pattern but the same CRC polynom, and the initialization data was exactly the DID & MID ))

[fyodore82]

George, how did you calculated CRC? No one polynom gives me correct results...

[George]

Maybe start with introducing yourself, show us more details on your research? Do you plan to share it? What chassis do you work with?

[fyodore82]

Yes, sure.

I try to understand how BEAN protocol works. I want to connect in-house built devices to this bus.
Using info from book you bought and shared on this site, I understood BEAN frame format (thank you for sharing book!) and built sniffer for BEAN.
As I found, most messages on BEAN network are sent repeatedly (2014-07-14 CodeSort.txt). First byte is count of messages got, second - CRC repeated from end of the frame, and frame itself.
Meaning of messages is unknown for me... I plan to make simple BEAN sender and send messages to bus and see what devices will response to them.

I also drawn scheme of BEAN sender/receiver. I drawn it from photo of conditioner's PCB. It is very similar to scheme from original book. But I have no luck when tried to make it work in Proteus... So I think I'll make simple form of transceiver using one transistor :-) Let there be noise :-)

[George]

Sorry can't explain too much details right now. PM me a bit later. Are you familiar with Matlab? Got any logic analyzer?

[gte]

Hi George,

Can you explain how you reverse engineered the CRC poly? I want to hack the mpx on a Celica ecu, but I'm rather new to Bean. It appears that the CRC8 always has a 1 as its first digit, leaving 128 other combinations of which 1111111 and 0000000 are not possible, so that leaves us with 126?

Is there a program I can use or build to figure out which of the 126 poly combos it is? If not, I don't mind figuring it out on my own but would need a little nudge in the right direction if you are feeling generous. I have an Oscope, but not Matlab ... do I need to buy it?

I've been programming a uC as an add on device and want to communicate with my gauge cluster.

My failed attempts are posted below.

--------
DID D2 - 11010010
MID 26 - 00100110
DATA1 00 - 00000000
DATA2 80 - 10000000
CRC B1 - 10110001
EOM 7E - 01111110

11010010001001100000000010000000 10110001
D2260080 10110001
DID + MID + DATA1 + DATA2 = P(x) = x8+ x7+ x5+ x4+ x0 OR P(x) = x7+ x5+ x4+ x0
MID + DATA1 + DATA2 = P(x) = x8+ x7+ x5+ x4+ x0 OR P(x) = x7+ x5+ x4+ x0
DID + DATA1 + DATA2 = P(x) = x8+ x7+ x5+ x4+ x0 OR P(x) = x7+ x5+ x4+ x0
(MID + DATA1 + DATA2) (DID + DATA1 + DATA2) = P(x) = x8+ x7+ x5+ x4+ x0 OR P(x) =

x7+ x5+ x4+ x0

--------
DID D2 - 11010010
MID C8 - 11001000
DATA1 02 - 00000010
CRC E9 - 11101001
EOM 7E - 01111110

110100101100100000000010 11101001
D2C802 11101001
DID + MID + DATA1 = P(x) = x8+ x7+ x6+ x5+ x3+ x0 OR P(x) = x7+ x6+ x5+ x3+ x0
MID + DATA1 = P(x) = x8+ x7+ x6+ x5+ x3+ x0 OR P(x) = x7+ x6+ x5+ x3+ x0
DID + DATA1 = P(x) = x8+ x7+ x6+ x5+ x3+ x0 OR P(x) = x7+ x6+ x5+ x3+ x0
(MID + DATA1) (DID + DATA1) = P(x) = x8+ x7+ x6+ x5+ x3+ x0 OR P(x) = x7+ x6+ x5+

x3+ x0

--------
DID D2
MID 2C
DATA1 01
CRC B5 - 10110101
EOM 7E

D22c01 10110101
DID + MID + DATA1 = P(x) = x8+ x7+ x5+ x4+ x2+ x0 OR P(x) = x7+ x5+ x4+ x2+ x0
MID + DATA1 = P(x) = x8+ x7+ x5+ x4+ x2+ x0 OR P(x) = x7+ x5+ x4+ x2+ x0
DID + DATA1 = P(x) = x8+ x7+ x5+ x4+ x2+ x0 OR P(x) = x7+ x5+ x4+ x2+ x0
(MID + DATA1) (DID + DATA1) = P(x) = x8+ x7+ x5+ x4+ x2+ x0 OR P(x) = x7+ x5+ x4+

x2+ x0

--------

Sorry can't explain too much details right now. PM me a bit later. Are you familiar with Matlab? Got any logic analyzer?

[dumbass]

u need one of these
http://store.intrepidcs.com/WaveBPS-...avebps-pro.htm

[George]

gte
you should concatenate all the fields rather than summing them. Ant then run a variety of 8-bit polynomials against them
Also note that bit stuffing is applied on informational fields

Try to check out this challenge
http://cryptopals.com/

It will improve your programming skills in performing activities like bus decoding, etc

dumbass
Apparently gte already has one

[gte]

That's unfortunately not an option. I'm pretty sure I could build a crude version of that for under $100 though ... maybe that's my only option?

A uC that would detect bits and print them to the screen as hex through firmware conversion would be sufficient I think. If I have the hex, I can then try to reverse engineer it I believe.

u need one of these
http://store.intrepidcs.com/WaveBPS-...avebps-pro.htm

[gte]

Hi George,

Thank you for the hint. I will be working on this today thanks to your direction .

Do you have a few complete example fields I can concatenate and test against? I saw the text document you've linked earlier with 5 fields in it, but from your hint it sounds like I would need all 10 fields.

gte
you should concatenate all the fields rather than summing them. Ant then run a variety of 8-bit polynomials against them
Also note that bit stuffing is applied on informational fields

Try to check out this challenge
http://cryptopals.com/

It will improve your programming skills in performing activities like bus decoding, etc

dumbass
Apparently gte already has one

[gte]

Looks like I'll definitely need a few examples of an entire set of data with all 10 fields as guessing is not working. I may have to build my own sniffer before hand as well.

Am I close George?

______________
Edited

SOF (1bit) 1 (1) (guess)
PRI (4bits) 3 (0001) (guess)
ML (4bits) 49 (01001001) (calculated)
DID (8bits) 62 (01100010)
MID (8bits) D2 (11010010)
DATA1 (8bits) 00 (00000000)
DATA2 (8bits) A0 (10100000)
DATA3 (8bits) 08 (00001000)
CRC (8bits) 0A (00001010)
EOM (8bits) 7E (01111110)
RSP (2bits) 2 (10) (guess)
EOF (6bits) F (00111) (guess)

73 total bits

00001010
DID to EOM = 62D200A0080A7E (poly is P(x) = x8+ x3+ x1)
SOF to EOF = 134962d200a0080a7e2f (poly is P(x) = x8+ x3+ x1)


--------


SOF (1bit) 1 (1) (guess)
PRI (4bits) 3 (0001) (guess)
ML (4bits) 41 (01000001) (calculated)
DID (8bits) 98 (10011000)
MID (8bits) CC (11001100)
DATA1 (8bits) 02 (00000010)
DATA2 (8bits) A8 (10101000)
CRC (8bits) 35 (00110101)
EOM (8bits) 7E (01111110)
RSP (2bits) 2 (10) (guess)
EOF (6bits) F (00111) (guess)

65 total bits

00110101
DID to EOM = 98CC02A8357E (poly is P(x) = x8+ x5+ x4+ x2+ x0 )
SOF to EOF = 134198cc02a8357e2f (poly is P(x) = x8+ x5+ x4+ x2+ x0 )

[George]

I'll post my matlab script's output as an example for you
PRI|ML 64
DID 98
MID CC
DATA1 02
DATA2 A8
CRC 35
check crc: 35
CRC OK
EOM 7E

p/s one more file
------Original packets count:5 --------
PRI|ML 64
DID FE
MID 40
DATA1 00
DATA2 00
CRC 3E
check crc: 3E
CRC OK
EOM 7E
--------
PRI|ML 64
DID D2
MID 26
DATA1 00
DATA2 00
CRC B1
check crc: B1
CRC OK
EOM 7E
--------
PRI|ML 53
DID D2
MID C8
DATA1 00
CRC E9
check crc: E9
CRC OK
EOM 7E
--------
PRI|ML 63
DID D2
MID 2C
DATA1 00
CRC B5
check crc: B5
CRC OK
EOM 7E
--------
PRI|ML 64
DID 98
MID CC
DATA1 02
DATA2 A7
CRC D4
check crc: D4
CRC OK
EOM 7E
--------