Differences

This shows you the differences between two versions of the page.

--- can_analysis [2019/02/06 16:54]
sam
+++ can_analysis [2019/02/06 18:18]
sam
@@ Line 17: / Line 17: @@
 ===== E-Bike Messages =====
+This analysis is completely non-invasive and no messages were transmitted to the CAN bus. The adapter is in silent mode.
 System Overview:
 {{::photo_2019-02-06_16-51-42.jpg?600|}}
+  * Adapter: generic SLCAN
+  * CAN bitrate: 1Mbps
 According to [[https://infosys.beckhoff.com/english.php?content=../content/1033/tcsystemmanager/fieldbus/canopen/Identifierverteilung.htm&id= | ref]], the 11 bit identifier consist of a 7bit node id and a 4bit function code.
@@ Line 44: / Line 50: @@
     * States: Boot-up (0x00), Pre-operational(0x7f), Operational (0x05)
-  * canopen.node_id == 0x7f
+  * canopen.node_id == 0x7f **[REMOTE]**
     * only sends NMT error control messages except at startup:
     * {{:2019-02-06-161831_513x132_scrot.png?400|}}
     * the message stream stops if the remote is unplugged! is this the remote?
   *  canopen.node_id == 0x0
     * on boot: NMT: start remote node 0x1 and 0x2
     * otherwise, while not riding: SYNC
-  *  canopen.node_id == 0x02
+  *  canopen.node_id == 0x02 **[BATTERY]**
-    * sends tx_PDO1, tx_PDO2, tx_PDO4 and NMT
+    * sends tx_PDO1 (fc=3), tx_PDO2 (fc=5), tx_PDO4 (fc=9) and NMT
     * no rx PDOs, so this is not an actuator? is this the battery?
     * unplugging the remote control doesn't stop this message stream
-  * canopen.node_id == 0x01
+  * canopen.node_id == 0x01 **[MOTOR]**
     * sends PDO1 (rx, tx), PDO2 (tx), PDO3, NMT and Default-SDO (rx,tx): initiate upload request and response
-    * When the remote controller is unplugged, EMCY (emergency) is seen and 2 last PDO1 are seen. After that only PDO3 and NMT operational until PDO3 also disappears. Node_id 0x01 is not the remote control?
+    * When the remote controller is unplugged, EMCY (emergency) is seen and 2 last PDO1 are seen. After that only PDO3 and NMT operational until PDO3 also disappears. Node_id 0x01 is not the remote control? I suspect this node is the motor, see below!
     * As soon as remote is plugged back in this happens:
     * {{::2019-02-06-164445_721x435_scrot.png?400|}}
-  *
+  * canopen.node_id == 0x01 and canopen.function_code == 0x7
+    * (PDO3 tx)
+    * Data field: **c4:07:00:00**:__01:00:00:00__ / the bold part goes up if the motor is turning and the underlined increments when the pedals are used. If the wheel is spinning freely, both are zero. If the wheel is driven backwards, the bold part decrements down from FFFFFFFF.
+    * canopen.node_id == 0x01 and canopen.function_code == 0x5 changes similarly but doesn't return to zero. Has some offset.
+  * canopen.node_id == 0x01 and canopen.function_code == 0x4
+    * pdo1 rx
+    * starts at 0
+    * when power is given to the motor, it increases and goes back to zero as soon as no power is fed to the motor
+    * i know it must be power to the motor, because it increases even if the wheel isn't turning
+  * canopen.node_id == 0x01 and canopen.function_code == 0x3
+    * pdo1 tx: independent of power or wheel spin
+    * **37:03:**00:00:68:c3:__aa:05__ - bold part doesn't change after reboot, the underlined seems to be some kind of timer. the rest changes seemingly randomly. (external odometer at time of writing: 3161km)
+  * canopen.node_id == 0x02 and canopen.function_code == 0x5
+    * PDO2 tx: looks like battery voltage or charge. Decrements when powered and increments when charger connected.
+  * canopen.node_id == 0x02 and canopen.function_code == 0x9
+    * PDO4 tx: increases when charging decreases when resting, could this contain a temperature? not sent as often as the other messages (1 per 2 sec)
+  * canopen.node_id == 0x02 and canopen.function_code == 0x3
+    * PDO1 tx: again something that increases when charging and decreases while standby and even more when powered. could this be battery voltage?