Hacking Lexia Protocol for Arduino - I did it !

[haydent]

Update, jump to this post for latest: http://www.frenchcarforum.co.uk/forum/v ... 74#p496777

old original post:

Code: Select all

Hi all, just going to post about my project and progress. Started from wanting the detailed data available via lexia for long term logging, without a pc. (also the native pc logging capability of lexia bombs out after a few minutes for me anyway.)

Bought a OBD2 logger, and it get the basics like fuel rail pressure, air flow & pressure, rpm, speed but wanted more.

Ideally to have a Arduino (embedded) micro controller running it so maybe you could have something like a turbo pressure gauge.

Decided it would probably be too hard to reverse engineer lexia's likely propriety diagnostic protocol, and instead focussed on getting an Arduino Due (with usb host support) to talk to the actia tool in the way lexia does on a pc.

Got a usb logger program, and logged the raw hex data being sent and recieved between lexia and the actia tool over usb.

Next after some time i got USBHOST mode to work on my arduino due, and actually got it talking with the actia tool !  :-D I could send the same hex data i captured and it would respond with hex data the same way it had when it was hooked up to the pc.

Next im the process of working out how to decode the data i want, eg turbo pressure reading from a bunch of hex which for me would be impossible, but im getting some tips by analysing an old version of lexia's files for clues...

Its funny to see that lexia appears to be a dos/windows 3.1 program, and citroen just kept putting it in wrappers to make it run in later versions of windows, and that lexia uses open source programs to do what it does like mozilla browser, eclipse ide, and firebird sql server ...

[haydent]

Update: it seems all the functions i need to see to understand the usb protocol are locked up in lexia's dll's, so now im back to trying to crack the packet format 'manually':
http://stackoverflow.com/questions/2981 ... b-captures" onclick="window.open(this.href);return false;
Here you can see some captures and my attempt to work out the stucture of data transmission.

[Stickyfinger]

Hi Haydent

Interesting, but why ?

[haydent]

For longer logging than lexia supports, and doing so automatically on engine start without need for computer, and for extended digital gauges beyond that which is accessible via obd2, protocol.

[Stickyfinger]

ahhh...OK thanks

[xantia_v6]

The last hex digit in the protocol is fairly clearly a checksum, as if you add all the characters in a packet, mod 255, the sum is always F4 or F5 (I can't yet see why it varies by one). So it seems that the 8th character is the 8 bit ADC reading, which is converted to a % on the PC.

I have done a lot of protocol analysis in previous lives, and have written a few Wireshark dissectors, so this is an interesting problem for me, but I don't know how much time I can spend on it at present.

[haydent]

The last hex digit in the protocol is fairly clearly a checksum, as if you add all the characters in a packet, mod 255, the sum is always F4 or F5 (I can't yet see why it varies by one). So it seems that the 8th character is the 8 bit ADC reading, which is converted to a % on the PC.

I have done a lot of protocol analysis in previous lives, and have written a few Wireshark dissectors, so this is an interesting problem for me, but I don't know how much time I can spend on it at present.

yes i too was thinking there would likely be a checksum there at the end somewhere. there's no rush, glad to have your help and support. i thought it might be adc reading, and it likely is, but how do you think they are getting the 6 point precision float from it ? or the arnt instead creating it on the pc end by dividing 100% by a number of increments...

[haydent]

Bringing this thread back from the dead, i abandoned trying to snoop and emulate the usb bus and instead focused on the other end of the diag tool, to diagnostics socket with great success ! it turns out to be quite simple to do, as the data im after is all available over the CAN bus at the standard 500kbps , you just have to watch how the actia tool does it and repeat. Ive done this and have made a data logger and display for the selected gear and gearbox electrovalve readings, but could easily be adapted to any reading available in lexia.
https://hackaday.io/project/12644-can-d ... can-shield

[jgra1]

Good work hayden. It doesnt mean a huge amount to me but i can the end result.
The nearest i get to a checksum is checking my bank balance!

Off topic all but i have an issue with my c5 and need to see the logs to help me understand what happens while driving.. can someone tell me where i need to be in diagbox to see log of car running..for example 2 days ago? I have done it before but by accident

Thanks
John

[GiveMeABreak]

You just need to go into the area you want to monitor - usually the specific ECU, then you should get a sub-menu, Measurements where you can select the particula tests to monitor - I think up to 10 specific measurements at the same time John.

[jgra1]

Thanks.marc.. i think i meant a long text list of the cars life.. i saw one soon after i bought it which seemed to show the last mimutes of the engines failure.. a few months before.. ?

Ahh.. just did a quick google and it led me back to fcf and addo and a faults journal!! That is what i mean

http://www.frenchcarforum.co.uk/forum/v ... hp?t=46645

Found it.. sorryyy

[haydent]

You just need to go into the area you want to monitor - usually the specific ECU, then you should get a sub-menu, Measurements where you can select the particula tests to monitor - I think up to 10 specific measurements at the same time John.

in lexia its only 6 custom parameters, and its pretty flaky at best, i also think it is only meant to record for 5 mins, but ive never gotten more than a couple before it drops with communication error.

my device automatically connects and reconnects if needed, so it can be left plugged in and will do its thing.

[WastedSpark]

Hi Hayden,

I have a project that needs to read engine paramaters from the CAN bus. I'm using an Arduino Leonardo, MCP2515 and MCP2551 to communicate with the bus.

What I have found sofar is that the engine ECU broadcasts a number of parameters on the bus without prompting, however it is not as complete as the data available through the live-data feed in PP2000 using Lexia. Did you find that you need to transmit anything specific to the ECU to get the data that you need?

Thanks,
Scotty

[haydent]

So yeah, you just monitor/record the can bus (with a y adapter) while requesting the data you want with pp tool, and then replicate that with your arduino tool. With my project i collected the required requests needed for the transmission, but you could do any system.