Question about FIAT CAN protocol

[sv095]

Hi!
I have tested Multiecuscan, but since I just want to sniff and analyze the CAN bus traffic, and I suppose that you know more than me about Fiat CAN bus protocols, I want to make you a question.

My car is a Fiat Grande Punto 2008. I use an ELM327 chip, I have tried the AT MA command (Monitor All), and I have read some interesting data, and I am now trying to decipher the STRUCTURE of the frames.

I have something like this (with headers turned on: AT H1):
[...]
00 30 A0 02 40 00 00 00 00 01 00 0C
0A 18 A0 01 01 00 80 63 01 24 19 00
06 18 A0 01 00 29 03 2F 00 18 58 00
06 28 A0 01 00 21 00 80 00 20 00 20
0A 28 A0 01 00 00 2D E0
00 1C A0 06 38 2A CA 1B 3B A9 FD 9D
00 14 A0 06 3B 6C B9 81 38 FB 0A 1B
02 10 A0 06 FF 02 FF 00 00 00 00 00
08 10 A0 00 00 FF 08 00
00 30 A0 02 40 00 00 00 00 01 00 0D
0A 18 A0 02 01 00
06 18 A0 01 00 27 03 46 00 18 58 00
06 28 A0 01 00 21 00 80 00 20 00 20
00 1C A0 06 08 2A CA 1B 0B A9 FD 9D
00 14 A0 06 0B 6C B9 81 08 FB 0A 1B
02 10 A0 06 FF 03 FF 00 00 00 00 00
08 10 A0 00 00 FF 0C 00
[...]

The first four bytes seem to be the header, however I have read that the headers of CAN 15765-2 frames (29 bits extended identifiers) have this structure:
Description - Number of Bits
SOF - 1
Arbitration Field - 32
Control Field - 6
(39 Bits preceding data)
Data Field - 0…64 0…64 data bits
CRC Field - 16
ACK Field - 2
End of Frame Field - 7
Interframe Space - 3
(28 Bits succeeding data)

And obviously, my frames are quite different from this structure...
I have read that maybe, Fiat uses RAW CAN protocol instead of ISO 15765... but I don't know anything about raw CAN

can you help me? what are these frames? is a proprietary protocol?
I am doing a researching work, and I need to know this kind of information...

Thank you!

[ARomeo]

see attachment

[sv095]

Thank you!
I have read that, but I think it is not what I was looking for... I mean, the PDF describes the Fiat 9141 protocol but that protocol was used in 1999, my car is 2008... I think my car does not use that protocol... I think it uses some propretary protocol from Fiat, running over the CAN bus... but I am not sure, and I would like to know that because I am doing a research work and I have to explain the protocol or at least the structure of the frames

[sv095]

I have been making some discoveries.

I think FIAT Grande Punto uses protocol UDS or ISO 14229 for diagnostics, over protocol ISO 15765, and then over ISO 11898-2 (used in Data Link and Phisical layers), and what I see when monitoring the traffic are raw CAN frames (ISO 11898), although the frames are encoded using a proprietary protocol to encode the headers and data fields.

It is like, for example, ICMP<IP<Ethernet frames, where Ethernet is ISO11898, IP is ISO15765 and ICMP is ISO14229

I am not 100% sure, so I would like someone to tell me whether I am wrong or not.

[acab]

i make diy canusb
and try sniff c-can(500kbit) from motor can bus.

i have some info in attached files

if anybody have more info about fiat c-can - please pm me. i have some questions


040 7 immo code response
041 7 immo code request
046 8 asr 0
081 8 mot sel
0C2 6 ge
146 8 asr 1
166 8 asr 2
361 8 mot 1
3A1 8 mot 2
560 8 status b-can
561 8 status c-ncm
562 2 status c-nfr
566 8 status c-nfr
5A0 4 vehicle speed and odometer
66A 0 RTR
680 8 end of line configuration
6A0 6 time + date
6A0 0 RTR
6AA 0 RTR
t6A 0 RTR

[ilpollicenero]

Hi!

The first four bytes seem to be the header, however I have read that the headers of CAN 15765-2 frames (29 bits extended identifiers) have this structure:
Description - Number of Bits
SOF - 1
Arbitration Field - 32
Control Field - 6
(39 Bits preceding data)
Data Field - 0…64 0…64 data bits
CRC Field - 16
ACK Field - 2
End of Frame Field - 7
Interframe Space - 3
(28 Bits succeeding data)

And obviously, my frames are quite different from this structure...
I have read that maybe, Fiat uses RAW CAN protocol instead of ISO 15765... but I don't know anything about raw CAN

Thank you!

The sniffed data do not correspond to the structure because it seems they are in HEX format but the structure refers to bits

[acab]

I still need contributors, because for me hard to investigate all packets...

https://github.com/pompushko/fca-canbus-monitor?files=1

[can2sky]

I still need contributors, because for me hard to investigate all packets...

https://github.com/pompushko/fca-canbus-monitor?files=1

Hi, acab. How can i message you? About cooperation

[htevents]

also want to jump into this thread, I also want to know a pretty detailed list of the CAN messages/ID's.
I want to create a full digital/LCD instrument cluster for my Punto 1.3Mjet 12+ and need to know what ID's tell what to the cluster, for example: What ID/message will turn on the Engine check light, the turn signal indicators, ABS light, etc.

So the list should look a bit like this:
ID: .. .. .. .. ..
Function: Engine checklight ON

ID: .. .. .. .. ..
Function: Left Turn signal ON/OFF

Etc.

Did someone already record ID's like this? Does somebody know if a list like this exists and if yes where?

I am based in the Netherlands, maybe someone with a bit more knowledge of the CAN system wants to help me out with this, to build this cool project?