Simulating CAN from a Variable Geometry Turbine
A variable geometry turbo (VGT) actuator is a device on an engine that communicates with the engine control module (ECM) over a controller area network (CAN). That’s three acronyms in one sentence! The issue is we don’t know what those CAN signals are and we need them in order to eliminate that fault from the ECM. The purpose of eliminating faults on an ECU is to keep the system from producing new faults on startup and overwriting existing fault codes. This is important in a forensic investigation when the ECM is not in a vehicle.
The Fault Code
For this example, we are connected to a Cummins CM2350 engine control module that is set to control an ISL9 engine. Cummins Insite diagnostic software shows fault code 1894.
An abnormal update rate is an indication that the VGT CAN signal is missing. To figure out the CAN signal, we need a baseline of CAN traffic without the VGT attached. To do this, we can use the Smart Sensor Simulator Interface application. In the Data Logger tab, we have the option to log data on the second CAN channel.
A video demonstration of recording the initial CAN2 or Engine CAN is shown below:
The saved file is here: SSS2_CAN2_Data_Log_2017-08-18_090708_CM2350_EngineCAN_NoVGT.csv.
Connecting the VGT
Schematic
The Cummins CM2350 is connected to the CAN2 channel on the SSS2 by connecting pins J1:69 to the CAN2H wire, which is J18:16 on the SSS2 and J1:93 to the CAN2L wire, which is J18:15. These are also available as CAN2 on the 9-pin round connector of the SSS2.
The following message was found from the VGT only:
To add this message to the SSS2 Interface App, we can create a new message that transmits every 25 milliseconds on CAN2.
The result of this message addition eliminates the VGT Abnormal Update Rate fault code, but two more codes show up.
Clearly there is still more work to do, since we eliminated one fault code, then added two more.
VGT Calibration Messages
Upon startup, the VGT sends some other messages to the engine controller. These were captured with the SSS2 Interface App in the following file.
The frequent message from the VGT is
Channel,Unix Timestamp,CAN ID (Hex),EXT,DLC,B1,B2,B3,B4,B5,B6,B7,B8
CAN2,1503052411.748793,18FFC502,1,8,11,FF,FF,50,08,FF,FF,FF
Parsing this message according to J1939 shows that the PGN is 0x00FFC5, which is a Proprietary Message.
As and experiment, we changed all the message contents to zeros and, to our surprise, we could see the calibration error go away! In other words, if we change
18FFC502,1,8,11,FF,FF,50,08,FF,FF,FF
to
18FFC502,1,8,00,00,00,00,00,00,00,00
another fault code is eliminated.
There is one VGT fault code left to eliminate, which is code 4956: Variable Geometry Turbocharger Actuator Software – Out of Calibration
The messages we are interested in the log file have a source address of 0x02 and are not the 18FFC502 messages. We find these two request messages:
CAN2,1503052411.760722,18EAFFFE,1,3,00,EE,00,00,00,00,00,00
CAN2,1503052411.761428,18EEFF02,1,8,BD,82,A4,12,00,85,00,00
which is a J1939 address claimed message and happens every 0.5 seconds or so at the beginning of the records. It repeats 10 times
The other messages that occur are responses to the following requests:
CAN2,1503052412.087318,18EA0200,1,3,DE,FF,00,00,00,00,00,00
CAN2,1503052412.088468,18FFDE02,1,8,30,30,30,31,31,32,32,31
where the first line is the request message from the CM2350 ECM and the second line shows the response from the VGT. Decoding the response message shows a numerical sequence of 00011221. There are no markings on the outside of the VGT with this number, so its meaning is unknown. This message sequence happens only once.