J1850 VPW Sniffer

[jlvaldez]

The OBD Xpro can sniff the bus with just a few commands to put it in the right mode https://obdxpro.com/product/obdx-pro-vt/

Code: Select all

ATSP2            # Protocol 2 VPW
ATH1             # Turn headers on
ATSH6C10F0  # Set the header to priority 6C to PCM 10 from Tool F0 (not entirely relevant for just logging)
DXPT1           # Enable pass through mode (turns on logging)
DXSMFF0000 # Sets the mask so that it only needs to match 6C (I think you can use 00 00 00 for all data, not sure as I didnt use that when I was logging with it)
DXSV1          # Sets VPW speed 1x or can use 4 to log at 4x

Awesome! This is pretty affordable. I think i'll pick one up. See if I can't be lazy.

I've already placed the order for the PCB manufacturing for the AllPros... Don't think I can cancel it now. RIP.

Alright, cost of IC components for 5 boards is $118.... Board manufacturing is $25 for 5 boards. Material cost is ~$29/board. Then I'll have to solder it... I don't mind soldering too much, I don't think, but then it's flash the board with firmware too... Probably ~40/board for the allpro, and that OBD device is $50.... I think I'll pay the $50

Unless there's 4 other people that want an allpro device. The boards are being manufactured, I already spent that. If there's interest in the allpro devices, I'll buy the components and build the boards. Estimated price of $40/board to cover material cost and some of my soldering and flashing time ( got to test them)...

[antus]

The firmware is pretty easy, you just put it in bootloader mode and use the tool to send it in. The soldering on the main IC is tight. I dont think I could do it by hand, but if you have SMD tools and the skills it could be done. You could leave the can and kline components off I guess if you just want VPW.

[In-Tech]

The OBD Xpro can sniff the bus with just a few commands to put it in the right mode https://obdxpro.com/product/obdx-pro-vt/

Code: Select all

ATSP2            # Protocol 2 VPW
ATH1             # Turn headers on
ATSH6C10F0  # Set the header to priority 6C to PCM 10 from Tool F0 (not entirely relevant for just logging)
DXPT1           # Enable pass through mode (turns on logging)
DXSMFF0000 # Sets the mask so that it only needs to match 6C (I think you can use 00 00 00 for all data, not sure as I didnt use that when I was logging with it)
DXSV1          # Sets VPW speed 1x or can use 4 to log at 4x

Hiya antus, are you guys already setup to do J1850 PWM too? Does it seem feasible to use this passively with a Y cable and rig up some sort of a logger? I apologize for my lack of knowledge. I realize logging traffic can get a bit touchy so please understand this is for my own learning and not to log and release secrets.

[antus]

Sorry its not my product, you'd need to ask Tazzi. I think its only VPW at the moment though PWM may not be too hard to add for them if there was enough interest. From what I understand PWM is the same electronically, but with a different PWM timing system.

[pman92]

PWM is 5v while VPW is 7v
PWM uses pin 10 as a low reference but VPW doesn't

[gjestico]

Stumbled across the AllPro. Hard to tell for sure, but it looks like it supports VPW 4x using standard AT commands over a comm port, which would be easy.
https://www.obddiag.net/allpro.html

There's also a kit, which has a DB9 connector over the horizontal 100 mil headers http://www.obddiag.net/allpro-kit.html

Can't find a source to buy it, but I can send it off to be fabbed and assembled. Question is if it's able to monitor the bus? Quick look at ELM AT commands suggests this is possible.

Hello, I have an original USB AllPro , and I too am looking to sniff the bus on a ~2000 Camaro system. Is there a specific set of commands to get it to do so ? It does not seem to support the ATMA (monitor) command that ELM327 devices do.

[antus]

No it does not. You would need to get the firmware source code from github and modify it just keep calling the receive function, compile a bin, and put that firmware on the device. I have compiled firmware, depending on having the right versions of the software its not too hard. The biggest gotcha is there is an extra build step you need to put in the mcu xpresso IDE to get it to build a bin which can be uploaded by the firmware tool.

Here are some screen shots I took as notes for the environment setup, and the pdf where I found the information about the build changes. The flash tool to write to the adapter is called flashmagic and the free version is enough. https://www.flashmagictool.com/ There is more information on the official allpro page, although it seems to have changed again.

Its been a long time since I looked at this stuff, so I cant really help with further questions. I'd be looking at these same notes and trying to figure it out again myself. All of those images show some settings you need to set to get it to build, and provided it hasnt changed too much again, there shouldnt be any other settings. Note that lpc xpresso turned in to mcu xpresso - they are the same thing.

To create a monitor mode doesnt really fit with the firmware design, because the elm protocol is designed to trigger on a command from the PC side, so monitoring the other side doesnt really fit the code flow. The firmware can be set to read a number of responses, 5 at max over a short time, but that isnt really a monitor mode (and isnt enough for pcm hammer to see the response to switch to 4x from all modules either). To add a monitor mode you'd want to put a monitor command in the dispatch table to enable it, and call a function that probably sets a flag for monitor, which is calls straight in to the receive function (short circuiting the send a message part), and then keep it in the receive function while the monitor flag is set. To do it properly you'd need to add something so that every protocol checks the monitor flag and skips the transmit part, and doesnt exit the receive part. this would mean you'd need to power cycle the interface to get out of monitor mode, but being a single threaded firmware I cant see a way around this without the firmware ending up like spaghetti. A very simple way to do it would be to hack the receive loop in VPW only so that it never exits.... but that'd break your interface until you flashed back in the stock firmware.

[123killagum]

Im also interested in MA mode for sniffing on the allpro. Hopefully someone will add it.

[jlvaldez]

The firmware is pretty easy, you just put it in bootloader mode and use the tool to send it in. The soldering on the main IC is tight. I dont think I could do it by hand, but if you have SMD tools and the skills it could be done. You could leave the can and kline components off I guess if you just want VPW.

Your Allpro board looks different than the gerbers I had. I'll take some pics when I get my PCBs sent. The one I am having built has pinout for the bus side for a DB9 connector, or 2 rows of 100 mil headers, whichever you populate. Dropping LIN would be convenient and save some cost. I'd like to keep CAN on mine, since I have some newer vehicles with CAN that I may want to sniff as well. CAN i'm quite familiar with (electrically and transfer protocol layer, not so much with the application layer, though).

I'm actually an electrical engineer as my day job, and painfully familiar with soldering small things. Recently, I've been spoiled with access to my work's reflow bench for small QFNs, but I used to do it by hand with soldering iron and some desolder wick

[jlvaldez]

Hot damn. Just got email confirmation that my boards are out of fab and otw to me! Nuts.

I'm still not planning to order components right now unless there's a few people that are ready to buy. I wouldn't ask for payment until i'm ready to ship, but I'd be more willing to buy the components and build if I know I'll get the money back soon lol. May build a single board to try it and make sure my component guesses are correct.