DIY: Getting data from Holley CAN BUS
#41
The electronics is a little over my head but if you're interested in doing that part, I'm perfectly happy to do the software part. My main goal is basically to have a unified gauge that just tells me that everything is OK, or which thing is not OK, but there's other fun stuff I'd like to do as well, like a side-scrolling AFR chart. And since the screen supports touch, the driver could swipe through different gauges, which would be neat.
Separately, but relatedly, and simple enough to do on my own, I'm itching to build something that will log a bunch of data from the stock PCM and send it over CAN, using this module from Pete Sonntag (OBDX, LS Droid) and either Arduino MKR or Seeed XIAO for the CPU and canbus stuff. The parts are all here, and hoping to get it working between xmas and new year's since I have the week off.
#42
TECH Fanatic
Thread Starter
I've been wanting something that fits into a standard 52mm gauge pod and uses a screen like this one with a microcontroller like this one plus a canbus interface. Peripherals optional, I'd be happy with just power, ground, and CAN.
The electronics is a little over my head but if you're interested in doing that part, I'm perfectly happy to do the software part. My main goal is basically to have a unified gauge that just tells me that everything is OK, or which thing is not OK, but there's other fun stuff I'd like to do as well, like a side-scrolling AFR chart. And since the screen supports touch, the driver could swipe through different gauges, which would be neat.
Separately, but relatedly, and simple enough to do on my own, I'm itching to build something that will log a bunch of data from the stock PCM and send it over CAN, using this module from Pete Sonntag (OBDX, LS Droid) and either Arduino MKR or Seeed XIAO for the CPU and canbus stuff. The parts are all here, and hoping to get it working between xmas and new year's since I have the week off.
The electronics is a little over my head but if you're interested in doing that part, I'm perfectly happy to do the software part. My main goal is basically to have a unified gauge that just tells me that everything is OK, or which thing is not OK, but there's other fun stuff I'd like to do as well, like a side-scrolling AFR chart. And since the screen supports touch, the driver could swipe through different gauges, which would be neat.
Separately, but relatedly, and simple enough to do on my own, I'm itching to build something that will log a bunch of data from the stock PCM and send it over CAN, using this module from Pete Sonntag (OBDX, LS Droid) and either Arduino MKR or Seeed XIAO for the CPU and canbus stuff. The parts are all here, and hoping to get it working between xmas and new year's since I have the week off.
Let me know if you're interested.
Does anyone know if there is an OBDII simulator? That would be the easiest way to get his going.
#43
TECH Fanatic
Thread Starter
Found this: OBDII simulator
Actually, now that I'm looking, there are lots of them out there.
and there seems to be some free stuff out there https://www.instructables.com/Arduino-OBD2-Simulator/
Actually, now that I'm looking, there are lots of them out there.
and there seems to be some free stuff out there https://www.instructables.com/Arduino-OBD2-Simulator/
Last edited by LSswap; 01-18-2024 at 10:52 AM.
#44
This is a really cool project. Would it be possible to use this to take Class 2 serial data from an early LS1 5.7 and convert it into Racepak Vnet data? I am trying to use an early IQ3 that doesnt have the built in OBD2 module (street version).
#45
TECH Fanatic
Thread Starter
#47
TECH Fanatic
Thread Starter
The hardware I described can read the CANBUS on the termX, but I don't have the list of can messages for the native bus. Some people out there have it. If you get info on the native messages, LMK, maybe I can help you then.
#48
well i can sniff the CanBus via a Teensy 4.0, I can say the first line look like a clock.. i think i found the MAT , maybe i found the CTS but not sure.. maybe the TPS also... 132 different adress! found the "topic" of a line is easy... for the formula, it's a mind blowing task! ... what's happen if i swith the canbus to Racepack instead of Holley... the Term X have only one CanBus port!
#49
well i can sniff the CanBus via a Teensy 4.0, I can say the first line look like a clock.. i think i found the MAT , maybe i found the CTS but not sure.. maybe the TPS also... 132 different adress! found the "topic" of a line is easy... for the formula, it's a mind blowing task! ... what's happen if i swith the canbus to Racepack instead of Holley... the Term X have only one CanBus port!
#50
Edit: Found this string that does suggest Holley CAN does run at 1Mbps "sbin/ip link set can0 up type can bitrate 1000000 restart-ms 50 listen-only off"
Last edited by Kippdipp; 08-01-2024 at 06:40 AM.
#52
TECH Senior Member
iTrader: (7)
I've disassembled some firmware using Ghidra and found the attached function which is from the 7" Holley display which receives and sends CAN data to and from a Holley Terminator X. (also found that the native bus likely runs at 500kbps rather than 1mbs like Racepak). Looks like index 0x90 corresponds to AFR from what I can tell. No idea if the command, target ID and other bits are similar to racepak but if they are then AFR would be 0x1F204000 (with serial masked) on the native bus (I think).
Andrew
#53
TECH Fanatic
Thread Starter
check out pages 91 and up
https://www.nhraracer.com/Files/Tech...ions_Rev10.pdf
is that what youre looking for?
https://www.nhraracer.com/Files/Tech...ions_Rev10.pdf
is that what youre looking for?
#54
Take this with a grain of salt but from what I can gather reverse engineering the digital dash firmware, the normal Holley CANBUS IDs are similar to the Racepak protocol and also runs at 1mbps but has a slightly different structure and values for the ID:
Bits 28:28 – Command Bit (=0 for broadcast i think)
Bits 27:25 – Target ID (I think 101= broadcast)
Bits 24:22 – Source ID (haven't confirmed if 010 is hefi like Racepak but pretty sure it is)
Bits 21:11 – Target Serial (used as a channel # index, index #1 is RPM)
Bits 10:0 – Source Serial Number (11 bits)
So assuming the structure above, the CAN ID for RPM with the source serial number masked out (using 0xfffff800) would be 0x14100001.
For the data:
RPM = (RxMessage.Data[1] << 8 ) | RxMessage.Data[0];
Example:
If the CAN message has:
CAN_ID = 0x14100001
RxMessage.Data[3] = 0x0
RxMessage.Data[2] = 0x0
RxMessage.Data[1] = 0x09
RxMessage.Data[0] = 0xC4
---------------
uint32_t RPM = RxMessage.Data[0] |
(RxMessage.Data[1] << 8) |
(RxMessage.Data[2] << 16) |
(RxMessage.Data[3] << 24);
Then:
RPM = 2500 RPM
My car is currently not operational or else I'd log and confirm. Anyone have a Holley CAN trace / log they can share?
Also think I found all of the other channel #'s but don't know if they directly correspond to the channel # index, but assuming they do then attached is the full list I found in the firmware.
Bits 28:28 – Command Bit (=0 for broadcast i think)
Bits 27:25 – Target ID (I think 101= broadcast)
Bits 24:22 – Source ID (haven't confirmed if 010 is hefi like Racepak but pretty sure it is)
Bits 21:11 – Target Serial (used as a channel # index, index #1 is RPM)
Bits 10:0 – Source Serial Number (11 bits)
So assuming the structure above, the CAN ID for RPM with the source serial number masked out (using 0xfffff800) would be 0x14100001.
For the data:
- First 4 Bytes: This would be the Value field. These bytes are combined into a 32-bit value. I haven't found any evidence of a scale or offset factor being applied.
- Second 4 Bytes: This would be the Status field. Usage is TBD.
RPM = (RxMessage.Data[1] << 8 ) | RxMessage.Data[0];
Example:
If the CAN message has:
CAN_ID = 0x14100001
RxMessage.Data[3] = 0x0
RxMessage.Data[2] = 0x0
RxMessage.Data[1] = 0x09
RxMessage.Data[0] = 0xC4
---------------
uint32_t RPM = RxMessage.Data[0] |
(RxMessage.Data[1] << 8) |
(RxMessage.Data[2] << 16) |
(RxMessage.Data[3] << 24);
Then:
RPM = 2500 RPM
My car is currently not operational or else I'd log and confirm. Anyone have a Holley CAN trace / log they can share?
Also think I found all of the other channel #'s but don't know if they directly correspond to the channel # index, but assuming they do then attached is the full list I found in the firmware.
Last edited by Kippdipp; 08-12-2024 at 11:43 AM. Reason: typo
#55
TECH Fanatic
Thread Starter
Take this with a grain of salt but from what I can gather reverse engineering the digital dash firmware, the normal Holley CANBUS IDs are similar to the Racepak protocol and also runs at 1mbps but has a slightly different structure and values for the ID:
Bits 28:28 – Command Bit (=0 for broadcast i think)
Bits 27:25 – Target ID (I think 101= broadcast)
Bits 24:22 – Source ID (haven't confirmed if 010 is hefi like Racepak but pretty sure it is)
Bits 21:11 – Target Serial (used as a channel # index, index #1 is RPM)
Bits 10:0 – Source Serial Number (11 bits)
So assuming the structure above, the CAN ID for RPM with the source serial number masked out (using 0xfffff800) would be 0x14100001.
For the data:
RPM = (RxMessage.Data[1] << 8 ) | RxMessage.Data[0];
Example:
If the CAN message has:
CAN_ID = 0x14100001
RxMessage.Data[3] = 0x0
RxMessage.Data[2] = 0x0
RxMessage.Data[1] = 0x09
RxMessage.Data[0] = 0xC4
---------------
uint32_t RPM = RxMessage.Data[0] |
(RxMessage.Data[1] << 8) |
(RxMessage.Data[2] << 16) |
(RxMessage.Data[3] << 24);
Then:
RPM = 2500 RPM
My car is currently not operational or else I'd log and confirm. Anyone have a Holley CAN trace / log they can share?
Also think I found all of the other channel #'s but don't know if they directly correspond to the channel # index, but assuming they do then attached is the full list I found in the firmware.
Bits 28:28 – Command Bit (=0 for broadcast i think)
Bits 27:25 – Target ID (I think 101= broadcast)
Bits 24:22 – Source ID (haven't confirmed if 010 is hefi like Racepak but pretty sure it is)
Bits 21:11 – Target Serial (used as a channel # index, index #1 is RPM)
Bits 10:0 – Source Serial Number (11 bits)
So assuming the structure above, the CAN ID for RPM with the source serial number masked out (using 0xfffff800) would be 0x14100001.
For the data:
- First 4 Bytes: This would be the Value field. These bytes are combined into a 32-bit value. I haven't found any evidence of a scale or offset factor being applied.
- Second 4 Bytes: This would be the Status field. Usage is TBD.
RPM = (RxMessage.Data[1] << 8 ) | RxMessage.Data[0];
Example:
If the CAN message has:
CAN_ID = 0x14100001
RxMessage.Data[3] = 0x0
RxMessage.Data[2] = 0x0
RxMessage.Data[1] = 0x09
RxMessage.Data[0] = 0xC4
---------------
uint32_t RPM = RxMessage.Data[0] |
(RxMessage.Data[1] << 8) |
(RxMessage.Data[2] << 16) |
(RxMessage.Data[3] << 24);
Then:
RPM = 2500 RPM
My car is currently not operational or else I'd log and confirm. Anyone have a Holley CAN trace / log they can share?
Also think I found all of the other channel #'s but don't know if they directly correspond to the channel # index, but assuming they do then attached is the full list I found in the firmware.
Obviously this needs to be bechtop tested and confirmed. I have a Simulator that can emulate all necessary sensors and cam and crank signals to run a Holley on a desktop. I also have a canbus processor that can interface with the Holley to test these codes. I don't have a Holley however.