DIY: Getting data from Holley CAN BUS
TECH Fanatic
Joined: Jan 2018
Posts: 1,059
Likes: 198
The electronics is a little over my head but if you're interested in doing that part, I'm perfectly happy to do the software part. My main goal is basically to have a unified gauge that just tells me that everything is OK, or which thing is not OK, but there's other fun stuff I'd like to do as well, like a side-scrolling AFR chart. And since the screen supports touch, the driver could swipe through different gauges, which would be neat.
Separately, but relatedly, and simple enough to do on my own, I'm itching to build something that will log a bunch of data from the stock PCM and send it over CAN, using this module from Pete Sonntag (OBDX, LS Droid) and either Arduino MKR or Seeed XIAO for the CPU and canbus stuff. The parts are all here, and hoping to get it working between xmas and new year's since I have the week off.
Thread Starter
TECH Fanatic
Joined: Nov 2014
Posts: 1,308
Likes: 660
I've been wanting something that fits into a standard 52mm gauge pod and uses a screen like this one with a microcontroller like this one plus a canbus interface. Peripherals optional, I'd be happy with just power, ground, and CAN.
The electronics is a little over my head but if you're interested in doing that part, I'm perfectly happy to do the software part. My main goal is basically to have a unified gauge that just tells me that everything is OK, or which thing is not OK, but there's other fun stuff I'd like to do as well, like a side-scrolling AFR chart. And since the screen supports touch, the driver could swipe through different gauges, which would be neat.
Separately, but relatedly, and simple enough to do on my own, I'm itching to build something that will log a bunch of data from the stock PCM and send it over CAN, using this module from Pete Sonntag (OBDX, LS Droid) and either Arduino MKR or Seeed XIAO for the CPU and canbus stuff. The parts are all here, and hoping to get it working between xmas and new year's since I have the week off.
The electronics is a little over my head but if you're interested in doing that part, I'm perfectly happy to do the software part. My main goal is basically to have a unified gauge that just tells me that everything is OK, or which thing is not OK, but there's other fun stuff I'd like to do as well, like a side-scrolling AFR chart. And since the screen supports touch, the driver could swipe through different gauges, which would be neat.
Separately, but relatedly, and simple enough to do on my own, I'm itching to build something that will log a bunch of data from the stock PCM and send it over CAN, using this module from Pete Sonntag (OBDX, LS Droid) and either Arduino MKR or Seeed XIAO for the CPU and canbus stuff. The parts are all here, and hoping to get it working between xmas and new year's since I have the week off.
Let me know if you're interested.
Does anyone know if there is an OBDII simulator? That would be the easiest way to get his going.
Thread Starter
TECH Fanatic
Joined: Nov 2014
Posts: 1,308
Likes: 660
Found this: OBDII simulator
Actually, now that I'm looking, there are lots of them out there.
and there seems to be some free stuff out there https://www.instructables.com/Arduino-OBD2-Simulator/
Actually, now that I'm looking, there are lots of them out there.
and there seems to be some free stuff out there https://www.instructables.com/Arduino-OBD2-Simulator/
Last edited by LSswap; Jan 18, 2024 at 10:52 AM.
Registered User
Joined: May 2024
Posts: 1
Likes: 0
This is a really cool project. Would it be possible to use this to take Class 2 serial data from an early LS1 5.7 and convert it into Racepak Vnet data? I am trying to use an early IQ3 that doesnt have the built in OBD2 module (street version).
Thread Starter
TECH Fanatic
Joined: Nov 2014
Posts: 1,308
Likes: 660
Thread Starter
TECH Fanatic
Joined: Nov 2014
Posts: 1,308
Likes: 660
The hardware I described can read the CANBUS on the termX, but I don't have the list of can messages for the native bus. Some people out there have it. If you get info on the native messages, LMK, maybe I can help you then.
Registered User
Joined: Jul 2024
Posts: 2
Likes: 0
well i can sniff the CanBus via a Teensy 4.0, I can say the first line look like a clock.. i think i found the MAT , maybe i found the CTS but not sure.. maybe the TPS also... 132 different adress! found the "topic" of a line is easy... for the formula, it's a mind blowing task! ... what's happen if i swith the canbus to Racepack instead of Holley... the Term X have only one CanBus port!
LS1 Tech Stories
The Best V8 Stories One Small Block at Time
6 Common C5 Corvette Failures and What's Involved In Repairing Them
Pouria Savadkouei
Retro Modern Bandit Pontiac Trans AM Comes With Burt Reynolds' Autograph
Verdad Gallardo
Top 10 Greatest Cadillac V Series Performance Models Ever, Ranked
Pouria Savadkouei
Top 10 Most Powerful Chevy Trucks Ever Made!
Hennessey's New Supercharged Silverado ZR2 Has 700 HP
Verdad Gallardo
Coachbuilt N2A Anteros Is an LS2-Powered C6 Corvette In Italian Clothes
Verdad Gallardo
Awesome K5 Blazer Restomod Comes With C7 Corvette Power
Verdad Gallardo
10 Camaros You Should Never Buy
10 LS Engine Myths That Refuse to Die
Verdad Gallardo
Staging Lane
Joined: Dec 2020
Posts: 52
Likes: 23
From: Ohio
well i can sniff the CanBus via a Teensy 4.0, I can say the first line look like a clock.. i think i found the MAT , maybe i found the CTS but not sure.. maybe the TPS also... 132 different adress! found the "topic" of a line is easy... for the formula, it's a mind blowing task! ... what's happen if i swith the canbus to Racepack instead of Holley... the Term X have only one CanBus port!
Staging Lane
Joined: Dec 2020
Posts: 52
Likes: 23
From: Ohio
Edit: Found this string that does suggest Holley CAN does run at 1Mbps "sbin/ip link set can0 up type can bitrate 1000000 restart-ms 50 listen-only off"
Last edited by Kippdipp; Aug 1, 2024 at 06:40 AM.
TECH Addict
Joined: Dec 2004
Posts: 2,177
Likes: 627
From: Florida
check out pages 91 and up
https://www.nhraracer.com/Files/Tech...ions_Rev10.pdf
is that what youre looking for?
https://www.nhraracer.com/Files/Tech...ions_Rev10.pdf
is that what youre looking for?
I've disassembled some firmware using Ghidra and found the attached function which is from the 7" Holley display which receives and sends CAN data to and from a Holley Terminator X. (also found that the native bus likely runs at 500kbps rather than 1mbs like Racepak). Looks like index 0x90 corresponds to AFR from what I can tell. No idea if the command, target ID and other bits are similar to racepak but if they are then AFR would be 0x1F204000 (with serial masked) on the native bus (I think).
Andrew
Thread Starter
TECH Fanatic
Joined: Nov 2014
Posts: 1,308
Likes: 660
check out pages 91 and up
https://www.nhraracer.com/Files/Tech...ions_Rev10.pdf
is that what youre looking for?
https://www.nhraracer.com/Files/Tech...ions_Rev10.pdf
is that what youre looking for?
Staging Lane
Joined: Dec 2020
Posts: 52
Likes: 23
From: Ohio
Take this with a grain of salt but from what I can gather reverse engineering the digital dash firmware, the normal Holley CANBUS IDs are similar to the Racepak protocol and also runs at 1mbps but has a slightly different structure and values for the ID:
Bits 28:28 – Command Bit (=0 for broadcast i think)
Bits 27:25 – Target ID (I think 101= broadcast)
Bits 24:22 – Source ID (haven't confirmed if 010 is hefi like Racepak but pretty sure it is)
Bits 21:11 – Target Serial (used as a channel # index, index #1 is RPM)
Bits 10:0 – Source Serial Number (11 bits)
So assuming the structure above, the CAN ID for RPM with the source serial number masked out (using 0xfffff800) would be 0x14100001.
For the data:
RPM = (RxMessage.Data[1] << 8 ) | RxMessage.Data[0];
Example:
If the CAN message has:
CAN_ID = 0x14100001
RxMessage.Data[3] = 0x0
RxMessage.Data[2] = 0x0
RxMessage.Data[1] = 0x09
RxMessage.Data[0] = 0xC4
---------------
uint32_t RPM = RxMessage.Data[0] |
(RxMessage.Data[1] << 8) |
(RxMessage.Data[2] << 16) |
(RxMessage.Data[3] << 24);
Then:
RPM = 2500 RPM
My car is currently not operational or else I'd log and confirm. Anyone have a Holley CAN trace / log they can share?
Also think I found all of the other channel #'s but don't know if they directly correspond to the channel # index, but assuming they do then attached is the full list I found in the firmware.
Bits 28:28 – Command Bit (=0 for broadcast i think)
Bits 27:25 – Target ID (I think 101= broadcast)
Bits 24:22 – Source ID (haven't confirmed if 010 is hefi like Racepak but pretty sure it is)
Bits 21:11 – Target Serial (used as a channel # index, index #1 is RPM)
Bits 10:0 – Source Serial Number (11 bits)
So assuming the structure above, the CAN ID for RPM with the source serial number masked out (using 0xfffff800) would be 0x14100001.
For the data:
- First 4 Bytes: This would be the Value field. These bytes are combined into a 32-bit value. I haven't found any evidence of a scale or offset factor being applied.
- Second 4 Bytes: This would be the Status field. Usage is TBD.
RPM = (RxMessage.Data[1] << 8 ) | RxMessage.Data[0];
Example:
If the CAN message has:
CAN_ID = 0x14100001
RxMessage.Data[3] = 0x0
RxMessage.Data[2] = 0x0
RxMessage.Data[1] = 0x09
RxMessage.Data[0] = 0xC4
---------------
uint32_t RPM = RxMessage.Data[0] |
(RxMessage.Data[1] << 8) |
(RxMessage.Data[2] << 16) |
(RxMessage.Data[3] << 24);
Then:
RPM = 2500 RPM
My car is currently not operational or else I'd log and confirm. Anyone have a Holley CAN trace / log they can share?
Also think I found all of the other channel #'s but don't know if they directly correspond to the channel # index, but assuming they do then attached is the full list I found in the firmware.
Last edited by Kippdipp; Aug 12, 2024 at 11:43 AM. Reason: typo
Thread Starter
TECH Fanatic
Joined: Nov 2014
Posts: 1,308
Likes: 660
Take this with a grain of salt but from what I can gather reverse engineering the digital dash firmware, the normal Holley CANBUS IDs are similar to the Racepak protocol and also runs at 1mbps but has a slightly different structure and values for the ID:
Bits 28:28 – Command Bit (=0 for broadcast i think)
Bits 27:25 – Target ID (I think 101= broadcast)
Bits 24:22 – Source ID (haven't confirmed if 010 is hefi like Racepak but pretty sure it is)
Bits 21:11 – Target Serial (used as a channel # index, index #1 is RPM)
Bits 10:0 – Source Serial Number (11 bits)
So assuming the structure above, the CAN ID for RPM with the source serial number masked out (using 0xfffff800) would be 0x14100001.
For the data:
RPM = (RxMessage.Data[1] << 8 ) | RxMessage.Data[0];
Example:
If the CAN message has:
CAN_ID = 0x14100001
RxMessage.Data[3] = 0x0
RxMessage.Data[2] = 0x0
RxMessage.Data[1] = 0x09
RxMessage.Data[0] = 0xC4
---------------
uint32_t RPM = RxMessage.Data[0] |
(RxMessage.Data[1] << 8) |
(RxMessage.Data[2] << 16) |
(RxMessage.Data[3] << 24);
Then:
RPM = 2500 RPM
My car is currently not operational or else I'd log and confirm. Anyone have a Holley CAN trace / log they can share?
Also think I found all of the other channel #'s but don't know if they directly correspond to the channel # index, but assuming they do then attached is the full list I found in the firmware.
Bits 28:28 – Command Bit (=0 for broadcast i think)
Bits 27:25 – Target ID (I think 101= broadcast)
Bits 24:22 – Source ID (haven't confirmed if 010 is hefi like Racepak but pretty sure it is)
Bits 21:11 – Target Serial (used as a channel # index, index #1 is RPM)
Bits 10:0 – Source Serial Number (11 bits)
So assuming the structure above, the CAN ID for RPM with the source serial number masked out (using 0xfffff800) would be 0x14100001.
For the data:
- First 4 Bytes: This would be the Value field. These bytes are combined into a 32-bit value. I haven't found any evidence of a scale or offset factor being applied.
- Second 4 Bytes: This would be the Status field. Usage is TBD.
RPM = (RxMessage.Data[1] << 8 ) | RxMessage.Data[0];
Example:
If the CAN message has:
CAN_ID = 0x14100001
RxMessage.Data[3] = 0x0
RxMessage.Data[2] = 0x0
RxMessage.Data[1] = 0x09
RxMessage.Data[0] = 0xC4
---------------
uint32_t RPM = RxMessage.Data[0] |
(RxMessage.Data[1] << 8) |
(RxMessage.Data[2] << 16) |
(RxMessage.Data[3] << 24);
Then:
RPM = 2500 RPM
My car is currently not operational or else I'd log and confirm. Anyone have a Holley CAN trace / log they can share?
Also think I found all of the other channel #'s but don't know if they directly correspond to the channel # index, but assuming they do then attached is the full list I found in the firmware.
Obviously this needs to be bechtop tested and confirmed. I have a Simulator that can emulate all necessary sensors and cam and crank signals to run a Holley on a desktop. I also have a canbus processor that can interface with the Holley to test these codes. I don't have a Holley however.
Teching In
Joined: Sep 2024
Posts: 10
Likes: 1
Take this with a grain of salt but from what I can gather reverse engineering the digital dash firmware, the normal Holley CANBUS IDs are similar to the Racepak protocol and also runs at 1mbps but has a slightly different structure and values for the ID:
Bits 28:28 – Command Bit (=0 for broadcast i think)
Bits 27:25 – Target ID (I think 101= broadcast)
Bits 24:22 – Source ID (haven't confirmed if 010 is hefi like Racepak but pretty sure it is)
Bits 21:11 – Target Serial (used as a channel # index, index #1 is RPM)
Bits 10:0 – Source Serial Number (11 bits)
So assuming the structure above, the CAN ID for RPM with the source serial number masked out (using 0xfffff800) would be 0x14100001.
For the data:
RPM = (RxMessage.Data[1] << 8 ) | RxMessage.Data[0];
Example:
If the CAN message has:
CAN_ID = 0x14100001
RxMessage.Data[3] = 0x0
RxMessage.Data[2] = 0x0
RxMessage.Data[1] = 0x09
RxMessage.Data[0] = 0xC4
---------------
uint32_t RPM = RxMessage.Data[0] |
(RxMessage.Data[1] << 8) |
(RxMessage.Data[2] << 16) |
(RxMessage.Data[3] << 24);
Then:
RPM = 2500 RPM
My car is currently not operational or else I'd log and confirm. Anyone have a Holley CAN trace / log they can share?
Also think I found all of the other channel #'s but don't know if they directly correspond to the channel # index, but assuming they do then attached is the full list I found in the firmware.
Bits 28:28 – Command Bit (=0 for broadcast i think)
Bits 27:25 – Target ID (I think 101= broadcast)
Bits 24:22 – Source ID (haven't confirmed if 010 is hefi like Racepak but pretty sure it is)
Bits 21:11 – Target Serial (used as a channel # index, index #1 is RPM)
Bits 10:0 – Source Serial Number (11 bits)
So assuming the structure above, the CAN ID for RPM with the source serial number masked out (using 0xfffff800) would be 0x14100001.
For the data:
- First 4 Bytes: This would be the Value field. These bytes are combined into a 32-bit value. I haven't found any evidence of a scale or offset factor being applied.
- Second 4 Bytes: This would be the Status field. Usage is TBD.
RPM = (RxMessage.Data[1] << 8 ) | RxMessage.Data[0];
Example:
If the CAN message has:
CAN_ID = 0x14100001
RxMessage.Data[3] = 0x0
RxMessage.Data[2] = 0x0
RxMessage.Data[1] = 0x09
RxMessage.Data[0] = 0xC4
---------------
uint32_t RPM = RxMessage.Data[0] |
(RxMessage.Data[1] << 8) |
(RxMessage.Data[2] << 16) |
(RxMessage.Data[3] << 24);
Then:
RPM = 2500 RPM
My car is currently not operational or else I'd log and confirm. Anyone have a Holley CAN trace / log they can share?
Also think I found all of the other channel #'s but don't know if they directly correspond to the channel # index, but assuming they do then attached is the full list I found in the firmware.
Staging Lane
Joined: Dec 2020
Posts: 52
Likes: 23
From: Ohio
Try this and provide the Holley data log too.
Teching In
Joined: Sep 2024
Posts: 10
Likes: 1
That's quite a bit simpler than I was expecting lol. Thankfully I bought a bunch of mizu connectors and terminals when I came across this thread a year or so ago, so I don't have to vampire clip my harness. I'll see what I can come up with and report back, If I can get the data direct from the sniper it'll make my other project so much simpler.
