CANBUS on Bosch MED9.1.1 Lamborghini

Ask for and share advice on using the PicoScope kit to fix vehicles here.
User avatar
FioranoCars
TwoWaves
TwoWaves
Posts: 386
Joined: Thu Dec 13, 2012 11:26 am
Location: London, UK

CANBUS on Bosch MED9.1.1 Lamborghini

Post by FioranoCars »

Hi all
We have a Gallardo LP560 Egear MY2008 using Bosch MED9.1.1 (2off) and Gearbox Marelli CFC311, the car reports multi CAN-BUS failures, and despite starting, and engaging 1st gear will not move, or engage neutral or reverse. The error codes are summarised for those who want to laugh or cry at the end of the message! This Combo will not be similar to the R8, as it used MED9.1.1 but a different gearbox ECU. Not sure of anything else that uses the Marelli CFC311, Ferrari/Maserati/Alfa use the Marelli CFC3xx but the 311 appears unique to the LP560, and the PINs/connectors I'm told are different.

The Egear appears to pump pressure fine (leaks down too fast for my taste, but within "factory" spec, at about 40seconds while engine running in neutral with clutch held open (that's what it does).The clutch position sensor reports good values for closed and open positions, and the gearbox engages neutral when you crank it. The selection and engage parameters seem to not work on our diagnostics, but the fact it does not flag any error on the postion of neutral, 1st or second, indicate the bands are defined and position is within them. The gearbox is not a box of spanners. We did get it to move once! The handbrake and brake pedal both communicate to the ECU's fine. Up selction seems more consistent to register than down, and neutral (both paddles together) refuses to function, as does reverse (in terms of parameters display in the ECU).

It seems, so the story goes, that it got VERY hot (rev'd at standstill and lots of traffic light burn ups), and then started to judder in first and reverse (clucth worn/flywheel warped/PIS reset - but not causing the current issue), and then refused to actually move once a gear (first - as can't select reverse), it does not even try to adjust the clutch position to start to engage the gear. Engine revs lift, but no movement and then gearbox light starts to flash...

BAsed on the ECUs reporting Internal CAN-BUS problems we started to look at each signal, and established the EOBD pins 06 and 14 are direct to Gearbox ECU (33L/45H) and Engine ECU RH (67L/68H) and Engine ECU LH (67L/68H) ~ a 1MB rate, but were expecting the RH Engine ECU to have a separate CAN-BUS on pins 89 and 90, see below which shows Ch C&D in the EOBD 06/14 and ChA in Engine ECU 89, ChB in Engine ECU 90 (makes not difference which Engine ECU you pin).

Just to add this is identical result with any ONE Engine ECU disconnected, but with BOTH disconnected Pin 89 has 0v and no activity. Both Engine ECU PINs 89-90 have a resistance of 120ohm (as you'd expect of a CAN-BUS pair), but Pin 90 has about 0.5ohm resistance to EOBD Pin 14. So this is not a short within the engine ECU's.
Zoom of main Can Bus for Engine and Gearbox to EODB socket and secondary signals
Zoom of main Can Bus for Engine and Gearbox to EODB socket and secondary signals
So has anyone ever seen a K line working a 1Mb? If not then they surely should be a pair (89 and 90) and there is a short between Pin 90 and the Low channel of the CanBus based on pin 14 of EOBD which is Pin 67 of each engine ECU?

While I'm aware of the Gibbs effect/principe, is the noise we're seeing acceptable (Pico can't decode it)?

We are looking at the areas where the harness could have been affected by heat etc, but the packaging is so tight we'd probably need to pull the engine to do this properly. It's a PITA.

One last thing of note, the ECU's being accessed by EOBD do NOT give any comms faults, and we have had a few Gallardo's that do suffer from this (pre LP560's mainly, so pre MY08), so either own diagnostics is more tollerant than the car's ECU's or the Engine/Gearbox bus which is available via the EOBD is doing something strange.

Any feedback on the capture (happy to do more specific things if requested!)
Any info on MED9.1.1 or CFC311 and confirmation that 89 and 90 indeed should be a CANBUS not a K line and deliberate extra Low to the other bus :lol: :lol: :lol:
Or Similar cases?
Any random thoughts welcome

Many thanks
Ricahrd Lukins
FioranoCars.com

Error Code Summary (not exhaustive and possibly not all at the same time, but probably! :twisted: ):
Gearbox:
Processor monitoring module Error code: P060A
Transmission actuator Error code: P172E
Engine/gear box data bus Error code: U0001
Engine control unit, no communication Error code: U0100
Selector lever, no communication Error code: U0103
No communication with the ABS control unit Error code: U0121
Steering angle sensor, no communication Error code: U0126
Diagnosis interface control unit, no communication Error code: U0146
Instrument panel control unit Error code: U0155
Selector lever Error code: U101B

engine
• P0604 ECU failure
• P1923 Read fault memory
• U0002 Engine/gear box data bus

abs
• 01314 Engine ECU data line
• 00778 Steering angle
• 01317 Communication with instrument panel ECU
• 01315 Transmission ECU dataline
• 01321 Communication with airbag ECU
• 01299 Data bus
• 01312 CAN line

Insturment
• 01314 Engine ECU data line
• 01315 Transmission ECU data line
• 01316 ABS ECU data line

Steering wheel electronics
01330 Comfort system main ECU
Attachments
Lamborghini Gallardo Can Bus on RH Engine ECU pins 89-90.psdata
2 can bus with short?
(16.69 MiB) Downloaded 666 times

User avatar
STC
Banned
Posts: 790
Joined: Sun Sep 13, 2015 2:10 am

Re: CANBUS on Bosch MED9.1.1 Lamborghini

Post by STC »

initial thoughts are
So has anyone ever seen a K line working a 1Mb?
The High Speed (Powertrain Can) is at 500Kbits/S. So No Way. That is different territory.

User avatar
FioranoCars
TwoWaves
TwoWaves
Posts: 386
Joined: Thu Dec 13, 2012 11:26 am
Location: London, UK

Re: CANBUS on Bosch MED9.1.1 Lamborghini

Post by FioranoCars »

Thanks, well it's faster than I thought, not seen one faster than 250k myself, normally 100k or less, but it's a big leap from 500k to 1mb, so pleased I asked. If anyone else can add further on fast than 500k please pitch right in!

Any Thoughts on what we can tweak within the Pico Decoder to try and assist the decode (or filters to apply) ? :?

Thanks
Richard

User avatar
STC
Banned
Posts: 790
Joined: Sun Sep 13, 2015 2:10 am

Re: CANBUS on Bosch MED9.1.1 Lamborghini

Post by STC »

Thanks, well it's faster than I thought, not seen one faster than 250k myself, normally 100k or less, but it's a big leap from 500k to 1mb, so pleased I asked. If anyone else can add further on fast than 500k please pitch right in!
I have downloaded your file and measured the Can speed and it is 500kbits/S - 500KHz - Most VM's use that speed.
(Any Thoughts on what we can tweak within the Pico Decoder to try and assist the decode (or filters to apply) ?)
Cant help with that but can ask you to - beware of yourself, if that makes sense. I can see you overcomplicating this !

If that Lambo is not vastly different from the R8 and some other high end VAG cars - (Which we know it is not?)

Then you are making assumptions that will mess with your head.

Both Engine ECU's, EGear, ABS ... Will be on Powertrain CAN which is NOT wired to the DLC. An additional Private Can Network Exists Solely Between the 2 Engine ECU's (and possibly goes to the DLC - I have 2 conflicting Documents - No reason for it to be there ?)
and established the EOBD pins 06 and 14 are direct to Gearbox ECU (33L/45H)
That is the first alarm bell !!
So has anyone ever seen a K line working a 1Mb? If not then they surely should be a pair
K line wont get anywhere near that speed, it is 1 wire and at 0 - ~~10v.. It may exist on your car for EOBD emissions reasons. unlikely to cause the problems you have.

I have a theory but need to look through some notes first, for now is it possible for you to do an ECU presence check? I'm more interested in the ones you cannot communicate with ?

Very interested in what The Diagnostic Gateway is reporting! it is directly diagnosable via the DLC.

What scan tool are you using ?
Last edited by STC on Thu Sep 29, 2016 11:44 am, edited 2 times in total.

User avatar
Mark Dalton
TwoWaves
TwoWaves
Posts: 106
Joined: Mon Dec 01, 2014 9:35 pm
Location: Melbourne

Re: CANBUS on Bosch MED9.1.1 Lamborghini

Post by Mark Dalton »

Do you have schematic we can look at? It would be good to see the Bus topology.
The CAN Bus signal doesn't look right to me, too much noise for my taste. The fact that the Pico can't decode it either isn't a good sign.
What's the resistance across 6&14 at the DLC? 60 Ohms??

andrewbishop66
TwoWaves
TwoWaves
Posts: 75
Joined: Wed Jan 20, 2016 10:16 pm

Re: CANBUS on Bosch MED9.1.1 Lamborghini

Post by andrewbishop66 »

Any idea what is causing the regular spikes in between the packets I do agree with Mark as the signal seems to have a high amount of noise

Andrew

User avatar
STC
Banned
Posts: 790
Joined: Sun Sep 13, 2015 2:10 am

Re: CANBUS on Bosch MED9.1.1 Lamborghini

Post by STC »

What's the resistance across 6&14 at the DLC? 60 Ohms??
That wont help Mark. It is VAG and has a Gateway. The DLC will only access the diagnostic gateway. Add to that, some systems do not put the terminating resistor between Hi Lo but one to 5v and the other to Ground. So system switched off the resistors are switched off too.

To get a pattern at 6 & 14 Richard will have to add something or it will look sad and bouncy.

Powertrain Can is designed to not to see interference, it looks for a 2v difference when in a dominant state as opposed to recessive regardless of voltage. It is robust as per its design.
Last edited by STC on Mon Sep 19, 2016 4:30 pm, edited 1 time in total.

steevegt
TwoWaves
TwoWaves
Posts: 70
Joined: Tue May 12, 2015 10:05 pm

Re: CANBUS on Bosch MED9.1.1 Lamborghini

Post by steevegt »

What type of probe are you using to scope that signals?

I have seen that same amount of noise, when using an unshielded connector to the DLC, or can wire. It doesn't need to be very long, less than 50 cm unshielded is what it takes to have that noise level.
What ground are you using? Chassis ground vs computer ground, makes a lot of difference when scoping for high frequency signals.

You can actually decode some data with pico software. I have tried the blue can signal, and most of the time it works. The decoded ones I have looked are all valid.
The red signal, to me, looks the worst one. You can also decode some can frames with the pico software, and are valid, but is not rare to have a frame that is ignored.

With that amount of communication codes in memory, the first thing I would check is that the noise I see is from my hardware setup, and is not part of the network itself.
It will be a coincidence to have the same noise level in 3 different networks. But not impossible I guess.

User avatar
FioranoCars
TwoWaves
TwoWaves
Posts: 386
Joined: Thu Dec 13, 2012 11:26 am
Location: London, UK

Re: CANBUS on Bosch MED9.1.1 Lamborghini

Post by FioranoCars »

Hi All and thanks for the replies, I'll try and update you all as best as I can (no pun) ...

STC, thanks for pointing out the Bit rate at 500k, had relied upon Pico to auto configure (Pico Staff ... bug report ...please take a look and try some tests using the file uploaded to see why your auto detect routine keeps defaulting to 1mb for this signal, when it is 500k?!), and realised afterwards that it had set itself up at 1mb not 500k, so some of our issues lay in basic speed being wrong! but also in the voltage settings, which when corrected allowed all packets to decode.

This then lead to a read up of the ISO standards, yawn!, but basically the differences between what we label things as is summarised as follows, not exhaustive and probably over simplifying for our current car... but ...
K-line - typically has a resistance to live or ground of 510ohm, not always, rate if via the OBD port is fixed to 10.4k ... not specified within private networks as far as I can see, other than rates of 1.2k to 10.4k were implemented)

Can-bus pair - swing voltage of 2v nett, so often 2.5v and +1 high, -1 low, nett 2v. 120ohm end point resistors, giving nett 60ohm but this is very often NOT the case, and many manufacturers use resistors in each ECU, rather than external or others, so can't be relied upon, ISO 11898 states Low Speed CAN (up to 125kBit/s) or High Speed CAN (up to 1MBit/s), low speed can's can operate at 5v signal swing (sometimes we see 4v swing not 5v)

Single wire canbus = upto 83k speed, voltage swing of 5v (I guess 4v might exist in the real world too)

so, knowing this, the second "corrupt pair" is running at 500k and based on the ECU's both showing an internal reistance between pins 89-90 of 120ohms, fits the spec and description of a Pair can bus, not a signle wire. So the short onto the main power train can bus, is as best we can tell a fault, and we'll try to prove this later in the week...

The EOBD is on the power train bus on this car, the data is ubale to lie! The pins of both engine ECU's () and the Gearbox are all identical, this cannot be a repeated thing, it is the same bus, remove the ECU's and do continuity, it's 0.3 ohms or less, and put a resistor of say 4.7ohms on it and that increases the resistance as expected ... it's the same wire pair! So noise is bad on only 1 bus, not 3 different ones.

So, the resistance on 6 and 14 is about 53ohms (Ohms law being 2 x 120ohm resistors in parallel give 60ohms resistance), so this is acceptable, take any ECU off, and this changes the resistance based on the ecu removed (gearbox is different to each engine ecu as it has different internal resistor termination), so again proves pins 6 and 14 are on the power train wires not some gateway. There may be a gateway for other ECU, on one of the 2 low speed (100k) can bus pairs that are made public at the EOBD socket (yes there are 3 can bus pairs visible there - see below), so no this is not the same as other VAG, and it has more in common with the Aventador architecture and other common ECU, than the R8, but the Aventador uses the Lambo in house dual LIE engine ECU and their own Gearbox ecu, where as the LP560 shares the MED9.1.1 but not the R8 Gearbox ecu ... and the MED 9.1.1 is pin programmable, so might not be software implemented the same as the R8. Don't have full R8 wiring to compare.

EOBD exposed CAN Lines (from our own research, which is still incomplete, in that we have not mapped every ECU, so airbag, steering, ABS etc not placed into our map/topology just yet...)
Pair CB1 - ECU's - Same Bus as EOBD (13L/12H) and xx () and xx () and xx ()
12 - CB1H = CanBus 100k High(Pair with Pin 13) [0v Base +4v High]
13 - CB1L = CanBus 100k Low (Pair with Pin 12) [5v Base -4v Low]

Pair CB2 - ECU's - Same Bus as EOBD (09L/08H) and xx () and xx () and xx ()
08 - CB2H = CanBus 100k High(Pair with Pin 09) [0v Base +4v High]
09 - CB2L = CanBus 100k Low (Pair with Pin 08) [5v Base -4v Low]

Pair CB3 - Same Bus as EOBD (14L/06H) and Gearbox (33L/45H) and Engine ECU RH (67L/68H) and Engine ECU LH (67L/68H) and xx ()
06 - CB3H = CanBus 500k High(Pair with Pin 14) [2.5v Base +1v High]
14 - CB3L = CanBus 500k Low (Pair with Pin 06) [2.5v Base -1v Low]

Mark, yes a topology is he first thing I try to get for any CAN issue, and sadly no, we don't have! We do have a partial one for the Gallardo 5.0L pre the LP560, but that is completely different and uses several K lines at EOBD, plus the old Lambo LIE and bespoke gearbox ECU's not Bosch/Marelli ones on this vehicle. We tried to start using that as a guide (as GFA, ZKE and other ECU's appear similar, but it became clear starting from no assumptions was easier and quicker) ... anyone with this or PIN outs for any ECU's (would consider R8 or Aventador too, just to get ideas!) or CAN pins, would be great - Dash, GFA, ZKE ILM being the ones most useful that we have little data on.

Mark, part answer above, but Andrew and Mark, the noise is not from our leads, as best we can tell, but with better decoding parameters, can decode the signal. Still not sure how much is Gibbs effect. The regular spikes not sure, but engine is off, ignition on, would need to check further if this is relevant or not once the big issues are fixed, and if any fix removes them....

steevegt, the Gallardo chassis and signal ground, like many cars now have a common earth point, but we're bonded on a breakout box using both, and using a new scope, so all 4 channels have their own grounds. While a branch on a high speed CAN has a theoretical limit of 30cm, with a 1Mega ohm impedance device like the PICO, we should be fine using 1meter cables, but have tried 15cm wires too which did not improve things. I'm old school, I used to install older Ethernet computer networks using 50ohm termination and fault find them when people had mixed topologies, and done other silly things, so canbus is like memory lane for me! Sadly, unrelated I also have a load of Voip clients, so use packet sniffers for proper high speed traffic, so would love to get hold of a wireshark equivalent, or maybe build an ardunio board to allow this sort of sniffing over longer periods ... but I digress :-)

Only the power train CAN (500k) has the noise, the 2 low speed CAN's don't.

the errors occur regardless of kit being plugged in, so we are not causing the errors ourselves!

Currently we are focusing on the fact that the ENGINE ecu's off the car are 120ohms between pins 89 and 90, yes both ECU the same, this supports the other data, including third party, and the speed it works at, the voltage logic levels, that 89 and 90 and a pair can-bus. But not operating as such due to the signal on pin 90 being a "copy" of pin 67, so looking at the rouge wire - pin 90, with engine ecu's disconnected, the harness has less than 0.5ohm resistance to pin 67 of the same harness or pin 14 at the EOBD (so there is a short somewhere). While it is open circuit between 89 and 90 (ecu's off), indicating that it is a private can directly between the two 120ohm terminations within each engine ecu. further with the ecu's off and the car powered the single wire of pin 89 has no voltage or wake up messages/logic levels.

As the owner has reported he got the car very hot (too hot to touch the rear quarter or engine lid), we're looking at maybe melted wires from a point where the harness runs too close to a heat shield etc. but there is no sign of anything other than so water ingress which we've already repaired and was not bad enough to cause a fault just yet, at any of the points we've stripped or inspected ... so it's going to be a deep dive in the guts of teh car.

While this might not solve all the issues, fixing what you can find is a good place, as the other problems might stem from other wires melted/chaffed at the same location. We then have further tests to ensure the body ECU is sending on a K line (well that's what we've been told it's using!) to both Engine ECU and Gearbox ECU's (a shared single wire K line with all 4 ECU) ... and then checking the rest of the CANBUS's to see if there is another one wee've not found, or allocate each ECU to the BUS's we have found.

In terms of ECU's we can or cannot communicate with, we seem to be able to see them all, although don't have a CAN visibility utility (we do for Ferrari etc) that can check presence ... is there a VAG tool that we could try?

Thanks again for all the questions and pointers, sometimes it realy does helps to have a different perspective being put forward, even if only to retest the things you thought, and prove they are what you thought!

Sorry for long rambling reply, but any further ideas, comments, and questions, or diagrams/tech data most welcome

Richard

User avatar
STC
Banned
Posts: 790
Joined: Sun Sep 13, 2015 2:10 am

Re: CANBUS on Bosch MED9.1.1 Lamborghini

Post by STC »

so again proves pins 6 and 14 are on the power train wires not some gateway.
It proves Only what you have. It does not prove that it is what it was the day it left the assembly line !!??


I stand to be corrected but No, I cannot take that as read unless I see it with my own eyes! The Instrument Cluster in that car is from an Audi A4 of that vintage - Fact. It just wears a different dress for the Italians.
The twin ECU set up is in all the big Audi, VW and Bentley offerings. I'm sticking my neck on the line with the Gateway, which may be the cluster itself.

As for Can Voltages, (VAG Powertrain) they should be recessive at 2.5 volts then 3.5 & 1.5 dominant, and then the "twist" The network doesn't give a flying you know what because its only looking for the difference between the two in either state, adding to its Robust structure. From that and that alone it can detect a short in either direction or a healthy network.
We can, and I have, dragged can signals to earth and B+ and they recover instantly. Indestructible !!

Post Reply