Finding Peugeot Expert extended PIDs for display in the Torque App

Overview

My current van is a 2015 Peugeot Expert 2.0. The engine is and AHZ DW10CD 129bhp with a Delphi DCM3.5BR2 (branch 2). Usually I would use the FAP app to view live DPF regeneration parameters, however the ECU was updated a year ago, and it stopped working. Numerous requests to the developer have been ignored, so I decided I needed anther approach.

After initially using a OBD2 splitter cable with a Bluetooth adapter monitoring OBD2 requests and responses from Diagbox, I realised that Diagbox already logs the data, and that it is possible to figure out the proprietary PIDs.

The two key file types, *.trc and *.xml, are stored at c:\AWroot\dwtr\SpareTrace

The trc files log the raw ODB2 request and response sent to the ECU when you run a paramter test is diagbox.

This is the typical output

<ECUFrames Timestamp="1682">

<ECUFrame Dir="Sent">QFF0621C98001</ECUFrame>

<ECUFrame Dir="Received">R61FF03290000FF01FFFFFF28013301340038FFFFFFFFFFFFFFFFFFFFFFFF43FFFF000089008B008A0086FFFFFFFF551F4C1F5B1F171F3B3D103D103F9040003E803E803E403E403E503E003CC03CC040F040F040F03FF03EC03EC03E403E403FD03F703EF03EF000013AA001F4020801DB01F8</ECUFrame>

<ECUFrames Timestamp="2413">

<ECUFrame Dir="Sent">QFF0621C98001</ECUFrame>

<ECUFrame Dir="Received">R61FF032A0000FF01FFFFFF270133012F0037FFFFFFFFFFFFFFFFFFFFFFFF43FFFF000089008A00890088FFFFFFFF551F5C1F221F4C1F483D103D103F9040003E803E803E403E403E503E003CC03CC040F040F040F03FF03EC03EC03E403E403FD03F703EF03EF000013AA001F6020801DA01F7</ECUFrame>

The timestamp is in ms since the logging started, the request sent "QFF0621C98001" consists a header and the actual PID 21C98001.

The response is a header 61FF and a long string of hex results. In this case 21C98001 is used to retreive fuel system parameters eg fuel pressure & injection timings. So even if only one paramater is required, the whole lot are retrieved. There can be multiple request/response frames per timestamp.

Diagbox will produce an eqivalent XML file from this trc file, as an intermediate step to produce graphs of the data.

This is the typical output

<ChannelHeader Id="0" Mnemo="MP_REGIME_MOTEUR" Label="@P7917-POLUXDATA" _Type="FLOAT" Unit="@P8673-POLUXDATA@\*" MinVal="-340282346638528860000000000000000000000.000000" MaxVal="340282346638528860000000000000000000000.000000">
<DiscreteLegend>
<DiscreteValue Label="@V" MinVal="0.000000"   

MaxVal="8001.000000"/> <DiscreteValue Label="@P8038-POLUXDATA" MinVal="-340282346638528860000000000000000000000.000000" MaxVal="340282346638528860000000000000000000000.000000"/> </DiscreteLegend>
</ChannelHeader>

<Points>  

<Point Value="809.000000" Timestamp="0"/>

<Point Value="810.000000" Timestamp="1682"/>

<Point Value="806.000000" Timestamp="2413"/>

<Point Value="805.000000" Timestamp="3204"/>

In this case the PID has been identified as MP_REGIME_MOTEUR, which is actually revs. Note that the time stamp starts at zero, whereas the actual timestamp should start at 1682, as per the trc file. So we can see that the revs changed from 809 to 810 between the 1st and 2nd timestamp. We can assume that the revs are stored in 2 bytes, so that would equate 0329 and 032A in hex. As it happens start of the 1st response above is R61FF0329... and the 2nd is R61FF032A.. So we can see that ignoring the header, bytes 0 and 1 contain the data for revs. 

In Torque extendedPIDs this response location can be referenced as A,B or raw R0,R1. So the basic config would be PID 21C98001 with formula INT16(A:B)

Obviously this was an easy PID to find, and not really that useful because it's part of the standard PID anyway, but it demonstrates that this data can be easily mined.

Identifying parameter names

As can be seen in the xml files, the names of the parameters are in French e.g.

<ChannelHeader Id="0" Mnemo="MP_REGIME_MOTEUR" Label="@P7917-POLUXDATA" _Type="FLOAT" Unit="@P8673-POLUXDATA@\*" 

However the text label referred as @P7917-POLUXDATA is a reference to a translation file located at c:\AWRoot\dtrd\trans

In this case the english file is POLUXDATAen_GB.DU8. This is a proprietary format as follows.

4 byte Header ox14231423, 4 byte integer of the total number of records. Then at position 0x64 a series of 4 byte integers pointing to the start location of each string record. I wrote a rough python script decode_du8.py to extract this to a csv file and then imported into a Sqlite database polluxdata.db

To help reading the xml file the Python script update pollux.py cycles through the xml files, replacing the @nnnn-POLUXDATA references with the english labels (remember to back the files up first)

After processing you should now see more user friendly labels e.g.

<ChannelHeader Id="0" Mnemo="MP_REGIME_MOTEUR" Label="Engine speed" _Type="FLOAT" Unit="*1 rpm@\*"