TheEvKid wrote:I have logged the CAN traffic while applying a load to the vehicle, and wide open throttle. I watched the torque command increase to the maximum as long as there was a heavy load. When the load decreased, the torques command decreased as well. I have reverse engineered most of this command (0x1D4). But I cannot solve the byte 8 (last byte). I know there is a rolling counter, and with nothing else changing, as the counter steps, the checksum(CRC)...the last byte changes too.
Here is some examples(torque not determined), the only changes are the counter(0,1,2,3) which is located in the two MSBs of lower nibble :
F7 07 00 00 07 44 00 D0
F7 07 00 00 47 44 00 17
F7 07 00 00 87 44 00 DB
F7 07 00 00 C7 44 00 1C
F7 07 00 00 07 44 30 70
F7 07 00 00 47 44 30 B7
F7 07 00 00 87 44 30 7B
F7 07 00 00 C7 44 30 BC
Any suggestions regarding the calculations of the last byte?
Does anyone have a binary image of either the VCM, or the motor controller with a communication log involving the controller image?
Before spending a lot of time trying to crack the algorithm, did you try to see if you are even able to insert a message and get a response? You can just record a message at some torque setting, then send the exact same message later to see if you launch the car into you garage wall. I suspect even if successful, it will only be for a ms or two before the VCM sends it's next update.