Automatic Cruisecontrol speed adjustment based on maximum speed

Some while ago I attended a workshop based on the Blackfin Embedded Vision Starter Kit.

I intend to make a detection for traffic signs and couple that to the cruisecontrol of my car. This makes it possible to slow down in case of a changing maximum speed. Also driving comfort is enhanced. When you drive from Amsterdam to Eindhoven, there are about 15 changes in the maximum speed. If you only miss one of them you risk (another) fine.

I intend to cover up the lens with a IR pass filter (piece of developed photo negative, or the inner disk of an old floppy disk). Adding IR leds on the car will shine on the traffic signs. Since the signs are covered with retroreflection, it should give a huge contrast. What I do not know yet is, is the standard lens on the kit capable of capturing the right view angle.

I think I found the correct block in the OBD interface where I can fool the cruise control speed to use another speed. Currently I use HEXCAN interface to connect to my Seat Cordoba, and I still need to reverse engineer the VAGCOM slowinit protocol.

When I read out my car I do this with the HEX+CAN interface. It will be a challenge to find out its inner workings to be able to send commands with an embedded solution. There is a FT232RL onboard, so it should be possible to overrule the USB interface and do it with an RS232 interface. Some reverse engineering is needed to understand the damn thing.

I got some info on the FT232R chip. You can read (and write) the configuration with the tool FT_PROG 2.8.2.0 from the site http://www.ftdichip.com/Support/Utilities.htm, this is the saved file content:

<?xml version="1.0" encoding="utf-16"?>
<FT_EEPROM>
<Chip_Details>
<Type>FT232R</Type>
</Chip_Details>
<USB_Device_Descriptor>
<VID_PID>1</VID_PID>
<idVendor>0403</idVendor>
<idProduct>FA30</idProduct>
<bcdUSB>USB 2.0</bcdUSB>
</USB_Device_Descriptor>
<USB_Config_Descriptor>
<bmAttributes>
<RemoteWakeupEnabled>false</RemoteWakeupEnabled>
<SelfPowered>false</SelfPowered>
<BusPowered>true</BusPowered>
</bmAttributes>
<IOpullDown>false</IOpullDown>
<MaxPower>50</MaxPower>
</USB_Config_Descriptor>
<USB_String_Descriptors>
<Manufacturer>Ross-Tech</Manufacturer>
<Product_Description>Ross-Tech HEX-USB</Product_Description>
<SerialNumber_Enabled>true</SerialNumber_Enabled>
<SerialNumber />
<SerialNumberPrefix>RT</SerialNumberPrefix>
<SerialNumber_AutoGenerate>true</SerialNumber_AutoGenerate>
</USB_String_Descriptors>
<Hardware_Specific>
<HighIO>false</HighIO>
<D2XX>false</D2XX>
<ExternalOscillator>false</ExternalOscillator>
<Invert_RS232_Signals>
<TXD>false</TXD>
<RXD>false</RXD>
<RTS>false</RTS>
<CTS>false</CTS>
<DTR>false</DTR>
<DSR>false</DSR>
<DCD>false</DCD>
<RI>false</RI>
</Invert_RS232_Signals>
<IO_Controls>
<C0>TXLED#</C0>
<C1>RXLED#</C1>
<C2>TXDEN</C2>
<C3>PWREN#</C3>
<C4>SLEEP#</C4>
</IO_Controls>
</Hardware_Specific>
</FT_EEPROM>

during the restore of this file, it bricked my adapter. It is always a good idea to dump the content of the chip before you start messing with it. I was lucky I had a binary dump of the FT232RL chip. I downloaded a project from codeproject which interfaces with the ftd2xx.dll and with this I was able to program the adapter again to factory settings.

Here are the pictures of the reverse engineered interface:

Top, original

Top, removed components

Top, with netlist

Bot, original

Bot, removed components

Bot, with netlist


C1 N/A
C3 N/A
C2 22p
C7 22p
C8 30p
C12 30p
C4 100n
C5 100n
C11 100n
C15 100n
C6 10u

IC4 FT232RL
IC5 MCP2551
IC6 MCP2515
IC7 D79F8513A

LED 5mm, DUO color RED/GREEN, 3 pins

Q1 1AM
Q2 1AM
Q3 1AM
Q4 1AM

R1 680E
R2 680E
R17 680E
R18 680E
R21 120E

RN1 10K * 4
RN2 10K * 4
RN3 4K7 * 4

X1 16.000 CERAMIC RESONATOR
X2 N/A
X3 7.3728


J1: OBD 16 pin

J2: Programming, SIL-8

J3: RS232, SIL-3
J3-1 GND
J3-2 RXD
J3-3 TXD

J4: USB
J4-1 Black USB Pin 4: GND
J4-2 Green USB Pin 3: Data +
J4-3 White USB Pin 2: Data -
J4-4 Red USB Pin 1: VCC (5V)


GND plane
C1-1,
C2-2,
C3-1,
C4-2,
C5-2,
C6-2,
C7-1,
C8-2,
C11-1,
C12-2,
C15-1,
IC4-7,
IC4-18,
IC4-25,
IC4-26,
IC5-2,
IC5-8,
IC6-9,
ICC6-10,
IC7-10,
IC7-33,
J2-8 top,
J2-8 bot,
J3-1 top,
J3-1 bot,
J4-1 top,
J4-1 bot,
JMP-1,
LED-2 top,
LED-2 bot,
OBD-04 (P11) (Chassis GND),
OBD-05 (P10) (Signal GND),
Q1-2 (NPN-E),
Q2-2 (NPN-E),
Q3-2 (NPN-E),
Q4-2 (NPN-E),
RN1-1,
RN1-2,
RN3-5,
RN3-6

5V
C4-1,
C5-1,
C6-1 (plus),
C11-2,
IC4-4,
IC4-19,
IC4-20,
IC5-3,
IC6-18,
ICC6-20,
IC7-11,
IC7-32,
J2-5 top,
J4-4 bot,
RN1-3,
RN1-4

12V
OBD-16 (P5) (+12V),
R1-2 *,
R2-2 *,
RN2-7 *,
RN2-8 *

CAN1_INT
IC6-12 (INT),
ICC6-13 (INT),
IC7-29

CAN1_SCK
IC6-13 (SCK),
ICC6-14 (SCK),
IC7-44

CAN1_SI
IC6-14 (SI),
ICC6-16 (SI),
IC7-1

CAN1_SO
IC6-15 (SO),
ICC6-17 (SO),
IC7-2

CAN_RXD
IC5-4 (RXD),
IC6-2 (RXCAN),
ICC6-2 (RXCAN)

CAN_TXD
IC5-1 (TXD),
IC6-1 (TXCAN),
ICC6-1 (TXCAN)

CANL (CAN-Low (ISO 15765-4 and SAE J2284))
IC5-6 (CANL),
OBD-14 (P3),
R21-2 (to CANH)

CANH (CAN-High (ISO 15765-4 and SAE J2284))
IC5-7 (CANH),
OBD-06 (P9),
R21-1 (to CANL)

FT232_RXD
IC4-5 (RXD),
IC7-31,
J3-2 top (RXD)

FT232_TXD
IC4-1 (TXD),
IC7-30,
J3-3 top (TXD)

IC7-9
C15-2 (to GND),
IC7-9

IC7_16
IC7-16,
JMP-2 (to GND)

CAN1_RESET
IC6-17 (RESET),
ICC6-19 (RESET),
IC7-42,
RN1-7 (to GND)

CAN1_CS
IC6-16 (CS),
ICC6-18 (CS),
IC7-43,
RN1-5 (to 5V)

J2_1 MCU OSC1

J2_2 MCU OSC2

J2_3
IC7-6,
J2-3 bot,
RN1-8 (Pulldown to GND)

J2_4
IC7-3,
J2-4 bot,
RN1-6 (pullup to +5V)

J2-5 +5V

J2_6
IC7-28,
J2-6 bot

J2_7
IC7-27,
J2-7 bot

J2-8 GND

K_LINE
OBD-07 (P8) (K-Line of ISO 9141-2 and ISO 14230-4),
Q1-3 (NPN-C),
R2-1 (to 12V),
RN2-5 (to sense)

K-LINE_DRIVER_A1
IC7-36,
RN3-2 *

K-LINE_DRIVER_A2
Q2-1 (NPN-B),
RN3-7 *

K-LINE_DRIVER_B
Q2-3 (NPN-C),
Q1-1 (NPN-B),
RN2-2 (to 12V)

K-LINE_SENSE
IC7-25,
RN3-4 (to GND),
RN2-4 (to K-LINE)

L_LINE
OBD-15 (P4) (L-Line of ISO 9141-2 and ISO 14230-4),
Q3-3 (NPN-C),
R1-1 (to 12V),
RN2-6 (to sense)

L-LINE_DRIVER_A1
IC7-35,
RN3-1 *

L-LINE_DRIVER_A2
Q4-1 (NPN-B),
RN3-8 *

L-LINE_DRIVER_B
Q4-3 (NPN-C),
Q3-1 (NPN-B),
RN2-1 (to +12V)

L-LINE_SENSE
IC7-23,
RN3-3 (to GND),
RN2-3 (to L-LINE)

LEDR
LED-1 bot,
R18-2 *

LEDR_RES
IC7-26,
R18-1 *

LEDG
LED-3 bot,
R17-2 *

LEDG_RES
IC7-24,
R17-1 *

CAN_OSC1
C7-2 (to GND),
IC6-8 (OSC1),
ICC6-9 (OSC1),
X1-2 *

CAN_OSC2
C2-1 (to GND),
IC6-7 (OSC2),
ICC6-8 (OSC2),
X1-1 *

FT232_OSCO
C1-2 (to GND),
IC4-28 (OSCO),
X2-1 *

FT232_OSCI
C3-2 (to GND),
IC4-27 (OSCI),
X2-2 *

MCU_OSC1 IC7
C12-1 (to GND),
IC7-7,
J2-1 bot,
X3-1 *

MCU_OSC2 IC7
C8-1 (to GND),
IC7-8,
J2-2 bot,
X3-2 *

USB_Data_P
IC4-15 (USBDP),
J4-2 top

USB_Data_M
IC4-16 (USBDM),
J4-3 top

NC
IC4-2,
IC4-3,
IC4-6,
IC4-8,
IC4-9,
IC4-10,
IC4-11,
IC4-12,
IC4-13,
IC4-14,
IC4-17,
IC4-21,
IC4-22,
IC4-23,
IC4-24,
IC5-5,
IC6-3,
IC6-4,
IC6-5,
IC6-6,
IC6-10,
IC6-11,
ICC6-3,
ICC6-4,
ICC6-5,
ICC6-6,
ICC6-7,
ICC6-11,
ICC6-12,
ICC6-15,
IC7-4,
IC7-5,
IC7-12,
IC7-13,
IC7-14,
IC7-15,
IC7-17,
IC7-18,
IC7-19,
IC7-20,
IC7-21,
IC7-22,
IC7-34,
IC7-37,
IC7-38,
IC7-39,
IC7-40,
IC7-41,
J2-1 top,
J2-2 top,
J2-3 top,
J2-4 top,
J2-5 bot,
J2-6 top,
J2-7 top,
J3-2 bot,
J3-3 bot,
J4-2 bot,
J4-3 bot,
J4-4 top,
LED-1 top,
LED-3 top,
OBD-01,
OBD-02,
OBD-03,
OBD-08 (P7),
OBD-09,
OBD-10,
OBD-11,
OBD-12,
OBD-13,
P1 top,
P1 bot,
P2 top,
P2 bot


Bluetooth OBD-II plug

Top print

Thanks to Wikipedia, here I found the following info:

Female OBD-II connector (J1962 connector, connector according to SAE J1962) pinout – front view

My Seat Cordoba has the following pins (marked in bold) connected: pin 4, 5, 6, 7, 14 and 16.

I found a cable, OBD to D9 Female:
OBD-02 -> D9-7 (SAE J1850 Bus+)
OBD-10 -> D9-6 (SAE J1850 Bus-)
OBD-04 -> D9-2 (Chassis ground)
OBD-05 -> D9-1 (Signal ground)
OBD-06 -> D9-3 (J2284 CAN-High)
OBD-14 -> D9-5 (J2284 CAN-Low)
OBD-07 -> D9-4 (ISO 9141-2 K-Line, ISO 14230)
OBD-15 -> D9-8 (ISO 9141-2 L-Line, ISO 14230)
OBD-16 -> D9-9 (Battery voltage)

http://image.pinout.net/pinout_obd2_files/connector_pinout.php?image=obd2_iso9141-2_cable.gif&pinout=

Yeah, I contacted the guys from http://www.vagtechniek.nl/ and they responded very quick 🙂
They told me that the set speed for the cruisecontrol cannot be found at the OBD port of my non-CAN Cordoba. If I would like to get the set speed, I would need to access the Powertrain to get realtime can commands. I should be able to find the powertrain (CAN) on the steeringwheel angle sensor when I have ESP (which I don’t). Also I should be able to find it between the Central computer and the Instrument panel. Also they told me that information on the schematics can be found at the dealer. they have a package which is called Elsawin and contains all technical information on schematics and everything else from VW/Audi group.

I came up with the following scenario:
Completely do the cruisecontrol myself and sit between the engine control unit and the gas pedal. Like a man in the middle attack. This solution is very dangerous, because the normal cruisecontrol system has a lot of safeguards (like when any airbag is giving an errorcode). Might not be the way to go. Also you will need to aquire the accelerator, break and clutch pedal signals. When engaging the break and/or the clutch, the cruisecontrol should disengage immediately. When using the accellerator pedal, it should speed up the car. In both situations, it should act immediately.

Second solution from Vagtechniek:
Simulate the buttons on the cruisecontrol handle. When speed should be slower, disengage the cruisecontrol, and then engage again when the wanted speed has been reached. The problem with this solution is, when you disengage the cruisecontrol, it does not go smooth but very abrupt. This is not comfortable. Also this solution does not make it possible to speed up.

Third solution is to use the + and – button, but then you do not know what the new set speed is. Maybe it is possible to get the set speed from the Powertrain bus.

More to follow here . ..