heavy vehicle event data recorders - university of tulsatucrrc.utulsa.edu/members/inline - chevy...

Heavy Vehicle Event Data Recorders

NTSS 2013 http://tucrrc.utulsa.edu 1

HOW EVENTS GET SET IN AN ENGINE CONTROL MODULE


Overview

Vehicle Speed Data

Vehicle Networking J1708/J1587

J1939 and Controller Area Networks

Synchronized Testing Results Network Data, EDR Data, and GPS Data

Out-of-service brakes

Review of TUCRRC Website Content

Digital Forensics for HVEDRs


Electronic Control Modules A computerized system that controls the operation of

different aspects of the vehicle. Engine Control Module (ECM) Electronic Brake Controller (EBC) Automatic Transmission Controller Body Controller GPS and Telematics Unit Collision Avoidance Systems Potentially a dedicated Event Data Recorder…

Definition in SAE J2728: An electronic control unit (ECU) is an electronic subsystem that manages the functions of a vehicle system or components. ECUs are often called electronic control modules, or ECMs, or simply modules.


We can’t work with this one


Missing Data??


Types of ECM Data

Event Data

Sudden deceleration (e.g. decrease of 7 mph/s)

Last Stop trigger

Diagnostic trigger

Fault Freeze Frame Data

Historical Data

Recorded by ECM for Use

Configuration Data

Programmed into ECM NTSS 2013 http://tucrrc.utulsa.edu 7

Pavement to EDR Data

Wheels Turn VSS Signal Generated

ECM Calculates

Speed

Data Transmitted on Network


Sensing Speed

A magnetic pick-up uses variable reluctance to sense the rotation of the tailshaft.


Tone Ring Transmission

Tailshaft Magnetic

Pickup

Transmission

Tailshaft


Vehicle Speed

Sensor

16 Tooth

Tone Ring



ECM Calculates

Speed



Speed Sensing In Action


Describing a Signal


eDAQ-DDEC6TestingWithHathaway.sie - [email protected]_1

Time(secs)

212.26 212.28 212.30 212.32 212.34

Wh

ee

lSp

ee

d(m

illi

vo

lts

)

-2000

-1500

-1000

-500

0

500

1000

Pe

ak –

to-P

ea

k, V

pp

Period, T

Frequency (Hz) = 1/T

Describing a Signal (Cont.)



Time(secs)

212.26 212.28 212.30 212.32 212.34

Wh

ee

lSp

ee

d(m

illi

vo

lts

)

-2000

-1500

-1000

-500

0

500

1000

Offset Am

plit

ud

e

DC Value or

Mean Value

Actual Vehicle Speed Sensor Signals

Wire pierce near the sensor

Record with the Analog In feature of the eDAQ.


Exhaust

Signal Wires

Example of Actual Speed Sensor Signal


VSS Tone Ring Signal (0.1 V)

Time(secs)

245 250 255 260

Sp

ee

d (

MP

H)

-70

-60

-50

-40

-30

-20

-10

0

10

20

30GPS Based Vehicle Speed (MPH)

VSS Check Pulses

Example of Actual Speed Sensor Signal (Zoomed)



Time(secs)

255.31 255.32 255.34

Sp

ee

d (

MP

H)

-70

-60

-50

-40

-30

-20

-10

0

10

20


x:255.30171 y:-10.3896 n:2302543

x:255.3 y:24.0398 n:18420

x:255.33927 y:-10.3927 dx:0.03756 dy:-0.00311184

x:255.34 y:24.0709 dx:0.04 dy:0.0310764

6 pulses in 0.03756 seconds with 2.93

gears and 19.5 inch radius = 23.7 mph

(GPS = 24.04 mph)

Example of Actual Speed Sensor Signal (Starting)



Time(secs)

247.0 247.5 248.0

Sp

ee

d (

MP

H)

-25

-20

-15

-10

-5

0

5


Example of Actual Speed Sensor Signal (Stopping)



Time(secs)

259.0 259.5 260.0 260.5

Sp

ee

d (

MP

H)

-35

-30

-25

-20

-15

-10

-5

0

5


Gap shows tire

“stick-slip”

when finishing

Speed Sensing Observations

Amplitude of the signal increases with speed.

Frequency of the signal increases with speed.

Peak to Peak may go from 10 mV to over 10 V.

May not be referenced to common ground.




ECM Calculates Speed



Determining Speed

A Signal Conditioning chip converts the analog signal into a pulse train.


Determining Speed (Cont.)

The ECM counts the number of pulses in a given unit of time, say 0.1 seconds.

The number of pulses is converted to a distance using pulses per mile (ppm).

Example: 60 pulses in 0.1 seconds. 60 pulses

0.1 sec×

mile

29126 pulses×

3600 sec

1 hour= 74.1 mph


Getting Pulses Per Mile

Ask the Engine Control Module:

J1587 PID 228: Speed Sensor Calibration

Software output (DDDL shown here)

3.700 x 16 x 492 = 29126.4 ppm


Confirming Pulses Per Mile

Physically Inspect the Vehicle

Component Information (maybe in the glovebox)

Tells what components to expect


3.70

Axle Tag Shows Gear Ratio

Tag may not be readable.

This one says RATIO 00370.

Look for signs of repair.


Estimate Rolling Radius

Method 1: Level and Tape Measure

Measure from center to ground of drive wheels

Typical ~19.5-21 inches

Circumference = 3.1415 x 2 x radius, which has units of inches per revolution

Method 2: Mark the drive wheels and direct measure circumference

Put grease on the tread and measure the spacing of the grease mark on the pavement


Looking Up Rolling Radius

Example:Google “michelin truck tire data book”

http://www.tiregroup.com/Catalogs/PDF%20Catalogs/Michelin.pdf

Other manufacturers have similar data


http://www.tiregroup.com/Catalogs/PDF Catalogs/Michelin.pdf




Looking Up Rolling Radius


Measuring Rolling Radius

SAE J1025 to get Revolutions per mile

Long distance controlled tests

1.5% Accuracy

According to the Michelin Truck Tire Service Manual, “The accuracy of the tire revolutions per mile number is +/- 1%”


Calculating Revs Per Mile


Multiply by the gear ratio and number of teeth to get Pulses Per Mile (492)(3.7)(16) = 29126.4 ppm

What if our rolling radius estimate is off?

If Rolling Radius = 20.5 inches,

600 pulses in 1 second gives 74.16 mph

If Rolling Radius is 19.5 inches, 600 pulses in 1 second gives 70.57 mph

Difference of 3.59 mph is about 5%.

Differences magnitudes are less for lower speeds

Pavement type and tread geometry have minor effects


Other Factors Affecting Speed

Heavier Load -> Smaller Rolling Radius -> Lower Speed

Low Tire Pressure -> Smaller Rolling Radius -> Lower Speed

Treadwear -> Smaller Rolling Radius -> Lower Speed

Tire Slip When Braking -> Less Revolutions -> Lower Speed

Tire Slip Under Power -> More Revolutions -> Higher Speed







1

-1

-0.8

-0.6

-0.4

-0.2

0

0.2

0.4

0.6

0.8

Time

0.10 0.01 0.02 0.03 0.04 0.05 0.06 0.07 0.08 0.09

SineSine

Simulating Our Own Speeds

Use a function generator to insert signals on the Vehicle Speed Sensor (VSS) circuit.

Only frequency matters


Result: Truck-in-a-box


Overall System


Heavy Vehicle Networks

Simplify Wiring

Enables multiple systems on one bus

Data sharing between ECUs

External interface with 6 or 9-pin connector


Network Standards

SAE J1708 and J1587

Based on a 9600 baud RS-485 connection

Similar to the serial port on a computer

Phased out, but still on the road (DDEC 4 and 5, Cat ADEM3)

SAE J1939

Based on a 250,000 baud Controller Area Network (CAN) connection

CAN is used on passenger cars too.


J1708 Network Messages

Speed signals are interpreted and broadcast as serial messages in frames.

J1708 Frame:

MID: Message Identifier

128 (0x80) for Engine

183 (0xB6) for Off-board Programming Station

PID: Parameter Identification

84 (0x54) for Road Speed

190 (0xBE) for Engine Speed


MID PID DATA Checksum

Interpreting J1708 Data

Use J1587 as the roadmap


Example Speed Data

J1708 Hex Serial Data is found in a log file:

MID: Engine

PID: Road Speed

Determine Decimal (55 in this case)

Multiply by 0.5 (27.5 in this case)

Append units from J1587: 27.5 mph


Line Abs Time(Sec) Rel Time (Sec) Er Tx Description MID PID DATA 24723 538.7992186 0.005920976 F F J1708 $80 80 54 37

Converting Hex to Decimal

Excel: =HEX2DEC(“37”)

Windows Calculator:


There are 10 types of people in this world:

Those that understand binary and those that don’t.


Why does this matter?

The SAE Standards explain many of the parameters in the EDR reports.

Can not expect better than 0.5 mph accuracy on J1708 based vehicles.

Network traffic reflects ECU computed data

If network traffic is accurate, then EDR data is likely accurate.

Network data is the source for telematics units (e.g. Qualcomm).

Enables assessment without the need to set events.

More data samples


Controller Area Networks Controller Area Network (CAN) serial bus

introduced by Bosch in 1986 A 2-wire bus with multi-master capability with

Collision Detection, Arbitration, and Error Checking Result: nearly 100% data integrity in harsh

environments

Implemented using CAN transceiver hardware Motorola / Microchip Amtel Freescale Semiconductors


http://tucrrc.utulsa.edu 48

CAN Messages

29-bit Identifier

(Arbitration)

Data Field Error Checking Control

Field

Data typically transferred up to 8 bytes at a time

NTSS 2013

SAE J1939

Built on CAN at 250,000 bits/s

Fast enough for real-time control

Uses the message identifier to define purpose.

Defines everything from physical connections to diagnostic applications.

Provides the basis for understanding and interpreting some of the data.


J1939 Connector (9-Pin)

Pin A: Battery (-)

Pin B: Battery (+)

Pin C: CAN High

Pin D: CAN Low

Pin E: CAN Shield

Pin F: J1708 (+)

Pin G: J1708 (-)

Pin H: OEM Use or 2nd CAN High

Pin J: OEM Use or 2nd CAN Low


APPLICATIONS TO HEAVY VEHCILES

Data Acquisition and


Vehicle Description

2008 Freightliner

Single Drive Axle

DDEC VI equipped Detroit Diesel Series 60 Engine

Eaton 10 Speed Manual

2.93:1 Rear Axle Ratio


Component Information


Procedure

Training Facility Driving (i.e. Closed Course)

Straight line runs with at least 2 hard brake events

Multiple Configurations

Bobtail

Single Pup

Twin Pups

Record while hitching and releasing pups


Correlated Data Gathering

Simultaneously obtain Tone Ring (VSS) Signals

J1939 Network Traffic (e.g. Wheel-based Vehicle Speed)

J1708 Network Traffic (e.g. Road Speed)

GPS Based Speeds (Vbox 3i and eGPS-200)

Tape Switch on Brake Pedal

Brake Chamber Pressures

Perform multiple hard braking events

Download HVEDR Data


Instrument Setup


Instrument Setup (cont.)


Details on Instrumentation with links: http://tucrrc.utulsa.edu/CorellatedDDEC6DataSet.html


http://tucrrc.utulsa.edu/CorellatedDDEC6DataSet.html

Nice signals give predictable and reliable results.

Higher speeds

Lab Simulated Sine Waves

Real Signals may not be nice at low speeds

Compromised circuit

Drive train rattle

Vibration

Longer sample times smooth out noise

1

-1

-0.8

-0.6

-0.4

-0.2

0

0.2

0.4

0.6

0.8

Time

0.10 0.01 0.02 0.03 0.04 0.05 0.06 0.07 0.08 0.09

SineDC with Uniform Noise

Speed Spikes and Noise


1.6

-1.6

-1.4

-1.2

-1

-0.8

-0.6

-0.4

-0.2

0

0.2

0.4

0.6

0.8

1

1.2

1.4

Time

0.10 0.005 0.01 0.015 0.02 0.025 0.03 0.035 0.04 0.045 0.05 0.055 0.06 0.065 0.07 0.075 0.08 0.085 0.09 0.095

Sine with Uniform NoiseDC with Uniform Noise

Speed Spikes at Shift Points

External GPS

Tone Ring Signal

J1939 Speed


eDAQ-DDEC6TestingWithHathaway.sie - GPS@speed_raw3d.RN_8

sp

ee

d_

raw

3d

(km

/h)

0

5

10

15

20

25


Wh

ee

lSp

ee

d(m

illi

vo

lts

)

-12000-10000-8000-6000-4000-2000

02000


Time(secs)

65 70 75 80 85

Wh

Bs

Ve

hS

p(k

m/h

)

0

5

10

15

20

25

Speed Spikes at Shift Points eDAQ-DDEC6TestingWithHathaway.sie - GPS@speed_raw3d.RN_8

sp

ee

d_

raw

3d

(km

/h)

10.811.011.211.411.611.812.012.212.4


Wh

ee

lSp

ee

d(m

illi

vo

lts

)

-5000-4000-3000-2000-1000

01000


Time(secs)

70.4 70.6 70.8 71.0

Wh

Bs

Ve

hS

p(k

m/h

)

91011121314151617

External GPS

Tone Ring Signal

J1939 Speed


Signal Noise When Slow

Some Event Records may show unphysical speed spikes (i.e. 0-55mph in 1 second).

The speed sensing circuit automatically increases sensitivity with lower amplitudes

More susceptible to noise

Can happen with impulses that cause drivetrain rattle


Tone Ring Noise From Trailer Connection

External GPS

Tone Ring Signal

J1939 Speed


eDAQ-DDEC6Testing.sie - GPS@speed_raw3d.RN_11

sp

ee

d_

raw

3d

(km

/h)

0

1

2

3

4

5

eDAQ-DDEC6Testing.sie - [email protected]_11

Wh

ee

lSp

ee

d(m

illi

vo

lts

)

-500

0

500

1000

1500


Time(secs)

269.5 270.0 270.5 271.0 271.5 272.0 272.5

Wh

Bs

Ve

hS

p(k

m/h

)

0.00.51.01.52.02.53.03.54.0

Speed Comparison

eGPS-200 from eDAQ

Vbox 3i GPS

J1939 Network

Wheel-based Vehicle Speed (Tone Ring)

Front Axle Speed (Electronic Brake Controller)

J1708 Network

Road Speed

DDEC Reports


Speed Records


J1939: Wheel-Based Vehicle Speed

Time(secs)

50 100 150

Sp

ee

d (

mp

h)

0

10

20

30

40

50

60

J1939: Front Axle Speed

GPS: VBOX 3i

GPS: eGPS-200

J1708: Road Speed

Speed Records Hard Brake



Time(secs)

150 152 154 156 158

Sp

ee

d (

mp

h)

0

10

20

30

40

50

60


GPS: VBOX 3i

GPS: eGPS-200

J1708: Road Speed

Zoom on Speed Feature



Time(secs)

155.0 155.2 155.4 155.6

Sp

ee

d (

mp

h)

6

8

10

12

14

16

18


GPS: VBOX 3i

GPS: eGPS-200

J1708: Road Speed

x:155.109 y:7.9873 n:155109

x:155.109 y:15.0739 n:155109

x:155.109 y:14.8695 n:155109

x:155.11 y:14.6489 n:31022

x:155.109 y:10 n:155109

Compare Tone Ring Signal to ECM Calculated Speed



Wh

ee

lSp

ee

d(m

illi

vo

lts

)

-2000-1000

0100020003000400050006000


Time(secs)

154.8 155.0 155.2 155.4 155.6

Ro

ad

Sp

ee

d(m

ph

)

8

10

12

14

16

18

20

DDEC Reports Data


0

500

1000

1500

2000

2500

0

10

20

30

40

50

60

-60 -50 -40 -30 -20 -10 0 10

En

gin

e S

pe

ed

(rp

m)

Sp

eed

(m

ph

)

Time (sec)

Hard Brake

DDEC Reports Speed

DDEC Reports RPM

Merge DDEC Data with Network Data


0

500

1000

1500

2000

2500

0

10

20

30

40

50

60

-60 -50 -40 -30 -20 -10 0 10

En

gin

e S

pe

ed

(rp

m)

Sp

eed

(m

ph

)

Time (sec)

Hard Brake

DDEC Reports Speed

Wheel-based Vehcle Speed

DDEC Reports RPM

J1939 RPM

Speed Data Observations

Network speed data are about 0.1 second be hind tone ring signal.

GPS units tracked each other around 0.2 mph difference

Front Axle Speed over reported speed

Likely reduced rolling radius from treadware

From the Electronic Brake controller

Road Speed (J1708) and Wheel-based Vehicle Speed (J1939) show drops in speed

Tire slip from braking

Used the same tone ring sensor


Air Pressure Transducer (Front Axle)


Air Pressure Transducer (Rear Axle)


Air Pressure for ABS Braking



Time(secs)

150 152 154 156 158

Bra

ke

Pre

ss

LR

(PS

I)

-20

0

20

40

60

80

100

120






Left Rear Brake Pressure with Wheel-Based Speed



Time(secs)

150 152 154 156 158

Wh

Bs

Ve

hS

p(k

m/h

)

-20

0

20

40

60

80

100eDAQ-DDEC6Testing.sie - [email protected]_2

Increase in pressure

causes wheel slip

and decrease in

measured speed.

Bobtail Braking Results

J1939 brake switch status lags tape switch by 0.07 seconds.

15 psi builds in that time.

40 psi (average operational pressure) lags by 0.25 psi

Data show the pressure modulation from the ABS system.

Front axle pressures tracked each other.

No modulation needed.


Determining Drag Factor

f = [ (v2 – v1) / (t2 – t1) ] / g

where

v1 is speed at time t1

v2 is speed at time t2

g is the acceleration due to gravity in the same units of v/t.

Example: g = 32.2 ft/s x 3600 sec/hour 5280 ft/mile = 21.95 mph/s


eDAQ-DDEC6Testing.sie - GPS@speed_3d.RN_2

Time(secs)

145 150 155 160

sp

ee

d_

3d

(km

/h)

0

20

40

60

80

100

Acceleration is the slope


DV

Dt a = (v2-v1) / (t2 – t1)

Drag Factor Results

Run Description v1 (km/h) v2 (km/h) t1 (sec) t2 (sec) Drag Factor

2a First hard brake - tactor 81.23 2.53 91.895 98.450 -0.34

2b Second hard brake - tractor 79.31 7.85 150.935 156.465 -0.366

3a Third hard brake - tractor 83.4 5.73 82.485 88.830 -0.347

3b Fourth hard brake - tractor 57.32 9.82 147.170 151.170 -0.336

5a First hard brake with single trailer 75.19 4.20 244.835 250.310 -0.367

5b Second hard brake with single trailer 68.82 3.18 301.950 307.080 -0.362

6a Third hard brake with single trailer 71.78 6.01 231.945 236.730 -0.389

6b Fourth hard brake with single trailer 69.13 3.68 311.970 316.760 -0.387

9a First hard brake with two trailers 65.18 3.95 96.445 100.630 -0.414

9b Second hard brake with two trailers 64.11 2.06 156.090 160.465 -0.402

10a Third hard brake with two trailers 63.43 3.92 189.715 193.570 -0.437

10b Fourth hard brake with two trailers 61.07 2.44 251.300 255.405 -0.404


Adding trailers made the drag factor

increase from about 0.35 to 0.42.

Rear Brake Pressures: Bobtail



Time(secs)

92 94 96 98 100

Wh

Bs

Ve

hS

p(k

m/h

)

-20

0

20

40

60

80

100

120



Rear Brake Pressures: Single Pup



Time(secs)

232 233 234 235 236

Wh

Bs

Ve

hS

p(k

m/h

)

-20

0

20

40

60

80

100

120



Rear Brake Pressures: Two Pups



Time(secs)

156 157 158 159 160 161

Wh

Bs

Ve

hS

p(k

m/h

)

-20

0

20

40

60

80

100



Push Rod Stroke - OK


Push Rod Stroke - Bad)


Remove Emergency Brake Line


Newer Bolt

This fell to the ground…


A Dime to Block the Line


Observations When the dime was removed no pressure

would hold when the parking brake was Dime prevented an air leak from a defective

chamber Service brake worked to depress the spring to

release the brake

Pressures were high/normal in the brake line No Pressure modulation since no wheel slip.

Push rod stroke was almost double on the defective brake

No pushrod stroke when parking brake was set


Setting a Speed Triggered Event in an ECM

A predefined threshold, say 7 mph/s, must be exceeded to trigger an event.

If an ECM sees a change in speed of that amount, then a braking event is recorded.

Threshold value is found in the Configuration data.


Fault Codes

Fault code data can also be recorded.

Faults may occur as part of a crash

Example: loss of accelerator pedal signal when a pusher bus or RV runs into a tree.

Timing of fault information is not certain yet

Fault Freeze Frame Data is often recorded too.


Freeze Frame Data A list of recorded parameters at the time a diagnostic

trouble code was captured. Consists of

Suspect Parameter Number (SPN) Fault Mode Indicator (FMI) Occurrence Count Engine Torque Mode Boost Engine Speed Engine Load Engine Coolant Temperature Vehicle Speed Maybe More Manufacturer Specific Data


Cummins Insite Example


Failure Mode Indicators

32 possible values describing how a parameter became bad as defined in J1939-73

Uses a Signal Range to divide FMI to severity levels:


Failure Mode Indicator

Examples:

FMI=3 - Voltage Above Normal, Or Shorted To High Source

FMI=4 - Voltage Below Normal, Or Shorted To Low Source

FMI=9 - Abnormal Update Rate

FMI=12 - Bad Intelligent Device Or Component

Software should interpret these numbers


Fault Data in Reconstruction

Timing of fault data is actively being researched.

Freeze frame data may be used as a lower bound

Fault data should be tied to physical evidence

Gouge in the oil-pan from a wreck corresponds to a loss of oil pressure.

Need to use the non-free software to get freeze frame data.


Historical Data

Describes mileage, times, and fuel uses.

Attribution is hard (i.e. unknown drivers)

There are many counters used in recording historical data.

ECM time: Amount the ECM was on

Engine time: Amount the Engine was turning

Trip data may be different than lifetime data.


Configuration Data

Used to verify speeds from RPM.

Shows power settings.

Gives governor limits.

Shows road speed limits.

Configuration data is programmed from the shop or manufacturer.


Consortium Website

All data from crash testing and this presentation will be available at

http://tucrrc.utulsa.edu

Credentials

User: TUCRRCmember Password: TUCRRCpassword


http://tucrrc.utulsa.edu/

THANK YOU

Safe Travels and Fair Winds.


heavy vehicle event data recorders - university of tulsatucrrc.utulsa.edu/members/inline - chevy...

Documents