R-Net Dongle tear-down.

Power wheelchair board for REAL info!

POWERCHAIR MENU! www.wheelchairdriver.com/powerchair-stuff.htm

Re: R-Net Dongle tear-down.

Postby WCDuser » 23 Oct 2019, 09:40

Nice Job.
WCDuser
 
Posts: 4
Joined: 07 Dec 2016, 08:24

Re: R-Net Dongle tear-down.

Postby Arima » 10 Nov 2019, 06:52

Irving wrote:Had a play today verifying the CAN messages in the directory previously mentioned and available here.

Most are the same though the device numbering is different and the lighting and seat control messages on my Puma are very different (though oddly horn is the same) which probably reflects the fact that they were testing on a Permobil!

More to come as I get time to dig deeper...


@Irving
Hey I'm new here and definitely not a network expert. Can you talk about the bus...what version? I've heard of 3...and there may be more.

CAN 2.0A 11 byte messages identification (standard), 125 kbs
CAN 2.0B 29 bit message identification (extended), 1 Mbs
CAN FD Flexible Data Rate, 10 Mbs

I'm still trying to figure out who is who on here. Are you involved with the work on github? You wrote software to scan/monitor the bus and collect data into readable frames? I didn't know there were more than a couple frame types/sizes.

Thxs
Arima
 
Posts: 14
Joined: 06 Nov 2019, 19:24
Location: Olympia, Wa.

Re: R-Net Dongle tear-down.

Postby LROBBINS » 10 Nov 2019, 09:30

The CAN bus is more complex than most other serial protocols, but not incomprehensible. There are numerous variants, especially of "shell" type protocols like CANOpen, that can be used with less understanding of the basic scheme, but to my mind get more complex as soon as you want to do something out of the ordinary, so I prefer to stick with "raw" CAN. CAN is complex, but it is robust, error and interference resistant, and certainly simplifies wiring - just a 4-wire cable between all the modules.

You'll find a pretty complete description of CAN in the attached pdf from Microchip.

Having decided that I was never going to be able to reverse-engineer someone else's "dictionary", I just created my own CAN system for the Roboteq. Aside from not tying me to someone else's decisions (and cost - CANOpen e.g. is "free", but the documentation is very expensive), it let me mostly use the defined constants of Roboteq's software and easily add whatever messages were needed on top of that. Working at the "raw" level I could also add some secondary features such as transmitting data bytes and the complements of the data bytes to allow a double check that nothing's been corrupted, non-blocking confirmation messaging that lets a program keep doing its thing while awaiting confirmation, error logging and notification and so on. Right now I'm adding PWM control of lift and tilt motors for a prototype lift/tilt device that simplifies the mechanicals but needs some "smarts" to keep tilt constant while going up and down.
Attachments
CAN basics.pdf
(141.62 KiB) Downloaded 13 times
LROBBINS
 
Posts: 4571
Joined: 27 Aug 2010, 09:36
Location: Siena, Italy

Re: R-Net Dongle tear-down.

Postby Irving » 10 Nov 2019, 13:51

Arima wrote:
Irving wrote:Had a play today verifying the CAN messages in the directory previously mentioned and available here.

Most are the same though the device numbering is different and the lighting and seat control messages on my Puma are very different (though oddly horn is the same) which probably reflects the fact that they were testing on a Permobil!

More to come as I get time to dig deeper...


@Irving
Hey I'm new here and definitely not a network expert. Can you talk about the bus...what version? I've heard of 3...and there may be more.

CAN 2.0A 11 byte messages identification (standard), 125 kbs
CAN 2.0B 29 bit message identification (extended), 1 Mbs
CAN FD Flexible Data Rate, 10 Mbs

I'm still trying to figure out who is who on here. Are you involved with the work on github? You wrote software to scan/monitor the bus and collect data into readable frames? I didn't know there were more than a couple frame types/sizes.

Thxs


Hi,

The pdf Lenny linked to in the previous post gives a good overall description of CAN Bus. Messages use either an 11 (Standard) or 29 (extended) bit identifier (ID) with up to 8 data bytes. CAN Bus is a promiscuous network in that the normal mode of operation is for nodes to transmit information without a specific listener/endpoint in mind. So in a car the engine management node will regularly transmit an 'engine revs' message - the ID is the 'name' of the parameter and the data is the 'revs'. Any node interested in 'revs' merely has to listen for the relevant ID, however for data not transmitted regularly or needed by a node it can send a request message using the same ID but with the request bit set. The 'owner' of that message then responds accordingly as soon as it can (but there are no standards for how quickly a node will respond).

Talking specifically about R-Net it runs at 125kps and follows the Bosch 2.0B standard using mainly 29bit Extended messages with a smattering of 11bit messages. Promiscuous messages include joystick position (x&y +/-100), distance (0-6533.6m trip, 0-65536km odometer), time/date (dd/mm/yy hh:mm:ss), various heartbeats, battery SoC (0-100%), battery amps, motor amps, etc.

I've not had any involvement with the original investigation on github, but I've been verifying their findings to ensure my setup is working, and I've written a simple Windows app to capture messages, winnow out the ones we know about so we can focus on the unknown. The app allows me to send messages too. So far I can: beep the horn, turn lights on & off, turn the light repeaters on the joystick on & off, send joystick positions, change the battery SoC meter and speed (but neither permanently, the PM overwrites them :( )

Here's a pic of my setup. To the left is an R-Net hub connected to my chair with a short lead to the small white box which is a commercially available CAN Bus to USB interface. To the right of that,in the middle of the breadboard, with the silver box, is a 32bit microcomputer with built-in CAN Bus interface and Bluetooth - this will be the basis of a permanently attached unit - and to the far right, on the desk, is a basic Arduino with, to its left, a 3rd party CAN Bus interface attached. All are simultaneously connected to the CAN Bus and are listening to the messages, and all can send messages if I want them to.

Later I'll post some video of them in action...

IMAG0611-2.jpg
Puma 40, 75Ah LiFePO4 (pic is on tour @ Whistler, BC)
Puma 40 backup, 73Ah MK (for now)
Spectra Plus (weedy 40Ah MK)
User avatar
Irving
 
Posts: 1680
Joined: 04 Dec 2012, 11:51
Location: NW London

Re: R-Net Dongle tear-down.

Postby Burgerman » 10 Nov 2019, 14:34

It makes me sad that anyone should need to go to these lengths to access a simple programming dongle. They SHOULD sell these to anyone that wants one at a sensible price instead of banning us from getting hold of them by every means they can dream up.

That way we cold buy these and the software legally, and then we would be happy. They would make more money. And the industry would not get so much bad press and everyone wins. Also people would INSIST that their new chairs were R-Net! So even PG Drives/Curtiss wins. They are stupidly short sighted.

Yes, its possible to program things to be dangerous, and to damage the motors etc. Or even cause a fire. But those of us that DO understand are way more profitient than the stupid dealers in the majority of cases. And have much more time to configure and test through trial and error that the manufacturer in the case of individual users problems. And we are all different. I CANNOT USE any stock chair. They dont go where I tell them. Its at this most basic level where the problems begin!

So while the manufactures look on at threads like this in despair, and the cracked software, and diy cables etc, and all the rest that we have already done, its their own stupid fault! No matter what they do to try and stop us we MUST find a way to circumvent it in order to live our lives. Its their own self induced fault.
User avatar
Burgerman
Site Admin
 
Posts: 47687
Joined: 27 May 2008, 21:24
Location: United Kingdom

Re: R-Net Dongle tear-down.

Postby Irving » 10 Nov 2019, 16:21

Agreed, but its a little bit a labour of love as its instructive and interesting. Plus I want a complete integrated Bluetooth chair & battery remote monitoring & control set-up with built-in on the fly programming/adaptation. And that's something PGDT won't provide.
Puma 40, 75Ah LiFePO4 (pic is on tour @ Whistler, BC)
Puma 40 backup, 73Ah MK (for now)
Spectra Plus (weedy 40Ah MK)
User avatar
Irving
 
Posts: 1680
Joined: 04 Dec 2012, 11:51
Location: NW London

Re: R-Net Dongle tear-down.

Postby Arima » 10 Nov 2019, 19:45

Irving wrote:Agreed, but its a little bit a labour of love as its instructive and interesting.


Doubt I'd be here wanting to deal with all these chair issues if it wasn't some sense of accomplishment. Probably the biggest change for me recently has been the return of my curiosity. Before that all I cared about was staying out of the hospital and not pissing on my self.

Thank you for the pdf @LROBBINs
Arima
 
Posts: 14
Joined: 06 Nov 2019, 19:24
Location: Olympia, Wa.

Re: R-Net Dongle tear-down.

Postby Burgerman » 10 Nov 2019, 23:35

I stll do that! :clap
User avatar
Burgerman
Site Admin
 
Posts: 47687
Joined: 27 May 2008, 21:24
Location: United Kingdom

Re: R-Net Dongle tear-down.

Postby Irving » 14 Nov 2019, 19:22

Progress is being made... I can now access the data behind the info that appears on the PM, JSM and ISM status panels under the system test menu...

Here are the actuator operating current plots for tilt, lift and recline - high currents are up and lower currents down obviously. Tilt & lift are smooth & silent, but recline is noisy & jerky and you can see that on the plot; a high current spike on starting and high ripple relative to average current drawn - that motor isn't long for this world I suspect without a strip-down. Knowledge is power :D

Other parameters I can get are battery volts & current, motor volts & current, PM heat-sink temperature, joystick position, lights & horn status, clock time, distance odometer & trip, current profile & mode

I can: change the clock & date, reset trip counter, turn lights on/off, beep horn, change speed setting, switch between profiles, switch between modes, and power the system down. In theory I can do anything you can do via OBP, I just haven't catalogued all the specific parameter IDs yet.

seat-tilt.PNG

seat-lift.PNG

backrest.PNG
Puma 40, 75Ah LiFePO4 (pic is on tour @ Whistler, BC)
Puma 40 backup, 73Ah MK (for now)
Spectra Plus (weedy 40Ah MK)
User avatar
Irving
 
Posts: 1680
Joined: 04 Dec 2012, 11:51
Location: NW London

Re: R-Net Dongle tear-down.

Postby Irving » 26 Nov 2019, 01:05

More progress...

I can now read the parameter pages, including the OEM settings, without a programmer, through my own windows app. Slowly working out what bytes represent a specific parameter and I already know which bytes represent the holy grail of the hidden acceleration etc. settings :D Won't be too long before I can change them!
Puma 40, 75Ah LiFePO4 (pic is on tour @ Whistler, BC)
Puma 40 backup, 73Ah MK (for now)
Spectra Plus (weedy 40Ah MK)
User avatar
Irving
 
Posts: 1680
Joined: 04 Dec 2012, 11:51
Location: NW London

Re: R-Net Dongle tear-down.

Postby ex-Gooserider » 26 Nov 2019, 01:22

Fantastic news.... I'm sure it will make a lot of people very happy, (and seriously piss off P&G....)

ex-Gooserider
T-5, ASIA-B
Jazzy 1100
Jazzy Select 6
Quickie Q-7
Invacare Mariner
Want to make / get a better chair, ideally one that stands.
User avatar
ex-Gooserider
 
Posts: 5234
Joined: 15 Feb 2011, 06:17
Location: Billerica, MA. USA

Re: R-Net Dongle tear-down.

Postby steves1977uk » 26 Nov 2019, 01:23

Irving wrote:More progress...

I can now read the parameter pages, including the OEM settings, without a programmer, through my own windows app. Slowly working out what bytes represent a specific parameter and I already know which bytes represent the holy grail of the hidden acceleration etc. settings :D Won't be too long before I can change them!


Interesting Irving! :ugeek: Wonder if there's other hidden settings? Keep up the good work! :thumbup:

Steve
User avatar
steves1977uk
 
Posts: 2659
Joined: 20 Oct 2011, 21:47
Location: Wells next the Sea, Norfolk, UK

Re: R-Net Dongle tear-down.

Postby farmer » 26 Nov 2019, 01:53

great job
cheers
farmer
 
Posts: 46
Joined: 27 Jan 2016, 03:22
Location: Lima, Ohio USA

Re: R-Net Dongle tear-down.

Postby gcebiker » 26 Nov 2019, 05:01

Sweet :thumbup:
http://greenmobility.com.au/dynamic-controls-3/shark/rc-wheelchair-controller/
My YouTube Ch -- https://www.youtube.com/user/gcebiker
User avatar
gcebiker
 
Posts: 818
Joined: 11 Jul 2015, 14:20
Location: Gold Coast, Queensland, Australia.

Re: R-Net Dongle tear-down.

Postby Irving » 27 Nov 2019, 20:37

Help... all of a sudden my copy of the Sunrise OEM EU software has stopped opening OEM files - so I've tried uninstalling all copies of R-Net software, reboot, download a fresh copy and re-install... and it still thinks its dealer level only

Ideas anyone?
Puma 40, 75Ah LiFePO4 (pic is on tour @ Whistler, BC)
Puma 40 backup, 73Ah MK (for now)
Spectra Plus (weedy 40Ah MK)
User avatar
Irving
 
Posts: 1680
Joined: 04 Dec 2012, 11:51
Location: NW London

Re: R-Net Dongle tear-down.

Postby Irving » 27 Nov 2019, 21:21

Irving wrote:Help... all of a sudden my copy of the Sunrise OEM EU software has stopped opening OEM files - so I've tried uninstalling all copies of R-Net software, reboot, download a fresh copy and re-install... and it still thinks its dealer level only

Ideas anyone?


Oddly, its working fine on my laptop... installed from same source... when you load an OEM file on the laptop it complains the parameter file is out of date, but carries on and opens it, whereas on the desktop it just won't open the file, wants to send it to the chair....
Puma 40, 75Ah LiFePO4 (pic is on tour @ Whistler, BC)
Puma 40 backup, 73Ah MK (for now)
Spectra Plus (weedy 40Ah MK)
User avatar
Irving
 
Posts: 1680
Joined: 04 Dec 2012, 11:51
Location: NW London

Re: R-Net Dongle tear-down.

Postby Burgerman » 27 Nov 2019, 21:37

Its something specific to you. Your PCs or your oem files. I just opened several oem files, edited, saved etc. All simple, no error boxes, all normal.
Sendme your file.

when you load an OEM file on the laptop it complains the parameter file is out of date, but carries on and opens it,


Never saw that.
User avatar
Burgerman
Site Admin
 
Posts: 47687
Joined: 27 May 2008, 21:24
Location: United Kingdom

Re: R-Net Dongle tear-down.

Postby Irving » 27 Nov 2019, 22:39

Might be because I've not ticked the box...

warning.PNG


oemhelp.PNG


opened.PNG
Puma 40, 75Ah LiFePO4 (pic is on tour @ Whistler, BC)
Puma 40 backup, 73Ah MK (for now)
Spectra Plus (weedy 40Ah MK)
User avatar
Irving
 
Posts: 1680
Joined: 04 Dec 2012, 11:51
Location: NW London

Re: R-Net Dongle tear-down.

Postby Irving » 27 Nov 2019, 22:45

The file...

CS11071460 canbus test 2 oem.R-net
(4.37 KiB) Downloaded 8 times


There's nothing special about it....
Puma 40, 75Ah LiFePO4 (pic is on tour @ Whistler, BC)
Puma 40 backup, 73Ah MK (for now)
Spectra Plus (weedy 40Ah MK)
User avatar
Irving
 
Posts: 1680
Joined: 04 Dec 2012, 11:51
Location: NW London

Re: R-Net Dongle tear-down.

Postby expresso » 27 Nov 2019, 23:05

i got that same message just once before - about the files being out of date etc. - installed the latest and was fine after - or maybe have to wipe it clean - uninstall and re install - or try a different ver. EU or Sunrise - etc,

by the way is there a newer version out yet ? if so i could use a link to download it -


thanks
Quickie P222se - 60Ah ADD ON
Quickie S646se - 150Ah LifePo4
Quickie P220 - Indoor Chair
Bounder Plus - 180Ah LifePo4
expresso
 
Posts: 7578
Joined: 10 May 2010, 03:17
Location: NYC - NY

Re: R-Net Dongle tear-down.

Postby Irving » 27 Nov 2019, 23:05

And then it was OK....

No idea what changed...

Here's the about page from the new install... note the date of the parameter file...

rnetabout.PNG
Puma 40, 75Ah LiFePO4 (pic is on tour @ Whistler, BC)
Puma 40 backup, 73Ah MK (for now)
Spectra Plus (weedy 40Ah MK)
User avatar
Irving
 
Posts: 1680
Joined: 04 Dec 2012, 11:51
Location: NW London

Re: R-Net Dongle tear-down.

Postby Irving » 27 Nov 2019, 23:20

Now reinstalled on laptop with the later parameter file.

It seems the parameter files (and possibly the "OEM-ness") are held in a DLL and if you've got the wrong version.... I'm guessing that, for some reason, the DLL was locked in memory so when the OEM version was run it retained the older, dealer, version/personality.
Puma 40, 75Ah LiFePO4 (pic is on tour @ Whistler, BC)
Puma 40 backup, 73Ah MK (for now)
Spectra Plus (weedy 40Ah MK)
User avatar
Irving
 
Posts: 1680
Joined: 04 Dec 2012, 11:51
Location: NW London

Re: R-Net Dongle tear-down.

Postby Burgerman » 28 Nov 2019, 00:36

ALL works fine no error box, but I dont have the dealer version installed.
User avatar
Burgerman
Site Admin
 
Posts: 47687
Joined: 27 May 2008, 21:24
Location: United Kingdom

Re: R-Net Dongle tear-down.

Postby Irving » 03 Dec 2019, 00:20

More progress to report. I now can write parameters back to the various modules though it isn't a simple process, it's more a block transfer of data. There does seem to be a way to change parameters individually but I'm not confident I've got that safe yet. I am just needing to research it more, don't want to brick anything!

I've also nearly completed mapping out the R-Net file structure and the block structure of the file neatly maps onto the parameter pages in the controller(s). In fact the file is a snapshot of the system memory! There are hundreds of not thousands of parameters and I've only identified about 50 so far.

So now I need some volunteers to help map the remaining parameters. You don't need to have a programmer, this is all offline from the chair. All you do need is a copy of the OEM programming software and the master file from a chair, either yours, mine or someone elses. I've written a little bit of software to read in an R-Net file and monitor it for changes when you use the OEM software to change something. All it needs is a methodical approach to change each parameter in turn and let my software record what changes. Tedious but three or four people working on different pages of the r-net file will map the whole thing in a few days.. Any takers?
Puma 40, 75Ah LiFePO4 (pic is on tour @ Whistler, BC)
Puma 40 backup, 73Ah MK (for now)
Spectra Plus (weedy 40Ah MK)
User avatar
Irving
 
Posts: 1680
Joined: 04 Dec 2012, 11:51
Location: NW London

Re: R-Net Dongle tear-down.

Postby farmer » 03 Dec 2019, 01:18

I have not yet done anything to do with programing a chair but if you send me a list of want you need me to do and a little coaching I would be glad to help
farmer
 
Posts: 46
Joined: 27 Jan 2016, 03:22
Location: Lima, Ohio USA

Re: R-Net Dongle tear-down.

Postby Burgerman » 03 Dec 2019, 02:23

Not sure I have time at the moment but send me anyway!

burgerman@ntlworld.com

Does it matter which version? The sunrise one has stuff the generic doesent for e.g.
User avatar
Burgerman
Site Admin
 
Posts: 47687
Joined: 27 May 2008, 21:24
Location: United Kingdom

Re: R-Net Dongle tear-down.

Postby Irving » 03 Dec 2019, 07:20

Burgerman wrote:Not sure I have time at the moment but send me anyway!

burgerman@ntlworld.com

Does it matter which version? The sunrise one has stuff the generic doesent for e.g.
thats a very good Q and one I've yet to find an answer to. According to PGDT the generic will leave the custom bits alone; you can still edit the file but you won't see/edit the custom bits. How they achieve this isn't clear, I'd expected the custom bits to be in a separate memory block but the Sunrise voltage setting for example, which is a custom bit, isn't... I need to do a bit more digging.

I suspect the short answer for now is we'll have to try both...
Puma 40, 75Ah LiFePO4 (pic is on tour @ Whistler, BC)
Puma 40 backup, 73Ah MK (for now)
Spectra Plus (weedy 40Ah MK)
User avatar
Irving
 
Posts: 1680
Joined: 04 Dec 2012, 11:51
Location: NW London

Re: R-Net Dongle tear-down.

Postby Irving » 03 Dec 2019, 07:26

farmer wrote:I have not yet done anything to do with programing a chair but if you send me a list of want you need me to do and a little coaching I would be glad to help

Thanks. No chair knowledge needed. I'll be putting a pack together with full instructions. Might be a week or so til that's done.
Puma 40, 75Ah LiFePO4 (pic is on tour @ Whistler, BC)
Puma 40 backup, 73Ah MK (for now)
Spectra Plus (weedy 40Ah MK)
User avatar
Irving
 
Posts: 1680
Joined: 04 Dec 2012, 11:51
Location: NW London

Re: R-Net Dongle tear-down.

Postby Burgerman » 03 Dec 2019, 10:29

If its bigger than a couple of mb you can send to burgerman hat wheelchair driver . com
No limit.
User avatar
Burgerman
Site Admin
 
Posts: 47687
Joined: 27 May 2008, 21:24
Location: United Kingdom

Re: R-Net Dongle tear-down.

Postby terry2 » 03 Dec 2019, 11:52

Irving wrote:More progress to report. I now can write parameters back to the various modules though it isn't a simple process, it's more a block transfer of data. There does seem to be a way to change parameters individually but I'm not confident I've got that safe yet. I am just needing to research it more, don't want to brick anything!

I've also nearly completed mapping out the R-Net file structure and the block structure of the file neatly maps onto the parameter pages in the controller(s). In fact the file is a snapshot of the system memory! There are hundreds of not thousands of parameters and I've only identified about 50 so far.

So now I need some volunteers to help map the remaining parameters. You don't need to have a programmer, this is all offline from the chair. All you do need is a copy of the OEM programming software and the master file from a chair, either yours, mine or someone elses. I've written a little bit of software to read in an R-Net file and monitor it for changes when you use the OEM software to change something. All it needs is a methodical approach to change each parameter in turn and let my software record what changes. Tedious but three or four people working on different pages of the r-net file will map the whole thing in a few days.. Any takers?



If I don't need any hardware I will give it a go.

My PC is on most the time anyway.
User avatar
terry2
 
Posts: 827
Joined: 07 Nov 2014, 12:08
Location: Solihull

PreviousNext

Return to Everything Powerchair

Who is online

Users browsing this forum: farmer, flagman1776, Google [Bot], iainsherriff, snaker and 51 guests

 

  eXTReMe Tracker