My Car tried to Kill me today (1973 Beetle +SDU Conversion), Potential Cruise Control Bug ?

[johu]

Yes defeat switch would work then the inverter no longer "sees" the brake pedal. Would be my preference as I don't want to make it configurable in software.

[Romale]

I've always put a brake line switch on the front wheel of my motorcycles. this made it possible to block the front and anneal the rubber by warming up the rear wheel. the simplest and most reasonable solution.

[johu]

I have tested the hardened CAN implementation today and it works. Put an error in the CRC calculation and that takes throttle away.

I will draft a new release soon.

Here's the function from stm32_car

Code: Select all

static void SendOIControlMessage()
{
   uint32_t data[2];
   uint32_t pot = Param::GetInt(Param::pot) & 0xFFF;
   uint32_t pot2 = Param::GetInt(Param::pot2) & 0xFFF;
   uint32_t canio = Param::GetInt(Param::canio) & 0x3F;
   uint32_t ctr = Param::GetInt(Param::canctr) & 0x3;
   uint32_t cruise = Param::GetInt(Param::cruisespeed) & 0x3FFF;
   uint32_t regen = Param::GetInt(Param::potbrake) & 0x7F;

   data[0] = pot | (pot2 << 12) | (canio << 24) | (ctr << 30);
   data[1] = cruise | (ctr << 14) | (regen << 16);

   crc_reset();
   uint32_t crc = crc_calculate_block(data, 2) & 0xFF;
   data[1] |= crc << 24;

   can->Send(63, data);
}

It is now necessary to disable all interrupts when using the CRC hardware elsewhere. Currently that means disabling all interrupts when saving/loading CAN map and parameters. This will appear in libopeninv also.

[jrbe]

I have tested the hardened CAN implementation today and it works. Put an error in the CRC calculation and that takes throttle away.

I will draft a new release soon.

Thanks Johu.

Is there a throttle decay for a crc error cut?
If / when the crc error resolves is there a throttle ramp up?

[johu]

There must be multiple consecutive errors until an action is taken. A good message will heal one bad message. When there are too many bad messages throttle, cruise control and regen will be cut and won't return until you restart the inverter.

Behaviour is up for discussion but that's the first cut anyway. Code says more then 1000 words: https://github.com/jsphuebner/stm32-sin ... ol.cpp#L70

[johu]

Now thought about some use cases that I've seen with control over CAN. At least one guy uses some generic Analog to CAN converter which isn't able to generate that CRC and I'm not even sure about the running counters. So I will add a parameter to make these optional but it defaults to both counter and CRC check. Still keeps the "important message" timeout.

[johu]

Now two months later I want to enquire: who is using this software and what have you observed? Especially those chaps who mentioned problems here.

[Bigpie]

My issue was entirely down to the CAN termination issue, and haven't had the issue since sorting out the resistances and I've done longer trips and daily driving. Not upgraded to this yet unfortunately, need to change my VCU code to put the checksums on.

[johu]

I want to reiterate on my issue as well (remember Touran accelerated far away from field weakening in stop&go traffic as soon as the brake pedal was released).
I now drive my wife to work. On the highway stretch I engaged cruise control. Suddenly cruise control disengaged accompanied by the green cruise indicator light turning off. So the VCU itself cancelled cruise control. Turned it on again only to find it off seconds later. Hmm.

Long time readers know my infamous sympathy for the single CAN bus architecture. I.e. car, inverter, BMS, charger all on one bus. This lead to an ID clash between the cruise control message and one Mitsubishi charger message 0x38A. Containing - temperatures!

So despite all my efforts of telling the two apart, I reckon a certain combination of temperatures values still slips through.

Code, FYI:

Code: Select all

static void DecodeCruiseControl(uint32_t data)
{
   int ctr1 = (data >> 4) & 0xF;
   int ctr2 = (data >> 20) & 0xF;
   int stt1 = (data >> 8) & 0xF;
   int stt2 = (data >> 0) & 0xF;

   if (ctr1 == ctr2)
   {
      int decodedStt = 0;
      if (stt2 == 13) decodedStt = CRUISE_ON;
      if (stt2 == 15) decodedStt = CRUISE_ON | CRUISE_DISABLE;
      if (stt2 == 9) decodedStt = CRUISE_ON | CRUISE_SETN;
      if (stt2 == 5) decodedStt = CRUISE_ON | CRUISE_SETP;

      if (decodedStt == stt1)
      {
         Param::SetInt(Param::cruisestt, stt1);
      }
   }
}

It uses redundancies in the message. What it doesn't use but should is the different message lengths. The CC message is 4 bytes, the charger one 8 bytes.

Anyway, that exact mechanism could have lead to cruise control first programming its setpoint to say 30 kph and then trying to resume to that speed whenever my wife let go the brake pedal.

[johu]

It only occurred to me two days ago that this viewtopic.php?p=59346#p59346 was the last post of Pete9008 who was very active here. Very sad to have lost him for this project

[uhi22]

No, why, what happened? Can't believe we lost Pete.

[johu]

Some say the project is not run in a responsible fashion and that put him off
I think, after re-reading this thread, his frustration threshold was ... hmmm... a bit low

Only Pete knows.

[MattsAwesomeStuff]

No, why, what happened? Can't believe we lost Pete.

It's right there where Johannes linked.

To be clear, since when people say "lost" sometimes to mean different things, he's still alive (I presume). He even was regularly here for a few more months. He just hasn't participated.

Pete had pretty strong opinions about how (potentially, and very rarely) unsafe the OI software was, and how changes to it were or were not being done once that was discovered. So he got a bit of a bee in his bonnet about it, and checked out.

From the sidelines, I didn't feel like Johannes was taking it lightly or even that they butted heads or disagreed that strongly at all. Johannes was making changes and still in the brainstorming stage of how to tackle the problem, while meanwhile also making some immediate changes to halt the behavior where he could. Not sure why Pete chose that specific moment to end his side of the discussion, I just didn't see it even becoming an argument, let alone being in the middle of one.

Maybe Pete just had very strong opinions, or maybe there was some miscommunication of intentions.

I too miss Pete and his contributions to the community.

[johu]

Yes, I didn't even realize he quit for good, just thought he was taking a break as somewhere else he complained about "low energy level"

Only when I realized he had deleted all OI forked repositories I found something had gone sideways

[MattsAwesomeStuff]

Well I reached out to him. I've left some communities over the years off of, even at the time what I knew to be small issues, but during times of my life when I just didn't have extra room for even small amounts of BS. Usually when people leave, I find it best to give them breathing room. But on the flip side, while it's not my goal to convince him of anything, I want to reach out and make sure he doesn't feel snubbed or that I'm apathetic that he left. Sometimes when you leave, it feels like no one cares that you were gone, and, when you do feel like coming back you don't because it might appear no one wanted you around. And in my personal situations, at least once that was actually true , but, usually not.