Ford Nugget LINBUS – part 1: A first look

connecting the oscilloscope

After installing solar panels on the roof of the campervan I wanted to see whether the solar voltage regulator was providing electrical potential and current data at the solar panel and battery side. The Votronic MMP solar regulator is connected to the LIN bus of the campervan. So I build a “sniffer” for the LIN bus and did some programming on an ESP32 board. To get it all working the oscilloscope came in handy. For example to figure out the baud rate of the LIN-bus.

LinBus trace of 1000ms showing a repeating pattern of approximately 360ms

The baud rate appears to be 19200 and it appears to be a repeating pattern every 360ms. Zooming in on the data reveals that

  • There is a single “spike” of about 3ms
  • After 47ms it is followed by a train of 10 frames
  • After 82ms it is followed by a second train of  frames
  • Finally after 47ms the single spike is detected again.

Individual frames

The short frames (called spikes before) are requests from the master on the LIN bus that remain unanswered, because the device is offline or just not build into the campervan. They contain typically the byte sequence 00 55 xx where xx = the Protected ID:

Master request that remains unanswered to Protected ID = 0x5B

The frame always start at nice 10ms time slots,. An example of a regular frame comes form the campervan living part batteries intelligent battery sensor:

Hella IBS frame PID = 0x25 (State of Charge SoC)

The Hella IBS sensor LIN bus protocol is well documented in those github repositories:

Frame identity

Finally, the complete overview of the frames with Protected and normal ID’s:

start time
/ ms
0 (=360)C101
500C06no response
609717no response
70D818no response
809919no response
1305B1Bisolated spike, no response
180C101called a second time
1904202called a second time
210E222Hella IBS
2202525Hella IBS
230A626Hella IBS
2407838no response
2704C0Cno response

Several Frame IDs do not have a response. Device ID 01 and 02 are called twice in a cycle and three of the ID’s are known to be from the Hella IBS and for the better part the data is decoded. More posts will appear among others on the LINBUS listener based on an ESP32 and decoding of the frames of some of the connected devices.