Hacking the CAN-Interior Bus - JeepForum.com
Search  
Sign Up   Today's Posts
User: Pass: Remember?
Advertise Here
Jeep Home Jeep Forum Jeep Classifieds Jeep Registry JeepSpace Jeep Reviews Jeep Gallery Jeep Clubs Jeep Groups Jeep Videos Jeep Events Jeep Articles
Go Back JeepForum.com > Models > Jeep Wrangler Forums > JK Wrangler Technical Forum > Hacking the CAN-Interior Bus

Rampage Bowless Soft Top Oconee offroadAlloy USA Still AvailableAdvance Adapters SYE Kits

Reply
Unread 12-29-2013, 10:38 AM   #1
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
Hacking the CAN-Interior Bus

I've been working on integrating directly with the CAN-Interior bus of my JKU for a few projects. This weekend I finally got enough of the pieces together that I was able to get a lot of data off the bus and figure out what actions generate what messages.

It's possible to generate your own messages on the bus to simulate the same actions, or listen for existing messages and perform your own action based on that, e.g. turning on auxiliary lights when the main lights go on. And of course, you can leverage the messages the Radio uses to send data to the EVIC to send your own messages:


I tapped into the CAN-Interior bus at the radio using a custom wiring harness so I could splice the CAN-H and CAN-L wires without having to alter any OEM wiring:


My extra CAN bus wires run to a Raspberry Pi credit-card-sized computer that I have sitting in the glovebox, for now:


The Raspberry Pi runs a Linux variant and is a pretty easy system to use for embedded projects like this.

See my blog at http://chadgibbons.com/2013/12/29/ha...erior-can-bus/ for more details on what I found and how I did it.

For the actual end-results, here are some of the messages I've found on the CAN-Interior bus so far. This list should grow pretty rapidly now that I've got a platform hooked up to the vehicle for further research.
Code:
3e6 00 0d 12 ... # hours, minutes, seconds since vehicle turned on
244 81 00 39 C3 80 # Driver's door open, byte 0
244 80 00 39 C3 80 # Driver's door closed, byte 0
208 01 22 6d 5a 1e 01 2c # Left blinker on, byte 0
208 00 22 6d 6a 1e 01 2c # Left blinker off, byte 0
208 02 22 6d 5a 1e 01 2c # Right blinker on, byte 0
208 00 22 6d 6a 1e 01 2c # Right blinker off, byte 0
1e1 00 00 10 65 00 00 00 00 # Steering wheel position, bytes 3 & 4
2e0 00 01 47 21 ff ff 0c # Brake pedal depressed, byte 4
2e0 00 01 47 20 ff ff 0c # Brake pedal released, byte 4
2e7 84 1c 00 00 00 00 87 # Parking brake on, byte 0
2e7 04 1c 00 00 00 00 87 # Parking brake off, byte 0
292 00 49 33 00 00 48 28 # Throttle pressed, byte 3
2a8 00 01 00 00 00 00 # Windshield wipers, byte 3
2e5 03 # Rear wiper
2d2 01 06 00 # 4WD-HI
2d2 04 04 00 # 4WD-LO
2d2 00 03 00 # 2WD
208 00 22 6d 5a 1e 01 2c # Lights on w/ fogs
208 58 22 6d 51 1e 01 2c
2e1 1a
208 00 22 6d 5a 1e 01 2c # Lights off w/ fogs
2e1 1b
2e1 1b # Fogs on
2e1 0b # Fogs off
2e1 0a # Lights on w/o fogs
2e1 0b # Lights off w/o fogs
29e 00 03 97 20 02 ff ff ff # Change to FM 91.9
291 09 01 05 30 f0 00 07 # Change to satellite, w/ no signal
293 00 00 b8 20 02 ff ff ff
291 01 01 05 10 10 00 07 # Change to FM, 91.5
291 00 03 93 20 02 ff ff ff
291 09 01 05 30 80 00 07 # Change satellite stations
293 00 00 19 23 02 ff ff ff
295 43 65 73 52 65 77 6e 64 # ClsRewnd
29e 00 00 0f 21 02 00 00 00 # Change CD tracks, byte 3
3d9 0a 0a 0a 0a 0a ff # Change volume, byte 0
3d9 08 0a 0a 0a 0a ff # Change volume, byte 0
Message id $295 is the most fun, as that's what you can use to display information on the EVIC.

If you have a request for more information about a certain set of accessories let me know and I'll see if I can find data for them.

You should be able to apply the same trick to the CAN-C power train bus, although the Diagnostic CAN-C bus is less useful for monitoring since it does not broadcast data on it is own without being asked first.

And for those projects coming down the pipeline, if anyone is interested in beta-testing let me know. Extra points if you are somewhere near Colorado

dcgibbons is offline   Reply With Quote Quick reply to this message
Unread 12-29-2013, 11:14 AM   #2
PaXJ
Registered User
2007 JK Wrangler 
 
Join Date: May 2001
Location: Lancaster Pa, Pennsylvania
Posts: 97
All I can say is WOW!!!!!
PaXJ is offline   Reply With Quote Quick reply to this message
Unread 12-29-2013, 12:58 PM   #3
Spank
Registered User
2012 JK Wrangler 
 
Join Date: Jul 2007
Location: Colorado
Posts: 1,037
Excellent work. Are you merely sending data to the display or do you have a means to make changes to the software? I've always felt the EVIC was a poorly utilized opportunity (they add this display that doesn't actually show you much other than "menus"), although they're finally doing something with it in the newer models. It'd be cool to have the EVIC show song titles, track numbers, time remaining, etc... when playing from the radio, among a litany of other things such as statistics and diagnostics ordinarily provided by the ODBII port.
__________________
'12 Wrangler Unlimited Rubicon
Spank is offline   Reply With Quote Quick reply to this message
Unread 12-29-2013, 01:34 PM   #4
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
Right now I am just sending data to the display and not changing any of the car's software at all. For my projects I'd like to avoid modifying anything in the car at all, as the risk of screwing things up goes up from there.

That said, you get a lot of good just from leveraging what's there. In my prototype so far, I'm able to flash things on the display such as "AUX ON" or whatever based both upon data on the bus and also my own external sensors.

What I haven't looked into yet, but would like to, is if I can talk to the TIPM and get power-train data via the CAN-Interior bus like you can from the diagnostic bus. I suspect not, but that would be wonderful if so. While plugging into the diagnostic bus is good for just that, it's not a great solution for a product that needs to live in the vehicle for a long-time.

Part of this research is to see if I can find the extended PIDs on the bus for the oil temperature and pressure sensor that is in the Pentastar engine, since it was those sensors. I've already found that they don't report on the older Chrysler extended PID of $04f4 for example, but they are reporting data onto the bus so it should be possible to get that data.
dcgibbons is offline   Reply With Quote Quick reply to this message
Unread 12-29-2013, 02:41 PM   #5
Spank
Registered User
2012 JK Wrangler 
 
Join Date: Jul 2007
Location: Colorado
Posts: 1,037
Quote:
Originally Posted by dcgibbons View Post
What I haven't looked into yet, but would like to, is if I can talk to the TIPM and get power-train data via the CAN-Interior bus like you can from the diagnostic bus. I suspect not, but that would be wonderful if so. While plugging into the diagnostic bus is good for just that, it's not a great solution for a product that needs to live in the vehicle for a long-time.

Part of this research is to see if I can find the extended PIDs on the bus for the oil temperature and pressure sensor that is in the Pentastar engine, since it was those sensors. I've already found that they don't report on the older Chrysler extended PID of $04f4 for example, but they are reporting data onto the bus so it should be possible to get that data.
Dude. Awesome.

If you're able to pull this off and make some kind of unit that basically adds this functionality to the EVIC, I think you've got yourself a product idea that a lot of people would be interested in, myself included.
__________________
'12 Wrangler Unlimited Rubicon
Spank is offline   Reply With Quote Quick reply to this message
Unread 12-29-2013, 04:27 PM   #6
MikeHoncho88
Registered User
2015 JK Wrangler 
 
Join Date: Mar 2010
Location: San Diego, CA
Posts: 359
I see a lot of possibilities for products here. Staying tuned for more...
MikeHoncho88 is offline   Reply With Quote Quick reply to this message
Unread 12-29-2013, 06:36 PM   #7
TheBoss
Registered User
2012 JK Wrangler 
 
Join Date: May 2010
Location: , Madiganistan, Illi-noise
Posts: 1,857
Outstanding! Keep picking away at it ,can't wait to read more about it.
__________________
[CENTER][COLOR="black"][/COLOR][COLOR="Cyan"]My JK Build thread [url]http://www.jeepforum.com/forum/f22/wanderlust-thebosss-jku-build-1483041/[/url][/COLOR][/CENTER]
[SIZE="1"]JK : AEV, Synergy, JKS, Teraflex, Bilstein, GoodYear, M.B, LoD, Ramsey, Hella, Uniden, Smitty-re-bilt rails, Safari Straps
:sold:WJ : BDS, Teraflex, JK Rubicon shocks, GoodYear, JK wheels :sold: [/SIZE]


[COLOR="Black"][CENTER][SIZE="4"][FONT="Showcard Gothic"][COLOR="Black"][URL="http://groups.jeepforum.com/built-not-bought/"][COLOR="Black"]Built Not Bought #690[/COLOR][/URL][/FONT][/SIZE][/COLOR][/CENTER][/COLOR]
[COLOR="Red"]"I predict future happiness for Americans if they can prevent the government from wasting the labors of the people under the pretense of taking care of them." Thomas Jefferson[/COLOR][SIZE="2"][/SIZE]
TheBoss is offline   Reply With Quote Quick reply to this message
Unread 12-29-2013, 10:27 PM   #8
Gumby1
Registered User
2014 JK Wrangler 
 
Join Date: Mar 2004
Location: Alberta, Canada
Posts: 131
I love the first pic "hacked" hahaha
Gumby1 is offline   Reply With Quote Quick reply to this message
Unread 12-30-2013, 03:15 AM   #9
spinlock
Registered User
 
Join Date: Apr 2010
Location: SoCal
Posts: 137
This is good stuff!

Are you able to just query the system and display messages or can you set parameters? Also, the documentation you reference on your web page does not decipher the hex codes displayed. Do you have access to that information?

If so, you need a way to set everything back to its original configuration similar to the programmers.
spinlock is offline   Reply With Quote Quick reply to this message
Unread 12-30-2013, 01:35 PM   #10
sanctified
Registered User
2013 JK Wrangler 
 
Join Date: Mar 2013
Location: WVC, UT
Posts: 450
I need to read up more about EVIC and CAN but this is awesome.

I'd love to know what projects you are hoping to implement with this hack. I'm in SLC and would consider being a BETA depending on what the projects are.
__________________
2013 JK (see info on left)
SOLD: 1983 CJ7
Utah Jeep Crew #178
sanctified is offline   Reply With Quote Quick reply to this message
Unread 01-01-2014, 04:37 PM   #11
jp07blkE85
Junior Member
 
jp07blkE85's Avatar
2013 JK Wrangler 
 
Join Date: Mar 2011
Location: Raleigh, NC
Posts: 34
awesome work!
__________________
'13 true blue JKU sport softtop Fuel-Trophy D552 wheels, Goodyear-Duratrac 315/70/17 tires, TeraFlex-2.5coillift/trackbar/uca/tirecarrier/tailgatehinge/.5rearguidespacer w/ Fox shocks, Evo gussets, K&N filter, AEV procal(tires+DRL),Mopar taillight guard/fuel cover, Smittybilt classic slider with steps. Spod, RigidIndustries-dualyspot/verticalmount, antennaX-CBstyle.

RIP: 07 WK black 4.7 V8 Limited + RK 3.5, Bilstein B6 HD, Duratrac 245/70/17E, XD Misfit, black grille + insert, mopar skid plates + tow hooks, 500 Black Magics, 4xguard front guard + rock rails, AVS wind deflectors, Hella 9005/9006 +black headlights, 05 WK black Hemi limited, 03 WJ HO black , 00 WJ laredo X black, 97 TJ black.
jp07blkE85 is offline   Reply With Quote Quick reply to this message
Unread 01-02-2014, 08:10 AM   #12
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
I spent a bit more time analyzing the messages I've captured and here's some more details on the message format. Still lots to figure out.

Message Id $3d9 - Audio Settings
Each byte details an individual audio setting, volume, balance, etc. Value $0a is the default level for most settings, except for volume where it is level 10. This is from the RES radio so it may vary with the different ones.
byte 00 = volume
byte 01 = balance
byte 02 = fader
byte 04 = bass
byte 05 = mid-range
byte 06 = treble

Message Id $2eb - Sensor Readings
byte 00 = unknown
byte 01 = unknown
byte 02 = unknown
byte 03 = light sensor, values range from $6a to $ef so far

Message Id $2e3 - Heated Seats
Byte 1 is bitmapped to what each heated set setting is at.
byte 00 = unknown (so far always $00)
byte 01 = bit flags
bit 0 = driver's seat low
bit 1 = driver's seat high
bit 3 = passenger seat low
bit 4 = passenger seat high
byte 02 = unknown (so far always $00)

Message Id $208 - Lights
byte 00 = lights active
bit 00 = left blinker
bit 01 = right blinker
bit 03 = parking lights
bit 04 = low-beams
bit 05 = high-beams
bit 06 = front-fog-lights
bit 07 = rear-fog-lights (an assumption)
bytes 01-06 = unknown

Stay tuned...
dcgibbons is offline   Reply With Quote Quick reply to this message
Unread 01-02-2014, 09:29 AM   #13
xflstl
Member
2010 JK Wrangler 
 
Join Date: Jan 2010
Location: Austin, MN
Posts: 277
Awsome stuff, my mind is numb just thinking about trying to figure this out...
xflstl is offline   Reply With Quote Quick reply to this message
Unread 01-02-2014, 09:53 AM   #14
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
You know what's annoying - I'm far from the first person to be looking at this data, but there seems to be a mindset of not sharing this information so everyone has to re-discover.

A lot of aftermarket-producs, from tuners to radio interfaces, have done effectively the same thing.
dcgibbons is offline   Reply With Quote Quick reply to this message
Unread 01-02-2014, 10:04 AM   #15
14Sport
Registered User
2014 JK Wrangler 
 
Join Date: Oct 2013
Location: The Dirty South
Posts: 333
Wow! That is awesome. Can you change my door message to "Do you live in a barn?"?
14Sport is offline   Reply With Quote Quick reply to this message
Reply

Tags
accessories , electrical , hack

Quick Reply
Message:
Options

Register Now

In order to be able to post messages on the JeepForum.com forums, you must first register.
Please enter your desired user name, your email address and other required details in the form below.
User Name:
Password
Please enter a password for your user account. Note that passwords are case-sensitive.
Password:
Confirm Password:
Email Address
Please enter a valid e-mail address for yourself.
Note: All free e-mails have been banned due to mis-use. (Yahoo, Gmail, Hotmail, etc.)
Don't have a non-free e-mail address? Click here for a solution: Manual Account Creation
Email Address:

Log-in

Human Verification

In order to verify that you are a human and not a spam bot, please enter the answer into the following box below based on the instructions contained in the graphic.


Thread Tools






Jeep, Wrangler, Cherokee, Grand Cherokee, and other models are copyrighted and trademarked to Jeep/Chrysler Corporation. JeepForum.com is not in any way associated with Jeep or the Chrysler Corp.