Hacking the CAN-Interior Bus - Page 2 - JeepForum.com
Search  
Sign Up   Today's Posts
User: Pass: Remember?
Advertise Here
Jeep Home Jeep Forum Jeep Classifieds Jeep Registry JeepSpace Jeep Reviews Jeep Gallery Jeep Clubs Jeep Groups Jeep Videos Jeep Events Jeep Articles
Go Back JeepForum.com > Models > Jeep Wrangler Forums > JK Wrangler Technical Forum > Hacking the CAN-Interior Bus

Smittybilt Hard Tops @ Oconee Off-Road! 706-534-9955XHD Heavy-Duty Hood Latches for JK and TJ available at OcoFS: Jeep Fog Light LED Bulbs! Several Brightness Options!

Reply
Unread 01-02-2014, 03:26 PM   #16
spinlock
Registered User
 
Join Date: Apr 2010
Location: SoCal
Posts: 137
Quote:
Originally Posted by dcgibbons View Post
You know what's annoying - I'm far from the first person to be looking at this data, but there seems to be a mindset of not sharing this information so everyone has to re-discover.

A lot of aftermarket-producs, from tuners to radio interfaces, have done effectively the same thing.
That is because they can gain monetarily from that information and they don't want to enable their competitors. Jeep probably makes at least some of that information available under NDA so that aftermarket manufacturer can build and integrate their products. However, making it available to the general public could lead to a flood of service calls from misuse. The real value of that data is not reading it, it's changing it. From a desktop operating system perspective look at like Windows not Linux.

spinlock is offline   Reply With Quote
Unread 01-02-2014, 04:56 PM   #17
jorhay
Registered User
1997 ZJ 
 
Join Date: May 2009
Location: DeKalb, IL, IL
Posts: 89
Awesome. Keep at it man, and good luck!
jorhay is offline   Reply With Quote
Unread 01-04-2014, 05:59 PM   #18
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
I finally found the "power-on" message, so you can bench test a OEM radio:

Code:
20b#6100
to turn it on, and
Code:
20b#0000
to turn it off. The car broadcasts the on message about every 100ms to keep the listening nodes alive, so on a bench you'll need to send it frequently.
dcgibbons is offline   Reply With Quote
Unread 01-04-2014, 06:33 PM   #19
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
And here's a good example of the limitations of interfacing with the bus, which is mostly limited to listening to system changes.

Message id 308 is sent out when the interior dimmer is changed. I've seen the following data so far:
308#0000ff # lights off
308#110000 # daytime - lights on bright
308#122200 # lowest dimmer setting
308#124c00 # next highest
308#12a000 # next highest
308#12c800 # all the way up

It is tempting to want to send your own messages to the bus to have these settings take place, but it doesn't quite work that way.

These messages are generated by the Cab Compartment Node (CCN) whenever it detects changes from the user by using the control stalk. Those messages are listened to by the radio and the TIPM nodes who take action as appropriate - such as dimming the radio lights.

The problem is, the CCN isn't listening for those messages even though it controls a large portion of the lights that are being dimmed. Additionally, it keeps broadcasting the current dimming state every 500ms, so it will override any commands you may send out yourself.
dcgibbons is offline   Reply With Quote
Unread 01-06-2014, 01:41 PM   #20
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
Huh, this is interesting. Something blasts out detailed information on song, artist, and album when playing from the USB interface (iPhone) and the radio displays it.

Code:
 (1389040747.468564)  vcan0  3AC   [8]  0B 01 20 20 20 20 20 20   '..      '
 (1389040747.497350)  vcan0  3AC   [8]  1B 03 20 4E 6F 20 49 6E   '.. No In'
 (1389040747.528932)  vcan0  3AC   [8]  03 03 66 6F 20 20 20 20   '..fo    '
 (1389040747.564518)  vcan0  3AC   [8]  3B 04 20 47 69 76 69 6E   ';. Givin'
 (1389040747.597491)  vcan0  3AC   [8]  23 04 27 20 59 6F 75 72   '#.' Your'
 (1389040747.633804)  vcan0  3AC   [8]  13 04 73 65 6C 66 20 41   '..self A'
 (1389040747.667984)  vcan0  3AC   [8]  03 04 77 61 79 20 20 20   '..way   '
 (1389040747.700881)  vcan0  3AC   [8]  0B 05 20 52 61 74 74 20   '.. Ratt '
 (1389040747.736770)  vcan0  3AC   [8]  1B 06 20 44 65 74 6F 6E   '.. Deton'
 (1389040747.760179)  vcan0  3AC   [8]  03 06 61 74 6F 72 20 20   '..ator  '
 (1389040747.794957)  vcan0  3AC   [8]  1B 07 20 4E 6F 20 49 6E   '.. No In'
 (1389040747.826042)  vcan0  3AC   [8]  03 07 66 6F 20 20 20 20   '..fo    '
 (1389040747.855264)  vcan0  3AC   [8]  3B 08 20 47 69 76 69 6E   ';. Givin'
 (1389040747.887166)  vcan0  3AC   [8]  23 08 27 20 59 6F 75 72   '#.' Your'
 (1389040747.923526)  vcan0  3AC   [8]  13 08 73 65 6C 66 20 41   '..self A'
 (1389040747.949203)  vcan0  3AC   [8]  03 08 77 61 79 20 20 20   '..way   '
 (1389040747.986814)  vcan0  3AC   [8]  0B 01 20 20 20 20 20 20   '..      '
dcgibbons is offline   Reply With Quote
Unread 01-06-2014, 08:08 PM   #21
JoonHoss
Registered User
2011 JK Wrangler 
 
Join Date: Mar 2005
Location: Washington State
Posts: 6,420
I wish I had even the slightest idea what all this means, 'cuz i'm fairly certain it's really kewl.



Hoss
__________________
Quote:
It's hard to say no to yoo-hoo, the name literally beckons...

Don't mind me, I'm just another FNG around here...
JoonHoss is offline   Reply With Quote
Unread 01-07-2014, 07:31 AM   #22
TheBoss
Registered User
2012 JK Wrangler 
 
Join Date: May 2010
Location: , Madiganistan, Illi-noise
Posts: 1,855
Quote:
Originally Posted by JoonHoss View Post
I wish I had even the slightest idea what all this means, 'cuz i'm fairly certain it's really kewl.



Hoss
It's quite elementary really, if you use a simple scan of the codes given throughout it repeatedly says I LIKE 80's ROCK BANDS ie Ratt Detonator album.
:-D
__________________
[CENTER][COLOR="black"][/COLOR][COLOR="Cyan"]My JK Build thread [url]http://www.jeepforum.com/forum/f22/wanderlust-thebosss-jku-build-1483041/[/url][/COLOR][/CENTER]
[SIZE="1"]JK : AEV, Synergy, JKS, Teraflex, Bilstein, GoodYear, M.B, LoD, Ramsey, Hella, Uniden, Smitty-re-bilt rails, Safari Straps
:sold:WJ : BDS, Teraflex, JK Rubicon shocks, GoodYear, JK wheels :sold: [/SIZE]


[COLOR="Black"][CENTER][SIZE="4"][FONT="Showcard Gothic"][COLOR="Black"][URL="http://groups.jeepforum.com/built-not-bought/"][COLOR="Black"]Built Not Bought #690[/COLOR][/URL][/FONT][/SIZE][/COLOR][/CENTER][/COLOR]
[COLOR="Red"]"I predict future happiness for Americans if they can prevent the government from wasting the labors of the people under the pretense of taking care of them." Thomas Jefferson[/COLOR][SIZE="2"][/SIZE]
TheBoss is online now   Reply With Quote
Unread 01-07-2014, 09:36 AM   #23
JoonHoss
Registered User
2011 JK Wrangler 
 
Join Date: Mar 2005
Location: Washington State
Posts: 6,420
See Boss- you lost me again with your new-fangled jargon

(my Ratt library only goes to Reach for The Sky...)



Hoss
__________________
Quote:
It's hard to say no to yoo-hoo, the name literally beckons...

Don't mind me, I'm just another FNG around here...
JoonHoss is offline   Reply With Quote
Unread 01-07-2014, 09:42 AM   #24
TheBoss
Registered User
2012 JK Wrangler 
 
Join Date: May 2010
Location: , Madiganistan, Illi-noise
Posts: 1,855
Quote:
Originally Posted by JoonHoss View Post
See Boss- you lost me again with your new-fangled jargon

(my Ratt library only goes to Reach for The Sky...)



Hoss
Gotcha, I could keep going and totally derail the progress here. So let's keep this "out of the cellar"
__________________
[CENTER][COLOR="black"][/COLOR][COLOR="Cyan"]My JK Build thread [url]http://www.jeepforum.com/forum/f22/wanderlust-thebosss-jku-build-1483041/[/url][/COLOR][/CENTER]
[SIZE="1"]JK : AEV, Synergy, JKS, Teraflex, Bilstein, GoodYear, M.B, LoD, Ramsey, Hella, Uniden, Smitty-re-bilt rails, Safari Straps
:sold:WJ : BDS, Teraflex, JK Rubicon shocks, GoodYear, JK wheels :sold: [/SIZE]


[COLOR="Black"][CENTER][SIZE="4"][FONT="Showcard Gothic"][COLOR="Black"][URL="http://groups.jeepforum.com/built-not-bought/"][COLOR="Black"]Built Not Bought #690[/COLOR][/URL][/FONT][/SIZE][/COLOR][/CENTER][/COLOR]
[COLOR="Red"]"I predict future happiness for Americans if they can prevent the government from wasting the labors of the people under the pretense of taking care of them." Thomas Jefferson[/COLOR][SIZE="2"][/SIZE]
TheBoss is online now   Reply With Quote
Unread 01-07-2014, 10:35 AM   #25
CoriolisSTORM
BURN IT DOWN POOKIE!!!
 
CoriolisSTORM's Avatar
2010 JK Wrangler 
 
Join Date: May 2004
Location: ???, Alabama
Posts: 1,182
That is really cool, as an industrial electrical tech I am familiar with the usage of CAN Bus and other comm types, but I DO NOT understand it... I am curious what you are going to do with it. I've wondered about it in this vehicle, but never toyed with it, mainly due to fear of breaking it. (Put another way, I know just enough to be dangerous.) I am toying with the idea of using a Raspberry Pi and/or an Arduino to put sensor data onto a screen in my TJ since the gauge cluster is such a POS.

edit: Did you by chance post this on the Raspberry Pi site? This seems like a pretty sweet project that could use some publicity.
__________________
Quote:
Its like a (silly censor)roach, the Wrangler - you can't kill it And now there's a four door. Joy.
CoriolisSTORM is offline   Reply With Quote
Unread 01-07-2014, 01:14 PM   #26
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
Quote:
Originally Posted by CoriolisSTORM View Post
That is really cool, as an industrial electrical tech I am familiar with the usage of CAN Bus and other comm types, but I DO NOT understand it... I am curious what you are going to do with it. I've wondered about it in this vehicle, but never toyed with it, mainly due to fear of breaking it. (Put another way, I know just enough to be dangerous.) I am toying with the idea of using a Raspberry Pi and/or an Arduino to put sensor data onto a screen in my TJ since the gauge cluster is such a POS.

edit: Did you by chance post this on the Raspberry Pi site? This seems like a pretty sweet project that could use some publicity.
I did yep. Lots of folks doing similar things there for different vehicles.

UPDATE: this guy's post has one of the most reasonable explanations of CAN bus data in a vehicle, from the electrical aspects to the software aspects of it: http://fabiobaltieri.com/2013/07/23/...and-socketcan/

But it's deceptively simple, really. It's a network that allows nodes (computers!) to broadcast messages on the bus using specific message identifiers. That's different from a network like TCP/IP (Internet!) where the messages contains source and destinations ids - in the CAN world the message has an identifier that means something, such as "this is my current sirius station." It is up to all the nodes in the system to decide what messages they broadcast and which ones they receive.

It was designed-for and works-well in vehicle applications because the electrical characteristics are very robust, and it allows for very loose coupling between the various computers in the cars.

The audio/video stuff is a great example... the UConnect module broadcast messages about what's playing via the USB control, and it doesn't matter what radio is installed in the vehicle. All the radio (or some other display system) has to do is listen for those messages and do what it wants to do. Electrically, it's all over the same twisted-pair of wires no matter who is involved.

What varies a lot between vehicles is what is a CAN node, what is a LIN (local interconnect network) node, and how many different buses there are.

As another example, in the JK, we've got the cab compartment node (CCN) - effectively the big dash system. That talks to a bunch of different switches over LIN, such as the window switches, the heated switch switches, the control stalks, etc. It may do something with the commands from those switches entirely internally, or decide to broadcast a message out on the CAN bus for someone else to do something. Lights are a great example here:
  1. Turn on your lights via the control stalk, which sends a LIN message to the CCN
  2. The CCN changes its own displays appropriately.
  3. The CCN broadcasts that command over the CAN-IHS bus
  4. The TIPM receives that message and turns on the appropriate light circuits
  5. The Radio receives that same message and changes its display appropriately

Last edited by dcgibbons; 01-07-2014 at 01:46 PM..
dcgibbons is offline   Reply With Quote
Unread 01-07-2014, 01:50 PM   #27
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
So all of the hacking I am doing is centered around listening to existing messages from existing nodes in the car and doing something extra with that data (like turning on auxiliary lights), and also sending out my own versions of existing messages to change the display of the EVIC or Radio or whatever else I may find.

All of that is not changing any of the software in the car, it's just listening to and sending out existing messages and changing the behavior slightly.

While there's a lot that can be accomplished there, the super fun stuff is likely limited to changing the actual programming in an existing node, like the TIPM or CCN, rather than what I am doing.
dcgibbons is offline   Reply With Quote
Unread 01-07-2014, 07:56 PM   #28
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
In case this is useful, too (and a reminder that I really need to write up a post on how to build this thing step-by-step):

I didn't have a cad diagram for the receptacle end of the wiring harness, but you get the idea. It's a straight wiring for the 6 circuits my C2 harness had, plus splicing the 2 CAN connections off so bring to my CAN interface board. I think your harness will vary if you don't have an amplifier etc. There's a few options for that connector looking at the repair information.



For reference: Mopar Connection Repair Kit and 1438759-1 Product Details - TE

I actually bought some aftermarket radio repair harnesses off eBay to get that connector/receptacle cheap, though. TE doesn't make a receptacle mate for that connector that isn't part of a PCB mount solution.
dcgibbons is offline   Reply With Quote
Unread 01-07-2014, 11:24 PM   #29
ufgeek
Registered User
2007 JK Wrangler 
 
Join Date: Feb 2012
Location: Longmont, CO
Posts: 7
Looks great. I'm interested in testing. I have an 07 JKU. I'm in Longmont, PM me. I'm a SW Engineer at QCOM, perhaps I can give you a hand on making this into something really interesting.
ufgeek is offline   Reply With Quote
Unread 01-09-2014, 04:35 PM   #30
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
I finished the 1st proof-of-concept for using the CAN-Bus data to control auxiliary relays. It worked great. Attached is a block diagram of what I used, and a longish video of how the testing went.



If you want to skip all the bench testing, the actual in-car testing happens at the 11:15 mark of the video.

Code for the demo can be found at https://github.com/dcgibbons/jeepbot/tree/poc1

A few hours after I finished, a bluetooth-low-energy board I ordered showed up. The next step will be to throw that on there so that I can use the smartphone to configure each switch and optionally control them by hand.

Each switch will have the following different possible control states:
  • always on
  • manual only
  • on when interior lights are on
  • on when high-beams are on

Right after that, I'll start working on a prototype PCB and housing so I can start testing real versions of this system.

I'll post the design, schematics and code in progress on my blog so anyone can offer feedback as it gets built.
dcgibbons is offline   Reply With Quote




Jeep, Wrangler, Cherokee, Grand Cherokee, and other models are copyrighted and trademarked to Jeep/Chrysler Corporation. JeepForum.com is not in any way associated with Jeep or the Chrysler Corp.