Hacking the CAN-Interior Bus - Page 3 - JeepForum.com
Search  
Sign Up   Today's Posts
User: Pass: Remember?
Advertise Here
Jeep Home Jeep Forum Jeep Classifieds Jeep Registry JeepSpace Jeep Reviews Jeep Gallery Jeep Clubs Jeep Groups Jeep Videos Jeep Events Jeep Articles
Go Back JeepForum.com > Models > Jeep Wrangler Forums > JK Wrangler Technical Forum > Hacking the CAN-Interior Bus

End of Summer Sale, 20% OFF!Introducing MONSTALINER™ UV Permanent DIY Roll On Bed LineRough Country Jeep Suspension Deals at Rockridge 4WD!

Reply
Unread 01-09-2014, 10:20 PM   #31
sanctified
Registered User
2013 JK Wrangler 
 
Join Date: Mar 2013
Location: WVC, UT
Posts: 447
I have been following this since your first post here and on other Jeep boards. I've also looked at your blog. I think this is really interesting and wonder if I have figured out what you are going to try to do with this. Are you hoping to integrate aftermarket accessories using Can-Bus rather than running separate power and switches? Is the goal to run accessories controlled with the computer or is this just exploratory? I'm trying to figure out what you're hoping to do with all this data you are amassing.

__________________
2013 JK (see info on left)
SOLD: 1983 CJ7
Utah Jeep Crew #178
sanctified is offline   Reply With Quote
Unread 01-10-2014, 09:03 AM   #32
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
Quote:
Originally Posted by sanctified View Post
I have been following this since your first post here and on other Jeep boards. I've also looked at your blog. I think this is really interesting and wonder if I have figured out what you are going to try to do with this. Are you hoping to integrate aftermarket accessories using Can-Bus rather than running separate power and switches? Is the goal to run accessories controlled with the computer or is this just exploratory? I'm trying to figure out what you're hoping to do with all this data you are amassing.
Lots of possibilities.

This started with a desire to make a smarter switcher for an existing aftermarket switching system that I have in my vehicle, and after experimenting I realized it would be easier to make my own, so that's my first project (the proof of concept from the other post).
dcgibbons is offline   Reply With Quote
Unread 02-03-2014, 03:02 PM   #33
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
I know most people won't like this, but I can't wait to get my hands on these systems for some fun hacking:

http://money.cnn.com/2014/02/03/auto...communication/
dcgibbons is offline   Reply With Quote
Unread 02-03-2014, 08:30 PM   #34
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
Oh, yeah, some new data from today:


20e 00 80 47 20 FF FF 0C ..G ... # Cruise Control ON

20e 00 00 47 20 FF FF 0C ..G ... # Cruise Control OFF


Bit 7 on the 2nd byte is if the cruise control system is on (just on, not activated) or not. The cab-compartment-node controls this, and while you can send that message and have both the PCM and dash go into the right mode, it'll reset as the CCN sends it actual state every 500ms.
dcgibbons is offline   Reply With Quote
Unread 02-24-2014, 05:02 PM   #35
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
So... by any chance does anyone have any experience with optocouplers versus full solid-state-relays versus just MOSFET's? Playing around with a few different design approaches.

Right now I'm thinking a main PCB in the cab that has the micro-controller, an array of optocouplers, and then the outputs of those driving another PCB in the engine bay with regular automotive relays.

But, I am tempted to explore just straight SSR's in the engine bay instead. They're more expensive but frankly that's a pretty small part of the cost of the whole system.

I have some concern about RF in either case, especially given that's not my area of expertise at all.
dcgibbons is offline   Reply With Quote
Unread 03-05-2014, 08:20 PM   #36
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
I ordered an '14 today so when it gets here I'll repeat my data gathering experiments and see what's changed. It has a few different options, too, plus the new EVIC software, so I'm excited to see what we can learn from it.
dcgibbons is offline   Reply With Quote
Unread 05-17-2014, 06:48 PM   #37
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
A quick update. I've had the '14 JKU now for a few weeks, and already have my data gathering equipment hooked up to it. I ran into a snafu with my test setup so I'm having to rebuild it - hopefully that'll happen this weekend.

And in good news, I swapped around my schedule so I should have some more free-time this summer to work on this project full bore. Lots of goodies await!
dcgibbons is offline   Reply With Quote
Unread 05-17-2014, 07:05 PM   #38
CoriolisSTORM
BURN IT DOWN POOKIE!!!
 
CoriolisSTORM's Avatar
2010 JK Wrangler 
 
Join Date: May 2004
Location: ???, Alabama
Posts: 1,182
I wish I could help, but I'm at a loss right now. Youve gone farther than I'd have thought possible already! In industry, particularly mine (no experience elsewhere), we normally see MOSFETs than anything else. But I play mostly with big electrons, not signal stuff... Excepting DC and AC drives...
__________________
Quote:
Its like a (silly censor)roach, the Wrangler - you can't kill it And now there's a four door. Joy.
CoriolisSTORM is offline   Reply With Quote
Unread 05-17-2014, 09:24 PM   #39
psouza1943
Registered User
2005 TJ Wrangler 
 
Join Date: Sep 2006
Location: California
Posts: 119
Quote:
Originally Posted by dcgibbons View Post
So... by any chance does anyone have any experience with optocouplers versus full solid-state-relays versus just MOSFET's? Playing around with a few different design approaches.

I have some concern about RF in either case, especially given that's not my area of expertise at all.
Most all RF induced problems are from diode rectification in bi-polar junctions. How the RF gets into the system is always unclear until a detailed test regimen is established. It seems the auto manufacturers don't see it as necessary currently, but we had better hope they wise up if their wet dream of self driving vehicles ever materializes.

As to using opto-isolators, an approach most favored for signal transfer between circuit blocks with large potential reference differences, or where ground loops are a possible noise source, I am not certain you will gain the RF isolation you hope for. You would have to research the stray capacitive coupling ratings of the various isolators. For this to have value, you will need to have an idea of the part of the RF spectrum you anticipate to be trouble some. A hit or mostly miss approach. Additionally, I thought the data buss transceivers were differential input/output (correct me if wrong please). These should not be bipolar and thereby not as vulnerable to RF detection.

Most frequently the offending junction will be in a relay driver or mid to high level amplifier that is normally biased either near cut off or just short of saturation where the added (or subtracted) bias generated by RF detection will be most damaging. Again NPN and PNP transistors are the offenders. I have never isolated this problem to a FET or MOS device.

Phil
psouza1943 is offline   Reply With Quote
Unread 05-18-2014, 05:55 PM   #40
Spank
Registered User
2012 JK Wrangler 
 
Join Date: Jul 2007
Location: Colorado
Posts: 1,028
Quote:
Originally Posted by dcgibbons View Post
Lots of possibilities.
This would be the perfect tool to improve upon the EVIC that, even with the added menus and changes with the '13 and '14, is still severely underutilized. Instead of having to buy an added gauge for pressure, temperatures, and other data that you'd need to bolt onto the dash or along the A-pillar, everything you need could be easily accessible through the EVIC (whether you pair it with data you can pull from the bus or feed it from a BT OBD-II reader).

I was working on a UI tweak of the EVIC a while back and exploring ways to implement it, but I never got beyond the Photoshop mockups. If you or an admin feels I'm hijacking the thread, I apologize in advance and welcome the removal of my post, but I figured I'd drop these in here just to give you an idea of what could be done with this device and how it'd really squeeze out a lot more functionality and usefulness from that nifty little pixel display.

I really hope you keep working on this. You've seriously got something special here.
evic2-1.jpg

evic2-2.jpg

evic2-4.jpg

evic2-5.jpg

evic2-6.jpg

evic2-7.jpg

evic2-8.jpg

evic2-9.jpg

evic2-3.jpg

__________________
'12 Wrangler Unlimited Rubicon
Spank is offline   Reply With Quote
Unread 05-19-2014, 09:19 AM   #41
Airborne Lee
Registered User
2013 JK Wrangler 
 
Join Date: Sep 2005
Location: Lee's Summit, Missouri
Posts: 1,148
As someone who builds and sells controls (similar to what you using but MUCH more powerful) I am very interested in what you are doing here. I have looked at creating after market products but have not seen enough interest to make a business case for it. Hobbyist to commercial product is a big jump. But I love what you are doing and...

subscribed!

__________________
please buy this NEW IN BOX:JK Rugged Ridge Light Bar
2013 JK Rubicon, Commando Green, CB, GPS, KC lites
KC Jeep Club Info - M416 Trailer Project
3 Previous Jeeps - 01 WJ Ltd, QD & UC - 01 WJ Ltd, QT II - 98 XJ Ltd
Airborne Lee is offline   Reply With Quote
Unread 05-19-2014, 09:43 AM   #42
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
Quote:
Originally Posted by Spank View Post
This would be the perfect tool to improve upon the EVIC that, even with the added menus and changes with the '13 and '14, is still severely underutilized. Instead of having to buy an added gauge for pressure, temperatures, and other data that you'd need to bolt onto the dash or along the A-pillar, everything you need could be easily accessible through the EVIC (whether you pair it with data you can pull from the bus or feed it from a BT OBD-II reader).

I was working on a UI tweak of the EVIC a while back and exploring ways to implement it, but I never got beyond the Photoshop mockups. If you or an admin feels I'm hijacking the thread, I apologize in advance and welcome the removal of my post, but I figured I'd drop these in here just to give you an idea of what could be done with this device and how it'd really squeeze out a lot more functionality and usefulness from that nifty little pixel display.

I really hope you keep working on this. You've seriously got something special here.
There's a lot of fun to be had if we can hack the EVIC software, but I suspect that is going to be a very difficult proposition. MCU's have gotten better about having protection fuses on them these days, making it harder to pull the code directly off the system and reverse engineer it that way (but this still seems to be what happens to most PCM's, so maybe not that big of a deal).

I suspect we'd have better luck grabbing one of the firmware updates directly from Jeep and using that, but I don't know if that crosses the reverse-engineering line a bit much.
dcgibbons is offline   Reply With Quote
Unread 05-19-2014, 09:44 AM   #43
dcgibbons
Registered User
2014 JK Wrangler 
 
Join Date: Jul 2012
Location: Tabernash, Colorado
Posts: 29
Quote:
Originally Posted by Airborne Lee View Post
As someone who builds and sells controls (similar to what you using but MUCH more powerful) I am very interested in what you are doing here. I have looked at creating after market products but have not seen enough interest to make a business case for it. Hobbyist to commercial product is a big jump. But I love what you are doing and...
Oddly enough, I've had more feedback from this little experiment than any of the open-source or other projects I've worked on for the past 25 years. Dramatically more. Business case looks there.
dcgibbons is offline   Reply With Quote
Unread 05-19-2014, 05:17 PM   #44
Spank
Registered User
2012 JK Wrangler 
 
Join Date: Jul 2007
Location: Colorado
Posts: 1,028
Quote:
Originally Posted by dcgibbons View Post
There's a lot of fun to be had if we can hack the EVIC software, but I suspect that is going to be a very difficult proposition. MCU's have gotten better about having protection fuses on them these days, making it harder to pull the code directly off the system and reverse engineer it that way (but this still seems to be what happens to most PCM's, so maybe not that big of a deal).

I suspect we'd have better luck grabbing one of the firmware updates directly from Jeep and using that, but I don't know if that crosses the reverse-engineering line a bit much.
I wonder if part of that is figuring out how the 730N sends data through the BUS to the EVIC during an active route. I installed a 730N that was purchased via eBay into a friend's '12 that originally came with the 130S last year; the computer wouldn't be programmed with any navigation options such as being able to turn EVIC route displays off (and that option actually isn't available in the menu), but the 730N still successfully sends the street name, distance, and arrow icons to it.

For a vehicle that truly thrives on the aftermarket, I'm surprised Jeep holds the reigns tight when it comes to the computer technology.
__________________
'12 Wrangler Unlimited Rubicon
Spank is offline   Reply With Quote
Unread 05-22-2014, 01:13 PM   #45
sparks1k
Registered User
 
Join Date: May 2014
Location: Miami, FL
Posts: 1
Quote:
Originally Posted by dcgibbons View Post
I finally found the "power-on" message, so you can bench test a OEM radio:

Code:
20b#6100
to turn it on, and
Code:
20b#0000
to turn it off. The car broadcasts the on message about every 100ms to keep the listening nodes alive, so on a bench you'll need to send it frequently.
dcgibbons, what you are doing is very interesting. I have a 2014 Jeep UConnect that I am trying to power up on the bench, when I send it the 20B#6100 message (every 100ms) on the CAN IHS bus, it starts drawing about 1 amp of current; but the backlight (display) never turns on. are you sending any other messages or connecting anything else up to it besides +12v & gnd?
sparks1k is offline   Reply With Quote




Jeep, Wrangler, Cherokee, Grand Cherokee, and other models are copyrighted and trademarked to Jeep/Chrysler Corporation. JeepForum.com is not in any way associated with Jeep or the Chrysler Corp.