JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[jmccorm]

Brake pedal pressure is definitely detected by the system. I do not know though if that data is available over CAN or in any way accessible without electronic mods.

Perhaps I was looking at this the wrong way. I thought you were looking for a variable which contained something like a minimum pressure value for Start / Stop to remain in effect. You're right, there are other variables which contain brake pressure values. I'm not yet entirely sure where the brakes are controlled from, but it seems like the BCM. Am I right?

If the brakes are controlled by the BCM and ESS is controlled via the PCM, then yes, you're right. You should be able to put a microcontroller in front of either of those modules and have it relay data (without modification) until ESS is active. When ESS is active (and the engine is stopped), it would replace the brake pressure signal(s) with ones that indicate more pressure than it actually sees on the input.

Right now (as we're just now diving into this), it seems like a difficult task, but very much like one that's possible. Your thoughts?

Sponsored

 

[Temperance]

I have to admit, you've got some interesting things going on over there!

PS: I share your observation that in ordinary day-to-day use, the tire pressures only seem to update while you're driving the vehicle. *HOWEVER* if you use the tire fill feature that's built into the Tazer (upgrade your Tazer firmware if necessary), it is able to do immediate pressure reads while the vehicle is stationary. So that's probably an idea candidate to reverse-engineer the traffic from! If not, then the Selectable Tire Fill Alert app which some Wrangler models do and don't have.

The Gladiator may be an ideal candidate for this... I am pretty sure that I have the selectable tire fill alert app. I imagine that if Jeep exposes this app that it is able to get updates faster than every 5-10 seconds (the interval that my scanner app states).

 

[oldcjguy]

I think brakes have their own module. Pretty sure that's all controlled by the ABS module

 

[jmccorm]

Cold morning here. Good, but not good enough.

The Wrangler's cold weather routine (which does some mild heating on cold mornings) slightly interferes with my own routine. When both activate, I've still got full heat going, full fan, and I'm recirculating air. But the heat is coming out from the floor and the windshield, which seems less useful than when it comes out of the main passenger vents.

Unfortunately, this makes a 20F cabin interior just a little more than 65F before the engine shuts off. It needs to be better. Now that I understand more of UDS, what I need to be doing is directly setting the conditions I want in the HVAC module (instead of simulating a person pressing the buttons I want). It's going to be quicker, and it's less susceptible to pre-existing changes in state.

Time for me to move on to version 2.0 of the remote-start HVAC controller which uses UDS messages instead of CAN messages.

 

[jmccorm]

I think brakes have their own module. Pretty sure that's all controlled by the ABS module

I don't know where the ABS module is, but if there's an easy way to pull the plug on it, I'm willing to see which messages disappear. My current belief is that much of the brake system is reported on by the BCM, but the ABS module interfaces with it (over the CAN bus) to perform it's duties.

I have one major to-do, and that's to isolate all of the CAN wires in the glovebox. The wiring diagram is going to tell me which module I'm unplugging, but it'll be up to me to see which messages disappear.

What I suspect is that there may be another CAN bus star connector somewhere else in the vehicle that I'll need to find in order to do that. But I hope not.

NOTE: I do say "belief". After I come up with a theory, I'm always looking for new data which either supports or refutes it.

 

[sanman357]

Cold morning here. Good, but not good enough.

The Wrangler's cold weather routine (which does some mild heating on cold mornings) slightly interferes with my own routine. When both activate, I've still got full heat going, full fan, and I'm recirculating air. But the heat is coming out from the floor and the windshield, which seems less useful than when it comes out of the main passenger vents.

Unfortunately, this makes a 20F cabin interior just a little more than 65F before the engine shuts off. It needs to be better. Now that I understand more of UDS, what I need to be doing is directly setting the conditions I want in the HVAC module (instead of simulating a person pressing the buttons I want). It's going to be quicker, and it's less susceptible to pre-existing changes in state.

Time for me to move on to version 2.0 of the remote-start HVAC controller which uses UDS messages instead of CAN messages.

I would let it heat to the windshield instead of the dash. As the Jeep slowly warms the glass it won’t break due to sudden change of temperature. Had a rock chip in my blazer for a few years. Had my dash vents blowing during Remote start. Windshield started to fog up put on the defroster and heard a pop. Cost me a windshield.

 

[jmccorm]

I would let it heat to the windshield instead of the dash. As the Jeep slowly warms the glass it won’t break due to sudden change of temperature. Had a rock chip in my blazer for a few years. Had my dash vents blowing during Remote start. Windshield started to fog up put on the defroster and heard a pop. Cost me a windshield.

A few minutes ago, I replied to your message... a reply that is now deleted. It took an extra minute or two for the significance of your story to sink in. Here's a better reply:

I unhooked my HVAC code, hopped into the Wrangler, and remote started it from the front seat. (Beforehand, I had my HVAC controls set to main vents, medium speed, 76F.) Instantly, it went to the windshield, full fan, full heat. Six minutes later (nothing had changed), I pressed the ignition button (telling the vehicle I'm actually here), and the HVAC returned to my previous settings.

You know what? I think you've given me a much better perspective on what's happening and why. If the HVAC never comes on when you remote start the Wrangler, except in one particular known case (below 40F), then it must be doing this for a very specific reason, and it isn't creature comforts. You've driven home a very solid reason, so I need to respect that. When the windshield is cold enough, you have to prep it with heat if you want to reduce the chance of cracks forming.

As my code stands now, the way it acts (in combination with the Wrangler's low-temperature windshield heating) is the same as factory behavior, except it splits part of the air to the floor, and it turns on air recirculation. That should be good enough (and way better than my original plan of going to passenger vents). In other circumstances when it's cold (but not cold enough to trigger the Wrangler's windshield heater), then my code will blow full-blast on the cabin. (And the same during hot weather, except, with A/C.)

What I'm seeing the Wrangler doing is coming together with what I learned from your story, and now this all makes sense. Thank you! Windshield prep will continue. (And this serves as a personal reminder not to write things off as "crazy behavior" just because I don't understand it.)

 

[jmccorm]

I placed an order with Mouser. The items should be here tomorrow. Naturally, I'll let you know how it turns out.

Line Number​	Mouser Part Number Customer Part Number Manufacturer Part Number Description​	Quantity Ordered​	Quantity Shipped​
1​	571-5-2138650-1 5-2138650-1 TE Connectivity Automotive Connectors US HTS:8536694040 ECCN:EAR99 COO:US​	10​	10​
2​	571-2-2138650-1 2-2138650-1 TE Connectivity Automotive Connectors US HTS:8538906000 ECCN:EAR99 COO:US	10​	10​
3​	571-5-963715-6 5-963715-6 TE Connectivity Automotive Connectors US HTS:8544200000 ECCN:EAR99 COO:DE	20​	20​

Mouser items received and tested!

The green CAN-IHS connector and the white CAN-C connector both plugged into their respective hubs without issue. They appeared identical to the factory connectors to the left and to the right of them. The keying was correct, so it was not possible to plug either one of them into the wrong bus. EXCELLENT!

Assembled using pre-wired terminals from an official Jeep CAN connector repair kit.​

The terminals (metal pins which go inside the connector) turned out to be a bit of a problem for me. I either don't have the right tools, or I don't have the right skills to create a solid crimp between the connector and a wire. So, to the best of my ability, I believe that these terminals are also correct. Total cost for both CAN bus connectors and terminals is $1.86 (plus the cost for wire).

I'll admit, my hardware skills could use some work, but I suspect many others are going to be equally unable to create a solid crimp to the terminal and then feed it into it's home inside the connector. I might be able to find some place local that could handle my own crimping, but is there a more universal solution? Some way to order the terminals already wired up, or... ?

I'm wondering if we should point people to the DLC (OBD-II) connector and bypass cables, or do we just make note of this as a hurdle when connecting directly to the CAN bus? Perhaps this isn't a problem that should be solved right now?

Thanks, all. And again, many thanks to Temperance for her keen eye and solid skills in locating just the right parts at Mouser! A+++

 

[SmartStopStart.com]

Mouser items received and tested!

The green CAN-IHS connector and the white CAN-C connector both plugged into their respective hubs without issue. They appeared identical to the factory connectors to the left and to the right of them. The keying was correct, so it was not possible to plug either one of them into the wrong bus. EXCELLENT!

The terminals (metal pins which go inside the connector) turned out to be a bit of a problem for me. I either don't have the right tools, or I don't have the right skills to create a solid crimp between the connector and a wire. So, to the best of my ability, I believe that these terminals are also correct. Total cost is $1.14 (plus the cost for wire).

I'll admit, my hardware skills could use some work, but I suspect many others are going to be equally unable to create a solid crimp to the terminal and then feed it into it's home inside the connector. I might be able to find some place local that could handle my own crimping, but is there a more universal solution? Some way to order the terminals already wired up, or... ?

I'm wondering if we should point people to the DLC (OBD-II) connector and bypass cables, or do we just make note of this as a hurdle when connecting directly to the CAN bus? Perhaps this isn't a problem that should be solved right now?

Thanks, all. And again, many thanks to Temperance for her keen eye and solid skills in locating just the right parts at Mouser! A+++

These terminals can be reliably soldered if you practice a bit. I often do that for very low volume work. Strip about 1/8" of the wire. Then use long nose pliers to first wrap the 2 rear tongs around the insulation. Get a cheap 'third hand' twin alligator clip holder to support the assembly and solder long enough so the solder flows into the cup but not so long that in flows into the mating area. An 1/8" chisel tip is ideal.

 

[jmccorm]

Smart.. Soldering the connections seems like it'd work a whole lot better for me. And lots of good details, too. Thanks!

 

[redracer]

So, i have to admit that I copied your mouser order. Mine will arrive tomorrow.

As for the terminals, I can point you to the appropiate tool. Without the tool, you have to fold over and overlap the flaps, then pinch them shut. and if in doubt, a touch of solder works too. It can be a bit fiddly and they are tiny.

 

[jmccorm]

So, i have to admit that I copied your mouser order. Mine will arrive tomorrow.

Awesome! Safety in doing the same things, right?

As it turns out, I added a fourth item to the order that was not necessary. Look for a bag with only 10 terminals instead of 20. That one can be stored away, trashed, however you handle that.

4

571-1718760-2 1718760-2 TE Connectivity Automotive Connectors US HTS:8538908140 ECCN:EAR99 COO:DE

10

10

 

[jmccorm]

Performance Shift Enable / Dodge Charger / Ram

I was chasing down some Body Controller Module parameters that I found with JScan. These were called "Performance shift enable customer settings menu" and "Performance shift rpm customer settings menu".

One link led me to a page in the 2021 Dodge Charger manual which talked about a change in your dash display that shows you when you need to shift (for manual vehicles or for automatic transmissions in manual mode).

Alternatively, I found a 1402 page-long thread in the Ram Forum which seems to be dedicated to using AlphaOBD to modify module parameters. One person believed that it then downshifted more redily and holds the gears rather than upshifting for economy.

It seems that there's two things worth chasing down here if someone's interested. The first is to read and to modify the Performance Shift parameters on a Wrangler and to see how it reacts. The other would be to thumb through this topic on the Ram Forum and see what goodies they've managed to come up with that might also work well for us!

ALSO: it seems that AlfaOBD is a straightforward way for non-programmers to adjust vehicular parameters that are available through UDS. And, of course, another note that any and all changes should be done with care.

 

[jmccorm]

Flashing the Overhead Courtesy Light

Here's another simple test script (before they start to become everyday and boring). This flashes the overhead courtesy light in the cab. It uses the same mechanism shown weeks ago that was done with flashing the third brake light, so this should start to become familiar.

The script is called overheadflash. I wanted to use it either to indicate when a vehicle had reached it's desired temperature after a remote start. Another use might be as part of an indication (along with the horn and headlights) to let the drive know that the 20 minute remote-startup timer is about expire, the vehicle is about to shut off, and they need to stop procrastinating and get going!

#!/bin/bash

# Wake up the CAN bus.
cansend can0 2D3#0700000000000000
sleep 2

# 2 byte message: Enter Diagnostic Session Control
# Subtype: Extended Diagnostic Session
cansend can1 620#0210030000000000

sleep 1

# Perform an infinite loop

while [ 1 ]
do

# 5 byte message: Input/Output Control by Identifier
# Identifier $D1BE, option $0301 (overhead courtesy light on)
echo Third brake light on
cansend can1 620#052FD1BE03010000
sleep 0.5

# 5 byte message: Input/Output Control by Identifier
# Identifier $D1BE, option $0300 (overhead courtesy light off)
echo Third brake light off
cansend can1 620#052FD1BE03000000
sleep 0.5

done

In addition, I have dedicated a third sheet in the CAN bus tracking spreadsheet for us to document what vehicle modules are at what locations, and what functions are available through those modules.

As you can see, I've added the overhead light AND the brake light there. We can add more notable devices or functions as we go along.

 

[redracer]

That worked as expected.

except....
"echo Third brake light on" isn't quite the text that I was expecting. ;-)

Sponsored