JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[jmccorm]

This was a success! The data in 0x093 does show you using the manual gear selections. I just have to add 7'th and 8'th gear in.

I've gone ahead and made those changes for you. Thanks!

It's good that we can distinguish between the vehicle being in 5th because the automatic transmission selected it versus being in 5th because the driver manually selected it. That's above and beyond it's use as a single place for both automatic and manual transmission gear selection. Nice!

About my own progress...

I'm still waiting for those shipments from pishop.us, but I've gone ahead and done some more work towards a final configuration including a RGB controller board that's far better constructed. I hope to get back to the world of CAN bus messages here in the next two or three weeks.

I've tested out that Zero2Go board, and sure enough, it does power detection and automatic on/off just fine as long as you don't manually shut down the OS. But there's a firmware fix for that which they're giving me instructions on how to implement.

UPDATE: Here's the board stack as it stands now, still subject to change.

From bottom to top we have a Raspberry Pi 4B, Waveshare 2-Channel CAN Bus, Zero2Go power/sleep controller, and a custom RGB control board. USB-C and 6VDC power supply both go into the Zero2Go board, with nothing plugged into the Raspberry Pi's power input.

Sponsored

 

[jmccorm]

I happened to stumble across this jewel:
Modular Raspberry Pi 4 Case - Black

This is a modular case that can be extended vertically in increments of 10mm, all the way up to an extra 50mm of enclosed space. I placed an order for a case, extensions, and screws... so here's hoping this turns out even better than the open-case design I had ordered.

Things are moving forward. Finally, some good news.

Here's a picture of my current board stack, placed side-by-side against the PiShop's Modular Raspberry Pi 4 case (with the maximum # of extensions):

Total height of the modular case is 3.25 inches. There's even more room for my existing board stack to grow. But I may not have to add back in a Fan SHIM because the top of the case itself contains vent holes and mounts for a 30mm fan.

Each of the case's five extensions pieces can be notched or drilled as needed to route any external cables. And if mistakes are made while notching out those holes, it's only $3 more to have an extra replacement piece on-hand.

Modular Case Cost (at maximum size):​

$10.95 modular case + $1.45 SD card cover + $14.75 for 5 extensions + $0.45 for 58mm screw pack + $4.95 for a variable speed GPIO fan (a single-speed 5V fan for $1 less) = $32.55​

​

Raspberry Pi 3 is +$1.85 more for an optional USB/HDMI cover.​

Of course, anyone is free to use whatever case they like. But for a high quality, fan-cooled, variable height, non-metallic case that supports multiple HATs... save for any custom-printed option, this clearly seems like the best case on the market.

Oh! While the case is still unpopulated, I should probably determine where and how this mounts behind the glovebox. I'd like to keep it in place with a very strong velcro adhesion, if at all possible.

 

[Tristan]

Hi, I'm using Savvycan to send data to a JL steering pump.

I'm playing back the 4 mile loop can dump and the pump is speeding up and slowing down exactly as I would expect based on what was recorded.

I'm trying to get the pump to stay at a high flow rate, (I assume the scenario would be a low-speed hard turn or something).

I'm unable to get the pump to stay at that high speed even by using captured frames at these moments during the playback.

Are there any tricks to make this work?

Thanks!

-Tristan

 

[redracer]

Unfortunately, you may be facing a timing or watchdog issue. We have found multiple signals that are always counting up and synching timing to all modules.

The problem as I see it, playing back just a snippet may cause good results for a moment but as soon as it stops, the pump will loose the timing and shut down thinking that the can bus has failed. The same goes for repeating a snippet, as the timing won't line up.

Until we understand the timing and initialization messages better, I don't know if we can help much.

 

[Tristan]

That sucks.

I am to initialize it and get it to run thru the full sequence only with the following IDs:

0x023
0x025
0x128

the pump sends signals on 128 so I’m assuming that I’m not responding with the right data to keep it happy.

 

[redracer]

So, remember how I wanted to make a better way of coding what data to display in my pycan.py ??

Well, may I present pycan2.py . Version 2! Now, you can add data fields to explore by just adding to the list.

#!/usr/bin/python3
# jeep canbus live data display
# v2

# import libraries
import can
import curses

canFilter = list()

# can bus variables, change these for vcan or can
canIHS = "vcan0"
canC = "vcan1"

# defined types to process the data. x = can message , a = byte 1 , b = byte 2
def raw8(x,a):
    return(x[a])

def raw16(x,a,b):
    return((x[a]<<8) + x[b])

def volt(x,a):
    return(x[a] / 10)

def temp(x,a):
    return(round((((x[a] - 40) * (9 / 5)) + 32)))

def tilt(x,a,b):
    return(round(((x[a]<<8) + x[b] - 2048) / 10))

def rpm(x,a,b):
    if x[a] == 0xFF:
        return(0)
    return((x[a]<<8) +  x[b])

def mph(x,a,b):
    return(round(((x[a]<<8) + x[b]) / 200,1))

def psi(x,a):
    return(round(((x[a] * 4) * 0.145038)))

def gear(x,a):
    if x[a] == 0x4E:
        return('N')
    elif x[a] == 0x52:
        return('R')
    elif x[a] == 0x31:
        return('1')
    elif x[a] == 0x32:
        return('2')
    elif x[a] == 0x33:
        return('3')
    elif x[a] == 0x34:
        return('4')
    elif x[a] == 0x35:
        return('5')
    elif x[a] == 0x36:
        return('6')
    elif x[a] == 0x37:
        return('7')
    elif x[a] == 0x38:
        return('8')
    elif x[a] == 0x50:
        return('P')
    elif x[a] == 0x44:
        return('D')

def xfer(x,a):
    if x[a] == 0x00:
        return('4x2H')
    elif x[a] == 0x02:
        return('N')
    elif x[a] == 0x10:
        return('4x4H')
    elif x[a] == 0x20:
        return('N')
    elif x[a] == 0x40:
        return('4x4L')
    elif x[a] == 0x80:
        return('Shifting')

def steer(x,a,b):
    return(((x[a]<<8) + x[b]) - 0x1000)

def wrapper(msg,name,func,output,*args):
    return(func(msg,*args))

def pstemp(x,a):
    return(round(((x[a] * (9 / 5)) + 32)))

# list of can ID's and details to monitor in this order:
# (ID, Channel, [("name", process, type, byte1, byte2)])
monitorlist=[(0x2C2,
              canIHS,
              [("Batt V",volt,str,2),
               ("Batt ?",raw8,hex,0)]),
             (0x02B,
              canC,
              [("Roll",tilt,str,0,1),
               ("Tilt",tilt,str,2,3),
               ("Yaw",tilt,str,4,5)]),
             (0x322,
              canIHS,
              [("RPM",rpm,str,0,1),
               ("MPH",mph,str,2,3)]),
             (0x127,
              canC,
              [("IAT",temp,str,0),
               ("Coolant",temp,str,1)]),
             (0x13D,
              canC,
              [("Oil Temp",temp,str,3),
               ("Oil Pres",psi,str,2)]),
             (0x093,
              canC,
              [("Gear",gear,str,2)]),
             (0x277,
              canC,
              [("Transfer",xfer,str,0)]),
             (0x023,
              canC,
              [("Steer Angl",steer,str,0,1),
               ("Rate",steer,str,2,3)]),
             (0x128,
              canC,
              [("PS Temp",pstemp,str,1),
               ("PS PSI",psi,str,2)])
              ]

stdscr = curses.initscr()

# setup
for monitor in monitorlist:
 # build out the can bus filtering list. only receive messages that we care about.
 canFilter.append({"can_id": monitor[0], "can_mask": 0xFFF, "can_channel": monitor[1]})
 for detail in monitor[2]:
  # place item titles, according to how they appear in the list
  stdscr.addstr(monitorlist.index(monitor),(monitor[2].index(detail) * 30),detail[0])

stdscr.refresh()

# define the can bus
bus = can.interface.Bus('', bustype='socketcan', filter=canFilter)

# Process every single message received from the canbus
try:
 for msg in bus:
  for monitor in monitorlist:
   if msg.arbitration_id == monitor[0] and msg.channel == monitor[1]:
    for detail in monitor[2]:
     stdscr.addstr(monitorlist.index(monitor),((monitor[2].index(detail) * 30) + 15), '%-5s' % detail[2](wrapper((msg.data),*detail)))
     stdscr.refresh()
 
except:
  bus.shutdown()
  curses.nocbreak()
  stdscr.keypad(0)
  curses.echo()
  curses.endwin()
  raise

 

[jmccorm]

Well, may I present pycan2.py . Version 2! Now, you can add data fields to explore by just adding to the list.

You did it! Nice!
I've got to get back into a position where I can try these things out.

 

[jmccorm]

I am to initialize it and get it to run thru the full sequence only with the following IDs:

0x023
0x025
0x128

the pump sends signals on 128 so I’m assuming that I’m not responding with the right data to keep it happy.

I don't know that I'll be able to help in any substantial way, but I had a few comments here.

It sounds like your pump shouldn't need to receive the 0x128 messages because that is the ID for messages that are sent by your pump, follow me? If you filter out 0x128 messages, you pump should still initialize all the same. Does it? And after initializing, does the pump run for a set period of time then fails, or what happens?

I've observed on a real vehicle that when there's noise on the CAN bus, it goes offline and stops working. Originally I thought it was an ECU commanding it to be quiet, but in retrospect, I'm wondering if it is the pump itself that goes offline if enough of a message it needs isn't found.

It shouldn't be harmful for your pump to receive all messages (save for 0x128). You've tried that, right?

Also, I don't know if this is a consideration, but the power steering pump might shut down for other reasons. Insufficient current, or too much or too little pressure. Or maybe it's looking for a change in pressure so it can take action?

I'm out of my depth here, but I'm trying to give you some ideas that you might be able to work with.

redracer --

POWER STEERING PUMP​

$00xx????????? – PS Fluid Temp in C
$00??xx???xxxx – PS pressure in PSI​

​

Which digits have the pump pressure? The first set of xx or the second xxxx?

 

[Tristan]

I think you’re right. The pump turns on and goes thru the program without sending data to 0x128.

if the pump gets the correct signals to start up and then loses either speed or steering angle it goes to a default speed, which is too slow for my application.

I’m confident it’s a data issue and not a power issue. It’s a brand new optima battery hooked up to a charger and I ran all new 4 ga wires to pump.

 

[jmccorm]

I’m confident it’s a data issue and not a power issue. It’s a brand new optima battery hooked up to a charger and I ran all new 4 ga wires to pump.

The only other thing that comes to mind would be that the log file contains both CAN-IHS bus messages and CAN-C bus messages. Sometimes, the message IDs overlap. So...

If you playback ALL log messages that are on CAN1 (except for 0x128) and NOT playback any CAN0 messages, that would at least be one more edge case that you should be able to rule out.

I am surprised that any of the hard turns that should be in the log file (getting in or out of the driveway) on message ID 0x23 don't elicit a reaction. It's tough diagnosing a black box.

If you're determined, the last option would be to generate semi-random data (and log what you're sending) and hope for some reaction that you can then go back and isolate what message caused the issue. But you'd need to respect the counter/checksum in the last four hex digits or your pump may discard the messages as erroneous.

You've done a lot of work so far, it seems, so I hate to offer even more. But start with isolating the simple edge case and get rid of those CAN0 messages and send everything else (using their original timing) that isn't 0x128.

 

[Tristan]

Hi, the hard turns do elicit a reaction when I play the log file back. My problem is that I can’t get those higher pump speeds to work at a sustained rate when I send those specific frames to the pump.

 

[jmccorm]

Hi, the hard turns do elicit a reaction when I play the log file back. My problem is that I can’t get those higher pump speeds to work at a sustained rate when I send those specific frames to the pump.

Okay. All these small details are far more useful than one might expect!

So you playback the (0x023 and 0x025) logs from when there was a hard turn of the steering wheel, and you get a reaction. But if you replay just those select frames over-and-over, it doesn't work.

That gives me one or two ideas of what might be wrong:

1. When you are looping just those select message(s), are you obeying the counter flow between messages? If not, you'll need to come up with a repeating sequences of messages which maintains the appropriate counter sequence for each ID (such as 05, 15, 25, 35 ... D5, E5, F5 ... and then loops back to the sequence starting once again at 05). Failure to do so may throw the pump offline.

2. Are you making any modifications to any of these messages? If so, you must recalculate the checksum of those messages or you'll create an invalid message which could throw the pump offline.

3. Observe the 0x128 messages that are emitted by the pump. We know that two of the digits are temperature and some of the other digits are pressure. Those aside, perhaps there are some status bits which are giving you an indication of the pump's status? That might help you refine the exact point at which the pump becomes unresponsive or offline. That can be used to find a common element before or at the point of reaching your undesired behavior.

PS: I'm glad you've got hardware and software skills! And thanks for staying positive.

 

[redracer]

Hi, the hard turns do elicit a reaction when I play the log file back. My problem is that I can’t get those higher pump speeds to work at a sustained rate when I send those specific frames to the pump.

when you say hard turns, are you sending custom messages indicating turn angle? Remember, we have also found the turning force or rate of turn value. I would think that rate of turn would drive the pump pressures up more than just changing the wheel angle alone.

 

[jmccorm]

when you say hard turns, are you sending custom messages indicating turn angle? Remember, we have also found the turning force or rate of turn value. I would think that rate of turn would drive the pump pressures up more than just changing the wheel angle alone.

If we're looking at the same turns (the ones in the driveway), they should be low speed (substantially increasing the required force) and somewhere near full turns. I was thinking that they would probably qualify to do some pump driving no matter what signal or signals it ended up using.

But I'm with you. I'd guess the turning force sensors would apply here.

EDIT: I could be wrong, but I didn't think he was crafting custom messages. But even if he was, I didn't think he would have been generating valid counter/checksum information which almost certainly would have been required. I probably just should have let him respond to you.

 

[Drdyer9051]

RedRacer why did you switch to curses instead of tkinter?

Sponsored