JEEP HACKING CAN-C / CAN-IHS / UDS ! (Reverse Engineering)

[jmccorm]

I found this great thread late last night, and just finished reading it all. We just traded a Tesla last week for a 4xE to use as a new tow car behind the RV. I have a beaglebone CAN logger I built to log messages in the Tesla several years ago. I'll dig it out and start logging too!

Welcome to the club!

Am I reading this correctly that the BeagleBone boards (except for the AI version) actually DO support two CAN bus connections? (I'm asking because I want to believe that Tesla is like most manufacturers and only a single CAN bus design. Jeep/Chysler/Dodge/Fiat is the oddball here.)

Josh, I can't wait to try your HVAC script in the 4xE.

After giving it some more thought, I'm going to freely distribute the HVAC code. I think I'll work with RedRacer and see if I can't get the right ensemble of scripts available over at GitHub. If someone else wants to turn it into a commercial product, I'd settle for a conspicuous mention or acknolwedgement.

I'm really surprised how far I managed to get with simple shell script. Not only has it been easy to read and write to the CAN bus, but creating multi-threaded code was extraordinarily simple, too.

I'd really like to see if there's a way to implement brake-hold like in a tesla, but I'd probably want a junker brake module to test anything like that with.

You may be better off going with a Tazer which has a built-in Brake Hold feature (among other things). It works but it can be just a little bit touchy in unexpected ways. For example, unclick your seatbelt and you lose brake hold. That was a surprise to me. But once you have a Tazer, there's always the possibility that you could sniff what it is doing, and produce your own behavior that works even better.

Sponsored

 

[Ellivnarg]

Welcome to the club!

Am I reading this correctly that the BeagleBone boards (except for the AI version) actually DO support two CAN bus connections? (I'm asking because I want to believe that Tesla is like most manufacturers and only a single CAN bus design. Jeep/Chysler/Dodge/Fiat is the oddball here.)


After giving it some more thought, I'm going to freely distribute the HVAC code. I think I'll work with RedRacer and see if I can't get the right ensemble of scripts available over at GitHub. If someone else wants to turn it into a commercial product, I'd settle for a conspicuous mention or acknolwedgement.

I'm really surprised how far I managed to get with simple shell script. Not only has it been easy to read and write to the CAN bus, but creating multi-threaded code was extraordinarily simple, too.

You may be better off going with a Tazer which has a built-in Brake Hold feature (among other things). It works but it can be just a little bit touchy in unexpected ways. For example, unclick your seatbelt and you lose brake hold. That was a surprise to me. But once you have a Tazer, there's always the possibility that you could sniff what it is doing, and produce your own behavior that works even better.

The Beagleboards are allot like a pi, but the have storage built-in. The CAN ports are actually on a NimbleLink Cellular Shield I had for it.

I found it, but can't recall the login info. That was about 4 years ago, so I'll probably pick up one of those isolated can shiled for a pi and use one of the new pi zero w2. I received one of those for Christmas that doesn't have a purpose yet.


With the 4xE when I do a remote start and it's plugged in, it doesn't start the engine. Just starts warming up with the electric. So adjusting the idle speed won't be part of my routine.

This is my first jeep, so I've got quite a learning curve just to figure all the systems out before I dive too deep.

I'll be looking for data on state of charge, charge rates and stuff like that too.

Can you use the Tazer brake hold for everyday driving or is that just for climbing? With tesla you hit the brake a little harder at a red light and it enables hold, when you hit the accelerator the brake is released.

 

[redracer]

Can you use the Tazer brake hold for everyday driving or is that just for climbing? With tesla you hit the brake a little harder at a red light and it enables hold, when you hit the accelerator the brake is released.

You can use it for every day, but it's not that elegant. The Tazer works by pressing an assigned shortcut key on the cruise control array, with the cruise control off, while holding the brake pedal. What I'm not 100% sure on, is if you have to keep holding that key down to keep the brake hold on. I never found it useful so I have not used it past the 1st try of "oh, okay" moment.

 

[TomahawkChop]

You can use it for every day, but it's not that elegant. The Tazer works by pressing an assigned shortcut key on the cruise control array, with the cruise control off, while holding the brake pedal. What I'm not 100% sure on, is if you have to keep holding that key down to keep the brake hold on. I never found it useful so I have not used it past the 1st try of "oh, okay" moment.

With the Tazer now, you can enable brake hold. It sounds exactly like the Tesla and how many of the other cars I have driven. Once you enable it in the Tazer settings, all you have to do is have your seatbelt on, and press firmly down on the brake. You'll be alerted by the parking brake light and ding to let you know it's activated. You can then let off the brake and it will hold for you. When you're ready to go, just press the skinny pedal on the left.

RedRacer,

I know what you're talking about with the shortcut keys and I forgot what Tazer calls it, but it's slightly different.

EDIT: Brake Hold apparently isn't available as a feature with the 4XE.
https://www.zautomotive.com/zpu/instructions/TazerJLMiniUserGuide1128.pdf

 

[Ellivnarg]

I wrote the Tazer guys, and they say 4xE support for brake hold may still be coming.


I was looking at this today: https://github.com/c3re/can2mqtt

Looks like a good way send can data to Home Assistant if anyone else is using Home Assistant. I have Teslamate picking up data using their web api. It shares it with HomeAssistant. It would be nice to have similar integration with the Jeep.

Is there an api for the uconnect site that you guys know of?

 

[jmccorm]

I wrote the Tazer guys, and they say 4xE support for brake hold may still be coming.

Hopefully some good news then!

Is there an api for the uconnect site that you guys know of?

To be honest, you may be among the first to even ask the question.

 

[Rick Deckard]

On a Willys, I'm thinking of adding an air controlled sway bar. If I add a microcontroller, CAN controller, and send sway bar status commands will the status "lights" show in the dash? For safety it'll also automatically lock over 30. Big thanks for all the work and sniffed codes, would you also happen to know the F/R axle locker status codes? I would like to show their status in the dash as well. Also looking for transfer case status codes to prevent air locking the front before the FAD connects. You guys are awesome, keep up the good work!

 

[jmccorm]

On a Willys, I'm thinking of adding an air controlled sway bar. If I add a microcontroller, CAN controller, and send sway bar status commands will the status "lights" show in the dash?

I don't know how much you do or don't know, so let me talk in generic terms. Let me also start with a much simpler case (which will quickly explode in terms of complexity):

1. You have a base 2018+ "JL" Wrangler (so a 2018+ Willy's will do fine)
2. You have the exact component off of another vehicle that's missing from your vehicle (a sway bar from a 2018+ JL Wrangler)
3. You have the wiring harness to connect it (or you know exactly what needs to be connected where, and you've done all of that). Don't underestimate the importance of this step, by the way.

When those above three items are completed, your Willy's Wrangler won't take advantage of the factory sway bar because a fourth element is missing:

4. The configuration bit(s) having been set in the ECUs which state that your vehicle is configured with a sway bar. (These are the exact same kind of configuration bits as those which tell your vehicle if it has LED lights or Halogen lights, LED turn signals or incandescent, etc.) Without the configuration bits set, your vehicle won't try to make use of the component. (As we advance, we're going to be able to identify and set those bits through software. In other cases, they can be done with JScan or a Tazer or through a dealer visit.)

Now, there's one other possible component that may need to be in place (or may not, as a sway bar is not my area of expertise):

5. A device-specific control module. In this case, it might be a Sway Bar Control Module. Now, I don't personally know if the Sway Bar requires a sway bar control module (I think it does) or where it is located (under the dash, under the hood, inside the sway bar itself, or somewhere else)? But if your device requires a control module, that'll be another item you'll need in place to enable full factory behavior. It contains all the logic and the smarts.

But what if you don't want full factory behavior? What if you want to wire up a factory Sway Bar button (and status light), and you want to connect that to a third party sway bar disconnect? That sounds more like what you're talking about.

Unfortunately, it depends on some minuta of the Sway Bar button that needs to be figured out. If the button (and status light) are on the LIN bus, then the only part of the vehicle which communicates with it would probably be the Body Control Module. It would then relay it's status back-and-forth to the CAN bus. You'd have to see if that's still operational without setting a bunch of configuration bits (but I'd guess that it would be operational without any special bits needing to be set).

If that is the case, what you're looking at is to use a microcontroller or a microcomputer to either perform tasks similar to what a Sway Bar Control Module would (see what the device's status is, update the status light, prevent disconnection after reaching a certain speed, or automatically connecting based on a certain speed, etc), -or- it is possible that (with additional knowledge and additional configuration bits set) you could go all-out and fully emulate a factory Sway Bar Control Module and then you've got full control over whatever sway bar device you connect to that.

Alternatively, you could get a sway bar control module, a wiring harness, an in-dash button and status light, a wiring harness, you could set the configuration bit, and then just use a microcontroller to emulate the bit between the Sway Bar Control Module and your air-controlled sway bar.

All the small details really add up to dictate which way(s) a successful project can take and how complex it is going to be.

As far a something simple, I think it is possible to make something which just sets/unsets a status light, monitors a button, listens on the CAN bus for vehicle state information (on/off, speed, etc) and activates a relay (as needed) and updates status information as needed, too. But it's likely that it may require one or two things we don't yet know to get that all to work.

TL;DNR: It's quite possible. But we don't have or know all the steps yet. You'd be pursuing a high risk high reward path. But you'd also be blazing a trail that many others after you might want to follow. Either as a DIY project or a commercial product.

And now, a personal update...

I'll be taking my vehicle to the dealer tomorrow morning for their help investigating an issue with hesitation upon requesting full throttle. (Allow me to proactively state that it isn't turbo lag.) I'll be asking for another Wrangler, but regardless, if I get anything remotely compatible, I'll be collecting more CAN data to add to the spreadsheet.

Truth be told, it may end up being MORE informative at this point for me to get a Dodge Charger or a Ram truck. HA!

 

[redracer]

I think that I've finished the dash mount for the Raspberry Pi 7" Display. It fits snug and does not move, shake, rattle, etc...

https://www.thingiverse.com/thing:5207841

 

[jmccorm]

Acceleration vs Pitch vs ???

We have some variables with message IDs $25, $27, and $2B that appear to have something to do with acceleration, yaw/pitch/roll, and maybe some other related factor.

Can someone with a good set of eyes go over this small excerpt from a recent drive and see if you can figure out which of the last three numbers are Pitch, Forward Acceleration (likely meters per seconds squared), or something completely different?

132 BRK: 00% ACCL: 11% (VALVE 13%) MPH: 38.32 VAL25: +188 VAL27: +0399 VAL2B: -015
133 BRK: 00% ACCL: 07% (VALVE 08%) MPH: 38.36 VAL25: +112 VAL27: +0381 VAL2B: -022
134 BRK: 00% ACCL: 04% (VALVE 04%) MPH: 38.31 VAL25: +037 VAL27: +0369 VAL2B: -039
135 BRK: 00% ACCL: 01% (VALVE 02%) MPH: 38.34 VAL25: -003 VAL27: +0375 VAL2B: -036
136 BRK: 00% ACCL: 00% (VALVE 00%) MPH: 38.40 VAL25: -082 VAL27: +0367 VAL2B: -041
137 BRK: 00% ACCL: 00% (VALVE 00%) MPH: 38.40 VAL25: -137 VAL27: +0357 VAL2B: -027
138 BRK: 00% ACCL: 00% (VALVE 00%) MPH: 38.18 VAL25: -187 VAL27: +0362 VAL2B: -042
139 BRK: 00% ACCL: 00% (VALVE 00%) MPH: 38.16 VAL25: -187 VAL27: +0368 VAL2B: -046
140 BRK: 00% ACCL: 01% (VALVE 00%) MPH: 37.78 VAL25: -150 VAL27: +0368 VAL2B: -050
141 BRK: 00% ACCL: 11% (VALVE 12%) MPH: 37.74 VAL25: +182 VAL27: +0396 VAL2B: -024
142 BRK: 06% ACCL: 00% (VALVE 04%) MPH: 37.30 VAL25: +028 VAL27: +0382 VAL2B: -062
143 BRK: 00% ACCL: 00% (VALVE 00%) MPH: 34.84 VAL25: -191 VAL27: +0348 VAL2B: -065
144 BRK: 00% ACCL: 00% (VALVE 00%) MPH: 33.33 VAL25: -189 VAL27: +0372 VAL2B: -055
145 BRK: 09% ACCL: 00% (VALVE 00%) MPH: 30.49 VAL25: -190 VAL27: +0363 VAL2B: -092
146 BRK: 11% ACCL: 00% (VALVE 00%) MPH: 26.86 VAL25: -189 VAL27: +0365 VAL2B: -101
147 BRK: 17% ACCL: 00% (VALVE 00%) MPH: 21.79 VAL25: -190 VAL27: +0367 VAL2B: -148
148 BRK: 17% ACCL: 00% (VALVE 00%) MPH: 15.89 VAL25: -165 VAL27: +0388 VAL2B: -144
149 BRK: 17% ACCL: 01% (VALVE 00%) MPH: 10.11 VAL25: -080 VAL27: -0052 VAL2B: -140
150 BRK: 09% ACCL: 04% (VALVE 05%) MPH: 05.76 VAL25: +015 VAL27: -0070 VAL2B: -091
151 BRK: 00% ACCL: 28% (VALVE 31%) MPH: 04.94 VAL25: +533 VAL27: +0398 VAL2B: +084
152 BRK: 00% ACCL: 23% (VALVE 24%) MPH: 09.26 VAL25: +385 VAL27: +0453 VAL2B: +047
153 BRK: 00% ACCL: 21% (VALVE 23%) MPH: 11.54 VAL25: +377 VAL27: +0449 VAL2B: +031
154 BRK: 00% ACCL: 29% (VALVE 27%) MPH: 13.84 VAL25: +446 VAL27: +0549 VAL2B: +005
155 BRK: 00% ACCL: 43% (VALVE 42%) MPH: 17.79 VAL25: +719 VAL27: +0972 VAL2B: +098
156 BRK: 00% ACCL: 42% (VALVE 43%) MPH: 22.75 VAL25: +738 VAL27: +1184 VAL2B: +093

Can anyone make any sense of what VAL25, VAL27, and VAL2B represents?

 

[eck]

Can anyone make any sense of what VAL25, VAL27, and VAL2B represents?

$25 looks like something tangentially related to acceleration, but not acceleration itself. For example, you have:

134 BRK: 00% ACCL: 04% (VALVE 04%) MPH: 38.31 VAL25: +037 VAL27: +0369 VAL2B: -039
135 BRK: 00% ACCL: 01% (VALVE 02%) MPH: 38.34 VAL25: -003 VAL27: +0375 VAL2B: -036
136 BRK: 00% ACCL: 00% (VALVE 00%) MPH: 38.40 VAL25: -082 VAL27: +0367 VAL2B: -041
137 BRK: 00% ACCL: 00% (VALVE 00%) MPH: 38.40 VAL25: -137 VAL27: +0357 VAL2B: -027

The speed is slightly increasing and then holding steady, but $25 is dropping and going negative. If it were true acceleration, I would expect it to be dropping towards zero but still staying positive.

Wild guess... something to do with fuel trim? It seems most correlated to VALVE which I am assuming is how open the throttle valve is via the position sensor.

 

[jmccorm]

The speed is slightly increasing and then holding steady, but $25 is dropping and going negative. If it were true acceleration, I would expect it to be dropping towards zero but still staying positive.

That's what made me think that instead of acceleration it might be vehicle pitch. Measuring how much the vehicle pokes it's head up during acceleration. Of course, I'm also assuming that these sensors were installed in a manner that's true to the vehicle's 4-wheel alignment.

As it turns out, those numbers were a simplified copy I created where I isolated a few promising candidates. But then, sensors like that I totally don't understand. I don't know if you have the stomach for it, but I'd taken our four mile test loop data and provided the (active) raw numbers from message IDs $25, $27, and $2B. It may be too much to work with signed hexadecimal numbers, but you can still spot patterns in what's going on. I've attached it here.

 

[jmccorm]

Wrangler CAN Bus Log Reader

This is the script I've been using for the past month to read "candump -l" log file and try to reverse even more parameters by putting them side-by-side with other known events that happen while I drive. Example:

KEY: Run BRK: 13% ACCL: 0% (VALVE 1%) RPM: 1068
STEER: CENTR DIR: E GEAR: D3 (4403) OD: 7425.9mi MPH: 12.30

This is the first script I wrote, and really one of my favorites. It's really useful when it comes to discovering what a CAN bus message ID might contain. It can display an unknown CAN bus message alongside many other variables which have been decoded, providing that additional context which may help you unlock additional secrets.

The previous version of the script was really sloppy with it's intervals (you tell it you want updates every second, you might update three times per second if some extra speedometer updates came in). That nonsense has been cleaned up.

The new interval can be adjusted (towards the beginning of the script) to your own preferences. I've used 0.01 seconds, 0.1 seconds, and 1 seconds as my typical choices.

I'm not proud of this script, but it works. And now it's finally a bit more improved. Anyone feel like discovering some more stuff?

#!/bin/bash
TMPDIR=/run/tmpfiles.d

# How frequent to update the output.
#.01 second=10000
# .1 second=100000
#  1 second=1000000
UPDATE_RATE=100000

# Enable if you want some alternate values displayed (where available)
# Throttle valve, automatic double-clutch gears
SHOW_ALTERNATES=1

# Here (flag1 through flag3) you can quickly put in a hexadecimal
# message ID and have all the logic flow through so that you can
# extract the variable and see if you can make use of it.
# See the matching code segment at the end of this script.

flag1="025"
flag2="027"
flag3="02B"

echo "0000" > /$TMPDIR/0AB
echo "023#FFFF" > /$TMPDIR/023
echo "F" > /$TMPDIR/358
echo "000001" > /$TMPDIR/3D2
echo "00" > /$TMPDIR/232
echo "0000000000000000" > /$TMPDIR/$flag1
echo "0000000000000000" > /$TMPDIR/$flag2
echo "0000000000000000" > /$TMPDIR/$flag3
echo "000000000" > /$TMPDIR/07B
echo "000" > /$TMPDIR/079
echo "000000000000" > /$TMPDIR/322

LATEST=0
cat $1 | egrep " 023#| 079#| 07B#| 232#| 340#| 358#| 3D2#| 322#| 122#| 0AB#| $flag1#| $flag2#| $flag3#" | while read a b c
do

case "$c" in

$flag1#*) echo "${c:4:16}" > /$TMPDIR/$flag1 ;;
$flag2#*) echo "${c:4:16}" > /$TMPDIR/$flag2 ;;
$flag3#*) echo "${c:4:16}" > /$TMPDIR/$flag3 ;;
079#*)    echo "${c:5:9}"  > /$TMPDIR/079 ;;
07B#*)    echo "${c:5:9}"  > /$TMPDIR/07B ;;
232#*)    echo "${c:6:2}"  > /$TMPDIR/232 ;;
358#*)    echo "${c:5:1}"  > /$TMPDIR/358  ;;
3D2#*)    echo "${c:4:6}"  >  /$TMPDIR/3D2 ;;
0AB#*)    echo "${c:8:4}"  > /$TMPDIR/0AB ;;
122#*)    echo "${c:4:4}"  > /$TMPDIR/122 ;;
023#*)    echo "$c" > /$TMPDIR/023 ;;
322#*)    echo "${c:4:12}" > /$TMPDIR/322 ;;
340#*)    echo "$c" | cut -c9-10,19,20 > /$TMPDIR/340 ;;
esac

NOW=${a:1:10}${a:12:6}
[ $LATEST -eq 0 ] && LATEST=$(( $NOW - 1000 ))
[ $NOW -gt $LATEST ]  && {
LATEST=$(( $LATEST + $UPDATE_RATE ))

trans=`cat /$TMPDIR/340`
speed="${trans:2:2}"

# The date is done here
time="${a:6:8}"
echo -n "$time  "

rawkey=`cat /$TMPDIR/122`
key="Unk${rawkey} "
case "$rawkey" in
  0301) key="Kill" ;;
  0302) key="Kill" ;;
  0502) key="Acc " ;;
  1502) key="Acc " ;;
  0000) key="Off " ;;
  0001) key="Off " ;;
  4501) key="Strt" ;;
  5D01) key="Crnk" ;;
  4401)
    key="RRun"
    [ "$rpm1" == "0.0k" ] && key="RAcc"
    ;;
  0402) key="Run " ;;
esac
echo -n "KEY: $key  "

BRAKE=`cat /$TMPDIR/079 | cut -c1-3`
BRAKE=$(printf "%d" 0x$BRAKE)
BRAKE=`echo "0k $BRAKE 22.5 / p" | dc`
[ "$BRAKE" -gt 100 ] && BRAKE=100
[ "$BRAKE" -lt 100 ] && BRAKE=" $BRAKE"
[ "$BRAKE" -lt 10 ] && BRAKE=" $BRAKE"
echo -n "BRK:$BRAKE%"

ACC="$(cat /$TMPDIR/07B)"
ACCEL="$(printf "%d" 0x${ACC:0:3})"
ACCEL2="$(printf "%d" 0x${ACC:6:3})"
[ $ACCEL2 -lt 2000 ] && ACCEL2=2000
ACCEL2=`echo "0k $ACCEL2 2000 - 18 / p" | dc`
ACCEL2=`printf "%2d" $ACCEL2`
[ "$ACCEL" -lt 1900 ] && ACCEL=1900
ACCEL=`echo "0k $ACCEL 1990 - 100 * 2000 / p" | dc`
[ "$ACCEL" -lt 0 ] && ACCEL=0
[ "$ACCEL" -lt 100 ] && ACCEL=" $ACCEL"
[ "$ACCEL" -lt 10 ] && ACCEL=" $ACCEL"
echo -n "  ACCL:$ACCEL% "
[ "$SHOW_ALTERNATES" -eq 1 ] && echo -n "(VALVE $ACCEL2%) "

rpm1=`cat /$TMPDIR/322 | cut -c1-4`
rpm1="$(printf "%d" 0x$rpm1)"
[ $rpm1 = 65535 ] && rpm1="0"
printf " RPM: %4d  " $rpm1

STEER=`cat /$TMPDIR/023 | cut -c5-8`
STEER="$(printf "%d" 0x$STEER)"
STEERSIGN="R "
[[ $STEER -gt 4096  ]] && STEERSIGN="L "
STEER=`echo "4096 $STEER -p" | dc | cut -d- -f2`
STEER=`echo "2k $STEER 2 / p" | dc | cut -d. -f1`
STEER=`printf "%3d\n" ${STEER}`
SYMBOL="°"
[ "$STEER" -lt  2 ]    && STEERSIGN="  " && STEER="  0"
[ "$STEER" -gt  1000 ] && STEERSIGN="IN" && STEER="VAL" && SYMBOL="D"
echo -n "WHEEL: ${STEERSIGN}${STEER}${SYMBOL}  "

[ "$speed" == "FF" ] && speed="00"
speed="$(printf "%d" 0x$speed)"

gear=`echo $trans | cut -c2`
[ "$gear" == "F" ] && gear="NA"
[ "$gear" == "B" ] && gear="R " && speed="-$speed"
[ "$gear" == "D" ] && gear="P "
if [[ "$gear" =~ ^[1-9]+$ ]]
then gear="D$gear"
fi
[ "$gear" == "0" ] && gear="N "

mph=`cat /$TMPDIR/322 | cut -c5-8`
mph="$( printf "%d" 0x$mph)"
[ $mph == 65535 ] && mph="0"
[ $gear == "R " ] && mph="-$mph"
mph=`echo "2 k $mph 200 / p" | dc`
mph=`printf "%2.2f" $mph`

compass=`cat /$TMPDIR/358`
case "$compass" in
F) compass="??" ;;
0) compass="N " ;;
1) compass="NE" ;;
2) compass=" E" ;;
3) compass="SE" ;;
4) compass="S " ;;
5) compass="SW" ;;
6) compass=" W" ;;
7) compass="NW" ;;
esac
echo -n "DIR: $compass "

echo -n " GEAR: $gear  "

## # Another gear display. Double clutched automatic transmission?
## [ "$SHOW_ALTERNATES" -eq 1 ] && echo -n "(`cat /$TMPDIR/0AB`)  "

echo -n "ODOM: "
odometer=`cat /$TMPDIR/3D2`
odometer="$(printf "%d" 0x$odometer)"
odometer=`echo " $odometer * 50 / 8 " | bc`
if [ "$odometer" == "6" ]
       then
         odometer="0"
         echo -n "??????.?mi  "
       else
        printf '%8.1f' `echo "$odometer / 100" | bc -l`
        echo -n "mi  "
fi

printf "MPH: %5s  " $mph

# See the flag1 through flag3 quick entries at the start of
# this script. You can uncomment these lines to display their
# raw values, or you can start manipulating the numbers as you
# see fit.

# echo -n "FLAG1: $(cat /$TMPDIR/$flag1)  "
# echo -n "FLAG2: $(cat /$TMPDIR/$flag2)  "
# echo -n "FLAG3: $(cat /$TMPDIR/$flag3)  "

echo ""
}

done

 

[jmccorm]

$25 looks like something tangentially related to acceleration, but not acceleration itself.

You're the only one so far that's really taken a look at this, but you've inspired me to try to do a better job of presenting these numbers. I've produced a new summary of the 4 mile round-trip that includes better formatting for the sensor values:

FLAG1: -0407 -0110 -0043 FLAG2: -00167 -0043 FLAG3: +0005 -0011

I thought the leading zeros might make it easier to see the flow, and I thought the same about always having a + or a - sign, but I guess it's a matter of interpretation. Can you give this report another look over? And I'm happy to customize some of those elements (or take them away) to make them easier for your eyes to read. Unfortunately, my eyes just don't want to cooperate. But I'm hoping we can pull something really useful out of here!

File is attached: "Four Mile Drive Data v2.txt"

PS: I'm also warming up to your suggestion that these could be non-gyroscopic or accelerometer values. TOUGH!

 

[jmccorm]

Background Info: HVAC Blower Modes

The HVAC system contains a one-byte variable that represents which HVAC vent(s) are currently selected. The default state is "0F" which actually means AUTO (like when you press the Auto Fan button). AUTO mode is not only an automatic fan speed selection, but an automatic vent mode selection too. Most people don't know that. AUTO is also the setting the HVAC system uses in cold temperatures when it is remotely started.

Another basic state is "00" which is the front windshield defroster. That's what you normally get when you press the [Front] Defrost button.

After that, we have all the modes that the HVAC system cycles through as you press the HVAC Mode button over and over. "02" is the front defroster plus the feet warmer. "04" is for the feet warmer by itself. "06" is for the main HVAC dash panels and the feet warmer. "08" is for the main HVAC dash panel itself. (I haven't verified it, but I believe that "08" is the only mode which also activates the vents for the back seats.)

As I've described this system, we've got a total of three different buttons which control your active HVAC vent(s). That may seem absurd, but from a user interface perspective, it works well enough. Myself, I'd prefer individual buttons for each HVAC mode, but car makers like to reduce unnecessary costs... and that means less physical buttons for you and I both.


Reading and Modifying the HVAC Vent Selection

The script ventmode (provided below) interrogates the HVAC module and returns a two digit hexadecimal number (00, 02, 04, 06, 08, or 0F) which represents the currently selected vent. If you need a refresher of what number means what vent, you can type "ventmode help".

USAGE: ventmode [vent id]​

Possible IDs: 00=Defrost, 02=Defrost+Feet, 04=Feet,​

06=Panel+Floor, 08=Panel, 0F=Auto​

When it comes time to select a different vent, the script is not (currently) able to directly write a new vent ID into the HVAC system. Instead it reads the currently selected vent, and then simulates presses of the Front Defroster, Fan Auto, or HVAC Mode buttons as needed to achieve the desired result. If the desired mode IS the current mode, no action is taken. If for some reason the desired mode is not achieved, the script will exit with an appropriate error message and an errorlevel of 1.

For example, "ventmode 08" will cause the script to hit the HVAC Mode button until the main panel vents are selected.

Script follows:

#!/bin/bash

# This script reads or modifies the currently selected HVAC mode.

usage() {
  echo ""
  echo "USAGE: $(basename $0) [vent id]"
  echo "  Possible IDs: 00=Defrost,     02=Defrost+Feet, 04=Feet,"
  echo "                06=Panel+Floor, 08=Panel,        0F=Auto"
  echo " "
  exit 1
}

TRIES=0
MAXTRIES=6
DEBUG=false
DELAY=0.6
VENTID=99
VENTWANTED=$(echo $1 | tr '[:lower:]' '[:upper:]')
[ "$VENTWANTED" == "-H" ] && usage
[ "$VENTWANTED" == "HELP" ] && usage
[ ${#VENTWANTED} -ne 2 ] && VENTWANTED="XX"

read_error() {
  echo "FAILURE: Could not read the vent mode from the HVAC Module."
  echo ""
  # Exit with a failure result code
  exit 1
}

write_error() {
  echo "FAILURE: Could not change the vent mode in the HVAC Module."
  echo ""
  # Exit with a failure result code
  exit 1
}

request_hvac_vent () {
  # In 0.1 second from now...
  # ...send a request to the HVAC Module asking for the vent mode status.

  ( sleep 0.1 ; cansend can0 783#0322029800000000 ) &

  # Collect all responses from the HVAC Module at ID $503 on CAN-IHS.
  # After $DELAY seconds, stop collecting.

  COMMAND="timeout -s 1 $DELAY /usr/bin/candump -L can0,0503:0FFF"

  # Only collect messages which are a direct response to our own query.
  # All other messages will be ignored.

  RESPONSE=$( $COMMAND | grep \#04620298 | cut -d# -f2 | cut -c9-10 | tail -1)
}

# MAIN PROGRAM LOOP BEGINS HERE ------------------------------------------
# Read the HVAC Vent Mode. If it isn't what we want,
# hit the HVAC Mode button. Lather, rinse, repeat.

while [ $VENTID != $VENTWANTED ]
  do

    # Ask the HVAC module for which vents have been selected.
    request_hvac_vent

    # If no response was found, try again.
    if [ "$RESPONSE" == "" ] ; then
      DELAY=1.2
      request_hvac_vent
    fi

    # If no response was found, try again.
    if [ "$RESPONSE" == "" ] ; then
      DELAY=1.8
      request_hvac_vent
      # If no response AGAIN, then exit with an error.
      if [ "$RESPONSE" == "" ] ; then read_error; fi
    fi

    VENTID=$RESPONSE

    [ "$VENTWANTED" == "XX" ] && {
      echo $VENTID
      exit 0
    }

    # If the current HVAC vent mode isn't the one we want,
    # then hit the appropriate HVAC control button.

    [ "$DEBUG" == "true" ] && echo VENTID: $VENTID   VENTWANTED: $VENTWANTED
    [ "$VENTID" != "$VENTWANTED" ] && {
      # If they wanted auto vents, let's just hit the auto button and exit.
      [ "$VENTWANTED" == "0F" ] && {
        # Turns on the automatic FAN and VENT control
        cansend can0 2D3#0700000000020000; sleep $DELAY
        exit 0
      }
      # If they wanted the front defroster, then hit the front
      # defroster button and exit.
      [ "$VENTWANTED" == "00" ] && {
        # Turns on the HVAC front defroster
        cansend can0 2D3#0700000000800000; sleep $DELAY
        exit 0
      }
      # Otherwise, hit HVAC Mode button to cycle the setting
      cansend can0 2D3#0700000000000800 ; sleep $DELAY
    }

    # We're going to try up to FIVE times to change the HVAC mode
    # to our desired selection. After that, exit with an error.

    TRIES=$(( $TRIES + 1 ))
    [ "$TRIES" -gt $MAXTRIES ] && write_error

  done

# A clean exit. Either we reported a value, made a change, or was requested
# to make a change but no change was necessary.

exit 0

Sponsored