Member Since: 10 Dec 2020
Location: Bideford
Posts: 29
Trying to sniff CAN bus - Without breaking my Disco! (oops?)
Hi all, I'm trying to accomplish something potentially exciting (for me at least) and would appreciate some technical help!
I want to read can bus messages and eventually re-send some, for two primary reasons:
1 - build my own 4x4 info display
2 - make the heater vents/fans work with the FBH
I've wired an arduino nano up to an MCP2515 board, then made up a cable using some quality ethernet cable and a OBD II connector.
I've wired the MCP2515 to the medium speed High and Low as indicated from all the research I've done... (pins 3 and 11), but having a great deal of trouble getting it working.
I can read a few messages, but after a short while (a few seconds to a minute or so) it stops, and the car gets upset - warning messages on dash, hazards flash, "Vehicle Fault - System Shutting Down" on head unit.
I've used both a simple example mcp2515 script, and the CanHacker software and code to sniff the messages. Both do the same.
After taking the key out and holding my breath for a minute or so, I can restart and everything is fine, until I start sniffing again.
Would anyone know what the problem is? I've triple checked all my connections, and so far the only things I suspect is either a voltage issue that's upsetting the car, or maybe my cable is too long and introducing issues? It's approximately 1.5m long, twisted pair.
Thank you very much in advance!
28th Dec 2020 6:45 pm
Pete K
Member Since: 15 Jan 2016
Location: GL
Posts: 10676
I can’t answer your question.
However if you want a less dangerous way of getting 4x4 data, get it from the audio optical network. A lot less dangerous !
28th Dec 2020 7:09 pm
chrisoverson
Member Since: 10 Dec 2020
Location: Bideford
Posts: 29
[img]
Hi Pete, thanks for the reply
Would the audio optical network only show me the same image as on screen, or all the raw data?
I appreciate there's some risk involved with this, but hopefully once I'm past this stage, as long as I don't send any silly codes over the can I should be good and can have some real fun (I work as a software developer, just not overly familiar with can)[/img]
28th Dec 2020 7:14 pm
epninety
Member Since: 12 Oct 2012
Location: Hampshire
Posts: 329
I've logged the canbus using RPi3 and the Waveshare dual can adapter, and also on my (Linux) laptop with a USBTin interface. My cable to the interface device was a modified cheap'n'nasty canbus extender from ebay (ribbon, not twisted), and I had some problems when the cable was longer than about a foot.
Like you, turn everything off, key out, then on restart everything is fine.
I was doing this as a downtime project last christmas, I reverse engineered the messages which control the dash instruments, so I could put a D3 dash into my kit car. This year I've not got much done on the car, so I haven't been back to it, but I have control of all the gauges and almost all the warning llights, and info messages, plus custom text.
28th Dec 2020 7:45 pm
chrisoverson
Member Since: 10 Dec 2020
Location: Bideford
Posts: 29
Great! Thanks. I'll try to rework my setup with a much shorter cable and just extend the USB to the arduino if necessary, and see how I get on. I imagine I might be introducing noise into the CAN lines.
28th Dec 2020 7:54 pm
Pete K
Member Since: 15 Jan 2016
Location: GL
Posts: 10676
Optical network will give you raw data
28th Dec 2020 8:34 pm
chrisoverson
Member Since: 10 Dec 2020
Location: Bideford
Posts: 29
Okidoke...
I've remade my cable, and now rather than 1.5m of canbus wiring it's less than 1 inch, just about managed to fit the mcp2515 and the arduino nano inside the obd II plug with a lot of jiggerypokeryy.
(and yes! the lid did go back on! )
I haven't a clue where to start reading the data from the audio optical system, but that sounds interesting too.
28th Dec 2020 11:08 pm
McAdam
Member Since: 21 Nov 2020
Location: Canary Islands
Posts: 129
Wow, Its amazing how many times I think of something I want to do to the car and someone makes a post at the same time.
I want to replace the Nav display with an Android Auto head unit, and as I go offroading at least 50% of the time in the car, its extremely handy to hand to have 4x4i but also a large display with off road routes/sat images.
I investigated it this morning, and didnt really come up with any good conclusions.
The headunit I ordered does have canbus connectors, but unsure how it would work with the car. If it does work, I would then need to find an android app to create some dashboard, or build one myself.
I am curious as to the MOST network, and trying to sniff from there.
I briefly looked at building a GVIF (how the display communicated with nav box) to Analogue RCA converter, but couldn't find any kind of ready solutions - and it seems that the 4x4i screen is hardcoded into the screen chip anyway.
I did think about getting a reverse screen connector and converting the 40 pin screen connector back to analogue... but thats insane
I know that IID is able to get the info over BT via the IID Tool, so the data must exist somewhere easily accessible.
Anyway... this is project 42 on my list of insane things for my disco... so i will watch here and give any input if I ever can.Pre-Production
D3 V8 #264
LHD '04 HSE
Living its life as a 50/50 On/Off road car exploring the Canary Islands
28th Dec 2020 11:19 pm
chrisoverson
Member Since: 10 Dec 2020
Location: Bideford
Posts: 29
Please keep in mind with anything I say that I'm new to this forum, this vehicle, and can bus, but I'm reasonably techinical, do software development daily, and I'm learning fast - so I might have some idea what I'm on about, but by no means an authority and may be dead wrong.
It's my understanding that there's virtually no chance any 3rd party system you can buy will show 4x4 information unless it's captured from where it's generated in the car already.
There's two canbus systems in the disco 3, high speed and medium speed. Medium speed includes information sent to the head unit, and, from reading some other threads here, also contains the information sent to the 4x4 display, but I haven't verified that as yet.
I'm sticking to medium speed where possible as I think I'm less likely to do serious damage there as it's not talking directly to the engine, and most of my areas of interest are on the medium bus anyway (FBH, fans, head unit), but I will probably need to play with both.
The way I'm planning to do it... is first identify and capture all info relating to the 4x4 positioning - steering angles, suspension info and so on, and then use this to make my own interface which will most likely be an android app. It won't be simple or quick, but could be interesting.
The other main thing I want to do is control miscelaneous items in the car, starting with fans so I can preheat the car along with running the FBH (which I have working through a 1533 timer and a remote GSM relay), but in time if possible controlling the windows, suspension and other such things might be fun and interesting.
I don't think my photo came through last time, so here's the little plug I've made (see attached)
28th Dec 2020 11:28 pm
McAdam
Member Since: 21 Nov 2020
Location: Canary Islands
Posts: 129
Your plug looks good.
There is a can connection in the back of the nav display, that connects to the HU via a private Can Network.
This might be an interesting point to tap into for 4x4i - since it makes sense that the nav screen would have some kind of filtered can.
There have been multiple attempts at can hacking in various LR cars including many RRs.
I still have nightmares from the last time I tried to Can Hack a 2013 Mini Cooper s... 28 hours of sniffing, but never able to trigger anything successfully. I was using an AutoPi.io adaptor to ensure I could focus on just the sniffing and not have to worry about anything else.
Good luck, and if you get further, I would be very interested in seeing how I can help!Pre-Production
D3 V8 #264
LHD '04 HSE
Living its life as a 50/50 On/Off road car exploring the Canary Islands
28th Dec 2020 11:44 pm
Pete K
Member Since: 15 Jan 2016
Location: GL
Posts: 10676
The electric windows are basic in these.
Don’t think operated via can.
No chance of operating D3 rear windows.
The private can I believe sends touch screen presses back to the nav to enter destination etc
I don’t think it contains 4x4 data.
While other manufactures have managed to interact with this on gvif units I don’t think there is anything exciting for you.
If you look here on posts titled Tesla or Android I thought an app already existed to display 4x4
Not seen it though
The replacement center consoles is interesting and they clearly have can working getting data like parking sensor distance
29th Dec 2020 12:05 am
epninety
Member Since: 12 Oct 2012
Location: Hampshire
Posts: 329
Just for interest, here's a little video of the D3 dash running on my bench, all controlled from a microcontroller using commands I reverse engineered from sniffing the canbus.
There are two types of communication over CAN, 11 bit addresses and 29 bit addresses. Each module has it's own unique ID and will send and receive signals using it's appropriate address. Medium speed is 125Kb/s and High Speed is 500Kb/s.
If you're sending random messages on the bus it will go into expulsion mode where each module will stop sending information. If you also have a terminating resistor, 120 Ohm, across your CAN wires, it will add to the overall bus resistance and again will be detected and cause problems. The bus resistance when measured across pins 3/11 should be 60 Ohm (120 Ohm in parallel).
You can listen to the CAN bus, but to make any sense of the information you are seeing (it will all be in hex), you need the CAN DBC file which allows it to be decoded.
You can also send signals on CAN if you emulate the tester by using a specific ID and then constructing the message to send to a particular module. However, not all modules will respond to all commands and some may need to go into extended diagnostic mode to actually function.
Once unplugged and everything shut down, it should recover normally as the 'fault' has been removed.1972 Range Rover Classic 2 door V8
2013 Land Rover Discovery 4 HSE - SCRAPPED
2016 Land Rover Discovery 4 Landmark
2022 Volvo XC40 T5 PHEV 282HP FWD 3 cylinder!
29th Dec 2020 11:02 am
chrisoverson
Member Since: 10 Dec 2020
Location: Bideford
Posts: 29
epninety wrote:
Just for interest, here's a little video of the D3 dash running on my bench, all controlled from a microcontroller using commands I reverse engineered from sniffing the canbus.
I don't suppose you have a list of what IDs and values relate to what? Don't want to put you out, but would save me some time
Another thing I'd like to implement is real time vehicle tracking, with reporting of values such as these. A web based info page for the car if you like.
Thanks everyone for your input, it's very much appreciated. I need to spend some time studying the CAN protocol and will be very careful when I start sending messages, for now I mainly want to listen and detect info, but opening the vents and starting the blowers at the windscreen would be a great start to interface with my FBH remote.
29th Dec 2020 2:30 pm
epninety
Member Since: 12 Oct 2012
Location: Hampshire
Posts: 329
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
)
