CANbus Coding in FRS/BRZ
 

Are there any talented individuals that are able to perform these functions on these cars?

IE.,

1. Roll windows up/down with keyfob
2. Disable seatbelt chime (track purpose for seat removal/harness)
3. Leave foglights ON while highbeams are ON

I know VAGCOM and BMW's EDIBIAS tools have been present for awhile now...unless the JDM Toyota crowd just isn't as smart? :p

There are quite a few smart fellows who post in the tuning forums and the romraider forums (and techstream folks), might want to post here and see who responds:

http://www.ft86club.com/forums/forumdisplay.php?f=88

2 and 3 can be done in a few ways I believe but 1 is impossible since the windows are strictly switch activated and not BCU controlled.

But how?

Tuning seems to be specific to Engine Control Unit and not other units such as lighting, convenience features etc..

One thing I don't understand that is why doesn't the keyfob allow me to lock my car when the vehicle is started? (Comfort Access/Smart Key option)

I'm guessing it's to prevent you locking your key inside the car or something like that (key falls out of your pocket as you get out of the seat and coincidentally hits the lock button as you shut the door, etc). how likely is it to accidentally lock while you're not in the car? probably not likely but it is still a possibility. I would like to lock my car when it's running though... sometimes a quick run into the post office without shutting off the car would be nice.

Outside my skill base but I hear good things about Carista. Keep in mind that if the controls are not there in the first place you will not get an option to change them. The door lock may very well be an on off function though. The upscale cars can have a lot more turned on and off because they have a lot more that is controlled through the system. We really don't have much on our cars.


Check it out here:


http://www.caristaapp.com/

That's a possibility... Most likely it's done to prevent kids from playing around in the car, locking it, and then not being able to get out. Nothing says lawsuit faster than a dead child in a small garage with the engine of the car they died in running.

VCDS person here, too. This DENSO stuff sure isn't Bosch....

You can roll the windows up/down with CANbus the problem is you can't do it if the ignition is off. You can also control the doorlocks via CANbus but again, only when the ignition is on. I was really wanting to build my own proxy unlock via an Arduino connected to the canbus but it's not possible because of the ignition requirement.

As for #2 you can do that with Carista and/or with Techstream. Techstream is the tool Toyota uses to changing these settings, diag, keyfob pairing, data logging ect ect. You just need a compatible cable (Amazon for $18). The software is easy to find with Google.

I'm not sure about the foglights. I don't have fogs so it's not a setting I've looked for in Techstream.

For now, I've found a way around that by triggering the ACC mode. This is NOT Ideal at all but it works in the meantime.
I will keep sniffing techstream so find a way to trigger and send power to the module responsible. I mean when you think about it. you can still roll down/up window even after the ignition is off for about 40 seconds (as long as the door isn't opened during that time span).
Another Bonus, I am able to control the HVAC too (techstream really does come in handy :party0030:

Additionally, unlocking the accelerometer would be awesome. I’m very surprised someone hasn’t figured that one out yet.

are you referring to the mid refresh (2017+) in-dash lcd screen sowing the g-force meter for the brz?

I have a Carista adapter and can confirm that the seatbelt chime is something that can be adjusted in Carista as well as things like the sensitivity of the auto headlight sensor in the dash.. No high beam + fog settings though. From what I understand, their team needs to enable the option for you to access it if it's even doable.

I will say though it's a bit barren compared to what I expect (coming from VCDS and Bimmercode vehicles). Not worth the price of the dongle / subscription to license in my opinion.

Techstream definitely sounds far more promising for the price though may be a bit more complicated than some are comfortable with.

Have considered picking up a tech stream dongle, just don't have a laptop to mess around with it on. Is it worth picking up one of the Amazon $49 dongles that comes with version 18?

The very same.

Courtesy of timurr: https://github.com/timurrrr/RaceChronoDiyBleDevice

CAN ID 208 (315 for 2nd gen). Byte 6 is lateral acceleration, byte 7 is longitudinal. I'm not sure the actual scale, but there's a 2x difference between the lateral and longitudinal values.

I'm not sure of which one of those knocks that actually works properly. I am using tactrix [openport 2.0] which is fully support techstream and not having to take a gamble on it.
But then again if you are just sniffing and sending commands (like doing active tests) , i do think the knock one should do that bare minimum.

Programming and other intricate stuff is when things start to get kinda shoddy for the knock offs.

I also use it in conjunction with a homemade arduino canbus sniffer and i'm able to connects it to the pin that's behind the car stereo (this is an unused 6 pin connect hidden behind the stereo dashboard all the way back which carries a canH/canL and constant current. I have a feeling that was probably meant for a a future stereo design to be able to show/tinker with vehicle stuff but perhaps later carried over the the second gen - who knows.

Yep.

Same here. I usually use the doorlocks commands to quickly lock the car with someone waiting inside, where they can't reach for the central lock switch.
Looks like the time is tied to the headlights follow me home function, where the lights will turn off after?

How did you manage to trigger the ACC though?

I lied.. apparently I can't directly trigger it via techstream and has to be in the 'ON' position.

Actually, I may have found a way to trigger the ACC AND the ignition via CanBus [courtesy of Active Testing] which trigger the relays respectively.
Now of course, you would need to have the key in the car. I just ordered a transponder bypass - was going to go totally different route but would be time consuming and probably even more hacky.

There is other list of canbus ids I've compiled like door/truck lock/ windows control/ various lights, buzzer sounds horns that you can manipulate and trigger at will, and even the HVAC (only applies to the HVAC (with the auto climate control obviously).
It will be controlled via Arduino (MKR1500 - IoT/LTE connection0 and also with the canbus shield). it makes the whole unit VERY compact working on unison.
Quite the project so I'm hoping to share it in the future as soon as it comes to fruition. :party0030:

Need a favor - do you have the command to turn off the car, akin to pressing the Start/Stop button when the car is idling?

Ahhh good question. I've yet to find an elegant (straight up) solution for that yet.
There is a command to cut fuel to the engine cylinders though but that's about it at the moment. IT puts the car in ACC mode.
I'll let you know if (and when) I do eventually have a valid solution without manually wiring the ignition/startup wire(s).

Good News!

Such a pain to decipher the CanBus. (Courtesy to SSM4 though - Techstream wasn't able to give me enough).

The hurdle I was encountering has to do with the fact that our vehicle (for some godly reason) has TWO! ignition state that are operated independently of each other.
When we turn on our car it cycles through each start before cranking.
Anyway long story short, I am now able to access those states.
Infact I can trigger three separate states (while the vehicle is completely off):
Ignition 1
Ignition 2
ACC
Cranking

Now I'm not quite sure if the combination of IGN1 and IGN2 = ACC (I'm going to assume it does) or ACC is another separate state. I haven't done a full test yet.
I do know for a fact that triggering IGN2 state almost seems like it's in ACC mode because all the lights power up and radio, dashlights, etc.. but weirdly enough the windows don't roll up/down - Basically the module responsible for that isn't getting power.
This basically means that IGN1 is responsible for that (among other components I've yet to test).

Triggering just the IGN1 state (you can hear some relays clicking but no lights - dash/radio..) helps me roll down the Windows up and down while the complete has been off (for more than 40 sec or the door was opened).:happyanim:
The state responsible for that I believe is IG1, as activates the relay that up the (BCM?) ECU.

I am now able to start the engine from cold start without manually putting it in ACC mode.

I will post the canbus command to send later and perhaps to stop the engine also but I need to make sure it's secured. I would hope it won't let me do that unless the transponder detects key because if you can send this without the key , then oh boy! :confused0068:- In that case I won't post the canbus and PIDs here publicly.

Give me few more days to fully compile things. Remote start with my arduino is becoming a reality now.

Minor Update (After additional testing):
So it seems like the cranking system proceeds like this:
1. ACC --> ACC mode will ONLY starts the radio and provides continuous power to the cigarette's port.

2. IGN1 --> Initiates power to the Door windows (and maybe other components I'm not aware of)

3. IGN2 --> Initiates essential electronics to the rest of the components (dash lights, relays , other ecus ..etc)

4. STSW --> Initiates power to PSC ECU that sends the ECM a 12-volt start switch request voltage to starts the car (starter switch)

Unfortunately, I've yet to find the Canbus address to stop the completely turn off the car and I'm not sure if and when I'm gonna be able to figure out the command :iono:. See my post below as to why and a potential alternative (depending on on your use case especially if you want it as a remote start)

Alright..
Upon further diagnosis I am able to FULLY start the vehicle with just two commands.

First command that put the car into FULL ACC Mode - ACC + IGN1 + IGN2 (kinda like pressing the brake (or clutch for MT) and pushing the start/stop but without cranking) - There is a canbus msg that would trigger all three states at same time.

The Second command that I send basically cranks the engine.

Now here is the caveat, you have to continue sending the the initial FULL ACC Mode canbus message at least once every 5 second else the car would automatically shut off completely.
This ACTUALLY works superb for my use case since I'll be remote starting anyway and i don't have to send a separate shut off command.

I've yet to find a message that can shut off the ACC/IGN1/IGN2 if the car was started by a normal procedure, unfortunately.
The closest I can do is being able to cut fuel to the engine..But car won't completely shut off and would just cut power to engine but not the electrical part which means the ACC and all the lights would remain active. I believe i might be able to eventually figure out the command if i continue to brute force but at this moment I have sorta reached my goal for remote start via my Arduino.

Another thing I discovered that's very crucial to my remote start quest would be the hand-over method when you are ready to start driving the car after the car was started originally from a remote start.
I kind of already thought about just stop sending command to the ecu as soon as the door state changed (from Closed to Opened) or if the brake pedal was pressed. So No biggie!
But then the question would be, well the engine doesn't exactly shut off RIGHT after I stopped sending the command as it takes about 5 seconds to be exact for the engine to shut off. Anyone can just quickly get in, put in gear and start driving , right? -with or without key.
Well apparently the ECU DOES NOT CARE! It still shuts off even if you are in drive. LOL.
Less thing to worry about it. Almost perfect for remote start and quite frankly good enough.

Now there is a caveat though (yea I know), you can actually override that by doing something interesting as soon as you get into the car and the car would switch to the normal state and the engine won't shut off. At this point I can't override the ACC MODE. Doing this override basically switches the car into the normal start that assumed a normal starting operation. I won't mention it here but you can PM me or email me if you are interested.
I am probably going to add that in my code that would basically kill the engine if you try to override but no key is detected - Yes I have the Canbus command that detects if the chip key is nearby or not. Easy fix for that.


Oh before I forgot I also tried sending the remote starting command without eh key presented. Interestingly enough (to my surprise) it actually started but shuts off like a second later indicating to me (in the lcd display) that I need to depress and have the key near the ignition).

Perhaps in the future I'll look into finding the command that would bypass they key and tricking the ecu that the key is presented but not a priority at the moment since i already bought a immobilizer transponder bypass.

So in retrospect after many trials and brute forces, I have the canbus commands that can do this follow while the car is completely off:
unlock/lock doors
unlock trunk
Roll up/down windows
headlight/Tailight on/off
Various (or practically all icons) in the gauge,
Drive Mode (sport/snow for AT)

ACC mode on/off
IGN1 on/off
IGN2 on/off
Crank
Cut Fuel to Engine
HVAC (all functionalities - only applies to the one with dual zones - not the manual ones. Car would also need to be running else it's pointless)

There are other miscellaneous stuff too that i can control remotely but not that important like horn, hazard light, interior buzzer sound, courtesy lights, dome light.
There are also read only status messages to get info like tire pressure/temperature, etc...
---------------------
I am still debating on whether to post all the canbus codes here or not.

Anyway, Now I am ready to finish up the code for my remote start.

I'm using arduino MKR 1500 (with built in 4g cat/nbIoT simcard) with the canbus shield which makes it SUPER portable compared to a conventional remote start kit which would require wire cutting and stuff. Infact the only thing that require some cutting might just be the immobilizer.

Also anyone that want to find a message that control particular function or rather a status message. Feel free to ask and in that case it's just preferable to start a whoile new topic.


Cheer!

To understand this correctly... if the car was started from a remote start and the command is not resent within 5 seconds, the engine would kill itself (fuel cut) or will the entire car turn off?

And to prevent this shutoff from happening, the override command has to be sent?

In this case, the 'chip key is present' command is NOT the same as disabling the immobilizer, to allow the car to start and continue running?

With the headlight/taillights you can basically adopt some form of follow-me-home setup with the Arduino too, lots of possibilities. Would love to work on something more programmable in the future but will have to use with what I have for now.

If you need any testing with the canbus commands I can help out for sure. As mentioned before I'm using an ELM327 to send/receive commands, though it's a bit limited as ELM327 can't send more than a certain number of bytes in a single frame (IIRC turning on gauge lights require payloads larger than what ELM327 can support). I'm on a 2015 MT GT86 prefacelift.

Certainly exciting - one step closer towards a DIY remote start :)

if you don't continue to send the same message to the ECU for at least once per 5 second the car WILL shut off - meaning engine and acc . It completely shuts off and not just cut fuel to engine. Full shutdown regardless of the gear status be it drive, reverse, neutral,...

One more important thing I forgot to mention is that the car will ONLY start in Park or Neutral gear when sending the remote command. This also provides less code for me to in terms of the checklist compensation before starting.



Yes, the fob 'chipped' key command is only just for status reading. It doesn't change anything regarding the status of the key.
Disabling the immobilizer would be godsend though if I can find the key/seed and the algorithm performed between the immobilizer and the bus system. Quite difficult I must say.
So best way is basically going straight at the ecu and find a way to send a command that would trick the ecu that the key is detected nearby and it's a valid one. I haven't gotten to that yet.
If you know your way around here is the canbus id for the smark key system:
CanID: 0x750 (Main Body)
PID: (0xB5)
:thumbsup:

I don't understands what you mean by the "follow-me-home" phrase. That's interesting lol.

I basically have two CANBUS connected to the car at same time to be able to write/decode/ready the CANBUS messages:
Tactrix Openport 2.0 and CANduino (which is basically an arduino nano but with built in canbus Transceiver ).

Tactrix plugged in to the obd 2.
CANduino connects to the CANbus through the unused CANbus plug (close at the firewall) behind the radio system.

incase you are interested:
https://www.tindie.com/products/mass...-with-can-bus/

So At this moment I'm gonna be using the gut of an extra keyfob to bypass the immobilizer. Of course it's going to be hidden away somewhere deep in the car and since the fob will be powered directly by the arduino it will only be instantiated in a [split] second just to start the car and then powered back down.