[Compelica]

Originally Posted by ojuniour

Yea..I tried not to go that route of actually completely turning off the engine as soon as the door is opened. I will only shut it off if the user attempts to drive the car and no valid key fob is available (which would be triggered as soon as the door state changes from closed to open).

Remote start is merely convenient to set the car to a nice/modest room temp based on the outside temp usually.
I live on the east coast, so this comes in very handy during the winter season and also during those summer heat waves. Having to step into the car, wait a few minutes to warm up while freezing your nuts off or the during the summer in which sometimes i basically have to quickly turn on the car, set AC (if it wasn't previously set), crack open the window and quickly get out of the car because of how HOT the inside can be.

That's my main reason for doing this. I mean i could have easily just go buy and install existing remote starters but what's the fun in that? Besides, those aren't exactly cheap and the ones with LTE remote start tend to be wonky and can sometimes take up to 15 seconds to send the command..among other things. At least I can control everything including my own server implementation.

Anyway, enough rant.

Now Be warned, For the Ignition 1, Ignition 2, and ACC commands needs to be sent one at a time.
Meaning if you are CONTINUOUSLY sending IGN1 message, you can't send IGN2, and ACC CONTINUOUSLY at same time.
You will have to stop sending the other message before you send another.
This only applies to the ignition states.
IF you don't HEED, then you will potentially soft lock your vehicle from starting UNTIL you clear 'engine code'.
Yea I learned my lesson. Even though the Check engine doesn't come up in the dash, the canbus is still internally confused when you send those messages simultaneously. Make sure you have an OBD adapter to perform the reset. Disconnecting the battery should also do the same (I think - not sure). I believe it's call "Cancel Code".
Good news though is that the canbus can trigger both IGN1 and IGN2, and even ACC at same time as long as you send the right code. You just can't manually send both together as explained above - I can't reiterate that enough).

here are the commands:

Ignition ACC
-----------------------------------------------------
//CanBus ID
ID: 0x750
//CanBus DATA bits
ACC: 0xE9 0x04 0x30 0x01 0x00 0x10 0x00 0x00
IGN1: 0xE9 0x04 0x30 0x01 0x00 0x20 0x00 0x00
IGN2: 0xE9 0x04 0x30 0x01 0x00 0x40 0x00 0x00
IGN1_IGN2: 0xE9 0x04 0x30 0x01 0x00 0x60 0x00 0x00
ACC_IGN1_IGN2: 0xE9 0x04 0x30 0x01 0x00 0x70 0x00 0x00

Toyobaru decides to use a nicely sequential representation here [5th bit] (How nice of them. lol)
If you only send the message once, the action is triggered and I believe it takes about 15 to 45 secs before the car system automatically deactivates (turn offs) the action. You can continue to send the message at least once per 15 seconds to keep the action alive.


Fuel Cut
------------------------------------------------------
//CanBus ID
ID: 0x7E0
//CanBus DATA bits
All Cylinder Fuel Cut: 0x06 0x30 0x1C 0x05 0x0F 0xA5 0x00 0x00


Windows
------------------------------------------------------
//CanBus ID
ID: 0x750
//
//CanBus DATA bits
Driver Full Up: 0xEC 0x04 0x30 0x01 0x01 0x80 0x00 0x00
Driver Full Down: 0xEC 0x04 0x30 0x01 0x01 0x40 0x00 0x00
Pass Full Up: 0xEC 0x04 0x30 0x01 0x01 0x20 0x00 0x00
Pass Full Down: 0xEC 0x04 0x30 0x01 0x01 0x10 0x00 0x00

One caveat regarding the windows ( I believe it applies to HVAC too) is that the car needs to have its Ignition state active prior to performing the window actions.
So basically you send the IGN1 (could have been IGN2 don't remember) which will power up the module for the window control system (At this point is when I realize why we have two ignition states - anyway moving on), then you can send the window commands as desired. You only have to send the command once, and the car would perform the action.
Now regarding the windows there are also some variations like roll up (or down) 1/3 or 2/3 or even at any point, but that is slightly more involved. You have to send a preliminary message first that would trigger that state.
I'm gonna assume you only care about full up or full down anyway.

Aaaand, there ya go!
For each of any of the commands the canbus will return a confirmation message. I am not going to include them since you will probably get them anyway as soon as you send these commands but I did include the receiving CanBus ID you should be listening to below:
Sending at 0x750 , returns confirmation at 0x758
Sending at 0x7E0 , returns confirmation at 0x7E8

Cheers!

Much appreciated @ojuniour.

As expected it works on my 86 as well, albeit with slightly different behavior. For example, ACC+IGN1+IGN2 only lasts for about 5 seconds before shutting off, and the window control commands have to be fired multiple times until it fully opens/closes. And in my logger (had to dig out the other stuff) - SSM4 is doing the same thing unlike yours which the entire window goes up/down with the command is only issued once.

Also, running ACC+IGN1+IGN2 when the car alarm is armed, triggers the alarm.

My fuel cut command is slightly different from yours, but it works all the same. It was captured from Techstream though.

Since ACC+IGN1+IGN2 is initiated by the BIU (with header 750), the turn off command should be coming from there as well. I can probably use the ELM327 to monitor and find that command somehow.