CANbus Coding in FRS/BRZ

[dpfarr]

Originally Posted by ojuniour

are you referring to the mid refresh (2017+) in-dash lcd screen sowing the g-force meter for the brz?

The very same.

[Luns]

Originally Posted by dpfarr

Additionally, unlocking the accelerometer would be awesome. I’m very surprised someone hasn’t figured that one out yet.

Courtesy of timurr: https://github.com/timurrrr/RaceChronoDiyBleDevice

CAN ID 208 (315 for 2nd gen). Byte 6 is lateral acceleration, byte 7 is longitudinal. I'm not sure the actual scale, but there's a 2x difference between the lateral and longitudinal values.

[ojuniour]

Originally Posted by ajaxburger

I have a Carista adapter and can confirm that the seatbelt chime is something that can be adjusted in Carista as well as things like the sensitivity of the auto headlight sensor in the dash.. No high beam + fog settings though. From what I understand, their team needs to enable the option for you to access it if it's even doable.

I will say though it's a bit barren compared to what I expect (coming from VCDS and Bimmercode vehicles). Not worth the price of the dongle / subscription to license in my opinion.

Techstream definitely sounds far more promising for the price though may be a bit more complicated than some are comfortable with.



Have considered picking up a tech stream dongle, just don't have a laptop to mess around with it on. Is it worth picking up one of the Amazon $49 dongles that comes with version 18?

I'm not sure of which one of those knocks that actually works properly. I am using tactrix [openport 2.0] which is fully support techstream and not having to take a gamble on it.
But then again if you are just sniffing and sending commands (like doing active tests) , i do think the knock one should do that bare minimum.

Programming and other intricate stuff is when things start to get kinda shoddy for the knock offs.

I also use it in conjunction with a homemade arduino canbus sniffer and i'm able to connects it to the pin that's behind the car stereo (this is an unused 6 pin connect hidden behind the stereo dashboard all the way back which carries a canH/canL and constant current. I have a feeling that was probably meant for a a future stereo design to be able to show/tinker with vehicle stuff but perhaps later carried over the the second gen - who knows.

[ojuniour]

Originally Posted by ajaxburger

I have a Carista adapter and can confirm that the seatbelt chime is something that can be adjusted in Carista as well as things like the sensitivity of the auto headlight sensor in the dash.. No high beam + fog settings though. From what I understand, their team needs to enable the option for you to access it if it's even doable.

I will say though it's a bit barren compared to what I expect (coming from VCDS and Bimmercode vehicles). Not worth the price of the dongle / subscription to license in my opinion.

Techstream definitely sounds far more promising for the price though may be a bit more complicated than some are comfortable with.



Have considered picking up a tech stream dongle, just don't have a laptop to mess around with it on. Is it worth picking up one of the Amazon $49 dongles that comes with version 18?

Originally Posted by Luns

Courtesy of timurr: https://github.com/timurrrr/RaceChronoDiyBleDevice

CAN ID 208 (315 for 2nd gen). Byte 6 is lateral acceleration, byte 7 is longitudinal. I'm not sure the actual scale, but there's a 2x difference between the lateral and longitudinal values.

Yep.

[Compelica]

Originally Posted by ermax

You can roll the windows up/down with CANbus the problem is you can't do it if the ignition is off. You can also control the doorlocks via CANbus but again, only when the ignition is on. I was really wanting to build my own proxy unlock via an Arduino connected to the canbus but it's not possible because of the ignition requirement.

Same here. I usually use the doorlocks commands to quickly lock the car with someone waiting inside, where they can't reach for the central lock switch.

Originally Posted by ojuniour

For now, I've found a way around that by triggering the ACC mode. This is NOT Ideal at all but it works in the meantime.
I will keep sniffing techstream so find a way to trigger and send power to the module responsible. I mean when you think about it. you can still roll down/up window even after the ignition is off for about 40 seconds (as long as the door isn't opened during that time span).
Another Bonus, I am able to control the HVAC too (techstream really does come in handy

Looks like the time is tied to the headlights follow me home function, where the lights will turn off after?

How did you manage to trigger the ACC though?

[ojuniour]

Originally Posted by Compelica

Same here. I usually use the doorlocks commands to quickly lock the car with someone waiting inside, where they can't reach for the central lock switch.

Looks like the time is tied to the headlights follow me home function, where the lights will turn off after?

How did you manage to trigger the ACC though?

I lied.. apparently I can't directly trigger it via techstream and has to be in the 'ON' position.

[ojuniour]

Originally Posted by Compelica

Same here. I usually use the doorlocks commands to quickly lock the car with someone waiting inside, where they can't reach for the central lock switch.

Looks like the time is tied to the headlights follow me home function, where the lights will turn off after?

How did you manage to trigger the ACC though?

Actually, I may have found a way to trigger the ACC AND the ignition via CanBus [courtesy of Active Testing] which trigger the relays respectively.
Now of course, you would need to have the key in the car. I just ordered a transponder bypass - was going to go totally different route but would be time consuming and probably even more hacky.

There is other list of canbus ids I've compiled like door/truck lock/ windows control/ various lights, buzzer sounds horns that you can manipulate and trigger at will, and even the HVAC (only applies to the HVAC (with the auto climate control obviously).
It will be controlled via Arduino (MKR1500 - IoT/LTE connection0 and also with the canbus shield). it makes the whole unit VERY compact working on unison.
Quite the project so I'm hoping to share it in the future as soon as it comes to fruition.

[Compelica]

Originally Posted by ojuniour

Actually, I may have found a way to trigger the ACC AND the ignition via CanBus [courtesy of Active Testing] which trigger the relays respectively.
Now of course, you would need to have the key in the car. I just ordered a transponder bypass - was going to go totally different route but would be time consuming and probably even more hacky.

There is other list of canbus ids I've compiled like door/truck lock/ windows control/ various lights, buzzer sounds horns that you can manipulate and trigger at will, and even the HVAC (only applies to the HVAC (with the auto climate control obviously).
It will be controlled via Arduino (MKR1500 - IoT/LTE connection0 and also with the canbus shield). it makes the whole unit VERY compact working on unison.
Quite the project so I'm hoping to share it in the future as soon as it comes to fruition.

Need a favor - do you have the command to turn off the car, akin to pressing the Start/Stop button when the car is idling?

[ojuniour]

Originally Posted by Compelica

Need a favor - do you have the command to turn off the car, akin to pressing the Start/Stop button when the car is idling?

Ahhh good question. I've yet to find an elegant (straight up) solution for that yet.
There is a command to cut fuel to the engine cylinders though but that's about it at the moment. IT puts the car in ACC mode.
I'll let you know if (and when) I do eventually have a valid solution without manually wiring the ignition/startup wire(s).

[ojuniour]

Originally Posted by Compelica

Need a favor - do you have the command to turn off the car, akin to pressing the Start/Stop button when the car is idling?

Good News!

Such a pain to decipher the CanBus. (Courtesy to SSM4 though - Techstream wasn't able to give me enough).

The hurdle I was encountering has to do with the fact that our vehicle (for some godly reason) has TWO! ignition state that are operated independently of each other.
When we turn on our car it cycles through each start before cranking.
Anyway long story short, I am now able to access those states.
Infact I can trigger three separate states (while the vehicle is completely off):
Ignition 1
Ignition 2
ACC
Cranking

Now I'm not quite sure if the combination of IGN1 and IGN2 = ACC (I'm going to assume it does) or ACC is another separate state. I haven't done a full test yet.
I do know for a fact that triggering IGN2 state almost seems like it's in ACC mode because all the lights power up and radio, dashlights, etc.. but weirdly enough the windows don't roll up/down - Basically the module responsible for that isn't getting power.
This basically means that IGN1 is responsible for that (among other components I've yet to test).

Triggering just the IGN1 state (you can hear some relays clicking but no lights - dash/radio..) helps me roll down the Windows up and down while the complete has been off (for more than 40 sec or the door was opened).
The state responsible for that I believe is IG1, as activates the relay that up the (BCM?) ECU.

I am now able to start the engine from cold start without manually putting it in ACC mode.

I will post the canbus command to send later and perhaps to stop the engine also but I need to make sure it's secured. I would hope it won't let me do that unless the transponder detects key because if you can send this without the key , then oh boy! - In that case I won't post the canbus and PIDs here publicly.

Give me few more days to fully compile things. Remote start with my arduino is becoming a reality now.

[ojuniour]

Minor Update (After additional testing):
So it seems like the cranking system proceeds like this:
1. ACC --> ACC mode will ONLY starts the radio and provides continuous power to the cigarette's port.

2. IGN1 --> Initiates power to the Door windows (and maybe other components I'm not aware of)

3. IGN2 --> Initiates essential electronics to the rest of the components (dash lights, relays , other ecus ..etc)

4. STSW --> Initiates power to PSC ECU that sends the ECM a 12-volt start switch request voltage to starts the car (starter switch)

[ojuniour]

Originally Posted by Compelica

Need a favor - do you have the command to turn off the car, akin to pressing the Start/Stop button when the car is idling?

Unfortunately, I've yet to find the Canbus address to stop the completely turn off the car and I'm not sure if and when I'm gonna be able to figure out the command . See my post below as to why and a potential alternative (depending on on your use case especially if you want it as a remote start)

[ojuniour]

Alright..
Upon further diagnosis I am able to FULLY start the vehicle with just two commands.

First command that put the car into FULL ACC Mode - ACC + IGN1 + IGN2 (kinda like pressing the brake (or clutch for MT) and pushing the start/stop but without cranking) - There is a canbus msg that would trigger all three states at same time.

The Second command that I send basically cranks the engine.

Now here is the caveat, you have to continue sending the the initial FULL ACC Mode canbus message at least once every 5 second else the car would automatically shut off completely.
This ACTUALLY works superb for my use case since I'll be remote starting anyway and i don't have to send a separate shut off command.

I've yet to find a message that can shut off the ACC/IGN1/IGN2 if the car was started by a normal procedure, unfortunately.
The closest I can do is being able to cut fuel to the engine..But car won't completely shut off and would just cut power to engine but not the electrical part which means the ACC and all the lights would remain active. I believe i might be able to eventually figure out the command if i continue to brute force but at this moment I have sorta reached my goal for remote start via my Arduino.

Another thing I discovered that's very crucial to my remote start quest would be the hand-over method when you are ready to start driving the car after the car was started originally from a remote start.
I kind of already thought about just stop sending command to the ecu as soon as the door state changed (from Closed to Opened) or if the brake pedal was pressed. So No biggie!
But then the question would be, well the engine doesn't exactly shut off RIGHT after I stopped sending the command as it takes about 5 seconds to be exact for the engine to shut off. Anyone can just quickly get in, put in gear and start driving , right? -with or without key.
Well apparently the ECU DOES NOT CARE! It still shuts off even if you are in drive. LOL.
Less thing to worry about it. Almost perfect for remote start and quite frankly good enough.

Now there is a caveat though (yea I know), you can actually override that by doing something interesting as soon as you get into the car and the car would switch to the normal state and the engine won't shut off. At this point I can't override the ACC MODE. Doing this override basically switches the car into the normal start that assumed a normal starting operation. I won't mention it here but you can PM me or email me if you are interested.
I am probably going to add that in my code that would basically kill the engine if you try to override but no key is detected - Yes I have the Canbus command that detects if the chip key is nearby or not. Easy fix for that.


Oh before I forgot I also tried sending the remote starting command without eh key presented. Interestingly enough (to my surprise) it actually started but shuts off like a second later indicating to me (in the lcd display) that I need to depress and have the key near the ignition).

Perhaps in the future I'll look into finding the command that would bypass they key and tricking the ecu that the key is presented but not a priority at the moment since i already bought a immobilizer transponder bypass.

So in retrospect after many trials and brute forces, I have the canbus commands that can do this follow while the car is completely off:
unlock/lock doors
unlock trunk
Roll up/down windows
headlight/Tailight on/off
Various (or practically all icons) in the gauge,
Drive Mode (sport/snow for AT)

ACC mode on/off
IGN1 on/off
IGN2 on/off
Crank
Cut Fuel to Engine
HVAC (all functionalities - only applies to the one with dual zones - not the manual ones. Car would also need to be running else it's pointless)

There are other miscellaneous stuff too that i can control remotely but not that important like horn, hazard light, interior buzzer sound, courtesy lights, dome light.
There are also read only status messages to get info like tire pressure/temperature, etc...
---------------------
I am still debating on whether to post all the canbus codes here or not.

Anyway, Now I am ready to finish up the code for my remote start.

I'm using arduino MKR 1500 (with built in 4g cat/nbIoT simcard) with the canbus shield which makes it SUPER portable compared to a conventional remote start kit which would require wire cutting and stuff. Infact the only thing that require some cutting might just be the immobilizer.

Also anyone that want to find a message that control particular function or rather a status message. Feel free to ask and in that case it's just preferable to start a whoile new topic.


Cheer!

[Compelica]

Now here is the caveat, you have to continue sending the the initial FULL ACC Mode canbus message at least once every 5 second else the car would automatically shut off completely.

Another thing I discovered that's very crucial to my remote start quest would be the hand-over method when you are ready to start driving the car after the car was started originally from a remote start.
I kind of already thought about just stop sending command to the ecu as soon as the door state changed (from Closed to Opened) or if the brake pedal was pressed. So No biggie!
But then the question would be, well the engine doesn't exactly shut off RIGHT after I stopped sending the command as it takes about 5 seconds to be exact for the engine to shut off. Anyone can just quickly get in, put in gear and start driving , right? -with or without key.
Well apparently the ECU DOES NOT CARE! It still shuts off even if you are in drive. LOL.
Less thing to worry about it. Almost perfect for remote start and quite frankly good enough.

To understand this correctly... if the car was started from a remote start and the command is not resent within 5 seconds, the engine would kill itself (fuel cut) or will the entire car turn off?

And to prevent this shutoff from happening, the override command has to be sent?

I am probably going to add that in my code that would basically kill the engine if you try to override but no key is detected - Yes I have the Canbus command that detects if the chip key is nearby or not. Easy fix for that.

Perhaps in the future I'll look into finding the command that would bypass they key and tricking the ecu that the key is presented but not a priority at the moment since i already bought a immobilizer transponder bypass.

In this case, the 'chip key is present' command is NOT the same as disabling the immobilizer, to allow the car to start and continue running?

With the headlight/taillights you can basically adopt some form of follow-me-home setup with the Arduino too, lots of possibilities. Would love to work on something more programmable in the future but will have to use with what I have for now.

If you need any testing with the canbus commands I can help out for sure. As mentioned before I'm using an ELM327 to send/receive commands, though it's a bit limited as ELM327 can't send more than a certain number of bytes in a single frame (IIRC turning on gauge lights require payloads larger than what ELM327 can support). I'm on a 2015 MT GT86 prefacelift.

Certainly exciting - one step closer towards a DIY remote start