Advertise on DISCO3.CO.UK
Forum · Gallery · Wiki · Shop · Sponsors
DISCO3.CO.UK > In Car Electronics (D3)

Trying to sniff CAN bus - Without breaking my Disco! (oops?)
Post Reply  Down to end
Page 2 of 2 <12
McAdam
 


Member Since: 21 Nov 2020
Location: Canary Islands
Posts: 129

Spain 2005 Discovery 3 4.4 V8 HSE Auto Zambezi SilverDiscovery 3

Chris, If you want to do lots of logging etc... I would suggest going with a Raspberry Pi based solution.
Could be worked out to store in an internal database, then sync online when it connects to your wifi at home.

Now I am getting really interested in this all Very Happy
 Pre-Production
D3 V8 #264
LHD '04 HSE
Living its life as a 50/50 On/Off road car exploring the Canary Islands 
 
Post #219715729th Dec 2020 6:36 pm
View user's profile Send private message View poster's gallery Reply with quote
chrisoverson
 


Member Since: 10 Dec 2020
Location: Bideford
Posts: 29

United Kingdom 2006 Discovery 3 TDV6 HSE Auto Tonga GreenDiscovery 3

Thanks for the idea Smile

I'm currently going to work with the CanHacker software, which I think can save a list of everything it detects already, and filter to various IDs etc - the arduino outputs all the data from the can bus to that software on my laptop, and I've got a car charger for my laptop, so it works nicely.

If that doesn't quite fit the bill then Pi might be another option certainly. I tend to avoid Pis in general... just seems like they have a lot of baggage running an entire operating system when I only need them to do a simple task, but I'm sure they have their place. I tend to like the dedicated microcontrollers that only do one job, but that's only because it's what I'm used to.

Once I've built up a good list of what everything does I can start making my own custom software to do something interesting with it, but that's likely to be involving an ESP32 board with an onboard sim card for reporting data back and remote control Very Happy
  
Post #219716229th Dec 2020 6:44 pm
View user's profile Send private message View poster's gallery Reply with quote
Prette
 


Member Since: 16 Mar 2020
Location: Previously Stoke-ST4 (pre-pandemic), Mostly The Hague (NL) partially Lyngby (DK) certainly somewhere
Posts: 160

2007 Discovery 3 TDV6 HSE Lux Auto Causeway GreyDiscovery 3

Nice idea Chris, I would love to help this development if need any hand.

my time of programming and such are long gone but I still hold some of that knowledge. If I can be of any assistance, let me know. These days I am mostly playing with Arduino/ESP-32/rPi0 etc... buiding servos and comms and .... well... anything really.

I would die to see all of that data (decripted) being displayed directly to the D3 original screen too, perhaps using the TV input. I am a supporter of original appearances, hence the idea to adapt the original screen to display the data.

So far, my (bad) experience was to read data from various ECUs while driving. As soon as odb access the particular ECU it stops to communicate with the others and thow a bunch of errors (cleared after a restart) but hey... it was fun. Whistle and scary Rolling with laughter

Also count me in for guinea-pig or beta tester if needed.
  
Post #219716729th Dec 2020 6:53 pm
View user's profile Send private message View poster's gallery Reply with quote
chrisoverson
 


Member Since: 10 Dec 2020
Location: Bideford
Posts: 29

United Kingdom 2006 Discovery 3 TDV6 HSE Auto Tonga GreenDiscovery 3

Thanks! Any help will be appreciated and probably needed lol.

I'm programming daily in my work, but normally high level languages like PHP, Javascript and the likes, so ashamedly I'm not that used to dealing with bits, bytes, hexadecimal and the nitty gritty protocols, so I'll need to refresh myself with that side of things. Once I've got the foundations right the rest should be a doddle...

Rolling with laughter

I'm leaning both ways... I want new features but I don't want to mess up the original look either too much. I'm almost certainly wanting to replace the in-built nav screen with a newer, higher resolution tablet of some description, but without wanting to lose the 4x4 info. I'll virtually never use it, but I just don't want to be worse-off than OEM out of principle.

So a modern nav and media interface is part of the plan. The other part is remote control and tracking.

Building my own protocol and hosting my own server should hopefully mean high speed and low bandwidth, as it's not having to do much handshaking and identifying, so I'm going for real-time telemetry from the car whilst it's in motion, but that's the long term goal.

Initially, I'll be happy with figuring out how to instruct the car to defrost once the FBH gets up to temp, and monitoring to make sure the FBH is actually working, rather than my current solution which uses a relay to push the flame button on the 1533 timer and just assume that's done the job. That on its own could be a standalone item that I'd love to make into an inexpensive kit.
  
Post #219717129th Dec 2020 7:03 pm
View user's profile Send private message View poster's gallery Reply with quote
Prette
 


Member Since: 16 Mar 2020
Location: Previously Stoke-ST4 (pre-pandemic), Mostly The Hague (NL) partially Lyngby (DK) certainly somewhere
Posts: 160

2007 Discovery 3 TDV6 HSE Lux Auto Causeway GreyDiscovery 3

I feel we are on the same page and moving towards the same thing. I agree with all that.

I currenlty see if my FBH is working by reading the live stream data using the odb: whenever the fuel pumpl is on, the stuff is running. My next step is to connect a simple micro-LED with 560R in series with the FBH fuel pump. so I will have a direct visual input somewhere on my dash.

In fact, I can see all the FBH operations using the iCarsoft (fan speed, glowplug, etc.. ) I can only assume this data is also floating in the CAN.

Besides, I can also see the Operation State of the FBH, by means of numbers which I still cannot fully comprehend. Here is a list of what I figured so far:

Operating state
4 system ready Nothing on
6 ON (no glow)
7 Warming (Fuel + Glow + high fan)
12 Start Water pump + heater fan + vent
16 check? no glow h fan vent standby?
17 ON (no glow)
20 Stablished Burning
26 Restarting? no fuel high /low fan no glow
27 ????
46 Water Pump Water pump + heater fan + vent + glow
47 Pre-heat (Water Pump + Glow + low fan)
40 OFF (???) (waiting for car fan signal)
45 flame check?
0 retry??
16 check? no glow h fan vent standby?
32 collant at temperature (no need for FBH)

Please, bear in mind that all these are guesses based on experience only.
Click image to enlarge
  
Post #219717829th Dec 2020 7:20 pm
View user's profile Send private message View poster's gallery Reply with quote
epninety
 


Member Since: 12 Oct 2012
Location: Hampshire
Posts: 327

Wales 2005 Discovery 3 TDV6 HSE Auto Java BlackDiscovery 3

When I bought the car about 6 years ago, I used the diagnostic interface to control the FBH. In fact, I sort of did it twice, rewriting messages between a webasto telestart and the FBH. Since the LR fitted FBH won't respond to telestart commands, I simply rewrote the messages in each direction to identify the sender as a diagnostic interface controller.
Used a very small STM32 microcontroller and probably cost about £10 to make (I already had a telestart going spare).

I took it out when the FBH failed a couple of years ago, never got around to refitting it...
  
Post #219718929th Dec 2020 7:33 pm
View user's profile Send private message View poster's gallery Reply with quote
OGif
 


Member Since: 15 Feb 2022
Location: Ontario
Posts: 2

Canada 

epninety wrote:
Just for interest, here's a little video of the D3 dash running on my bench, all controlled from a microcontroller using commands I reverse engineered from sniffing the canbus.

http://www.ep90.com/downloads/D3dashboard.mp4


Awesome work. I have a project like this one to control an Instrument Cluster.
Could you please share the canbus IDs or Arduino sketch? Thank you!
  
Post #227898815th Feb 2022 4:21 pm
View user's profile Send private message View poster's gallery Reply with quote
epninety
 


Member Since: 12 Oct 2012
Location: Hampshire
Posts: 327

Wales 2005 Discovery 3 TDV6 HSE Auto Java BlackDiscovery 3

Sorry, I dont use Arduino. Actually, strike that, I'm sorry I can't be of more help, but I'm not sorry about the Arduinos Laughing

My datalogging of the D3 was done using Python on a Raspberry Pi with a CAN interface card.

My control of the IPC was done using an STM32 based controller that I designed for something else, which is programmed in either C or Micropython depending on the job at hand. I haven't touched this in a long while, but I think it was using Micropython just for the speed of getting things going.

Below are my notes from the time. I could probably dig out the uPython code if it was useful.

Dave

Apologies to the non-techies, the following will look like gobbledygook.


HS Bus :-

##### MsgID 0979BAB0

Associated with the gearbox.

0979BAB0#8880008650F7FF0C makes the IPC drop the error and indicate the gearbox is in park momentarily. All tested values indicate park.

0979BAB0#80D80086C2F4605D N
0979BAB0#87D80086C2F4605D R
0979BAB0#88D80086C2F4605D P
0979BAB0#89D80086C2F4605D D
0979BAB0#89A000B6C2F7FF4D Sport Mode D
0979BAB0#8AA000BEC2F7FF1D Command Shift 1
0979BAB0#8AA000BEC2F7FF2D Command Shift 2
0979BAB0#8AA000BEC2F7FF3D Command Shift 3
0979BAB0#8AA000BEC2F7FF4D Command Shift 4
0979BAB0#8AA000BEC2F7FF5D Command Shift 5
0979BAB0#8AA000BEC2F7FF6D Command Shift 6

##### MsgID 0BD5FDF0

Change mask is 000f00001fff0100 from a longer datalog.

0BD5FDF0#000BE0141123FF sets the speedo to 27mph

0BD5FDF0#0000E0141C7FFE sets 45mph

1E7F = 49mph
2E7F = 75mph
3E7F = 101mph
4E7F = 127mph
4FFF = 130mph

0x5000 = 20480 = 130mph

So set value to 157 * speed (mph)

(or set the low byte to 00, and set the high byte to mph/2 ?)

Seems likely to be Speed in kmh x 100 ?? 130 mph = 208kmh.
20800d = 5140h



##### MsgID 108CF1F0

108CF1F0#00C0FF0465C821C8 Turns off the ABS warning and skid control warning light.

data[0]
0x08 gives 'HDC switched off' message
0x01 puts ABS warning light ON

data[3]
0x02 HDC lamp ON
0x01 HDC lamp flashing

data[6]
0x80 traction control lamp yellow
0x40 traction controll lamp flashing yellow

##### MsgID 17ADBF70

17ADBF70#0030005FFE0000A6 Gives 'Transmission Fault Traction Reduced'

Can also light low range indicator

data[7]
0x02 High Range (low range lamp off)
0x01 Low Range FLASH
0x00 Low Range lamp ON

##### MsgID 17B452B0

17B452B0 [7] 02 EC 76 6E 40 C0 C8 gives 'Park Brake Fault'

##### MsgID 17B80030

17B80030#20 turns OFF airbag warning, turns ON seatbelt warning.

Bit 0x80 turns airbag warning ON.

Bit 0x04 set turns OFF seatbelt warning.

##### MsgID 17BDFFE0

Sends the rev counter briefly to some rpm

17BDFFE0#3FE0233407
17BDFFE0#3F40234407
17BDFFE0#3EC0234007
17BDFFE0#3FA0233C07
17BDFFE0#4080233807
17BDFFE0#40C0233707
17BDFFE0#3FE0233407
17BDFFE0#3EC0233407

cansend can1 17BDFFE0#3FE03F3407 5200rpm
cansend can1 17BDFFE0#3FE0353407 4700rpm
cansend can1 17BDFFE0#3FE0343407 4500rpm
cansend can1 17BDFFE0#3FE0333407 4300rpm
cansend can1 17BDFFE0#3FE02F3407 3500rpm
cansend can1 17BDFFE0#3FE0243407 1000rpm

Change mask : 0xffff2fffb7000000,

##### MsgID 17CCE6A0

17CCE6A0#40BD1C0040C8 Briefly turned off the stability control warning

Change mask 0x2007000402000000

data[0]

0x10 Suspension low limit icon
0x20 Suspension Low height icon
0x60 Suspecions super extended icon

data[2]

0x80 Yellow stability warning lamp ON
0x40 Yellow stability warning lamp FLASH

data[4]

0x06 Ding Ding
0x04 Ding Dong
0x02 Ding ding ding ding bloody ding



##### MsgID 17D80420

17D80420#928F89FC2780 sets Temp gauge at mid value

[0x92, 0x8F, 0x49, 0xFC, 0x27, 0x80] reads min

[0x92, 0x8F, 0x69, 0xFC, 0x27, 0x80] reads min

[0x92, 0x8F, 0x79, 0xFC, 0x27, 0x80] reads just below 1/4 scale

6D = BLUE
77 = MIN
7D = 1/4
A0 = MID
B1 = 3/4
B3 = MAX
B4 = RED
B5 = WARNING LIGHT ON

values 96-127 in the last byte put the engine management warning light on!

change mask 0xffffffffffa70000

##### MsgID 17E012B0

Terrain response knob. 17E012B0#0010 no visible effect but 'System Fault, special programs not available' at end of sequence. Change mask 0010000000000000

##### MsgID 17E49220

17E49220#0000000019D05194 turns OFF the battery warning light.

17E49220#0000800019D00079 turns ON the battery warning light.

The 8 is the key

Change mask 0xFFFFFFFF19DCFFFF

Also removes 'Engine System Fault' message from the dash.

##### MsgID 17E80420

Glowplug light and some warning messages

6 byte message

d[4]
0x80 'Water in Fuel'
0x40 'Cooling System Fault - Monitor Gauge'
0x10 'Reduced Engine Performance'

d[5]
0x80 Glowplug warning ON

MS Bus :-

###### MSgID 11540020

MSgID 11540020 carries text for info display on instrument cluster

Test message for dash info display

(0.1) can0 11540020#20507574206D6500
(0.2) can0 11540020#20696E2032426501
(0.3) can0 11540020#7820000000000002
(0.4) can0 11540020#0000000000000003

Seen working as a single line 16 char message.

Message is flushed to screen on the last packet. Sending just the last packet repeats the previous message. Message only remains onscreen for a limited time, or if a more important message is posted.

I think multi line messages are possible though (IID?)

###### MsgID 06840BE0

MsgID 06840BE0 carries the dashboard temperature indicator

can0 06840BE0#0000FE30F4012038 - shows +214C on dash.
^^

Range -40C (0x00) to +214C (0xFE) - 0xFF is ignored

Remains displayed only for ~ 1sec.

###### MsgID 13800020

MsgID 13800020#171500A0000000 carries the clock time.

can0 13800020#173B00A0000000 (173B = 23:59)
^ ^

Remains displayed only for ~ 1sec.

###### MsgID 08AC0AB0

msgs=[
b'\x00\x00\x30\x40\x00\x00\x00', # LH IND
b'\x00\x00\x70\x40\x00\x00\x00', # LH IND + TRAILER
b'\x00\x00\x08\x80\x00\x00\x00', # RH IND
b'\x00\x00\x48\x80\x00\x00\x00', # RH IND + TRAILER
b'\x00\x00\x38\x80\x00\x00\x00', # HAZARDS
b'\x00\x00\x78\x80\x00\x00\x00', # HAZARDS + TRAILER
]

  
Post #227899615th Feb 2022 4:44 pm
View user's profile Send private message View poster's gallery Reply with quote
Green Land Rover
 


Member Since: 21 Oct 2017
Location: Stourbridge
Posts: 408

United Kingdom 2014 Discovery 4 3.0 SDV6 HSE Auto Aintree GreenDiscovery 4

If you're seriously considering installing something like this permanently, might be wise to go with a passive way of reading the CAN bus like this: -

https://www.sailesmarketing.com/shop/can-b...an-reader/

You don't want your homemade hardware falling over and stopping the bus from operating when you're in lane 3 of the motorway doing 70! Thumbs Up
 Discovery 4 HSE - Aintree Green
Freelander 2 TD4 SE Automatic - Tonga Green
Defender XS - Tonga Green - Gone Now
Freelander 1 Td4 ES Manual - Epsom Green - Gone Now
Freelander 1 Td4 Kalahari SE - Epsom Green - Gone Now
Freelander 1 XEi - Epsom Green - Gone Now

www.greenlandrover.uk

 
 
Post #227928016th Feb 2022 8:14 pm
View user's profile Send private message View poster's gallery Reply with quote
OGif
 


Member Since: 15 Feb 2022
Location: Ontario
Posts: 2

Canada 

Thank you Dave for the quick answer and for sharing all the CAN IDs you have.
This will be very helpful Thumbs Up

By any chance would you know how to turn on the instrument cluster light?

When watching the video I thought it was an Arduino from the board size which happens to be pretty much the same as a Raspberry PI.

Thank you again! Very Happy
Olivier
  
Post #227932117th Feb 2022 4:55 am
View user's profile Send private message View poster's gallery Reply with quote
epninety
 


Member Since: 12 Oct 2012
Location: Hampshire
Posts: 327

Wales 2005 Discovery 3 TDV6 HSE Auto Java BlackDiscovery 3

If you mean the background lighting for the dash panel, I believe that's in hardware, Pin 5 of the main connector.


Instrument Cluster - Main Connector C0230

| Pin # | Signal       | Comment                                    |
| ----- | ------------ | ------------------------------------------ |
| 1     | HS-CAN+      |                                            |
| 2     | HS-CAN-      |                                            |
| 3     | OIL_PRESS    | Oil pressure switch, GND active            |
| 4     | WASH_LVL     | Input from washer fluid level               |
| 5     | DIMMING      | Signal from lights switch + dimmer.        |
| 6     | BELT         | Seatbelt warning input                     |
| 7     | ?            | From CJB C0580-22, anti theft LED.         |
| 8     | PARK_BRAKE   | Signal from parking brake module           |
| 9     | BRAKE_WEAR   | Signal from Brake Pad Wear sensor          |
| 10    | -            |                                            |
| 11    | -            |                                            |
| 12    | FUEL_LVL_1   | Return from fuel level sender 1            |
| 13    | FUEL_LVL_COM | Current feed to Fuel level senders         |
| 14    | -            |                                            |
| 15    | IGN          | Ignition supply from key switch            |
| 16    | VBATT        |                                            |
| 17    | MS-CAN+      |                                            |
| 18    | MS-CAN-      |                                            |
| 19    | COOLANT_LVL  | Coolant level switch input                 |
| 20    | RR_FOG       | Probably +ve warning indicator             |
| 21    | BRAKE_LVL    | Brake Fluid Level switch input             |
| 22    | TRIP         | Trip reset button on stalk, gnd to trigger |
| 23    | -            |                                            |
| 24    | FR_FOG       | Probably +ve warning indicator             |
| 25    | -            |                                            |
| 26    | -            |                                            |
| 27    | FUEL_LVL_2   | Return from fuel level sender 2            |
| 28    | -            |                                            |
| 29    | -            |                                            |
| 30    | -            |                                            |
| 31    | GND          |                                            |
| 32    | GND          |                                            |


I think the 'board' you saw in the video is actually the corner of my desk mat Smile This is a pic of the board I was using. It's much larger than necessary. I designed it for something else entirely, but since it had canbus interfaces and I had already compiled micropython for it, it was perfect for this.

Click image to enlarge
  
Post #227933817th Feb 2022 10:53 am
View user's profile Send private message View poster's gallery Reply with quote
Mayfair86
 


Member Since: 25 Nov 2020
Location: Bedfordshire
Posts: 11

United Kingdom 2005 Discovery 3 TDV6 S Manual Indus SilverDiscovery 3

Hi, sorry to jump on a slightly old post but hopefully still relevent. I am in the process of trying to get my head round the whole canbus thing, I've done some very basic coding about 15 years ago but never experienced canbus. I am putting a 4.4 D3 AJV8 engine in my manual 2.7tdv6 D3. So the V8 loom and ecu will be changing from auto to manual. I've got to try to figure out what I need with regards to canbus info to give the ECU the signals it needs to function properly and for the special programs to function as they should. Also relating to epnintey's posts, I will be switching the clocks from the V8 donor so will need to try and code the mileage and it would be nice to have the gear selection on it. Not sure how much of this is possible but any guidance or assistance on where to start would be appreciated.
Thanks
Josh
 

Last edited by Mayfair86 on 21st Sep 2022 12:18 pm. Edited 1 time in total 
Post #230775515th Sep 2022 7:42 pm
View user's profile Send private message View poster's gallery Reply with quote
chrisoverson
 


Member Since: 10 Dec 2020
Location: Bideford
Posts: 29

United Kingdom 2006 Discovery 3 TDV6 HSE Auto Tonga GreenDiscovery 3

Hi Josh

I didn't get significantly further forward on this but I'm revisiting it now and just saw your reply

If you're swapping the ECU over then I assume the special programs etc should be alright as I doubt they're designed to specifically function with the TDV6 - in general if everything that revolves around the engine and instrumentation is swapped them I'd expect most other things to work, but someone else might be able to better confirm that.

If you need to swap more bits from a V8 to your D3 then you're likely better off doing that, it'd be a bad idea to modify or spoof can bus signals on the fly as they're constantly going at a high rate and there may be safety consequences.
  
Post #230814920th Sep 2022 5:32 pm
View user's profile Send private message View poster's gallery Reply with quote
Mayfair86
 


Member Since: 25 Nov 2020
Location: Bedfordshire
Posts: 11

United Kingdom 2005 Discovery 3 TDV6 S Manual Indus SilverDiscovery 3

Yeah that's what I'm hoping. I've been through all the CAN network maps and the wiring diagrams and I don't see that, other than a bit of updating of firmware, it shouldn't work.
Yeah It looks like I shouldn't have to spoof any signals, I think I can amend the firmware files to account for the differences.
Fingers crossed it all works, I think I'm at the point of just sucking it and seeing, then fixing the coms issues as they arise.
  
Post #230837222nd Sep 2022 3:32 pm
View user's profile Send private message View poster's gallery Post Reply
Display posts from the last:  
Post Reply Back to top
Page 2 of 2 <12
Jump to:  
Previous Topic | Next Topic >


Posting Rules
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



DISCO3.CO.UK Copyright © 2004-2024 Futuranet Ltd & Martin Lewis
DISCO3.CO.UK RSS Feed - All Forums

DISCO3.CO.UK is independent and not affiliated to Land Rover.
Switch to Mobile Site