CAN bus hacking thread

Chevy Spark EV Forum

Help Support Chevy Spark EV Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.

Tdk408

Active member
Joined
Aug 25, 2014
Messages
32
The various parts of the Spark EV are networked, and tapping into the CAN bus could give an insight into that is happening inside the car, (like random honking) and possibly allow us to inject some sanity to the behavior of the car.

Here is a link describing how the CAN bus works and data that's available on GM's other electric car. How different could they be?

http://www.evtools.info/ChevyVoltOBD2CAN.html

The above page says the following data can be extracted from the CAN bus: Accelerator Position, Brake Pressure, Drive Position, Shift Position, Battery SOC, GPS Latitude, GPS Longitude, and Speed. Lots more data exists on your Spark and is waiting to be discovered.

To take the idea further, here is an instructable that describes an arduino that can send messages to a car via CAN bus:

http://www.instructables.com/id/Hack-your-vehicle-CAN-BUS-with-Arduino-and-Seeed-C/

If you could issue commands to the car, think of the vehicle modifications that could be possible! Imagine pressing the remote lock three times, and all the windows roll up. Imagine being able to adjust the dash brightness all the time, and not just when the lights are on. Imagine a panic button on the remote that was louder than a mosquito fart. Imagine the car radio goes back to "multimedia" after a phone call, instead of being stuck on "phone". Imagine getting around all the stupid car horn honking!

An ElmScan5 tool is only $25 bucks. http://www.scantool.net/scan-tools/pc-based/elmscan5-compact.html

Anybody want to play?
 
Tdk408 said:
The various parts of the Spark EV are networked, and tapping into the CAN bus could give an insight into that is happening inside the car, (like random honking) and possibly allow us to inject some sanity to the behavior of the car.

Here is a link describing how the CAN bus works and data that's available on GM's other electric car. How different could they be?

http://www.evtools.info/ChevyVoltOBD2CAN.html

The above page says the following data can be extracted from the CAN bus: Accelerator Position, Brake Pressure, Drive Position, Shift Position, Battery SOC, GPS Latitude, GPS Longitude, and Speed. Lots more data exists on your Spark and is waiting to be discovered.

To take the idea further, here is an instructable that describes an arduino that can send messages to a car via CAN bus:

http://www.instructables.com/id/Hack-your-vehicle-CAN-BUS-with-Arduino-and-Seeed-C/

If you could issue commands to the car, think of the vehicle modifications that could be possible! Imagine pressing the remote lock three times, and all the windows roll up. Imagine being able to adjust the dash brightness all the time, and not just when the lights are on. Imagine a panic button on the remote that was louder than a mosquito fart. Imagine the car radio goes back to "multimedia" after a phone call, instead of being stuck on "phone". Imagine getting around all the stupid car horn honking!

An ElmScan5 tool is only $25 bucks. http://www.scantool.net/scan-tools/pc-based/elmscan5-compact.html

Anybody want to play?

This is cool.

If we could gather data on the mapping of the power produced and limits of the inverter, there may be potential to unleash additional potential performance-wise from this car.

Not to mention a host of other things that can be tinkered with.

Take it a step further and do what Rimac does, for example, remapping torque vectoring to each wheel so as to completely change the handling characteristics of their car...from full oversteer to full understeer.

Good stuff. Lot's of work though.
 
Tdk408 said:
Imagine getting around all the stupid car horn honking!

I agree that playing around with the settings will improve the functionality of the car significantly. However, all of the annoying "honking" can be disabled in the settings menu.
 
I'm very interested in fiddling with the CAN, mostly for performance reasons. I've already got one of these on order:

http://www.autosportlabs.com/racecapturepro-2/

No idea what I'm going to do with it, specifically, yet...but there's obviously lots of potential.

Bryce
 
The LEAF forum is full of guys who have done this type of work, so you might want to go there for CAN hacking 101.

Virtually everything is now public domain on LEAF, so it might help understand the tricks that are used. For instance, while we were looking for the battery temperature of the RAV4 EV, you would expect to see a message grouped in the battery management grouping with something in hexadecimal that would be around room temperature in centigrade / Celsius.

But, instead, they indexed it to zero at -40C, so it's always a positive number (and presumably shuts down at -40C). Other things are divided by random numbers, reversed, etc.

[removed flaming component of post]
 
On a related note, I've been regularly checking helminc.com to order a factory service manual when it becomes available. As luck would have it, as of today it is finally available! At $240, it is not cheap, but considering how rare these cars are and how many unique systems they have, I'm glad to pay it! This should drastically simplify understanding how many of the electronic/electrical systems work, including network architecture and wiring schematics.

If you're interested in getting a copy, it's Helm item number GMP14SEV and it's currently only available in paper form.

Bryce
 
Nashco said:
On a related note, I've been regularly checking helminc.com to order a factory service manual when it becomes available. As luck would have it, as of today it is finally available! At $240, it is not cheap, but considering how rare these cars are and how many unique systems they have, I'm glad to pay it! This should drastically simplify understanding how many of the electronic/electrical systems work, including network architecture and wiring schematics.

If you're interested in getting a copy, it's Helm item number GMP14SEV and it's currently only available in paper form.

Bryce

Have you ever worked on a Volt? Do you think the system in the Spark may have shared logic/electronics/etc.? I expect to be so as the EV tech is spread over all models I'd assume.
 
nozferatu said:
Have you ever worked on a Volt? Do you think the system in the Spark may have shared logic/electronics/etc.? I expect to be so as the EV tech is spread over all models I'd assume.

I haven't worked on a Volt, but of course they have lots in common. GM wouldn't redesign widgets and architectures if they didn't have to! I expect we'll be able to use the bits Volt owners have already deciphered as a kickstarter for our own tinkering.

Another helpful link for those insterested in Arduino stuff:

http://www.instructables.com/id/Custom-OBD-II-Gauge-in-With-OEM-Look/

For those wanting something cheaper than the Autosport Labs unit I linked above, but still wanting the ability to control stuff, the Arduino makes a lot of sense. Personally, if I were putting an Arduino on the car and tinkering, I'd be inclined to get this one:

http://www.ruggedcircuits.com/ruggeduino/

Bryce
 
I forgot about this unit, which a friend recently turned me on to. It is CAN only (no other analog/digital IO), but if you just want to intercept and manipulate CAN only (to do things like manipulate the horn, window motors, lighting controls, etc.) it could prove to be pretty handy since it has 3 CAN channels available:

http://canb.us/#/

They just closed out on a kickstarter campaign, so I expect to see some more activity on it in the coming weeks.

https://www.kickstarter.com/projects/etx/canbus-triple-the-car-hacking-platform

Bryce
 
Here's another interesting platform for playing with CAN. Looks like their next generation hardware (due in Q1 2015) will have some decent functionality as well as some interesting crowd-sourced software and CAN ID database.

http://www.carknow.me/

Bryce
 
Anybody else out there start hacking on their Spark EV? I've finally got my hardware and software working and started sniffing around. I also found another helpful Volt/Ampera link:

https://github.com/openvehicles/Open-Vehicle-Monitoring-System/blob/master/vehicle/Car%20Module/VoltAmpera/voltampera_canbusnotes.txt

Bryce
 
Nashco said:
Anybody else out there start hacking on their Spark EV? I've finally got my hardware and software working and started sniffing around. I also found another helpful Volt/Ampera link:
Yeah, I have the 3 CAN busses on the OBD-2 port wired up and can sniff data; I haven't tried actually poking at anything yet. Looking at just the powertrain bus, (IIRC) the accelerator CAN ID matched the Volt but e.g. the SOC did not. In general, I'd expect this thing to be a lot simpler than the Volt (without any of the ICE parameters to worry about) -- would you agree?

Do you have any idea where this magic constant (43 69 43 68) came from? It seems that people sniffed it from a DashDAQ, but where did they get it from? Service tools?

49,547 7E4 8 06 2C FE 43 69 43 68 00 (input: config for voltage/current of charger)

(43 69 43 68 = 'CiCh'???)
 
Hello,

Just got here yesterday.
Here in Germany we have developed a CAN-Bus to Bluetooth Interface with free App for Android special for GM vehicles.
(As i am not allowed to advertise without preclearance by the admins, i wont say names).
You can forget the 20usd OBD Scan tools, as they are only cabable of the OBD Frames that are very limited, and kind of question and answer game. Our dongle understands the native CAN Frames and control nearly everything (for example, speech control " Windows down").
The best thing is, that we are doing firmware updates for free and can get your desired values from the Battery System.
We are launching the public source code of the App shortly, so everyone with programming skills is welcome to join the development.

Hope this is interessting for you guys.

Bernd
 
Hello Bernd, good morning from California :) Thanks for stopping by.

I think I found your Happy hardware, it looks like you are talking on the SWCAN and Powertrain busses, but not the Chassis bus (12/13) -- is this correct? Looks like a nice device, it will be great to have stuff that people can go out and buy instead of hacking something together.

How are you getting the battery system data? Are you polling it using diagnostic commands, or passively sniffing the bus and recording data? I'd love to see your code for talking with the Volt, I can try to adapt it to work on my setup and see how similar our vehicles are.
 
Hi solder,

thanks for the reply.
Yes i am on SW and Powertrain. The Chassis Extension Bus had no priority, as there is not too much interessting things going on.
Diagnostic works over SW and Powertrain, though.

All Data that i use are regular transmited Frames, no question and answer Game here(PID like the cheap dongles do).
As all newer GM cars are "Global A" electrical architecture, the module will work with the volt by instance.
Of course smaller adaptions will be necessary (the outside lights are slightly different from model to model).

What things are you interessted in?
 
Oh, I'd love to see complete programmability of the whole car, of course :D

But, to pick one thing -- the Nissan Leaf owners have some really neat tools that show them e.g. the individual cell voltages inside the main battery (e.g. http://www.electricvehiclewiki.com/Leaf_Battery_Application)

Screen_1.png


I would love to see that level of detail for our Spark EVs, because the battery health is so critical.

Other people have mentioned things like, disabling annoying horn honking. That would be cool, too :)
 
Hi,

Well to see this you would need access to the BMS, which i dont have at the moment.
I am pretty impressed by now, to see all those values accessible over PIDs.
At the moment i do have values like:
- Battery Temperature
- Battery State of charge
- Battery State of Health
- Remaining Range...

But i could dig deaper. Anyone know what the dealer sees for values on the GDS2 using MDI?

But maybe we can also look at some PIDs and understand what they mean.
 
There is (apparently) more info available in GDS2, yes:


(not my screenshot, stolen from http://gm-volt.com/forum/showthread.php?5328-Volt-Diagnostic-Tool&p=63399#post63399)

It's tempting to buy a cheap Chinese MDI clone from Aliexpress for $200 and a 3-day GDS2 subscription for $57, and then sniff the CAN bus traffic, but who knows if it will work? If it doesn't work, I'll have wasted the money :/

I do agree, BTW, that passively sniffing the CAN bus and avoiding diagnostic protocols is more powerful (and safer), but we probably won't see these values reported without sending diagnostic commands to the BECM.
 
Yeah, okay. The Chassis bus is relatively boring, there are just 13 message types on there --according to the service manual, the only devices on it (aside from the DLC) are:

  • Inflatable Restraint Sensing and Diagnostic Module
  • Electronic Brake Control Module (gateway to Primary Powertrain bus)
  • Power Inverter Module / Hybrid/EV Powertrain Control Module 1

By way of comparison, I see 94 unique message IDs on the Powertrain (high-speed GMLAN) bus:
  • Engine Control Module (gateway to Powertrain Expansion Bus)
  • Hybrid/EV Control Module
  • Battery Charger - DC (optional)
  • A/C Compressor
  • Electronic Brake Control Module (gateway to Chassis Expansion Bus)
  • Battery Charger Control Module
  • Battery Energy Control Module (inside battery pack)
  • Body Control Module (connected to DLC) (gateway to Low-Speed GMLAN)
  • Power Steering Control Module
  • Pedestrian Alert Sound Control Module
  • Telematics Interface Control Module
  • Hybrid/EV Powertrain Control Module 2 (Gateway to High Voltage Management Bus)
  • Parking Brake Control Module

and 160 messages on the low-speed GMLAN / SWCAN bus:
  • Body Control Module (gateway to High-Speed GMLAN)
  • Instrument Cluster
  • Inflatable Restraint Sensing and Diagnostic Module
  • Radio
  • HVAC Control Module
  • Coolant Heater Control Module
  • Hybrid/EV Powertrain Control Module 2
  • Passenger Presence Module
  • Telematics Communication Interface Control Module
  • Keyless Entry Control Module

Some are easy to pick out with the car parked (but on), playing with the controls -- e.g. steering wheel angle is a 16-bit signed int in Powertrain message 0x55B. 0x10380099 (SWCAN) is the rear defroster status.

All of the Powertrain messages from the OVMS Volt/Ampera notes are present -- including "Gas engine rpm"! -- except for 206, Battery SOC. Odd. I'll have to log the other messages while my car charges and see what changes slowly (tedious...)
 
Okay, I grew a pair and started actually sending CAN (OBDII) messages to different controllers to see what's there. I found the BECM with 193 values that look like voltages, and 36 temperatures. I'm having trouble matching them up with the Battery Energy Control Module Scan Tool Data Parameters in the service manual (p6-45), can anyone help?

Check out how they are grouped: https://gist.github.com/anonymous/b6d68671772a2ca1ecc9

For references, here are the values in this group from the service manual:

Control Module Voltage Signal (Volts)
5V Reference 1,2 (Volts)
System Power Mode (Off/Accessory/Run/Crank Request)
Hybrid/EV Battery Pack Low Resolution Current Sensor (Amps)
Hybrid/EV Battery Pack High Resolution Current Sensor (Amps)
Hybrid/EV Battery Pack Terminal 1 Voltage (Volts)
Hybrid/EV Battery Interface Control Module 1-9 Cell Overvoltage (Deg C)

Temperature Scan Tool Data Parameters
Hybrid/EV Battery 1-8 (Deg C)
Hybrid/EV Battery Pack Coolant Temperature 1-2 (Deg C)

Voltage Data 1 Scan Tool Data Parameters
Hybrid/EV Battery 1-15 (Volts)

Voltage Data 2 Scan Tool Data Parameters
Hybrid/EV Battery 16-30 (Volts)

Voltage Data 3 Scan Tool Data Parameters
Hybrid/EV Battery 31-45 (Volts)

Voltage Data 4 Scan Tool Data Parameters
Hybrid/EV Battery 46-60 (Volts)

Voltage Data 5 Scan Tool Data Parameters
Hybrid/EV Battery 61-75 (Volts)

Voltage Data 6 Scan Tool Data Parameters
Hybrid/EV Battery 76-90 (Volts)

Voltage Data 7 Scan Tool Data Parameters
Hybrid/EV Battery 91-105 (Volts)

Voltage Data 8 Scan Tool Data Parameters
Hybrid/EV Battery 106-112 (Volts)

It occurs to me that my service manual is from 2014, and my car is a 2015, so perhaps the LG battery pack has a different geometry with a different number of sensors. Can someone with a 2014 confirm these readings?

Edit: Yes, my car has 192 cells groups (of 2), see http://insideevs.com/gm-shifts-2015-chevy-spark-ev-battery-manufacturing-house-facility/. So, we have 1 PID per cell group (with 1 extra). Assuming each group is still rated at 3.3V (is this a good assumption?), we just need to find a formula such that 0xDA00 (55808) =~ 3.3v. (simply dividing the numbers gives 0.000059 V per tick, which seems awfully awkward)

It would also be nice to figure out how the temperature sensors mapped to the cells.
 
Back
Top