When you click on links to various merchants on this site and make a purchase, this can result in this site earning a commission. Affiliate programs and affiliations include, but are not limited to, the eBay Partner Network.
Hey guys hoping someone can answer a question regarding the CAN B network in the W211, specifically a CDI.
I've been sniffing packets and sorting out the message ID's and some of the data sets for the networked modules on my W211. While the CAN C network has been pretty easy to identify different modules like TCM from it's message ID, I've had zero luck getting anything useful off CAN B.
Tapping into two different canbus X30/ hubs, one in drivers rocker area, other under passenger side glove box, neither is giving up any usable data. According to everything I've read, CAN B wiring is BN & BNRD with BN being CAN L and BNRD being CAN H. But not always the case.. While I have been able to establish a connection at different baud rates from 83k to 500k, all I'm receiving is these 2 messages depending on which hub I monitor
02 91 5a 10 18 31 04 00 00 00
00 79 5a 10 18 31 04 00 00 00
Unlike the CAN C bus, data on CAN B never changes, no matter what buttons or switches I press in the car... I was originally only looking to map steering wheel buttons for a input to a BT project. After reading and reading, testing and testing, I've gotta be missing something. Any input would be much appreciated.
There is some cool electronic attachments on the market today for the hobbyist that will allow you to intercept, modify, and send custom commands on the vehicle bus. IE, intercept steering wheel button inputs and create "shortcut" combination to display engine sensor data. Incorporate radar detector data on the dash is another cool example I've seen.
Anyways, if anyone wants to share information on this, please let me know. The CanBus Triple from canb.us is what I'm currently testing with. It has a BT LE modem included to link up with your phone, tablet, or whatever. See many possibilities with a little custom coding and imagination.
About 12 years ago, I built a canbus interface for my E320. I used it to intercept the steering wheel buttons to control an after market Bluetooth phone adaptor. I'll have to see if I can find any notes on how I interfaced it, but I do recall CANB is fault tolerant so needs the right interface chip to correctly interpret the voltage levels. I have found the source code for the PIC16F84 code I was using and I was filtering on 01 A8 messages, so these were the ones I established were for the steering wheel controls.
Thanks Dave. Yes what I'm experiencing is likely fault tolerance measures kicking in. N93 is sometimes freaking out, setting network error codes, flashing lights, door locks, or posting red "visit workshop" messages. Luckily once the CBT is taken offline, or Can B is allowed to sleep, everything resets on next wake up. That's how I've managed to log some short data bursts, just nothing useful yet.
Think I need to borrow an oscilloscope and verify what the network doing next. Guessing at it isn't accomplishing much.
I couldn't see wasting the time with the Oscope, it will not net anything useful.
Why not just break down and buy a Metra ASWC-1 and program the outputs for what you want. There is also PAC Audio which will utilize 2 modules and allow you a bit more customization.
The Metra and PAC are both great units for plug and play control over analog devices like head units. Where the canbus triple is a CAN2CAN or CAN2BT gateway based on Arduino with open source code. This unit can be loaded to do anything you might imagine, like unlock the doors, or start the car with your phone. Basically the type of tool those developers used to design the PAC or Metra devices. It also has USB and BT interfaces, plus "3" 2515 canbus transceiver chips. Making it pretty versatile for filtering and modifying existing bus messages.
Like the N93 central gateway module controls messages between CAN C, B, and D (OBDII) networks, this unit is capable of doing the same when inserted into the network the same way. I found it from this story on Hack A Day. The Mazda guys (who designed this simple PCB) demonstrate a few examples of what is possible. It's more of a hacker tool for those looking to get a little deeper into the workings of automotive networks.
you aren't going to start the vehicle over CAN without a MidCityEngineering module, so you lost me, which does, lock/unlock, trunk/hatch, and start for the past 6 years. I'm quite familiar with CAN and reading CAN from my time working with the engineers at NAVTV when i was working for MB. For stuff like video in motion, remote start and parking sensor speed integration to name a few... also they were the first with a remote start solution
you aren't going to start the vehicle over CAN without a MidCityEngineering module
That almost sounds like a challenge... But since it's proven possible, and obviously old technology, how about sharing some of that knowledge? You are "retired" right?
I'm also a long time retired ASE master tech, who holds a degree in automotive engineering, and currently working towards my Masters Degree. After spending twenty years in IT as a network engineer, this CAN hacking thing is just a hobby. So I'm not looking to compete against anyone, nor buy their products. Just sharing the info with others interested in building their own modules.
My first goal is simply connecting my Escort 9500 to the dash. Yes I could easily buy one of Midcity's modules and reverse engineer it before lunch, done deal. But what's the fun in that? Doing it on my own shouldn't be too hard once I stop creating errors on CAN B. Hence my reason for hooking up the SnapOn Modis and verifying the voltages and protocol speeds with an oscilloscope. I've sorted much of CAN C data already, but B has been giving me trouble. I've only spent a couple hours on this so far, and was hoping someone could help me isolate the errors and speed up the process.
Hooked up a good oscilloscope tonight to both CAN B and CAN C. Was educational to watch the C 500kbps network sending packets first, then finding the problem on CAN B was obvious. Simple ohm test also showed 60 on C and a open on B...
Time to go dig back into the rocker panel and check my wiring job.
Anyone know the part numbers for the canbus hubs and node connector plugs?? None of the bone yards around me a late model MB I can cut them out of.
CAN B in 211 is a low speed network at 83.3kbps. Since it is a low speed network it does not use termination resistance which is why you do not see 60 ohms. I took a quick look at the HW you are using which seems to be equipped with High Speed CAN transceivers.
For MB the CAN wire with the tracer is always CAN HI.
Thanks much for that info, any input is appreciated.
I actually cut a CAN B & C bus bar, along with handful of those Tyco connectors out of a junk W211 last week. First thing I noticed is the C hub has one of the 120 ohm resistors built into it. While the B hubs are just a simple copper bar. Second thing I noticed, is as you stated, the B network isn't terminated. Which I believe could be inducing errors the MCP2515 transceiver chips dislike. Then we have that oddball 83.3 baud setting, which the developer of the CBT hasn't written specific code for yet.
After hacking together a little custom baud rate code, I have been able to log a few minutes of good data off the B network with the CBT unit. Then the transceiver error count appears to hit the chip limit and stops it sending. That's possibly due to the lack termination. And If I terminate it, then the other nodes on the bus probably won't like it. At least won't go into sleep mode I bet. So it's gonna take a little more time to sort out with this device.. I did find on a arduino forum where someone got a similar 2515 chipset board working on a 83.3k bus. The Jeep and Chrysler guys are experiencing the same issues, cause of the shared network design.
In the end this project does open up a lot of opportunity for custom interfaces, without relying on the OBD gateway/firewall to translate messages. When it comes to utilizing the steering wheel buttons, the only option is something like the CBT.
Kid turbo you're skills are impressive. I'm an 06 w211 owner and also have the escort 9500 detector so am interested to know if you've been successful integrating yours through software mods. I'm not capable to modify existing program as you are but would try to find someone , here in NYC, who is.
Thanks much
kidturbo, did you make any further progress with your CAN project?
I recently picked up a CBT and have had good progress regarding sniffing packets but in terms of sending packets, the same values sent back into the network don't perform the same action (for example, the wrong window goes down).
I think I need the 29-bit support for this to work correctly, but there isn't a firmware with 83.3kbps and 29-support in the same code. Well not that I know of.
Another bump for updates.
I've been looking into this with an Arduino Uno I have sitting around, so I'm very interested to see what you've been able to do!
I've actually made some progress in this area. Got some text to change on the OEM dashboard under the AUDIO screen and also made some random arrows appear under the NAVI screen with varying amounts of miles remaining before the next turn. I'm still experimenting though, but will wait for the colder months to pass.
I'd like to be able to manipulate the NAVI screen based on Google maps turn by turn directions but I think I'm a long way off from that.
Besides I've been spending too much time on trying to get the ABC system 100% again, although thanks to crownhouse over at mbclub, this may be sorted.
I am trying to do similar. I have Android Tablet with OTG, where I will have navigation. I want to display following information on W211 MFD:
-navigation information
-current speed limit (and maybe warn if exceeded)
-traffic information/warnings (accidents and other).
Furthermore I want to control table with steering wheels buttons.
I am just waiting for CAN BUS interface to arrive which I will connect to USB host in Tablet.
I am going to get CAN wires (GND, CAN H, CAN L) from the back of Audio 20.
I am willing to share with my results, but I would like to start based on current knowledge.
I suspect the information I provide below may not be that helpful cause the message positions might end up in different locations, but you never know.
One thing to note is that important information has higher priority so will appear as a lower message ID (Parameter ID in CAN terms)
For example I can see the rev counter on PID 002 but window controls are on PID 219 and steering wheel buttons are on PID 330.
You will be looking at logged packets for a while, it can be a slow process. You should be able to see everything on the CAN wires behind the Audio 20, but you may not be able to send everything through those cables cause of CAN firewalls but that is okay if you are mostly looking to capture information rather than control the car with your tablet (i.e I can send steering wheel button presses but can't send seat control module buttons).
With regards to sending information to the MFD, I have been spamming PID 328 (MFD/OEM display on a w215) and having a tough time figuring it out. I've managed to change the text by mistake a few times. It is sent in ASCII. You need to analyse what the current Audio 20 sends to the screen. I've also seen navigational arrows and remaining miles change on the NAVI screen, it just seems inconsistent. Problem is, the first byte rotates from 10 to 2F depending on the last message sent to the MFD.
Any idea how you are going to extract the information from navigation software/Google maps yet? Screen grabbing then some optical character recognition?
Using AutoInput is possible to get texts from Google Maps navigation.
And for example using Tasker it possible to get those text and use as you want. So it should be also possible to use it in your own app.
What I have noticed Google Maps application must be in foreground.
What's more it looks that every field shown above has its unique ID.
So getting text is possible.
Regarding directions (left, right, forward, etc.), I haven't figured it out yet, but image comparison should make it (I believe AutoInput does the thing also).
So for the begginig I will start with getting texts and directions like every second in Tasker and if something changes via Intent it will go to my applications.
Of course eventually direct API should be used. It requires some googling or "looking" how AutoInput does it.
Until I get and CAN interface (still going from PRC), I will get into it.
JacekD, that's awesome. AutoInput looks like it is up for the job then. I was going to say if Google maps is not in the foreground then you get a notification giving some information, maybe that could be useful. Probably a little less information though. Thanks.
Since Android API Level 18 (Android 4.3) there is a class NotificationListenerService. You must set the Permission BIND_NOTIFICATION_LISTENER_SERVICE and use a intent-filter with the action NotificationListenerService.
04-01-2015, 03:11 AM
