Notices
Audio & Electronics Use this forum to discuss audio and electronic upgrades for your Mercedes-Benz.
Sponsored by:
Sponsored by: Innova

CANBus Hacking with Carloop

Thread Tools
 
Search this Thread
 
Rate Thread
 
Old May 17, 2017 | 02:21 AM
  #1  
JoeJErnst's Avatar
Thread Starter
MBWorld Fanatic!
 
Joined: Jun 2014
Posts: 1,036
Likes: 169
From: Portland, Oregon
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
CANBus Hacking with Carloop

I just got my Carloop yesterday and finally got time to play around with it tonight. It's pretty straight-forward; I got it working in just a couple hours and I didn't know anything about the Particle Photon before yesterday.




Next step is to load a simple program and see if I can get it communicating with the car via the OBD-II port. After that I'll figure out how to sniff the CAN bus, and then write a program that turns on my intercooler pump whenever the key is ON.

I'm new to this so feel free to chime in with advice. I'll ask specific questions below when they come up.
Reply
Old May 17, 2017 | 08:08 AM
  #2  
JoeJErnst's Avatar
Thread Starter
MBWorld Fanatic!
 
Joined: Jun 2014
Posts: 1,036
Likes: 169
From: Portland, Oregon
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
Challenge accepted!
Reply
Old May 17, 2017 | 11:06 AM
  #3  
JoeJErnst's Avatar
Thread Starter
MBWorld Fanatic!
 
Joined: Jun 2014
Posts: 1,036
Likes: 169
From: Portland, Oregon
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
OK, all joking aside, are you saying that you know *for certain* that the intercooler pump is not on either of the CAN buses?
Reply
Old May 17, 2017 | 02:23 PM
  #4  
JoeJErnst's Avatar
Thread Starter
MBWorld Fanatic!
 
Joined: Jun 2014
Posts: 1,036
Likes: 169
From: Portland, Oregon
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
Originally Posted by Plutoe
All joking aside----yes of course the message is communicated via the CAN, however I doubt that your handy dandy CAN bus analyzer will see the message and if it does you can't\won't be able to read and edit the instruction from the ECU without very specialized software.


Your best bet is start talking to tuners as you are at preschool and the actual editing is way above my pay grade!
Thank you for that clarification. I have already sent Tony a question to see if he can command the pump from the tune. And if the pump is on the CAN, I should be able to sniff it out and command it on and off myself. I'll report back here once I have time to play around with it.
Reply
Old May 17, 2017 | 02:41 PM
  #5  
jumph4x's Avatar
Super Member
 
Joined: Aug 2009
Posts: 998
Likes: 70
From: Oakland
W210 DRFT BNZ
Originally Posted by Plutoe
You wasted your money---the parameter instructions are all within the engine ECU and you tool can't read or edit the ECU------return and buy your girlfriend a hot dog!
Originally Posted by Plutoe
All joking aside----yes of course the message is communicated via the CAN, however I doubt that your handy dandy CAN bus analyzer will see the message and if it does you can't\won't be able to read and edit the instruction from the ECU without very specialized software.


Your best bet is start talking to tuners as you are at preschool and the actual editing is way above my pay grade!
Plutoe, why so negative, man? Everything going well?
Reply
Old May 17, 2017 | 02:47 PM
  #6  
jumph4x's Avatar
Super Member
 
Joined: Aug 2009
Posts: 998
Likes: 70
From: Oakland
W210 DRFT BNZ
Negativity aside, here is some real, constructive material.

As you well know, Alex Angelov was able to source internal materials for a lot (all?) of the system's parameters and I wrote a script to translate the 3000+ lines of German into Russian and English. Analyzing the files, we immediately see the following goodies:

--- KLA_A1 ID:0x0030
--- --- ZWP_EIN() Switch on the auxiliary water pump, offset:3, len:1
--- GW_C_B2 ID:0x0003
--- --- ZWP_EIN_MS() Switch on the auxiliary water pump, offset:56, len:1
--- SAM_B_A1 ID:0x008c
--- --- ZWP_LFT() Auxiliary water pump runs, offset:1, len:1
--- PFDS_A1 ID:0x02a8
--- --- PFDSMOT_ST() Status FDS pump motor, offset:6, len:2
--- --- PFDS_DEAKT() FDS pump deactivated, offset:3, len:1
--- --- P_PFDS(hPa) Supply pressure FDS pump, offset:11, len:5
This from just a quick search for the keyword 'pump'. But even if this CANBUS project was to never succeed, what's to stop JoeJErnst from routing his own relay and SPST switch to the interior?

Rock on, man.
Reply
Old May 17, 2017 | 02:48 PM
  #7  
jumph4x's Avatar
Super Member
 
Joined: Aug 2009
Posts: 998
Likes: 70
From: Oakland
W210 DRFT BNZ
Cross linking existing wisdom and efforts for the Canbus Triple and DIY versions here: https://mbworld.org/forums/audio-ele...b-hacking.html
Reply
Old May 17, 2017 | 04:54 PM
  #8  
BoostedAero's Avatar
Super Member
10 Year Member
Photogenic
Liked
Loved
 
Joined: Jan 2016
Posts: 599
Likes: 120
2004 E55
Just make sure that is the actual intercooler pump and not the auxiliary water pump (behind passenger headlight) and I would say we are on to something good :~>

keep it up fellas!
Reply
MB World Stories

The Best of Mercedes & AMG

story-0

Manual Mercedes? 6 Times Sindelfingen Let Drivers Have All The Fun

 Verdad Gallardo
story-1

Mercedes SLR McLaren 722 S Is Extremely Rare Example Modified by McLaren

 Verdad Gallardo
story-2

8 Classic Boxy Mercedes Designs That Have Aged Like Fine Wine

 Verdad Gallardo
story-3

Flawlessly Restored Mercedes 190E Evo II Heads to Auction

 Verdad Gallardo
story-4

Electric Mercedes C-Class Unveiled: 11 Things You Need to Know

 Verdad Gallardo
story-5

Mercedes EQS Gets A Major Update: Everything You Need to Know

 Verdad Gallardo
story-6

5 Underrated Mercedes-Benz Models That Don't Get the Love They Deserve

 Verdad Gallardo
story-7

Mercedes 300D Has Pushed Well Past 1 Million Miles and It Ain't Stopping

 Verdad Gallardo
story-8

10 Most Reliable Mercedes-Benz Models You Can Buy Used

 Verdad Gallardo
story-9

Mercedes Teases Updated EQS With Steer-By-Wire and a Yoke

 Verdad Gallardo
Old May 17, 2017 | 05:01 PM
  #9  
JoeJErnst's Avatar
Thread Starter
MBWorld Fanatic!
 
Joined: Jun 2014
Posts: 1,036
Likes: 169
From: Portland, Oregon
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
Originally Posted by BoostedAero
Just make sure that is the actual intercooler pump and not the auxiliary water pump (behind passenger headlight) and I would say we are on to something good :~>

keep it up fellas!
I had no idea there was a water pump behind the passenger headlight. What's it for?
Reply
Old May 17, 2017 | 05:15 PM
  #10  
jumph4x's Avatar
Super Member
 
Joined: Aug 2009
Posts: 998
Likes: 70
From: Oakland
W210 DRFT BNZ
Even for reliability's sake I would probably turn this into a physically-wired project. Put in a logical AND* between the switch and the ignition 12VDC+ that would go to a three post relay. I will likely end up doing just that for my purposes and activities, TBQH. Since the post-relay power would be wired in parallel to the physical pump, you would end up with a logical OR between your switch and the ECU's decision to run the fan.

* - I admittedly don't know much about electrical, but based on a quick search most 3-,4- and 5- post relays will not do this. But a logical AND can be achieved quickly with two regular relays in series.

So what you have with the setup above (what I'm planning) is:

Pump on = (ECU says it should be on) OR ((car ignition is ON) AND (interior switch is ON))

Originally Posted by BoostedAero
Just make sure that is the actual intercooler pump and not the auxiliary water pump (behind passenger headlight) and I would say we are on to something good :~>

keep it up fellas!
It probably is the AUX water pump.

Originally Posted by JoeJErnst
I had no idea there was a water pump behind the passenger headlight. What's it for?
Mercedes come with two pumps, one mechanical and one electrical. From what I understand the auxiliary pump runs on a delay relay after car shutdown to prevent hotspots in the motor? Who knows, that's the folklore passed down to me a decade ago.

A relic of the over-engineered W1XX cars. Remember the 'rest' heat option on those? For long drives at night there would be a button that would pump heat into the interior, I'm guessing this would run the AUX pump on a low setting to make sure the heater core has a longer supply of warmth. Also explains why this message can be sent over CANBUS instead of the ECU operating a relay directly (which is likely the case for the intercooler pump).

Last edited by jumph4x; May 17, 2017 at 05:32 PM.
Reply
Old May 17, 2017 | 06:17 PM
  #11  
JoeJErnst's Avatar
Thread Starter
MBWorld Fanatic!
 
Joined: Jun 2014
Posts: 1,036
Likes: 169
From: Portland, Oregon
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
Well, I guess I'll use the Carloop for something else then.

Originally Posted by jumph4x
... Pump on = (ECU says it should be on) OR ((car ignition is ON) AND (interior switch is ON))
I will simplify this down to Pump on = car ignition is ON. Since I'm running a Killer Chiller with a tank and no H/X I want the pump on all the time.

I'll probably unplug the harness connector on the pump and run an entirely new circuit to it, pulling power off the back of the alternator and the relay signal from... ? Where should I grab the relay signal for when the key is ON? Somewhere in the engine compartment would be best, and I don't want to cut any wires. Can I tap into a fuse somewhere?
Reply
Old May 18, 2017 | 11:30 PM
  #12  
jumph4x's Avatar
Super Member
 
Joined: Aug 2009
Posts: 998
Likes: 70
From: Oakland
W210 DRFT BNZ
Originally Posted by JoeJErnst
Well, I guess I'll use the Carloop for something else then.



I will simplify this down to Pump on = car ignition is ON. Since I'm running a Killer Chiller with a tank and no H/X I want the pump on all the time.

I'll probably unplug the harness connector on the pump and run an entirely new circuit to it, pulling power off the back of the alternator and the relay signal from... ? Where should I grab the relay signal for when the key is ON? Somewhere in the engine compartment would be best, and I don't want to cut any wires. Can I tap into a fuse somewhere?
Yeah, probably. Start by checking out what the fuses and relays do at the driver-side underhood distribution panel. Then just tap into the wire of choice behind it.

I wonder if I should just do the same. Can anyone think of a reason not to run the damn pump all the time? Seriously...
Reply
Old May 19, 2017 | 01:33 AM
  #13  
JoeJErnst's Avatar
Thread Starter
MBWorld Fanatic!
 
Joined: Jun 2014
Posts: 1,036
Likes: 169
From: Portland, Oregon
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
Originally Posted by jumph4x
I wonder if I should just do the same. Can anyone think of a reason not to run the damn pump all the time? Seriously...
No, I can't think of any good reason to not have it run all the time. I currently have Plan C underway. Tony (my tuner) says he can command the pump on in the tune. I'll report back here when I have more details.
Reply
Old Aug 22, 2017 | 04:29 AM
  #14  
jumph4x's Avatar
Super Member
 
Joined: Aug 2009
Posts: 998
Likes: 70
From: Oakland
W210 DRFT BNZ
Originally Posted by JoeJErnst
No, I can't think of any good reason to not have it run all the time. I currently have Plan C underway. Tony (my tuner) says he can command the pump on in the tune. I'll report back here when I have more details.
Now that I swapped in the new 010 part number, I see that the only thing running to the pump is a 2 lead connector. Sounds like you should just run some 16 AWG wire from the hood fusepanel directly to the positive lead of the pump.

Possibly put a mechanical override switch/breaker inline for highway hauls and such. The only reason here being is possibly extending the pump's life.
Reply
Old Oct 2, 2017 | 07:05 PM
  #15  
iwl's Avatar
iwl
Newbie
 
Joined: Sep 2017
Posts: 5
Likes: 2
From: Germany Leipzig
A-Class W169
Originally Posted by JoeJErnst
Next step is to load a simple program and see if I can get it communicating with the car via the OBD-II port. After that I'll figure out how to sniff the CAN bus
How have you done that?

I've got information there is a separate diagnosis can at the OBD port and you only get answers to diagnosis requests there.

Some say without requests it is just silent and you can't sniff anything.
Reply
Old Oct 14, 2017 | 01:17 PM
  #16  
Russell Ormerod's Avatar
MBWorld Fanatic!
 
Joined: Jun 2011
Posts: 1,494
Likes: 131
From: Cape town
not a merc
You can sniff can bus data without a problem, but transmitting your own message is totally another issue. So your best option is to just directly control the pump relay directly. You see if you transmit on the bus you going to need to transmit with the same ID as what the original ecu uses. This would cause a bus error because the protocol does not allow for same ID to be transmitted. ID's are how bus arbitratation takes place. Lower ID have higher priority.
Reply
Old Nov 10, 2017 | 12:38 AM
  #17  
ecmexchange's Avatar
Former Vendor of MBWorld
 
Joined: Mar 2017
Posts: 335
Likes: 12
na
Any resolution on this? Just wondering.
Reply
Old Nov 10, 2017 | 03:38 AM
  #18  
Russell Ormerod's Avatar
MBWorld Fanatic!
 
Joined: Jun 2011
Posts: 1,494
Likes: 131
From: Cape town
not a merc
Can bus is always interesting
Reply
Old Nov 10, 2017 | 12:14 PM
  #19  
JoeJErnst's Avatar
Thread Starter
MBWorld Fanatic!
 
Joined: Jun 2014
Posts: 1,036
Likes: 169
From: Portland, Oregon
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
Originally Posted by ecmexchange
Any resolution on this? Just wondering.
I could never get the ECU to command the pump on all the time. I ended up running a lead from the fuse box directly to the pump so it comes on with the ignition. It was actually quite simple, and didn't require cutting into the factory harness in any way.
Reply
Old Dec 5, 2017 | 03:44 AM
  #20  
Richard's Avatar
MBWorld Fanatic!
 
Joined: Nov 2001
Posts: 1,148
Likes: 16
From: Berkshire, UK
2004 SL55, 2015 A250d, 2016 GLC250d
just remember that the CANbus going to the Diagnostic socket is a private CANbus between the CGW (often part of another control module such as the EZS or the Front SAM) and the socket.

So most information is not there and you may have to find the engine/chassis CANbus (green/white,green probably).
-This prevents people easily plugging stuff into CANbus and doing stuff that was un-intended (like starting the car I imagine)

Interested to know how you get on

Richard
Reply
Old Dec 13, 2017 | 10:04 PM
  #21  
jumph4x's Avatar
Super Member
 
Joined: Aug 2009
Posts: 998
Likes: 70
From: Oakland
W210 DRFT BNZ
Originally Posted by JoeJErnst
I could never get the ECU to command the pump on all the time. I ended up running a lead from the fuse box directly to the pump so it comes on with the ignition. It was actually quite simple, and didn't require cutting into the factory harness in any way.
Any photos or tips would greatly help. Going to do the same.
Reply
Old Dec 14, 2017 | 12:10 AM
  #22  
JoeJErnst's Avatar
Thread Starter
MBWorld Fanatic!
 
Joined: Jun 2014
Posts: 1,036
Likes: 169
From: Portland, Oregon
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
Unfortunately I only took one picture so this may get a little wordy...



See that red wire running through the middle of the fuse panel? It connects in the back left corner to a fuse tap that I bought at Autozone. I don't remember which fuse location it is, but if you check your fuse diagram (it should be behind the little panel on the left side of the dashboard; only accessible when the driver's door is open) you will see a couple fuses that can be put in two positions; one for continuous power, and one for accessory power. (one of them is the cigarette lighter; can't remember the other one)

Anyway, I tapped into the one that has accessory power so my pump will run whenever the key is in position 1 or 2. I ran the red wire through some of the black corrugated loom, across the top of the radiator over to the passenger side and down to the pump. If you look closely you can see where the ground wire pops out of the loom and attaches to the factory ground stud.

On the pump end, I simply unplugged the pump and wrapped the connector in some electrical tape to keep it clean in case I ever want to re-attach it. I bought a new plug from the dealer so I can just connect my wire to it and plug it into the pump.

This part was a little tricky, because when I ordered the plug, the only thing it came with was the plastic bits. There was no connector or weatherproofing bits. I think you can get them all from the dealer, but you will end up ordering 3 different part numbers just to make the plug. (sorry, I don't know what the numbers are) They are each only a few bucks though, so I think it would be worth it to avoid having to cut up the harness. Since I didn't want to wait for another week, I ran down to Fry's electronics and found the connector bits that go inside the plastic plug. I just skipped the weatherproofing bits.

Here's the packaging for the connectors from Fry's:
Reply
Old Dec 14, 2017 | 01:31 AM
  #23  
jumph4x's Avatar
Super Member
 
Joined: Aug 2009
Posts: 998
Likes: 70
From: Oakland
W210 DRFT BNZ
Every bit helps, but skipping the dealer part numbers!? This is a wonderful mod: easy and doable by anyone.
I love you all the same, regardless. Thanks, buddy!

EDIT for posterity:

Source: https://www.jaguarforums.com/forum/x...k-91611/page2/

Originally Posted by 80sRule
Part Numbers for me buying locally at the Mercedes dealer:

Here are the Mercedes part numbers needed to build the plug that fits the 010 bosch pump:

Qty 1 of: 230-540-00-81 "COUPLING" - $2.70
Qty 2 of: 008-545-63-26 "PLUG" - $7.20 (total)
Qty 2 of: 000-54568-80 "RUBBER RIN" - $6.30 (total)

Total Price at local Mercedes dealer - $16.20

I did this on my XKR and works great and now modular!
Placed a custom order with FCP Euro, will verify.

Last edited by jumph4x; Dec 14, 2017 at 01:42 AM.
Reply
Old Dec 14, 2017 | 12:02 PM
  #24  
JoeJErnst's Avatar
Thread Starter
MBWorld Fanatic!
 
Joined: Jun 2014
Posts: 1,036
Likes: 169
From: Portland, Oregon
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
Nice find on the Jag forum! That looks like the right stuff.

Sorry, I was off my game the day I did the install. I won't let it happen again. ;-)
Reply


You have already rated this thread Rating: Thread Rating: 0 votes,  average.


All times are GMT -4. The time now is 06:25 PM.

story-0
Manual Mercedes? 6 Times Sindelfingen Let Drivers Have All The Fun

Slideshow: Yes, Mercedes built manual cars, and some of them are far more interesting than you'd expect.

By Verdad Gallardo | 2026-05-02 12:36:58


VIEW MORE
story-1
Mercedes SLR McLaren 722 S Is Extremely Rare Example Modified by McLaren

Slideshow: A one-of-one U.S.-spec Mercedes-Benz SLR McLaren Roadster became even rarer after a factory-backed transformation at McLaren's headquarters.

By Verdad Gallardo | 2026-04-29 11:19:28


VIEW MORE
story-2
8 Classic Boxy Mercedes Designs That Have Aged Like Fine Wine

Slideshow: Before curves took over, Mercedes mastered the art of the straight line, and some of those shapes still look right today.

By Verdad Gallardo | 2026-04-25 12:05:49


VIEW MORE
story-3
Flawlessly Restored Mercedes 190E Evo II Heads to Auction

Slideshow: The 190E Evolution II shows how a homologation necessity became a six-figure collector icon.

By Verdad Gallardo | 2026-04-22 17:53:47


VIEW MORE
story-4
Electric Mercedes C-Class Unveiled: 11 Things You Need to Know

Slideshow: Mercedes is turning one of its core nameplates electric, and the details show just how serious this shift is.

By Verdad Gallardo | 2026-04-21 13:58:06


VIEW MORE
story-5
Mercedes EQS Gets A Major Update: Everything You Need to Know

Slideshow: Faster charging, longer range, and a controversial steer-by-wire system define the latest evolution of Mercedes-Benz EQS.

By Verdad Gallardo | 2026-04-15 10:35:34


VIEW MORE
story-6
5 Underrated Mercedes-Benz Models That Don't Get the Love They Deserve

Slideshow: These overlooked Mercedes-Benz models never got the spotlight, but they quietly delivered more than most remember.

By Verdad Gallardo | 2026-04-13 19:35:45


VIEW MORE
story-7
Mercedes 300D Has Pushed Well Past 1 Million Miles and It Ain't Stopping

Slideshow: A well-used 1991 Mercedes-Benz 300D with more than one million miles is now looking for a new owner, and it still appears ready for more.

By Verdad Gallardo | 2026-04-10 10:05:15


VIEW MORE
story-8
10 Most Reliable Mercedes-Benz Models You Can Buy Used

Slideshow: From bulletproof sedans to surprisingly tough SUVs, these Mercedes models proved that the three-pointed star can go the distance.

By Verdad Gallardo | 2026-04-08 09:55:49


VIEW MORE
story-9
Mercedes Teases Updated EQS With Steer-By-Wire and a Yoke

Slideshow: The 2027 update adds a fully digital steering system, revised styling, and potential charging upgrades as the company looks to revive interest in the luxury EV.

By Verdad Gallardo | 2026-04-04 10:24:38


VIEW MORE