Notices
Audio & Electronics Use this forum to discuss audio and electronic upgrades for your Mercedes-Benz.

CANBus Hacking with Carloop

Thread Tools
 
Search this Thread
 
Rate Thread
 
Old 05-17-2017, 02:21 AM
  #1  
MBWorld Fanatic!
Thread Starter
 
JoeJErnst's Avatar
 
Join Date: Jun 2014
Location: Portland, Oregon
Posts: 1,036
Received 166 Likes on 137 Posts
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
CANBus Hacking with Carloop

I just got my Carloop yesterday and finally got time to play around with it tonight. It's pretty straight-forward; I got it working in just a couple hours and I didn't know anything about the Particle Photon before yesterday.




Next step is to load a simple program and see if I can get it communicating with the car via the OBD-II port. After that I'll figure out how to sniff the CAN bus, and then write a program that turns on my intercooler pump whenever the key is ON.

I'm new to this so feel free to chime in with advice. I'll ask specific questions below when they come up.
Old 05-17-2017, 08:05 AM
  #2  
Out Of Control!!

 
Plutoe's Avatar
 
Join Date: Feb 2011
Location: Tampa
Posts: 14,542
Received 1,019 Likes on 947 Posts
1999 E300TD
You wasted your money---the parameter instructions are all within the engine ECU and you tool can't read or edit the ECU------return and buy your girlfriend a hot dog!
Old 05-17-2017, 08:08 AM
  #3  
MBWorld Fanatic!
Thread Starter
 
JoeJErnst's Avatar
 
Join Date: Jun 2014
Location: Portland, Oregon
Posts: 1,036
Received 166 Likes on 137 Posts
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
Challenge accepted!
Old 05-17-2017, 11:06 AM
  #4  
MBWorld Fanatic!
Thread Starter
 
JoeJErnst's Avatar
 
Join Date: Jun 2014
Location: Portland, Oregon
Posts: 1,036
Received 166 Likes on 137 Posts
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
OK, all joking aside, are you saying that you know *for certain* that the intercooler pump is not on either of the CAN buses?
Old 05-17-2017, 02:16 PM
  #5  
Out Of Control!!

 
Plutoe's Avatar
 
Join Date: Feb 2011
Location: Tampa
Posts: 14,542
Received 1,019 Likes on 947 Posts
1999 E300TD
All joking aside----yes of course the message is communicated via the CAN, however I doubt that your handy dandy CAN bus analyzer will see the message and if it does you can't\won't be able to read and edit the instruction from the ECU without very specialized software.


Your best bet is start talking to tuners as you are at preschool and the actual editing is way above my pay grade!
Old 05-17-2017, 02:23 PM
  #6  
MBWorld Fanatic!
Thread Starter
 
JoeJErnst's Avatar
 
Join Date: Jun 2014
Location: Portland, Oregon
Posts: 1,036
Received 166 Likes on 137 Posts
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
Originally Posted by Plutoe
All joking aside----yes of course the message is communicated via the CAN, however I doubt that your handy dandy CAN bus analyzer will see the message and if it does you can't\won't be able to read and edit the instruction from the ECU without very specialized software.


Your best bet is start talking to tuners as you are at preschool and the actual editing is way above my pay grade!
Thank you for that clarification. I have already sent Tony a question to see if he can command the pump from the tune. And if the pump is on the CAN, I should be able to sniff it out and command it on and off myself. I'll report back here once I have time to play around with it.
Old 05-17-2017, 02:41 PM
  #7  
Super Member
 
jumph4x's Avatar
 
Join Date: Aug 2009
Location: Oakland
Posts: 998
Received 70 Likes on 54 Posts
W210 DRFT BNZ
Originally Posted by Plutoe
You wasted your money---the parameter instructions are all within the engine ECU and you tool can't read or edit the ECU------return and buy your girlfriend a hot dog!
Originally Posted by Plutoe
All joking aside----yes of course the message is communicated via the CAN, however I doubt that your handy dandy CAN bus analyzer will see the message and if it does you can't\won't be able to read and edit the instruction from the ECU without very specialized software.


Your best bet is start talking to tuners as you are at preschool and the actual editing is way above my pay grade!
Plutoe, why so negative, man? Everything going well?
Old 05-17-2017, 02:47 PM
  #8  
Super Member
 
jumph4x's Avatar
 
Join Date: Aug 2009
Location: Oakland
Posts: 998
Received 70 Likes on 54 Posts
W210 DRFT BNZ
Negativity aside, here is some real, constructive material.

As you well know, Alex Angelov was able to source internal materials for a lot (all?) of the system's parameters and I wrote a script to translate the 3000+ lines of German into Russian and English. Analyzing the files, we immediately see the following goodies:

--- KLA_A1 ID:0x0030
--- --- ZWP_EIN() Switch on the auxiliary water pump, offset:3, len:1
--- GW_C_B2 ID:0x0003
--- --- ZWP_EIN_MS() Switch on the auxiliary water pump, offset:56, len:1
--- SAM_B_A1 ID:0x008c
--- --- ZWP_LFT() Auxiliary water pump runs, offset:1, len:1
--- PFDS_A1 ID:0x02a8
--- --- PFDSMOT_ST() Status FDS pump motor, offset:6, len:2
--- --- PFDS_DEAKT() FDS pump deactivated, offset:3, len:1
--- --- P_PFDS(hPa) Supply pressure FDS pump, offset:11, len:5
This from just a quick search for the keyword 'pump'. But even if this CANBUS project was to never succeed, what's to stop JoeJErnst from routing his own relay and SPST switch to the interior?

Rock on, man.
The following users liked this post:
JoeJErnst (05-17-2017)
Old 05-17-2017, 02:48 PM
  #9  
Super Member
 
jumph4x's Avatar
 
Join Date: Aug 2009
Location: Oakland
Posts: 998
Received 70 Likes on 54 Posts
W210 DRFT BNZ
Cross linking existing wisdom and efforts for the Canbus Triple and DIY versions here: https://mbworld.org/forums/audio-ele...b-hacking.html
Old 05-17-2017, 04:54 PM
  #10  
Super Member
 
BoostedAero's Avatar
 
Join Date: Jan 2016
Posts: 599
Received 120 Likes on 96 Posts
2004 E55
Just make sure that is the actual intercooler pump and not the auxiliary water pump (behind passenger headlight) and I would say we are on to something good :~>

keep it up fellas!
Old 05-17-2017, 05:01 PM
  #11  
MBWorld Fanatic!
Thread Starter
 
JoeJErnst's Avatar
 
Join Date: Jun 2014
Location: Portland, Oregon
Posts: 1,036
Received 166 Likes on 137 Posts
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
Originally Posted by BoostedAero
Just make sure that is the actual intercooler pump and not the auxiliary water pump (behind passenger headlight) and I would say we are on to something good :~>

keep it up fellas!
I had no idea there was a water pump behind the passenger headlight. What's it for?
Old 05-17-2017, 05:15 PM
  #12  
Super Member
 
jumph4x's Avatar
 
Join Date: Aug 2009
Location: Oakland
Posts: 998
Received 70 Likes on 54 Posts
W210 DRFT BNZ
Even for reliability's sake I would probably turn this into a physically-wired project. Put in a logical AND* between the switch and the ignition 12VDC+ that would go to a three post relay. I will likely end up doing just that for my purposes and activities, TBQH. Since the post-relay power would be wired in parallel to the physical pump, you would end up with a logical OR between your switch and the ECU's decision to run the fan.

* - I admittedly don't know much about electrical, but based on a quick search most 3-,4- and 5- post relays will not do this. But a logical AND can be achieved quickly with two regular relays in series.

So what you have with the setup above (what I'm planning) is:

Pump on = (ECU says it should be on) OR ((car ignition is ON) AND (interior switch is ON))

Originally Posted by BoostedAero
Just make sure that is the actual intercooler pump and not the auxiliary water pump (behind passenger headlight) and I would say we are on to something good :~>

keep it up fellas!
It probably is the AUX water pump.

Originally Posted by JoeJErnst
I had no idea there was a water pump behind the passenger headlight. What's it for?
Mercedes come with two pumps, one mechanical and one electrical. From what I understand the auxiliary pump runs on a delay relay after car shutdown to prevent hotspots in the motor? Who knows, that's the folklore passed down to me a decade ago.

A relic of the over-engineered W1XX cars. Remember the 'rest' heat option on those? For long drives at night there would be a button that would pump heat into the interior, I'm guessing this would run the AUX pump on a low setting to make sure the heater core has a longer supply of warmth. Also explains why this message can be sent over CANBUS instead of the ECU operating a relay directly (which is likely the case for the intercooler pump).

Last edited by jumph4x; 05-17-2017 at 05:32 PM.
Old 05-17-2017, 06:17 PM
  #13  
MBWorld Fanatic!
Thread Starter
 
JoeJErnst's Avatar
 
Join Date: Jun 2014
Location: Portland, Oregon
Posts: 1,036
Received 166 Likes on 137 Posts
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
Well, I guess I'll use the Carloop for something else then.

Originally Posted by jumph4x
... Pump on = (ECU says it should be on) OR ((car ignition is ON) AND (interior switch is ON))
I will simplify this down to Pump on = car ignition is ON. Since I'm running a Killer Chiller with a tank and no H/X I want the pump on all the time.

I'll probably unplug the harness connector on the pump and run an entirely new circuit to it, pulling power off the back of the alternator and the relay signal from... ? Where should I grab the relay signal for when the key is ON? Somewhere in the engine compartment would be best, and I don't want to cut any wires. Can I tap into a fuse somewhere?
Old 05-18-2017, 11:30 PM
  #14  
Super Member
 
jumph4x's Avatar
 
Join Date: Aug 2009
Location: Oakland
Posts: 998
Received 70 Likes on 54 Posts
W210 DRFT BNZ
Originally Posted by JoeJErnst
Well, I guess I'll use the Carloop for something else then.



I will simplify this down to Pump on = car ignition is ON. Since I'm running a Killer Chiller with a tank and no H/X I want the pump on all the time.

I'll probably unplug the harness connector on the pump and run an entirely new circuit to it, pulling power off the back of the alternator and the relay signal from... ? Where should I grab the relay signal for when the key is ON? Somewhere in the engine compartment would be best, and I don't want to cut any wires. Can I tap into a fuse somewhere?
Yeah, probably. Start by checking out what the fuses and relays do at the driver-side underhood distribution panel. Then just tap into the wire of choice behind it.

I wonder if I should just do the same. Can anyone think of a reason not to run the damn pump all the time? Seriously...
Old 05-19-2017, 01:33 AM
  #15  
MBWorld Fanatic!
Thread Starter
 
JoeJErnst's Avatar
 
Join Date: Jun 2014
Location: Portland, Oregon
Posts: 1,036
Received 166 Likes on 137 Posts
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
Originally Posted by jumph4x
I wonder if I should just do the same. Can anyone think of a reason not to run the damn pump all the time? Seriously...
No, I can't think of any good reason to not have it run all the time. I currently have Plan C underway. Tony (my tuner) says he can command the pump on in the tune. I'll report back here when I have more details.
Old 08-22-2017, 04:29 AM
  #16  
Super Member
 
jumph4x's Avatar
 
Join Date: Aug 2009
Location: Oakland
Posts: 998
Received 70 Likes on 54 Posts
W210 DRFT BNZ
Originally Posted by JoeJErnst
No, I can't think of any good reason to not have it run all the time. I currently have Plan C underway. Tony (my tuner) says he can command the pump on in the tune. I'll report back here when I have more details.
Now that I swapped in the new 010 part number, I see that the only thing running to the pump is a 2 lead connector. Sounds like you should just run some 16 AWG wire from the hood fusepanel directly to the positive lead of the pump.

Possibly put a mechanical override switch/breaker inline for highway hauls and such. The only reason here being is possibly extending the pump's life.
Old 10-02-2017, 07:05 PM
  #17  
iwl
Newbie
 
iwl's Avatar
 
Join Date: Sep 2017
Location: Germany Leipzig
Posts: 5
Likes: 0
Received 2 Likes on 2 Posts
A-Class W169
Originally Posted by JoeJErnst
Next step is to load a simple program and see if I can get it communicating with the car via the OBD-II port. After that I'll figure out how to sniff the CAN bus
How have you done that?

I've got information there is a separate diagnosis can at the OBD port and you only get answers to diagnosis requests there.

Some say without requests it is just silent and you can't sniff anything.
Old 10-14-2017, 01:17 PM
  #18  
MBWorld Fanatic!
 
Russell Ormerod's Avatar
 
Join Date: Jun 2011
Location: Cape town
Posts: 1,494
Received 131 Likes on 129 Posts
not a merc
You can sniff can bus data without a problem, but transmitting your own message is totally another issue. So your best option is to just directly control the pump relay directly. You see if you transmit on the bus you going to need to transmit with the same ID as what the original ecu uses. This would cause a bus error because the protocol does not allow for same ID to be transmitted. ID's are how bus arbitratation takes place. Lower ID have higher priority.
Old 11-10-2017, 12:38 AM
  #19  
Former Vendor of MBWorld
 
ecmexchange's Avatar
 
Join Date: Mar 2017
Posts: 335
Received 12 Likes on 12 Posts
na
Any resolution on this? Just wondering.
Old 11-10-2017, 03:38 AM
  #20  
MBWorld Fanatic!
 
Russell Ormerod's Avatar
 
Join Date: Jun 2011
Location: Cape town
Posts: 1,494
Received 131 Likes on 129 Posts
not a merc
Can bus is always interesting
Old 11-10-2017, 12:14 PM
  #21  
MBWorld Fanatic!
Thread Starter
 
JoeJErnst's Avatar
 
Join Date: Jun 2014
Location: Portland, Oregon
Posts: 1,036
Received 166 Likes on 137 Posts
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
Originally Posted by ecmexchange
Any resolution on this? Just wondering.
I could never get the ECU to command the pump on all the time. I ended up running a lead from the fuse box directly to the pump so it comes on with the ignition. It was actually quite simple, and didn't require cutting into the factory harness in any way.
The following 2 users liked this post by JoeJErnst:
ecmexchange (11-10-2017), jumph4x (12-13-2017)
Old 12-05-2017, 03:44 AM
  #22  
MBWorld Fanatic!
 
Richard's Avatar
 
Join Date: Nov 2001
Location: Berkshire, UK
Posts: 1,148
Likes: 0
Received 16 Likes on 13 Posts
2004 SL55, 2015 A250d, 2016 GLC250d
just remember that the CANbus going to the Diagnostic socket is a private CANbus between the CGW (often part of another control module such as the EZS or the Front SAM) and the socket.

So most information is not there and you may have to find the engine/chassis CANbus (green/white,green probably).
-This prevents people easily plugging stuff into CANbus and doing stuff that was un-intended (like starting the car I imagine)

Interested to know how you get on

Richard
Old 12-13-2017, 10:04 PM
  #23  
Super Member
 
jumph4x's Avatar
 
Join Date: Aug 2009
Location: Oakland
Posts: 998
Received 70 Likes on 54 Posts
W210 DRFT BNZ
Originally Posted by JoeJErnst
I could never get the ECU to command the pump on all the time. I ended up running a lead from the fuse box directly to the pump so it comes on with the ignition. It was actually quite simple, and didn't require cutting into the factory harness in any way.
Any photos or tips would greatly help. Going to do the same.
Old 12-14-2017, 12:10 AM
  #24  
MBWorld Fanatic!
Thread Starter
 
JoeJErnst's Avatar
 
Join Date: Jun 2014
Location: Portland, Oregon
Posts: 1,036
Received 166 Likes on 137 Posts
2019 Jeep Trackhawk, 2002 CLK55, 2014 911 Carrera
Unfortunately I only took one picture so this may get a little wordy...



See that red wire running through the middle of the fuse panel? It connects in the back left corner to a fuse tap that I bought at Autozone. I don't remember which fuse location it is, but if you check your fuse diagram (it should be behind the little panel on the left side of the dashboard; only accessible when the driver's door is open) you will see a couple fuses that can be put in two positions; one for continuous power, and one for accessory power. (one of them is the cigarette lighter; can't remember the other one)

Anyway, I tapped into the one that has accessory power so my pump will run whenever the key is in position 1 or 2. I ran the red wire through some of the black corrugated loom, across the top of the radiator over to the passenger side and down to the pump. If you look closely you can see where the ground wire pops out of the loom and attaches to the factory ground stud.

On the pump end, I simply unplugged the pump and wrapped the connector in some electrical tape to keep it clean in case I ever want to re-attach it. I bought a new plug from the dealer so I can just connect my wire to it and plug it into the pump.

This part was a little tricky, because when I ordered the plug, the only thing it came with was the plastic bits. There was no connector or weatherproofing bits. I think you can get them all from the dealer, but you will end up ordering 3 different part numbers just to make the plug. (sorry, I don't know what the numbers are) They are each only a few bucks though, so I think it would be worth it to avoid having to cut up the harness. Since I didn't want to wait for another week, I ran down to Fry's electronics and found the connector bits that go inside the plastic plug. I just skipped the weatherproofing bits.

Here's the packaging for the connectors from Fry's:
Old 12-14-2017, 01:31 AM
  #25  
Super Member
 
jumph4x's Avatar
 
Join Date: Aug 2009
Location: Oakland
Posts: 998
Received 70 Likes on 54 Posts
W210 DRFT BNZ
Every bit helps, but skipping the dealer part numbers!? This is a wonderful mod: easy and doable by anyone.
I love you all the same, regardless. Thanks, buddy!

EDIT for posterity:

Source: https://www.jaguarforums.com/forum/x...k-91611/page2/

Originally Posted by 80sRule
Part Numbers for me buying locally at the Mercedes dealer:

Here are the Mercedes part numbers needed to build the plug that fits the 010 bosch pump:

Qty 1 of: 230-540-00-81 "COUPLING" - $2.70
Qty 2 of: 008-545-63-26 "PLUG" - $7.20 (total)
Qty 2 of: 000-54568-80 "RUBBER RIN" - $6.30 (total)

Total Price at local Mercedes dealer - $16.20

I did this on my XKR and works great and now modular!
Placed a custom order with FCP Euro, will verify.

Last edited by jumph4x; 12-14-2017 at 01:42 AM.
The following users liked this post:
ecmexchange (12-14-2017)


You have already rated this thread Rating: Thread Rating: 0 votes,  average.

Quick Reply: CANBus Hacking with Carloop



All times are GMT -4. The time now is 08:41 PM.