Vauxhall Owners Network Forum banner

1 - 20 of 30 Posts

·
Registered
Joined
·
10 Posts
Discussion Starter #1
Hey Everyone,

First off, MERRY CHRISTMAS :)

I am working on a project here and was hoping for some information on the CANbus system for my Vehicle (Astra SRI MK5 2008).

Unlike most of you who would use the OBDII standard and some factory kit to read error codes, I am working on reading the CANbus data directly from the infotainment system using a "CANbus Arduino Shield". Using a OBDII connector I was able to monitor the engine traffic sent over the high speed CANbus from the ECU (inc. veh. speed and rpm), however the infotainment system (and also lights, locks etc) are controlled over the medium speed CANbus which does not directly link into the OBDII connector (only if probed over the ECU). This is where I have managed to get stuck.

I know this is entirely possible as I have done extensive research and am an electronic engineer so this is not my first project of this magnitude, I am just having problems with Vauxhalls (expectedly) sparse information on this subject.

In particular, I am after the baud rate for the medium speed network of my car (I have tried 125, 250 and 500kbps of which none show data), and also if the CANbus frame is 11bit or 29bit format (on the High Speed CANbus it is 11bit at 500kbps). My car contains the factory fitted CD30 MP3 Radio and headup unit, so I have tapped directly into the CANH and CANL behind the radio to try scan for the CANBus data and learn the steering wheel controls to begin with. Unfortunately I am unable to get any data, and although I will continue to work on that hardware interface side, I was just curious if 1) Any one has attempted this on a similar vehicle and 2) is there any technical specs for either the radio or any other med-speed canbus enabled device my vehicle has that could shed some light into the CANbus structure :)

Any help at all would be fantastic :D

Happy holidays,
M
 

·
Premium Member
Joined
·
16,229 Posts
Im not sure I can answer your question but this is the speeds at which the opcom/vauxcom are programmed to communicate with the MS-CAN on the Astra H. It gives 2 readings for the MS-CAN depending on the year of the car. Its listing the 2008 as 95.6kbps. Upto and including 2008 was 95.6kbps. 2009> is 92.5kbps.

HS-CAN = 500kbps
MS-CAN = 92.5/95.6 kbps
SW-CAN = 33.3 kbps


Hope this is of some use!
 

·
Registered
Joined
·
10 Posts
Discussion Starter #3
Thank you :)

It is of course non standard (10kbps is the closest) so I will need to do a little more programming on my end to configure this to those new speeds, I will let you know :)

Many Thanks
 

·
Registered
Joined
·
10 Posts
Discussion Starter #5
Just an update guys,

I tried the MS-CAN lines at 92.5/95.6 kbps with no luck. I also found that after market steering controls are set for 95 kbps for the CD30MP3, which I also tried to no avail. I checked with an oscilloscope connected to the CANH and CANL and have confirmed 95ish kbps is the correct rate. In case I have managed to damage the electronic board I am using, I have ordered another to let me check my code further and it should be here in a week or so, I will report back when I know more. I will figure this out!!

With two canbus boards I can test code before feeding it into the car (I am terrified of accidentally triggering the airbags haha). I already managed to read engine data from the high speed canbus, but right now am not particularly interested in that data (not until I crack the low- and med-speed canbus to control vehicle systems).

If you are interested, this an example of the hardware I am using: http://www.seeedstudio.com/wiki/CAN-BUS_Shield#6._Receive_Data
Mine also includes an LCD and GPS interface, my ultimate goal is to combine these with a 3G network board I own to relay live vehicle information back to my computer and of course allow remote control :D

Once I start receiving data it will be a simple matter of listening to data packets that are on the canbus after button pushes etc and will be able to quickly learn and replicate commands.

All good fun :)
 

·
Super Moderator
Joined
·
26,656 Posts
Just an update guys,

I tried the MS-CAN lines at 92.5/95.6 kbps with no luck. I also found that after market steering controls are set for 95 kbps for the CD30MP3, which I also tried to no avail. I checked with an oscilloscope connected to the CANH and CANL and have confirmed 95ish kbps is the correct rate. In case I have managed to damage the electronic board I am using, I have ordered another to let me check my code further and it should be here in a week or so, I will report back when I know more. I will figure this out!!

With two canbus boards I can test code before feeding it into the car (I am terrified of accidentally triggering the airbags haha). I already managed to read engine data from the high speed canbus, but right now am not particularly interested in that data (not until I crack the low- and med-speed canbus to control vehicle systems).

If you are interested, this an example of the hardware I am using: http://www.seeedstudio.com/wiki/CAN-BUS_Shield#6._Receive_Data
Mine also includes an LCD and GPS interface, my ultimate goal is to combine these with a 3G network board I own to relay live vehicle information back to my computer and of course allow remote control :D

Once I start receiving data it will be a simple matter of listening to data packets that are on the canbus after button pushes etc and will be able to quickly learn and replicate commands.

All good fun :)
Remote Control ?
 

·
Registered
Joined
·
3 Posts
hey I can confirm the med speed is 95Kbps I had to amend my lid to use this speed, as a note check what your using crystal wise mine was 8 instead of 16 so didn't see any coms now overwhelmed with info took awhile to find steering control codes but now masked the other and use my arduino to send IR codes to my radio for volume control and the other functions, video on you tube regarding this (
)
 

·
"Red One.."
Joined
·
2,873 Posts
This is deep stuff alright, interesting too - you're looking at actually being able to interpret data packets in order to emulate messages and give you the ability to send your own commands through the CAN network. Certainly something at a tech level we would never have looked into.

Just to comment on your first post, as to whether it would be any use to you, the MSCAN does indeed terminate at the diagnostic plug, namely pins 3&11. HSCAN as you've probably already found terminates at pins 6&14, and the LSCAN is a single wire configuration terminating at pin 1.

Possibly of further use - the gateway between HS and LS is the CIM unit behind the steering wheel, gateway between LS and MS is the radio info display unit. This allows any necessary messages to then be transferred between all three networks if required.
 
  • Like
Reactions: Fred Bassett

·
Registered
Joined
·
3 Posts
good info, currently im still picking up the MSCAN from the Radio as original removed so these were spare, (also left dia plug free) the only unfortunate area is trying to interpret what each code corresponds to as there as quite a few..... I compared to 1 min samples of data sent over the can after key on. basic but it worked, recently I decided to replace my single din with a double din with reverse camera for the partner, so going to do some more data scoping to see if I can pick out the can message for (Reverse), not sure which speed its on thou currently
 

·
"Red One.."
Joined
·
2,873 Posts
The CAN signal for reverse will be sent on the single wire LSCAN network, to either the REC (if fitted), or the UEC (if car doesn't have an REC). There's a myriad of messages being sent and received so I'd be interested as to how you'd actually even begin to pick out an individual message off the bus and pinpointing it to being for one specific item.
 

·
Super Moderator
Joined
·
26,656 Posts
The CAN signal for reverse will be sent on the single wire LSCAN network, to either the REC (if fitted), or the UEC (if car doesn't have an REC). There's a myriad of messages being sent and received so I'd be interested as to how you'd actually even begin to pick out an individual message off the bus and pinpointing it to being for one specific item.
Me Too ! Lol :D
 

·
Registered
Joined
·
3 Posts
The CAN signal for reverse will be sent on the single wire LSCAN network, to either the REC (if fitted), or the UEC (if car doesn't have an REC). There's a myriad of messages being sent and received so I'd be interested as to how you'd actually even begin to pick out an individual message off the bus and pinpointing it to being for one specific item.
to be honest patience, two 2 minute periods of data (with ignition on=a few thousand lines of data), couple of cups of coffee big fag and compared to data dumps line for line (one of the dumps I pressed the buttons to present the messages on the can bus for viewing) took a while and would have been much easier with a comparator, once I had found the id however I set the masks and filters so could only receive from the respective area of the can bus (made viewing much easier). very satisfying when it worked, many thanks about the reverse signal being on the low speed I am guessing the parking brake is also (saves me getting my butt out in the cold, mhhhh that's scuppered my plans a little was going to amend the code for a new radio to produce the signal for the parking break and reverse.
 

·
"Red One.."
Joined
·
2,873 Posts
Yes that might be a stumbling block. Not impossible as the radio via the info display does have a way of transferring the data - it'd be a message along the MSCAN to the display, which would then output a message onto the LSCAN. But it's whether the display can handle and interpret a message for reverse lights that it's probably not receiving under normal circumstances.
 
  • Like
Reactions: Fred Bassett

·
Registered
Joined
·
1 Posts
Hello

I am working on something similar... fit a Raspberry Pi with CAN interface as CAR PC......
I have successful communication over MS-CAN on Diag connector under the handbrake.
I came to idea to fit Raspberry Pi and other electronics in the place where CD was in CD30MP3.
I am trying to communicate to MSCAN on the pins back on CD30MP3 same way as MSCAN on Diag - no success – Any idea what to do…?

Codes on MS-CAN are:
CAN ID LEN
======= ===
180 8 (tested by me it is OK)
Date / Time [46] [the XX-th] [year] [month] [DD] [DD] [second] [the FF] Byte
[DD] [DD] - packed values of the day, hours and minutes: 5 bits - Day 5 bits - watch 6 bits - minutes

201 3 (tested by me it is OK)
GU Buttons (CD30MP3) [1/0 is pressed / no] [key] [long press]
buttons codes: 01- the BC 31-39 - station 6F- OK 6S- right D6- left E0- AM / FM and CD / MP3 ( ??? why the 2 buttons with one code) FF- the Settings of Opera (CDC30) e0- the Main [08] [6A] [FF / 01] - the central handle, rotate left / right [00] [6B] [long]. - pressing the central knob

6C1 8 (tested by me it is OK)
RDS Sent 9 package The first package: 1st byte [10] 2-8 bayty- ??????? Note .: After the first packet before the second-ninth always skips a message with CAN id 2C1 [30 00 00 00 00 00 00 00] 2nd - 9th packages: 1st byte [21-28] 2-8 bayty- text 2 bytes starting with the first ever [00], second [ASCII code]

206 3 (tested by me it is OK)
The buttons on the steering wheel first byte is pressed or not 0/1
second - which button [81/82 left buttons up / down] [91/92 right buttons]
3rd - press (appears in seconds) Castors [08] [83 left wheel] [the FF up, 01 down] [00/01] [84 pressing the left wheel] [length] [08] [93 right wheel] [01 \ the FF up \ bottom]

208 6 (not tested by me, maybe like this, who knows?????)
Climate control air flow direction: Pressing [00/01] [17] [XX XX XX XX] Rotation [08] [16] [the FF / 01 Left / Right] [XX XX XX]

2B0 8 (not tested by me, maybe like this, who knows?????)
Sound Menu 4th byte BE (E6 display is turned off?)

258 (not tested by me, maybe like this, who knows?????)
Climate

658 (not tested by me, maybe like this, who knows?????)
Climate By rotating the handle airflow rate [22] [50] [00] [3 [0-7] fan speed]


450 4 (tested by me it is OK)
Ignition and lights: 3rd byte - the status of the ignition switch 06 Ignition = 2, 00 = No key 04 = key is inserted, 05 = ignition 1 4th byte - lights 01..FF = lights on, the brightness (FF = max, 01 = min) 00 = lights off


4E8 7 (tested by me it is OK)
Reverse and speed of:
the 3rd and 4th bytes - tachometer (MSB, LSB)
5th and 6th bytes - speed (MSB, LSB)
7th byte - bit mask 0x 04 reverse if ??????? is not on - sent approximately once per second. If the wound - about 5-8 times per second.

697 8 (not tested by me, maybe like this, who knows?????)
Sending at intervals of 2.5 seconds. It includes a display (maybe even on something affects) 47 00 60 00 02 00 00 80


683 3 (tested by me it is OK)
# 46 01 XX where the temp in celsius is XX/2-40 so 0x00 is -20.0°C and 0x76 is 19.0°C.
 

·
Premium Member
Joined
·
16,229 Posts
And now in English lol.. Far beyond my understanding but well done for your effort.
 

·
Super Moderator
Joined
·
26,656 Posts
And now in English lol.. Far beyond my understanding but well done for your effort.
My thoughts entirely lol . I’ll stick to doing my jigsaws .
Krume , what’s this all in aid of ?
 

·
Registered
Joined
·
10 Posts
Discussion Starter #18
Getting back into this again, stopped due to other projects. I will update as I go. In case anyone is doing the same, I found that the MSCAN is available on the OBD2 port on pins 3(high)/11(low). It does appear to be 95.6 kbaud, but if anyone can agree/disagree to this I would like to know. On the MSCAN, canID 518 decimal is the steering wheel controls to the radio (CD30 MP3).

I think each button press is not a single CAN packet, but rather a sequence of them, but I have yet to confirm this.
 

·
Super Moderator
Joined
·
26,656 Posts
Getting back into this again, stopped due to other projects. I will update as I go. In case anyone is doing the same, I found that the MSCAN is available on the OBD2 port on pins 3(high)/11(low). It does appear to be 95.6 kbaud, but if anyone can agree/disagree to this I would like to know. On the MSCAN, canID 518 decimal is the steering wheel controls to the radio (CD30 MP3).

I think each button press is not a single CAN packet, but rather a sequence of them, but I have yet to confirm this.
Glad to see your still cracking on with this project of yours :D
 

·
Super Moderator
Joined
·
14,150 Posts
Hello

I am working on something similar... fit a Raspberry Pi with CAN interface as CAR PC......
I have successful communication over MS-CAN on Diag connector under the handbrake.
I came to idea to fit Raspberry Pi and other electronics in the place where CD was in CD30MP3.
I am trying to communicate to MSCAN on the pins back on CD30MP3 same way as MSCAN on Diag - no success – Any idea what to do…?

Codes on MS-CAN are:
CAN ID LEN
======= ===
180 8 (tested by me it is OK)
Date / Time [46] [the XX-th] [year] [month] [DD] [DD] [second] [the FF] Byte
[DD] [DD] - packed values of the day, hours and minutes: 5 bits - Day 5 bits - watch 6 bits - minutes

201 3 (tested by me it is OK)
GU Buttons (CD30MP3) [1/0 is pressed / no] [key] [long press]
buttons codes: 01- the BC 31-39 - station 6F- OK 6S- right D6- left E0- AM / FM and CD / MP3 ( ??? why the 2 buttons with one code) FF- the Settings of Opera (CDC30) e0- the Main [08] [6A] [FF / 01] - the central handle, rotate left / right [00] [6B] [long]. - pressing the central knob

6C1 8 (tested by me it is OK)
RDS Sent 9 package The first package: 1st byte [10] 2-8 bayty- ??????? Note .: After the first packet before the second-ninth always skips a message with CAN id 2C1 [30 00 00 00 00 00 00 00] 2nd - 9th packages: 1st byte [21-28] 2-8 bayty- text 2 bytes starting with the first ever [00], second [ASCII code]

206 3 (tested by me it is OK)
The buttons on the steering wheel first byte is pressed or not 0/1
second - which button [81/82 left buttons up / down] [91/92 right buttons]
3rd - press (appears in seconds) Castors [08] [83 left wheel] [the FF up, 01 down] [00/01] [84 pressing the left wheel] [length] [08] [93 right wheel] [01 \ the FF up \ bottom]

208 6 (not tested by me, maybe like this, who knows?????)
Climate control air flow direction: Pressing [00/01] [17] [XX XX XX XX] Rotation [08] [16] [the FF / 01 Left / Right] [XX XX XX]

2B0 8 (not tested by me, maybe like this, who knows?????)
Sound Menu 4th byte BE (E6 display is turned off?)

258 (not tested by me, maybe like this, who knows?????)
Climate

658 (not tested by me, maybe like this, who knows?????)
Climate By rotating the handle airflow rate [22] [50] [00] [3 [0-7] fan speed]


450 4 (tested by me it is OK)
Ignition and lights: 3rd byte - the status of the ignition switch 06 Ignition = 2, 00 = No key 04 = key is inserted, 05 = ignition 1 4th byte - lights 01..FF = lights on, the brightness (FF = max, 01 = min) 00 = lights off


4E8 7 (tested by me it is OK)
Reverse and speed of:
the 3rd and 4th bytes - tachometer (MSB, LSB)
5th and 6th bytes - speed (MSB, LSB)
7th byte - bit mask 0x 04 reverse if ??????? is not on - sent approximately once per second. If the wound - about 5-8 times per second.

697 8 (not tested by me, maybe like this, who knows?????)
Sending at intervals of 2.5 seconds. It includes a display (maybe even on something affects) 47 00 60 00 02 00 00 80


683 3 (tested by me it is OK)
# 46 01 XX where the temp in celsius is XX/2-40 so 0x00 is -20.0°C and 0x76 is 19.0°C.

I need a lie down after looking at that :eek:

But can you please start your own post onyour problem,

Thank you..............:sleep::sleep::sleep::sleep::sleep::sleep::sleep:
 
1 - 20 of 30 Posts
Top