Alfaa123 / Volvo-CAN-Gauge

Reverse engineering the Volvo VIDA protocol and CAN network to gather diagnostic information not available via OBD2 on Volvo cars.
96 stars 9 forks source link
can-bus car-hack car-hacking due volvo volvo-vida-protocol

Volvo-CAN-Gauge

Reverse engineering the Volvo VIDA protocol to gather diagnostic information not available via OBD2 on Volvo cars.

Video of the project here: https://www.youtube.com/watch?v=hdAKEG6ggRk

Hardware:

Libraries:

Basic Functional Description:

The Volvo VIDA protocol is a diagnostic protocol similar to UDS. However, unlike UDS the VIDA protocol, the first byte is a DLC and the second byte is the ECU address. An example (reading boost pressure) can be found below:

Other commands for byte 3 can be found in this paper: https://hiltontuning.com/wp-content/uploads/2014/09/VolcanoResearchPaperWeb.pdf

Car Specific Details

This Volvo uses 29-bit IDs on both high (500kbps) and low (125kbps) speed CAN busses. Every frame from every ECU is 8 bytes long. There is no gateway between the OBD2 port and the rest of the car and both busses are pinned out at the OBD2 connector, which makes it extremely easy to interface with the vehicle's onboard systems. A Pinout is shown below:

In this project, we are only concerned with recieving data that would be otherwise unavailable with OBD2. Boost pressure, for example, is not available via OBD2 on Volvo cars and if it was, it definitely would've made this project a lot simpler. (a partial list of discovered codes that you can request from ECU 7A from the VIDA database files is in Codes.txt)

We also use data from some broadcasted CAN frames that are used elsewhere in the car (for dashboard brightness, ignition status, the status of the light sensor on the dashboard and the buttons on the steering wheel). Ideally, we would capture ALL of our information from broadcast frames as that involves a lot less overhead and traffic on the bus. However, some of the information that we need never gets broadcast, so we sometimes have no choice.

The code uses a psudo multi-tasking approach where the message recieve loop is always running if one of the other loops isn't currently running. This allows us to update/check broadcast frames in the background for brightness changes, ignition status changes and button presses and update the global variables accordingly to be used elsewhere in the code.

In the display loop, we can show boost pressure, coolant temperature, intake temperature and ignition advance:

We react to the dashboard brightness broadcast frame so the display updates it's brightness along with the rest of the dashboard when the headlights are on. If the headlights are off, the display brightness is at maximum unless the brightness control is at it's minumum value as a way to shut the display off if required.

For right now, the only button we track is the cruise control cancel button. Holding the button for more than 2 seconds changes the currently displayed page. Perhaps in the future, a menu system could be implemented.

In order to turn the display on and off with the ignition, we look at the ignition status frame:

In order for the gauge to feel more "analog" the needle and value of the gauge will not change between distant values instantaneously. There is a built in loop that will require the needle to go through all intermediate values if the variable changes by more than 1.

Notes:

Other Resources: