Honda B-CAN and Carloop

[clemoyne]

My 2012 Honda Odyssey has two CAN systems, one is High Speed CAN and one is Low Speed CAN. In Hondaspeak, high speed CAN is called F-CAN and low speed CAN is called B-CAN and it runs at 125 kbps. B-CAN controls "less important" things like climate control, audio, door locks, the blind spot indication system, and so on. B-CAN connects to HS-CAN via the instrument cluster. Interestingly, you can pull B-CAN error codes without a scan tool.

As far as I can tell, there is no diagnostic connector for B-CAN, so I would have to tap into the system by splicing wires and cobbling it together with a Carloop.

Should be a fun project, looking forward to posting some results.

Below is a picture showing some of the systems controlled by F-CAN and what is controlled by B-CAN.

[clemoyne]

So I took a crack at this today. I disconnected the parking sensor module which has B-CAN H and B-CAN L and I tried to tap into the connection as shown below.

Unfortunately this did not work. I set the speed to 125 kbit/s in socketcan and received no data.

Is there a more elegant way to use the Carloop when not using the OBD pins? As in does CAN-H / CAN-L break out somewhere else on the board?

Will try again later and put a multimeter on it to see if I'm getting 2.5V.

[alanm]

Nice work, @clemoyne! I would recommend using one of our OBD-II female connectors. We will be publishing a bunch of new accessories on our store next week that makes this kind of work MUCH more enjoyable!

Stay tuned!

[clemoyne]

Nice to know about offering more stuff in the store!

As for my B-CAN work, I did just read the following from a post on CAN standards.

Low Speed/Fault Tolerant CAN offers baud rates from 40 Kbit/s to 125 Kbits/sec. This standard allows CAN bus communication to continue in case of a wiring failure on the CAN bus lines. In low speed/fault tolerant CAN networks, each device has its own termination.

Looks like that means I have to put a termination resistors on the Carloop (from B-CAN H to Ground and B-CAN L to Ground). Maybe that is why I was not receiving anything!

[clemoyne]

Hmm, this might be a problem:

From http://inst.cs.berkeley.edu/~ee249/fa08/Lectures/handout_canbus2.pdf

For Low-Speed CAN, each device on the network needs a termination resistor for
each data line: R(RTH) for CAN H and R(RTL) for CAN L. Unlike the High-Speed
CAN, Low-Speed CAN requires termination on the transceiver rather than on the cable.
Figure 3 indicates where the termination resistors should be placed on a single-wire,
low-speed CAN network (The National Instruments Single-Wire CAN hardware includes
a built-in 9.09 kohm load resistor.)

Maybe the way to tackle is to tap into the B-CAN wires so the Carloop is just sniffing data. I tried using the Carloop as a termination which probably won't work with low speed fault tolerant CAN.

[clemoyne]

Good news: I managed to tap into the B-CAN lines at the heated seat module and record some data.

The bad news is that the data is not really decodable. I could not find any patterns, as the values are constantly changing. Here are a couple videos showing what I found with cansniffer:

B-Can recording 1

B-Can recording 2

[clemoyne]

Just curious, does @jvanier's socketcan serial app support CAN messages with extended 29 bit arbitration ID's?

I am pretty sure that Honda B-can uses extended ID's.

[clemoyne]

Today I managed to access BCAN using a USB CAN device. It turns out that cansniffer does not work with extended 29 bit arbitration ID's. When I ran cansniffer nothing would happen, but with candump I was able to get some data. When I played back the data with canplayer, I could get doors to lock/unlock, lights to flash, and the heated seats to turn on and off.
So I am still not sure if Carloop's socketcan app will work with 29 bit ID's, will have to try that later. For now glad that I managed to hack into the body CAN system on my Honda!

[alanm]

Great work! I'm quite sure that can-utils also works with 29 bit IDs. We've been pretty busy but I'd love to help out on this project! Sounds like you are making great progress, @clemoyne

[clemoyne]

Hey guys, long time no post. I have picked up my project again and am making good progress...more on that soon.

I was still wondering if socketcan-serial can handle 29 bit arbitration ID's.

I was able to successfully figure out some messages sent by a Blind Spot Indication module that I picked up when I analyzed it with a USB2CAN. I have tried doing the same thing with a Carloop using socketcan-serial and I am not reading getting any messages off the bus. It is low speed can (125 kbit) so I changed the speed from s6 to s4 in the slcand command, but it still doesn't seem to pickup these 29 bit ID's

[alanm]

hey @clemoyne,
Great to have you back! Yes, you can get 29 bit arbitration IDs using candump as oppossed to cansniffer.

cansniffer doesn't yet have the 29-bit arbitration ID implemented. See the issue brought up in 2016 on can-utils repo: https://github.com/linux-can/can-utils/issues/30

[clemoyne]

Hi Alan,

Actually my question this time was whether socketcan-serial works with 29 bit ID's on a Carloop. Do I need to add "message.extended = true" to the socketcan_serial.ino file?

[clemoyne]

Also here's an update on my project.

This all started because I purchased a metric cluster for our 2012 Odyssey, and the cluster was showing an error for the blind spot indication (BSI) system, which our van does not have. I discovered that the BSI system is on the low speed 125 kbps B-CAN fbus.

In the interest of science, I purchased the BSI module for our van off eBay. I figured out the pinout from the shop manual, connected the pins for power, ground, BCAN H/L, and the mirror indicators, and I powered it up.

I knew it was working because on boot the LED's for the mirrors lit up. Using my USB2CAN, I ran CANDUMP and saw the following 29-bit messages:

(1501182476.597224) can0 1610FF9F#
(1501182476.601778) can0 12F8AC9F#09
(1501182476.901628) can0 12F8AC9F#09
(1501182477.201563) can0 12F8AC9F#09
(1501182477.501585) can0 12F8AC9F#09
(1501182479.601400) can0 12F8AC9F#09
(1501182479.621410) can0 12F8AC9F#08
(1501182479.921487) can0 12F8AC9F#08
(1501182480.101490) can0 12F8AC9F#11
(1501182480.401726) can0 12F8AC9F#11
(1501182480.591237) can0 1610FF9F#
(1501182480.701417) can0 12F8AC9F#11
(1501182481.001430) can0 12F8AC9F#11
(1501182481.301328) can0 12F8AC9F#11

I haven't figured out what 1610FF9F# means, but I did discover that 12F8AC9F#08 indicates everything is OK, 12F8AC9F#09 turns on just the BSI warning light to indicate self test (while starting the car), and 12F8AC9F#11 indicates a fault.

Armed with this information, I created a carloop transmit script that send the "BSI is OK" 12F8AC9F#08 message every 20 milliseconds. The message is sent to the bus via the B-CAN lines under the passenger seat, and I am powering the Photon via USB on switched power so I don't have to worry about battery drain. Voila, no more BSI errors!

void loop() {
// Send a message at a regular time interval
unsigned long now = millis();
if (now - lastTransmitTime > transmitInterval) {
CANMessage message;
// A CAN message has an ID that identifies the content inside
message.id = 0x12F8AC9F;
message.extended = true;
// It can have from 0 to 8 data bytes
message.len = 1;
// Pass the data to be transmitted in the data array
message.data[0] = 0x08;
// Send the message on the bus!
carloop.can().transmit(message);
lastTransmitTime = now;
}
}

[cyclin_al1]

@alanm, I think this one is for you (there is more than one Alan here )

[yuvch]

Hey @clemoyne , I am trying to figure out a way to control A/C that's on my navigation unit I am planning to replace with a carpc. Heres the connecter (DISPLAY UNIT CONNECTER A (5P)) that gives the navigation unit A/C control: https://www.manualslib.com/manual/939368/Honda-2004-Odyssey.html?page=2034#manual .

I'm a newbie at this, I assume that the connecter is linked in with B-CAN. How would I capture the data I'd need from there?

Maybe I should do something similiar to what you did with your BSI system. Take out the Navigation unit and connect it to my own CAN Network, replay the data to my car. I seriously doubt it would work with a nav unit tho.

If only the stinkin a/c controls weren't in the nav

[clemoyne]

Based on the pinouts it does not look like the 2004 Odyssey uses CAN for either of these modules. You would see BCAN_H / BCAN_L or something like that on the pinout of one of the connectors.

[yuvch]

You're absolutely right. I just realised that the CAN bus standard was implemented after 2007.

It uses the ISO9141 protocol but I'm not sure if the nav or climate control module are even using that.

I'll have to do some more research. Thanks for pointing that out, idk how it flew over my head

[cyclin_al1]

I doubt that ISO9141 would interface with the nav or climate control.
Back in those days, those systems were typically discrete and not integrated together.
As a guess, the only thing on the ISO9141 are the OBD2 and re-flashing the engine control mapping.

Most likely, the climate controls are mechanical, with levers, louvres and mechanical thermostats; there is probably no software there at all.

The navigation system is most likely a plug-in replacement for the usual radio/stereo system. It likely has only connections for power, speakers and the antennae (radio & GPS).

That being said, I am still working on CarloopRetro, which is intended to do ISO9141.
An oscilloscope just arrived, so I can now look into signal integrity in my prototyping.

[nokoa]

I know this is an old thread, but I couldn’t find an answer for this. I am trying to hook into the B-CAN to hopefully control the ac. I am trying to do this on a 2017 Honda Accord, it has soft AC buttons. I am not sure where to exactly find access to B-CAN, can I access it through the motorized driver seat? I saw that previously someone accessed it through the option connector, but I couldn’t find it on the fuse box.

[clemoyne]

Hello, I was able to access B-CAN at the wiring for our heated seat module. Really you could do this at any module that has a B-CAN connection. Please be sure to let us know if you are able to successfully control HVAC over B-CAN!