Hello all,

I read a few posts here about hacking the CAN bus of some car models.
One to build a clock out of an instrument cluster, one to get steering wheel angle, etc.

I want something different. I want to build a full virtual cockpit for my car.

What do I need:
I need to know all the CAN messages, the values possible per message and their description received and sent by the stock instrument cluster, so I can write a translation script for my visualization software (like RealDash or similar).

It is not really doable for me to sniff all the different messages and I guess they are already known, because some people here already did some hacking.

I would very like to have some help with this project and maybe, when everything works, you can have fun with it yourself as well.

The concept:
Get a used or new instrument cluster. Empty the housing and build an LCD screen in it. Then build some hardware in it like a Raspberry PI, Arduino or even Android device.
The LCD will show the dials,, gauges, indicators, etc.

The hardware is connected to the CAN bus with a CAN shield and will receive and sent the messages. Yes, sending messages back to the CAN system, because the original cluster does this as well, like telling the Body Computer that is it awake, etc.

Any one interested to build this project? I really hope so.

Oh boy do you have a challenge on MANY counts.

1) CAN-Bus is just a communication network (as you probaly already know)

2) The are generic meesages/info that could/shoud/must be presented at an EOBD port but internally to the vehicle the manufacturer is free to encode/twiddle/fudge/create custom data values, sequences, etc.

I'm not going to even suggest that what you are looking to do can not be done. Everything can be done but you are entering a very specialised and technically dark area. (dark as in data transfers over CAN are/will be manufacturer encoded specific)

Here on MES I doubt there are many who have that extra level of CAN-Bus expertise that you seek. Hope I'm wrong but you have to bear in mind that for even simple Can-Bus EOBD dignostic data stream information EOBD kit manufacturers like SnapOn, Autel, ....... have to pay quite substantial sums of money for information over and above the legally required base EOBD requirements.

s130 said:

Oh boy do you have a challenge on MANY counts.

1) CAN-Bus is just a communication network (as you probaly already know)

2) The are generic meesages/info that could/shoud/must be presented at an EOBD port but internally to the vehicle the manufacturer is free to encode/twiddle/fudge/create custom data values, sequences, etc.

I'm not going to even suggest that what you are looking to do can not be done. Everything can be done but you are entering a very specialised and technically dark area. (dark as in data transfers over CAN are/will be manufacturer encoded specific)

Here on MES I doubt there are many who have that extra level of CAN-Bus expertise that you seek. Hope I'm wrong but you have to bear in mind that for even simple Can-Bus EOBD dignostic data stream information EOBD kit manufacturers like SnapOn, Autel, ....... have to pay quite substantial sums of money for information over and above the legally required base EOBD requirements.

Click to expand...

Thank you for your response.

I do know that this project will be very complicated.

I know from this forum that there are people that already played with the CAN protocol to make a clock out of a cluster, so it is not impossible.

Then about MES, AlfaOBD and similar software. They use the OBDii protocol, but can read/request and send proprietary ODBii PIDs that are not part of the standard OBDii protocol. If I can have acces or get those PIDs from someone that already figured this out, I guess almost every function used by the instrument cluster is accesable.

Am I on the right track thinking this way?

htevents said:

If I can have acces or get those PIDs from someone that already figured this out, I guess almost every function used by the instrument cluster is accesable.

Am I on the right track thinking this way?

Click to expand...

Yes you are on the right track. I've not done this type of work with the CAN-Bus BUT I've done quite a bit of this with radio communications equipment when creating my programs that do full virtual control and hunting down unpublished control commands.

Once you have the basic CAN-Bus protocol information then you can sit on the bus and look at all the data being sent. Filtering on IDs is the way to go but unless you know the specific ID for a device/message then it is really difficult because every node in the vehicle will be streaming data including what I would call heart beat data.

Once you have identified and ID (say by exercising indicators, or rev counter, etc. then you have work out which byte(s) in the message decode to specific values etc.

Yes a real fun project to play with.

To help you on your way you need Wireshark

https://www.wireshark.org/

For others interested in Can Bus then this may be of value

https://www.youtube.com/watch?v=FqLDpHsxvf8

s130 said:

Yes you are on the right track. I've not done this type of work with the CAN-Bus BUT I've done quite a bit of this with radio communications equipment when creating my programs that do full virtual control and hunting down unpublished control commands.

Once you have the basic CAN-Bus protocol information then you can sit on the bus and look at all the data being sent. Filtering on IDs is the way to go but unless you know the specific ID for a device/message then it is really difficult because every node in the vehicle will be streaming data including what I would call heart beat data.

Once you have identified and ID (say by exercising indicators, or rev counter, etc. then you have work out which byte(s) in the message decode to specific values etc.

Yes a real fun project to play with.

To help you on your way you need Wireshark

https://www.wireshark.org/

For others interested in Can Bus then this may be of value

https://www.youtube.com/watch?v=FqLDpHsxvf8

Click to expand...

The PIDs I was mentioning where about the OBDii protocol PIDs. The OBDii protocol (used for diagnostics) is standardized for all vehicles, so they can be diagnosed with (almost) every universal diagnostic device. But every manufacturer can use specific OBDii PIDs to read, request and control different nodes in the car. That is how AlfaOBD works for example. They don't use the CAN protocol, but the OBDii protocol, but with specific PIDs. I can turn on and off almost every light in the instrument cluster, with AlfaOBD, but I can not do that with VAG OBDii diagnostic devices for example, that means that the developer of AlfaOBD has the specific and proprietary OBDii PID, that has nothing to do with the CAN protocol of the car.

Maybe someone here has done some research about Fiats specific OBDii PIDs.

You are right that it is a real fun project, if I can work this out in any way.

OK so you want OBDII PIDs only. I was covering generally / including OBDII because your post was specifically titled "CAN bus hacking Punto 2012 1.3 Mjet instrument cluster" and implied you wanted to intercept and analys the CAN Bus to Cluster specifc data and not just the data that can be extracted/energives via the OBDII subset.

s130 said:

OK so you want OBDII PIDs only. I was covering generally / including OBDII because your post was specifically titled "CAN bus hacking Punto 2012 1.3 Mjet instrument cluster" and implied you wanted to intercept and analys the CAN Bus to Cluster specifc data and not just the data that can be extracted/energives via the OBDII subset.

Click to expand...

It is true that my initial post was about the CAN bus system, but I did some more research and I found out it is not possible to not exchange the cluster in total. The ECU and body computer will only work with the factory cluster type.

So my new idea is to get a used cluster, design a circuit board that I can "click" behind the original board, reroute the indicators, warning lights AND the standard lcd display to a small bar at the top of the cluster. Then I can fit a touchscreen on almost the whole cluster and only need to get the follwoing info from the car thu CAN and/or OBDii, that way I do not have to rebuild the whole cluster AND no problems with CAN bus fails.

1. Speed (km/h)
2. RPM
3. Engine coolant temp
4. Fuel level temp
5. Turbo boost pressure

1, 2, 3 and 5 I can get thru OBD protocol, Fuel level I don't know. I guess Fiat has their specific OBD PID for it, but I can not find a way to get that PID, maybe I do need to get that info directly from the CAN bus. If someone knows the OBD2 PIDS for fuel level, please let me know.

Ofcourse I can have a lot more info on the new display, but for now, lets keep it "simple".

Main conclusion: I need to know (some) specific fiat/punto OBDii PIDs.

MES can measure fuel level on a Punto 2012 1.3 Mulitjet Instrument Panel Marelli MY09.

s130 said:

MES can measure fuel level on a Punto 2012 1.3 Mulitjet Instrument Panel Marelli MY09.

Click to expand...

Correct, AlfaOBD can this too, but I need the PID for reading fuel level, so I can import that PID in Torque, RealDash or self designed software + if I connect to the instrument panel, I can't read data from the ECU, like speed, RPM, coolant, turbo boost pressure and so on.

Can I use an OBD "Y"cable, so I can connect 2 ELM/OBD adapters on the port, One with the yellow adapter cable to connect to the cluster and one to connect to the ECU without adapter cable? Or will this mess up the OBD system if 2 devices are requesting data?