Arduino Volvo Display Thread

[szecho]

Hi vtl, I want to replace my radio in 2005 xc90 and apart from controlling the buttons on the steering wheel, I would like to have also working the parking sensor.
I found your project - read steering wheel buttons for aftermarket radio, and it is very helpful. I logged CAN messages and found those from the SW buttons - I have the same SWM ID address as it is on your project, and I can read the SWM buttons

I would also like to read information about parking sensors and display it on the display. I know that this information is sent by the REM module, but I don't know it ID,
I found this information on the Internet:
RemId = 0x1E0522E;
CemId = 0x617FF8;
SwmId = 0x404066;
but these ID addresses don't match to mine.

[vtl]

Hi vtl, I want to replace my radio in 2005 xc90 and apart from controlling the buttons on the steering wheel, I would like to have also working the parking sensor.
I found your project - read steering wheel buttons for aftermarket radio, and it is very helpful. I logged CAN messages and found those from the SW buttons - I have the same SWM ID address as it is on your project, and I can read the SWM buttons

I would also like to read information about parking sensors and display it on the display. I know that this information is sent by the REM module, but I don't know it ID,
I found this information on the Internet:
RemId = 0x1E0522E;
CemId = 0x617FF8;
SwmId = 0x404066;
but these ID addresses don't match to mine.

You can get everything from VIDA MSSQL database. The process is described here: viewtopic.php?p=630192#p630192

[szecho]

Thank you for your response. I don't have a Vida interface, but is it enough if I will download the soft and only check its database files?

[vtl]

Thank you for your response. I don't have a Vida interface, but is it enough if I will download the soft and only check its database files?

Yes. Install the software (or download a ready to go vmware image), database login/password can be found in one of bat files.

[npexcept]

Very cool project!
I'm working currently on a similar one.
Have some additional sensors in my XC90 (D5244T, P2, 2003) like oil pressure, coolant pressure etc.
For my project I'm using a custom PCB that I designed. It is compact and sits directly on the OBD-II port.
The schematic is build on @vtl's "volvo cem cracker", basically just that with more added peripherals for the display and extra sensors.
To display engine vitals I'm using a "nextion display". These are pretty cool and "smart" themselfes.
For the MCU there is a socket for a plug-in Teensy 4.0. (Had them laying around for that CEM cracking stuff)
To connect the additional sensors I'll run a I²C bus.
If anyone is interested in more elaborate info, just ask.

sneak peak: (not all components render correctly, there are some ICs and 3 buttons)

Screenshot 2023-11-20 001830.png (863.86 KiB) Viewed 457 times

[dikidera]

Hi vtl, I want to replace my radio in 2005 xc90 and apart from controlling the buttons on the steering wheel, I would like to have also working the parking sensor.
I found your project - read steering wheel buttons for aftermarket radio, and it is very helpful. I logged CAN messages and found those from the SW buttons - I have the same SWM ID address as it is on your project, and I can read the SWM buttons

I would also like to read information about parking sensors and display it on the display. I know that this information is sent by the REM module, but I don't know it ID,
I found this information on the Internet:
RemId = 0x1E0522E;
CemId = 0x617FF8;
SwmId = 0x404066;
but these ID addresses don't match to mine.

You can get everything from VIDA MSSQL database. The process is described here: viewtopic.php?p=630192#p630192

You are telling me that it was actually possible all this time to decode the CAN ids to what module they belong? And not just but even see which position in the streaming CAN data is which param?

So I know that 0080401E belongs to my ECM, but this was discoverable in VIDA DB all this time?

[vtl]

You are telling me that it was actually possible all this time to decode the CAN ids to what module they belong? And not just but even see which position in the streaming CAN data is which param?

So I know that 0080401E belongs to my ECM, but this was discoverable in VIDA DB all this time?

Yes.

[dikidera]

Someone once mentioned it to me that cfe ultra used the Vida dB, I dismissed it as a wild goose chase. Can't believe it was actually correct.

[vtl]

Someone once mentioned it to me that cfe ultra used the Vida dB, I dismissed it as a wild goose chase. Can't believe it was actually correct.

I lot can be done via observation of CAN traffic, especially when it is possible to trigger the needed event in VIDA. But some conversion formulas are wild, I can't see how they could be reverse engineered w/o peeking at VIDA DB. Navigating this DB is not an easy task, but once you understood the structure you can fetch anything VIDA has.

[dikidera]

The factors/formulas can be reverse engineered by looking at the ECM or TCM code and how they work with the data, but yes it's faster with DHA or VIDA DB.
The TCM for AW55 likes to work with human readable data and not the raw analog to digital values. So it checks if temps is in degrees which makes guessing what is happening much better.
The ECM on the other hand works with the raw values but sometimes it will use the ALU to convert to human readable via floating point multiplication or division.

It was a challenge to understand how CAN worked, but I was finally able to correlate CAN ids to modules via reverse engineering the code, especially TCM. The only part of the protocol I did not understand fully is how the CAN signal configuration encodes offsets for the streaming data. With some hard work I can at least cross-check TCM and ECM CAN data and fill in the missing variable names in either codes.

Btw for anyone interested in CAN frames of Volvo, here is my shoddy implementation

Code: Select all

class CANFrame:

    def __init__(self):
        self.start_byte = 5
        self.is_multi = 0
        self.complete = 0
        self.data_copy = bytearray() 
        self.params = 0
    
    def assemble_frame(self, msg):
        
        if msg.data[0] == 0xCC:
            self.is_multi = 0
            self.complete = 0
            self.start_byte = 5
            self.data_copy = bytearray()
            return -1

       
        if self.is_multi == 0:
            #print("is_multi 0")
            if msg.data[0] == 0x97:
                self.is_multi = 1
                
                self.data_copy += msg.data[self.start_byte:self.start_byte+3]
                return 1

        if self.is_multi == 1 and self.complete == 0:
            #print("is_multi 1")
            self.start_byte = 1
            
            if msg.data[0] >= 0x50 and msg.data[0] <= 0x5F: #end of data stream
                self.complete = 1
                
            elif msg.data[0] == 0xCC:
                self.is_multi = 0
                self.comlete = 0
                self.data_copy = bytearray()
                return 1
                
            self.data_copy += msg.data[self.start_byte:]
            
        return 1

    def return_data(self):
           return self.data_copy
           
    def clear(self):
        self.is_multi = 0
        self.complete = 0
        self.start_byte = 5
        self.data_copy = bytearray()

So far has not let me down in A6 params of ECM.