Success!

It's Saturday night and I feel like partying! :D  After countless hours and ~3500 lines of code later, I finally managed to connect VIDA successfully to Volvo, launch the diagnostic part related to Combustion Preheater Module and turn on the parking heater with my laptop!

Sorry about the poor image quality here:

Vida correctly identifies most of the vehicle features. Only transmission, steering and body style had to be manually entered. Reason for this can be seen in the next picture..

Sardine CAN is connected to low speed network, so all queries relating to CAN modules residing in high-speed network (such as Break Control Module,  Staareing Angle Sensor, Engine Control Module, Transmission Control Module as well as the high speed interface of Central Electronic Module) cannot be reached. For some reason messages from few low speed modules ( Upper Electronic Module, SRS, Rear Electronic Module) are not received correctly either. Accessory Electronic Module and Road Traffic Information module I don't have in my car.

When sniffing the CAN traffic while VIDA scans the modules and their diagnostic error codes, I can infer which module is being queried and which CAN identifier the module uses for replying. Note that this identifier differs from the one the module uses for normal inter-module communications.

Let's refresh our memories of the general format of module query (from past blog post):

000FFFFE CB xx B9 F0 00 00 00 00
          |  |  |  |
          |  |  |  |
          |  |  |  '---- Identify (?)
          |  |  '----------------- Read Data Block By Offset
          |  '-------------------- Module id (list below)
          '----------------------- Message length
00 0F FF FE: The identifier VIDA (or any other diagnostic module) uses for messaging.
Message length: High nibble seems to be always 'C' in command message. Low nibble: Bit 3 is always on. Bits 0-2 is the actual message length (excluding the first byte). Hence A=2, B=3, C=4, D=5, E=6, F=7

I found this command set somewhere on Swedespeed car forum:

A1 No Operation Performed (keep alive)
A3 Security Access Mode 
A5 Read Current Data By Offset 
A6 Read Current Data By Identifier
A7 Read Current Data By Address 
A8 Set Data Transmission
A9 Stop Data Transmission
AA Dynamically Define Record
AB Read Freeze Frame Data By Offset
AC Read Freeze Frame
AD Read Freeze Frame By DTC
AE Read DTC
AF Clear DTC

B0 Input Output Control By Offset
B1 Input Output Control By Identifier
B2 Control Routine By Offset 
B4 Define Read Write ECU data 
B8 Write Data Block By Offset 
B9 Read Data Block By Offset 
BA Write Data Block By Address
BB Read Data Block By Address 


And here's the list of all modules that were queried and identified on Volvo S80 MY02.
CAN diag Id    ID  Description 
00 80 00 03 :: 40  CEM, Central Electronic Module 
                   (also answers queries related to CPM(heater)
00 80 00 09 :: 51  DIM, Driver Information Module
00 80 08 01 :: 48  SWM, Steering Wheel Module
00 80 10 01 :: 29  CCM, Climate Control Module
00 80 00 11 :: 43  DDM, Driver Door Module
00 80 00 81 :: 45  PDM, Passenger Door Module
00 80 01 01 :: 2e  PSM, Power Seat Module
00 80 04 01 :: 46  REM, Rear Electronic Module
00 80 02 01 :: 58  SRS, Air bag
00 80 20 01 :: 47  UEM, Upper Electronic Module
00 80 00 05 :: 60  AUM, Audio Module
00 80 00 21 :: 64  PHM, Phone Module

These module were queried but didn't reply:
ID  Description
50  CEM, Central Electronic Module (Hi-speed interface)
01  BCM, Break Control Module (hi-speed network)
52  AEM, Accessory Electronic Module 
11  ECM, Engine Control Module (hi-speed network)
28  SAS, Steering Angle Sensor (hi-speed network)
6e  TCM, Transmission Control Module (hi-speed network)
62  RTI, Road Traffic Information module

And here's the sweet sight of hard reverse engineering work coming finally to fruition! Only coolant water temp and heater work status are being correctly queried though. Few software glitches still remain, but I don't care about that for now, since the thing I've been hunting for past few weeks has been now identified! Yes, the command for starting the heater :)

Turn on the diesel heater:
00 0f ff fe | cf 40 b1 5f 3b 01 01 84 
And the reply:
00 80 00 03 | cc 40 f1 5f 3b 00 00 00 


Turn off diesel heater:
00 0f ff fe | cf 40 b1 5f 3b 01 01 80 
Reply:
00 80 00 03 | cc 40 f1 5f 3b 00 00 00 


Now, this seems weird, since I had already tried this command before and it didn't work! It is one of the possible permutations of the message I was advised to try earlier by Swedish hackers (thanks again guys!), and I'm quite sure I tried this one before. There are few possible explanations:

1) I somehow managed to screw up sending the message using ELM327 (with its yucky AT command set), but now when using the MCP2515 based Arduino CAN shield the message is constructed correctly.
2)  ECU needs something else in addition to the command message itself. When looking at the message log, I see VIDA sending the following message every 1-5 seconds:
00 0f ff fe | d8 00 00 00 00 00 00 00
Could this be some kind of keep alive message needed by ECU?

Also VIDA keeps querying following stats every 3-4 seconds and their presence could be necesssary (although unlikely):

Cmd:   00 0f ff fe | cd 40 a6 1a 04 01 00 00
Reply: 00 80 00 03 | cd 40 e6 1a 04 1e 00 00 
The 6th databyte of reply seems to coincide with ignition key lock status:
1e = ignition II, 1d=radio (ignition I), 1c=off, 18=key out

Cmd:   00 0f ff fe | cd 40 a6 1a 02 01 00 00 
Reply  00 80 00 03 | cd 40 e6 1a 02 60 00 00 
The sixth databyte of reply fluctuates between 5d and 62, and could be the battery voltage. If we assume bits 0-2 consist of fractional part and bits 3-8 the integer part, then the values here would be interpreted as 11.625 and 12.25, and would fit well in our hypothesis. Actually a battery charger was connected during testing, so voltage over 12 volts would not be strange here.

VIDA needs the key to be in ignition II position in order to launch the heater section, but I did try switching the key position and it didn't have any effect on the result itself: Heater can be turned on with diagnostic command even when key is not in the keylock! This is actually quite a relief - spoofing the keylock position in the remote heater starter would require quite a bit of more work, but luckily this doesn't seem to be needed. However what is little bit alarming, is that any indication on the heater status is NOT shown on DIM, nor does the manual on/off functionality on the control stalk work when turning on the heater using this diagnostic command. Thus I will have to put some other kind of stop functionality and warning system in place when designing the box.

Still this isn't a fully functional J2534 device yet: It doesn't support ISO9141 or any other kind of protocols apart from CAN and ISO 15765, nor does it work when connecting it to OBD port, since it's missing the K-line initialization and keep-alive messaging to keep the diagnostic relay open on CAN bus pins. Maybe I will add some more functionality later, but for now, I'm quite happy with the results that I got. Also, no more Win32 programming for a while :)

What's going on here?

Combine the following attributes:

• Newly acquired Volvo S80 2002 with a diesel heater (Ardic)
• Cold and hostile environment.
• Moderate amount of free time (but never enough!)
• Reasonable coding skills and electronics know-how
• Hatred of cold and snow

Mix them in a blender (figuratively) and what you get? Desire to construct a remote control for the diesel heater! Laziness is indeed a major motivator for comfort zone aficionados.

My Volvo does have a timer for starting the heater, but I my schedules are almost never fixed, and what I would rather do in my mornings is to press a button, sip coffee and watch behind a window how my Volvo gets warmer, instead of going there to set it on manually. Hence the project in question.

Now, the quest started with basic Googling: what is already available, have other people done something like this before and how much do they cost? Volvo does offer OEM remote heaters, but they cost shitload of money. Not going pay a hefty amount of 600-1000+ euros for a simple remote control and a box that hits a switch. My hacker soul laughs - challenge accepted.

I've decided to document this project, not only gather my thoughts, but also to share any bits of information that I might find. I hate re-inventing the wheel as much as any other coder, so if this ends up helping even one person trying to figure out their Volvo innards and hack their Swedish tanks, writing this might not been in vain.

My plan was to build a prototype using Arduino (open-source microcontroller) and XBee (low-cost radio module). I've been messing around with Arduino for quite a while, but wireless experience I do not have. However XBee is supposedly quite easy to program and is well documented, so I won't anticipate huge problems in that area. Besides, it's fun to expand your field of expertise. In this case to two new fields: car automation and wireless communication.

Other DIY guys have been thinking alike: 

• A guy called VP (link here) has made a reasonably nice device: SMS-controlled heater starter which uses AVR microcontroller and GSM-module. 
• Similar project (finnish only, sorry) using SMS-controller relay (Celotron centro)
• Another one (finnish & english)

However to control the actual heater, all of the above mentioned devices rely on AEM (Accessory Electronical Module) to do the dirty work. AEM is a 150-200+ euro Volvo accessory that  offers simple voltage-based on/off interface for non-official, non-Volvo external accessories, such as alarm systems, parking assistance, handsfree systems etc, and of course remote heater starters. AEM then connects to the car's internal electronic system (CAN bus) and controls other devices in the car by sending them CAN bus messages. Thus, external devices don't have to know how to talk to the aforementioned devices directly but can use the simple interface offered by AEM.

Again, I was definitely not going to go out and spend money on a device that just turns the heater on when being told so. I'm both cheapskate and stubborn. So, my only choice was to find out how CAN bus works by a humongous task of googling, researching and reverse engineering the message traffic, and ultimately perhaps finding out how to control the heater. Then design and construct a prototype for sending the ignition command. Then add wireless modules and build a remote. Then press button, sip coffee and watch my Volvo get warm.

Sounds like a lot of work? Sure. But even risking having frostbites after hours of hacking outside in cold temperatures, I'd rather do that than empty my bank account and pay a horseload of money to a guy behind the counter in order to fast-forward to the coffee sipping. Did I mention stubborn?