====== CAN bus access ======

There are two very different ways onto the vehicle bus. **Know which is which.**

===== Route A — via the companion MCU (works for control) =====

The head unit talks to a **companion MCU over UART** (''/dev/ttymxc3'' @115200). The MCU bridges to
the vehicle CAN bus. The UART is owned by the ''carmanager'' CarService; other apps reach it through
a system service (AIDL). The MCU frame carries a "send CAN control frame" address and a control-type
selector (air-conditioning, charging, dashboard, …).

This is the route that actually **reads decoded values and sends control commands** — see
[[control]]. The head unit never sees raw CAN frames here, only decoded register values.

===== Route B — the OBD2 port (a dead end for control) =====

To read/inject //actual// CAN frames, the OBD2 port was tapped with a hardware adapter
(**Jhoinrch RH02**, a CANable clone: STM32F072, candleLight firmware, classical CAN up to 1 Mbit/s).

**Findings (confirmed after fixing the cabling):**
  * **Passive listening is silent** at every bitrate — nothing broadcasts on this port.
  * **Active probing** at **500 kbit/s, 11-bit** gets ECU responses; 29-bit and 250k are silent.
  * → The OBD2 port is a **query-only diagnostic gateway** (ISO 15765-4, 11-bit / 500k),
    **isolated** from the live internal bus. You can //poll// diagnostic PIDs but **cannot sniff**
    the body/HVAC/SoC broadcasts, and **cannot control** anything.
  * The one reachable ECU returns **SecurityAccess = serviceNotSupported** — no UDS security layer,
    no actuation services.

**Verdict:** OBD2 cannot switch on the car or the AC. Real actuation would need UDS write services
behind SecurityAccess on the HVAC/VCU ECUs — which needs Aiways's secret seed-key algorithm, and
even then OEM HVAC only actuates while the car is already powered. **So AC control stays on Route A;
parked preconditioning stays a TBox/VCU problem.** The next hardware step is a **direct tap of the
internal TBox CAN bus**.

===== Wiring / adapter notes (OBD2) =====

  * OBD2 **pin 6 = CAN-H, pin 14 = CAN-L** (+ ground on pin 4/5). Getting this wrong looks exactly
    like a dead bus. Confirm good wiring by watching the adapter's **TX //and// RX LEDs** blink
    during an active probe.
  * Adapter DIPs: **Boot OFF** (run), **R120 OFF** (the OBD2 bus is already terminated 2×120 Ω).
    A DIP change only takes effect after a full unplug/replug.

===== Safety checklist for tapping the internal (TBox) CAN bus =====

The internal bus is **live and possibly safety-relevant** (unlike the isolated OBD2 gateway):

  - **Listen-only (silent) mode first.** A normal CAN node still transmits ACK bits, and at the
    wrong bitrate emits error frames that can disturb real ECUs. Use the adapter's hardware
    listen-only mode to identify bus/bitrate before ever transmitting.
  - **Measure termination.** With the car off, measure CAN-H/CAN-L: **~60 Ω** = already terminated
    both ends (add nothing); **~120 Ω** = only one end. Keep the stub short.
  - **Confirm the bitrate** (sweep 500k → 250k → 125k in listen-only) before going active.
  - **Non-destructive tap** — back-probe or T-tap; never cut or pierce the harness. Tie adapter
    ground to chassis ground. Never short CAN-H/L to 12 V or to each other.
  - **Parked only.** Connect with the car asleep, then wake it to capture. Never probe a bus while
    the vehicle could move.
  - **Identify the right bus by correlation** — trigger a known signal (e.g. AC on, or a
    lock/unlock) and watch which frames change.