CAN bus access

There are two very different ways onto the vehicle bus. Know which is which.

The head unit talks to a companion MCU over UART (/dev/ttymxc3 @115200). The MCU bridges to the vehicle CAN bus. The UART is owned by the carmanager CarService; other apps reach it through a system service (AIDL). The MCU frame carries a “send CAN control frame” address and a control-type selector (air-conditioning, charging, dashboard, …).

This is the route that actually reads decoded values and sends control commands — see control. The head unit never sees raw CAN frames here, only decoded register values.

To read/inject actual CAN frames, the OBD2 port was tapped with a hardware adapter (Jhoinrch RH02, a CANable clone: STM32F072, candleLight firmware, classical CAN up to 1 Mbit/s).

Findings (confirmed after fixing the cabling):

• Passive listening is silent at every bitrate — nothing broadcasts on this port.
• Active probing at 500 kbit/s, 11-bit gets ECU responses; 29-bit and 250k are silent.
• → The OBD2 port is a query-only diagnostic gateway (ISO 15765-4, 11-bit / 500k),
  • *isolated** from the live internal bus. You can poll diagnostic PIDs but cannot sniff

the body/HVAC/SoC broadcasts, and cannot control anything.

• The one reachable ECU returns SecurityAccess = serviceNotSupported — no UDS security layer,

no actuation services.

Verdict: OBD2 cannot switch on the car or the AC. Real actuation would need UDS write services behind SecurityAccess on the HVAC/VCU ECUs — which needs Aiways's secret seed-key algorithm, and even then OEM HVAC only actuates while the car is already powered. So AC control stays on Route A; parked preconditioning stays a TBox/VCU problem. The next hardware step is a direct tap of the internal TBox CAN bus.

• OBD2 pin 6 = CAN-H, pin 14 = CAN-L (+ ground on pin 4/5). Getting this wrong looks exactly

like a dead bus. Confirm good wiring by watching the adapter's TX and RX LEDs blink

  during an active probe.
* Adapter DIPs: **Boot OFF** (run), **R120 OFF** (the OBD2 bus is already terminated 2×120 Ω).
  A DIP change only takes effect after a full unplug/replug.

The internal bus is live and possibly safety-relevant (unlike the isolated OBD2 gateway):

1. Listen-only (silent) mode first. A normal CAN node still transmits ACK bits, and at the

wrong bitrate emits error frames that can disturb real ECUs. Use the adapter's hardware

  listen-only mode to identify bus/bitrate before ever transmitting.
- **Measure termination.** With the car off, measure CAN-H/CAN-L: **~60 Ω** = already terminated
  both ends (add nothing); **~120 Ω** = only one end. Keep the stub short.
- **Confirm the bitrate** (sweep 500k → 250k → 125k in listen-only) before going active.
- **Non-destructive tap** — back-probe or T-tap; never cut or pierce the harness. Tie adapter
  ground to chassis ground. Never short CAN-H/L to 12 V or to each other.
- **Parked only.** Connect with the car asleep, then wake it to capture. Never probe a bus while
  the vehicle could move.
- **Identify the right bus by correlation** — trigger a known signal (e.g. AC on, or a
  lock/unlock) and watch which frames change.