No announcement yet.

Can I lock and unlock the doors of a RAV4 via the CAN bus?

  • Filter
  • Time
  • Show
Clear All
new posts

  • Can I lock and unlock the doors of a RAV4 via the CAN bus?

    This is something I need to be able to do for multiple cars, but for development I'm using my own Toyota 2010 RAV4. I have built a CAN interface that I've plugged into the OBD-II port. Normally, when the car is turned off, the bus is quiet. Unlocking the door causes a brief flurry of messages, which I can record. I don't know if any of those message specifically relate to unlocking the door, or whether they're just flashing the lights, beeping etc. When I replay them, nothing happens. So here are my questions:

    1) Is it likely that the doors could be controlled from the OBD-II port, which I believe only exposes the CAN C (high-speed bus for engine diagnostics)?

    2) Is there anywhere convenient I could access the other CAN buses from? Are the doors even controlled by CAN messages?

    3) Is it possible that I'm seeing the right messages, but they're being forwarded from another bus via a one-way gateway?

    4) Where would I find a full wiring diagram online?

    There are lots of tantalising hints from Google searches, but nothing is quite useful enough. Really, anything anyone can offer that will help me in the right direction would be really useful.

    (As for whether my replays work, recording turning on the headlights and playing that back does cause the headlight indicator on the instrument cluster to come on, so that's something.)

  • #2
    Get a shop manual for your car. The same one the dealer uses to repair your car. You need this to be able to track what components your car has.

    If you decode the commands I believe there is information there that ID's the module it is coming from and to. I have a shop manual for my GM truck and I should be able to use this along with the CAN data to decode most commands and duplicate them. The manual gives me the names of the modules, where they are, what they are responsible for, and their CAN id addresses so with this information I should be able to communicate with them.

    If you look at where the commands are coming from and where they are going to and the order they happen you will likely be able to figure out what is going on. Since the CAN bus has been somewhat standardized since 1996 with ODBII you should be able to find information on the structure of a command and it should become simple. There are generic commands that are spelled out in the protocol but there is plenty of room for proprietary commands which all manufacturers use but they still use the same structure so you should be able to decode them relatively easily.

    This is NOT a simple mater of just recording the information and playing it back as you have noticed. You will likely have a command response sequence you need to follow.


    • #3
      You should be able to duplicate anything that TECHII can generate.

      Snap-on also makes a similar unit for about $5k.

      Door lock and unlock may not be a can bus command.
      link to my CTS-V project:


      • #4
        You may try starting from here:

        Sounds like they are pretty reasonable but I have no experience with them.

        If you are getting some chatter it is likely you can figure out the stuff once you decode the commands and responses.
        This is apparently an online manual source. There are manuals available for your vehicle but seem to be very expensive.


        • #5
          Here is a very good article and some info.

          link to my CTS-V project: