Announcement

Collapse
No announcement yet.

Onstar GMLan & CAN bus GPS hacking

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Onstar GMLan & CAN bus GPS hacking

    A clever engineer over at radioetcetera has released code to convert Onstar / GMLan bus to plain NMEA data. There is a little bit of work left to be done, but it looks like most of the heavy lifting has been completed. Why would you want to do this?
    • GM has put a great external GPS antenna in your car. Why do you need to buy another one?
    • It is fun weekend project and a great exhibit of your geek talent
    • Using an external GPS should give you much better reception
    All someone needs to do is make a single wire CAN to RS-232 adapter and tweak the provided code to finish the project. The guys over at hack a day say Andy is having a baby and has to stop working on the project. Maybe some mp3car CAN gurus could pick this up? We might consider issuing an innovation grant if cash is an issue. Let the discussion begin!

  • #2
    Oh snap! I'd love to tap into the already existing antenna. Will existing scantools work?
    Former author of LinuxICE, nghost, nobdy.
    Current author of Automotive Message Broker (AMB).
    Works on Tizen IVI. Does not represent anyone or anything but himself.

    Comment


    • #3
      I don't know. you might want to check that guys blog. If an existing scantool did work, that might be a great reason to buy a scantool with a gm car - you get engine diagnostics and GPS all with one purchase and one cable.

      Comment


      • #4
        For hobbyists, you can use CAN to RS-232 converters such as the CAN232 or the OBDLink, but you’ll probably need to log the data and post-process it.
        That's great! That means it can be implemented in software for those of us with existing scantools. I'll see if I can come up with a plugin for obdgpslogger or something. I can test on my 08 impala.
        Former author of LinuxICE, nghost, nobdy.
        Current author of Automotive Message Broker (AMB).
        Works on Tizen IVI. Does not represent anyone or anything but himself.

        Comment


        • #5
          Make sure you use a scantool that supports SWC.

          SWC = Single Wire CAN = separate network from regular 2-wire CAN.

          My Elm327 Bluetooth doesn't support SWC

          Comment


          • #6
            Originally posted by regulatre View Post
            Make sure you use a scantool that supports SWC.

            SWC = Single Wire CAN = separate network from regular 2-wire CAN.

            My Elm327 Bluetooth doesn't support SWC
            I have an OBDPro. I have no idea if it supports SWC or the 2-wire CAN stuff... :-S
            Former author of LinuxICE, nghost, nobdy.
            Current author of Automotive Message Broker (AMB).
            Works on Tizen IVI. Does not represent anyone or anything but himself.

            Comment


            • #7
              I did some digging (Cause I wana play with this!)... The single-wire stuff has a few names - GMLAN, Class B, class 2 data bus, J2411 SWC Single-Wire CAN.

              I'll be darned if I couldn't find a single PC adapter that can tap into the SWC network for less than $500! Some of them were $1100+ I'm taking a little break from googling this topic so If anybody can find a cheap (less than $50) interface for SWC please post it

              Comment


              • #8
                I was able to use a two-wire CAN adapter (sort of anyway) by tying CAN_LO to ground. I did get a lot of error frames while doing this, but was able to see the data.

                Also, some of the GM CAN protocol documents can be purchased here:

                http://auto.ihs.com/news/newsletters...r05-04.htm#gmw

                I'm not sure if they contain any useful information or not, I haven't seen them.

                Andy

                Comment


                • #9
                  Andy - thank you for the guidance.
                  I wonder if one might have luck with an ELM327 based chip...

                  On power-up, the ELM327 checks to detect which pinout/protocol it's connected to... So one would may need to manually run ATSP to set the protocol and bypass the autodetect. (Which protocol/rate??)

                  With all that said and done, ATMA (monitor all) would be used to sniff the network.

                  I wonder if regular OBD MODE/PIDs can be requested on the SWC network, or is this connection only feasible for sniffing purposes...


                  References:
                  ELM327 Datasheet
                  ELM327 Bluetooth Adapter (Chinese knock-off)
                  Protocols supported by ELM327:
                  0 - Automatic
                  1 - SAE J1850 PWM (41.6 Kbaud)
                  2 - SAE J1850 VPW (10.4 Kbaud)
                  3 - ISO 9141-2 (5 baud init, 10.4 Kbaud)
                  4 - ISO 14230-4 KWP (5 baud init, 10.4 Kbaud)
                  5 - ISO 14230-4 KWP (fast init, 10.4 Kbaud)
                  6 - ISO 15765-4 CAN (11 bit ID, 500 Kbaud)
                  7 - ISO 15765-4 CAN (29 bit ID, 500 Kbaud)
                  8 - ISO 15765-4 CAN (11 bit ID, 250 Kbaud)
                  9 - ISO 15765-4 CAN (29 bit ID, 250 Kbaud)
                  A - SAE J1939 CAN (29 bit ID, 250* Kbaud)
                  B - USER1 CAN (11* bit ID, 125* Kbaud)
                  C - USER2 CAN (11* bit ID, 50* Kbaud)

                  Comment


                  • #10
                    Ok, so I guess the ELM327 doesn't support a 33.3kbps mode. That's probably out then.

                    Someone could look into whether GPS info is available on the regular OBD or powertrain CAN busses that run at 500k. I can't think of a reason off the top of my head why they might put it there, but you never know.

                    Andy

                    Comment


                    • #11
                      Page 47 of the datasheet describes a user-definable setting. I'll take a crack at it later on and see how close I can get it to 33.3kbps. It appears to be possible.

                      Protocol B (USER1) baud rate divisor. See PP 2B for a description.

                      CAN baud rate divisor. 01 to 40 02 R
                      (250 Kbps)
                      The protocol A CAN baud rate is determined by this value (rate in
                      kbps = 500/value). For example, setting this PP to 19 (ie. decimal
                      25) provides a baud rate of 500/25 = 20 kbps.

                      Comment


                      • #12
                        In addition to setting the baud rate to 33 kbit/s you will need additional hardware to work with SW CAN.

                        GridConnect sells an adapter for $170:

                        http://www.gridconnect.com/au5790.html

                        Or you can roll your own using a "normal" CAN transceiver (e.g., MCP2551) and a SW CAN transceiver chip (e.g., NCV7356). Total parts cost <$10.

                        Notice that GridConnect's adapter will not work with ElmScan 5 or OBDLink out of the box (the pinout is different).

                        Best regards,

                        Vitaliy
                        OBDLink MX: world's smallest, fastest, most advanced OBD/Bluetooth adapter with SW and MS CAN support. Read the review to learn more.
                        — Need to look up a diagnostic trouble code? Try the most up-to-date, free DTCsearch.com!

                        You cannot send me a private message using this forum. Use my email instead: vitaliy[@]scantool.net.

                        Comment


                        • #13
                          Thanks Vitality for the good info.

                          I wish I had the smarts to make that circuit.

                          Comment


                          • #14
                            If you are looking to view SW can data you can also look up the Peak Systems (PCAN-AU5790) device. This will convert SW CAN to Dual Wire and DW CAN to SW.

                            You can find out if you car has GPS over CAN by looking at the OBD II connector and try to find PIN 1. This is typically in the top left of the connector (PIN 1 is at the left of the wider part of the connector).

                            If there is something there, then you have SW CAN. If you see something in PIN 2 (just right of PIN 1). Then your car uses J1850 (aka Class 2). Of course you car has to be equipped with OnStar as well.

                            Good Luck.
                            Hack your car's CAN BUS at www.canbushack.com

                            Comment


                            • #15
                              The ELM327 can be configured and wired to communicate on the GMLAN bus.

                              see my notes and pictures at: www.gtosoft.com under "coming soon".

                              Just wanted to follow up so nobody spins their wheels

                              Comment

                              Working...
                              X