Hey all, I think my research into this problem has finally hit a wall. Hoping you guys can steer me in the right direction.
I have a setup with Arduino Leonardo -> MCP2515 to sniff/inject CAN bus frames to my car. I'm using autowp-mcp2515, autowp-arduino-canhacker libraries and software CANHacker V2 written by fuchs.
Now, the sniffing part works flawlessly, I've intercepted/decoded window motor can frames. The problem comes up when I try to inject the frame to my car to simulate window pushdown.
Once the mode changes to mcp2515.setNormalMode(); my car gets Electrical failure (central electronics failure) fault on the dash. Hence, I believe CAN bus ignores my frame that I'm trying to send. In the meantime, I still can see frames coming from my car CAN bus.
If mode mcp2515.setListenOnlyMode(); activates, then no electrical failure appears. Though, CANHacker V2 software Listen only mode doesn't work, so I've tested this with the code that I wrote myself and looking at serial monitor in Arduino IDE.
After doing a lot of research into the problem, I was a little surprised that I couldn't find anyone else experiencing the exact same issue, so I started to think that maybe something was wrong on my end. Btw, tried to inject the frame to my car with sketch I built and also with CANHacker V2 software - none of them worked.
Anyone had similar issue trying to inject the frame? Am I stuck with only sniffing? :(
FYI:
Clock is configured to 8mhz based on MCP2515;
120 ohm resistor is not shorted on MCP2515;
BMW 5-Series E61 2007
Connected to K-CAN bus with CAN baudrate 100Kbit/s (not via OBD, but CAS module)
Is the car still putting messages on the bus at the same time you are sending messages?
If so you may be seeing the effect of identical packet address collisions which in turn is triggering a fault state.
For this type of application people often use a "pass through" device with two CAN interfaces so you can filter out the original message and substitute you own.
Welcome!
You neglected to tell us what vehicle you are working with: make, model and year. Also, exactly where are you connected to the CAN bus?
My first thought is that the vehicle may have a gateway between the CAN bus you are connected to and the module you are trying to control. You may be able to receive the window messages but that does not necessarily mean an injected message will be forwarded to the required module.
However, the fact that you get a central electronics failure as soon as you change the MCP2515 from listen-only to normal mode makes me wonder if there is another problem. Before chasing the window command, I would first determine why simply enabling transmission is causing the vehicle to report a fault.
Post an annotated schematic showing exactly how the Leonardo and MCP2515 are connected to the vehicle. Also tell us the CAN bit rate, MCP2515 crystal frequency, and where you connected CANH and CANL.
If we are talking about specific 0FA frame, no. They only appear/update whenever driver window pushdown button is pressed manually.
If we talk about bus in general, yes during the frame injection bus communicates a lot of messages.
Did some more digging, I just realized that K-CAN bus on BMW is fault-tolerant/low-speed CAN bus which is not a good pair with TJA1050 on my MCP2515, instead I should have TJA1055 which is designed for fault-tolerant/low-speed CAN communication. Am I thinking correct?
The terminology surrounding the various CAN bus variations is super confusing. Documentation often talks about CAN (ISO 11898-2) in general being 'fault tolerant', but it's the specific ISO 11898-3 variation that provides more 'fault tolerance' and uses different incompatible voltage levels and is also limited to under 125kbps.
Test existing setup on PT-CAN bus which is high speed 500 kbits bus, if no problems/faults then we know that my TJA1050 is not compatible with K-CAN bus.
If step 1 turns out to be true, buy TJA1055T and solder to MCP2515 board to replace 1050. Though, not sure how would i achieve this, but..
