Awesome

2016 Subaru WRX CAN BUS Ids

CAN BUS ids sniffed from a 2016 Subaru WRX

• Introduction
• CAN IDs and Data
  • 0x152
  • 0x140
  • 0x0D1
  • 0x0D4
  • 0x375
  • 0x002
  • 0x0D0
  • 0x281
  • 0x282
  • 0x6D1
• Logs
• Tools
• Resources/References

Introduction

The following outlines CAN BUS ids and data I've discovered while sniffing the (high speed, 500KB/s) CAN BUS on my 2016 Subaru WRX.

Some of these are certain, some are still only suspicions. These are my personal notes that can hopefully help anyone else looking at the CAN network for this particular car.

CAN IDs and Data

I'm generally only highlighting the data that is significant. 00 indicates either observed 00 data, or unknown/irrelevant data.

CAN ID 0x152

Byte 8

Headlights:

Turn signal:

Windshield wipers:

Byte 7

Parking/hand brake and brake pedal:

CAN ID 0x140

Bytes 6 & 7

Accelerator pedal pressure:

CAN ID 0x0D1

Bytes 1 & 2

Vehicle speed:

For example, if B1 and B2 are 0x0F and 0x04 respectively:

(4 * 256) + 15 = 1039
1039 * 0.05625 = ~58 km/h

Byte 3

Brake pedal pressure:

I wasn't able to observe a value higher than about 0x53 for byte 3 for brake pressure while casually stomping on the pedal.

CAN ID 0x0D4

Bytes 1-8

Individual wheel speeds:

See 0x0D1 above for speed calculation.

CAN ID 0x375

Byte 1

Door locking state:

Byte 2

Door open state:

CAN ID 0x002

Bytes 1 & 2

Steering wheel position:

Combination of two bytes used for steering wheel position.

B1 and B2 are used together to get a pretty high definition value of steering wheel motion. From a position of dead centre (00,00), turning the wheel left: 00,01 -> 00,02 -> ... -> 01,00 -> 01,01 etc

Cranking the wheel hard left, I was only able to observe the first byte go as high as 0x19.

Turning the wheel right from a centered position shows a reduction in values:

I didn't test with the wheel all the way right, but I assumed B1 would range from 0xFF to about 0xE6.

I used a calculation such as below to determine steering wheel position as a percentage, from -100% (right) to 0 to 100% (left), assuming conversion to decimal:

LEFT: (B1 * 255 + B2) / 26*255
RIGHT: (((255 - B1) * 255) + B2) / 26*255 * -1
* where the max observed was B1 and B2 were 0x19 (25 in dec) and 0xFF respectively

I saw previously somewhere that this is actually a measurement of degrees, but I can no longer find the calculation.

CAN ID 0x0D0

I observed very similar data on bytes 1 and 2 from CAN ID 0x0D0 for steering wheel position but didn't not investigate further on maximum values.

CAN ID 0x281

Byte 1

Climate control fan speed (bits 5-8):

Fan speed shows increases on byte 1 by 0x20 for each level (20, 40, 60, ..., E0), utilizing the last 4 bits:

• 00000000 - off
• 00010000 - speed 1
• 00100000 - speed 2
• 00110000 - speed 3
• 01000000 - speed 3
• 01010000 - speed 5
• 01110000 - speed 6
• 10000000 - speed 7

Air direction/vent modes (bits 3-4):

• 00000000 - Footwell vents + windshield
• 00000100 - Upper vents
• 00001000 - Upper vents + footwell vents
• 00001100 - Footwell vents

Byte 2

Appears to be used for combinations the automatic climate control modes, by bit:

• 00000100 - Windshield defrost (bit 3)
• 00001000 - "Full auto" mode? (bit 4)
• 00010000 - Air conditioning (bit 5)
• 00100000 - Rear defroster (bit 6)
• 01000000 - Air recirculation (bit 7)
• 10000000 - Not sure? (bit 8)

Byte 3

Climate control temperature:

CAN ID 0x282

Byte 6

Seatbelt buckle (inverse) state for driver and passenger (bits 1 and 2)

CAD ID 0x6D1

Odometer reading:

Calculation per OBD PID A6 spec

(A*2^24 + B* B*2^16 + C*2^8 + B) / 10

Logs

The following are some log files I obtained using candump with certain events. It's helpful to run these through canplayer on a virtual device. These were done with the ignition on but without the car running (unless otherwise specified)

• logs/brake-pedal.log
• logs/gas-pedal.log
• logs/doors-open-close.log
• logs/steering-wheel.log
• logs/accessory-to-ignition.log - Going from accessory mode to ignition on (engine still off)
• logs/car-running-idle.log - From ignition on to turning engine on, idling
• logs/driving.log - A log from a short drive (5 minutes?)

Tools

I've used the following tools to perform my sniffing in various ways:

• Carloop
  • socketcan_serial.ccp
• can-utils
• socketcand
• Arduino
  • Sparkfun CAN-BUS Shield
  • slcauino
  • ElecFreaks CAN-BUS Shield
  • Seeed-Studio CAN BUS Shield library

Resources/References

These are the resources I used either when I was getting started or to dig a bit deeper:

• Use Carloop with SocketCAN and can-utils
• CAN Messages | Subaru Diesel Crew
• The Car Hacker's Handbook