Subaru Outback Forums banner
1 - 12 of 12 Posts

·
Registered
Joined
·
6 Posts
Discussion Starter · #1 ·
Hi all,

I'm hoping someone here maybe familiar with the communication used on the instrument cluster from an Outback Legacy BP9 (Part number: 85012AG030) .

I'm hoping to use the cluster with an arduino and control it via that for racing games :)

I'm familiar with car protocols such as can bus but having trouble actually talking to the cluster.

I can power the IC, but I don't know:
  • What CAN speed the cluster talks
  • Which pins on the i10 connector are can high, and can low (I know the pins are A21 and A22)
  • Whether I should expect to see any traffic with a CAN sniffer (e.g. candump) when turning on the IC. I thought I would and tried a few different CAN speeds...
I did manage to find the following from the 2009 Service Manual:

468463


I don't have a Subaru or ECU to actually sniff communication, so I'm hoping the CAN IDs and messages are already somewhere online.

Anyone got some thoughts or able to help ? :)

Thanks,

Matt
 

·
Registered
2005 OBXT Limited, VF37, STI intake, 5MT
Joined
·
1,610 Posts
Paging @Ryan J. Geyer

He's worked mostly with the comms between the ECU, BIU, and cluster for the immobilizer system, but he might be able to shed some light on the CANBUS IDs.

I'm not sure how responsive the cluster will be without the immobilizer handshake (if it will respond at all to other CANBUS inputs), but it's worth a shot. You're using a CAN shield with an Arduino, I imagine?

IIRC, there was some work done in the BRZ/FRS community with CANBUS mapping, and it was determined that Subaru liked to use the same ID map across several platforms (the VA-body WRX/STI was the test subject, I believe).
 

·
Registered
2005 Outback XT 2.5T
Joined
·
198 Posts
Ohh! Fun project.

I don't have a ton of detail about non immobilizer related comms and CAN IDs, but I can probably help with the other questions.

There is only low speed CAN going into the cluster. It communicates at 125000 bps. The wiring.. The FSM I had actually had an error, and I'm trying to interpret my notes, but I believe that A21 is CAN- and A22 is CAN+. Worse case, swap them if you don't get any CAN messages.

When you first fire it up, whether it's in an integrated system or not, it'll spew some IDs.
 

·
Registered
Joined
·
6 Posts
Discussion Starter · #4 ·
Hey @RoughDiamond @Ryan J. Geyer,

Thanks for the comments :)

I'm not sure how responsive the cluster will be without the immobilizer handshake (if it will respond at all to other CANBUS inputs), but it's worth a shot.
Hmm. Yeah. I'm not sure if this is causing be grief or not, as I just can't seem to get any CAN output from the unit :-/

You're using a CAN shield with an Arduino, I imagine?
I have a CAN shield etc, but I've also got a http://canable.io which lets you use https://github.com/linux-can/can-utils to dump or send can data using standard linux commands.

The goal would be to move to the arduino once I've got a fair idea on can IDs and generating data.

I've had success with CANable with some other can bus stuff, so I'm familiar with how to use it :)

IIRC, there was some work done in the BRZ/FRS community with CANBUS mapping, and it was determined that Subaru liked to use the same ID map across several platforms (the VA-body WRX/STI was the test subject, I believe).
Yeah I'm wondering/hoping this might be the case.

The main reference I've seen to CAN IDs has been https://subdiesel.wordpress.com/ecu-analysis/can-messages/


When you first fire it up, whether it's in an integrated system or not, it'll spew some IDs.
This is the problem :-( I'm just getting nothing on the BUS.

The difficult thing I've had is whether anything else is required other than:
  • A11, A12 for GND
  • A1 for Power - 12V.
  • A3 for Ignition connected to power.
  • A21 CAN
  • A22 CAN

I see A20 is connected to ECM but I'm not sure if this would be important for anything I'm doing.

In short the IC will power up when I connect Ignition, but yeah nothing on the bus.

I've tried CAN cables both ways around, tried a number of interface speeds (but primarily trying 125kbps), and also tried with and without 120ohm termination resistor. I get nothing on the bus and am some what out of ideas :-/
 

·
Registered
Joined
·
6 Posts
Discussion Starter · #5 ·
Hey @Ryan J. Geyer I've had another go at this tonight, and still not having much luck with getting any CAN frames out of the cluster.

I've learned elsewhere the cluster doesn't spit anything out on the can bus unless it goes through the handshake process first.

I came across your post here: https://www.subaruoutback.org/threa...robably-other-year-models.501753/post-5815773 which looked pretty awesome going into detail on this.

From this, I tried sending in a can frame while simulating ignition by doing the following
[email protected]:~ $ while true; do cansend can0 016#02010000; sleep 0.1; done

I was expecting to see a response frame with ID 17 as per your comment, but unfortunately not having much luck :(

I know my can interface is at 125kbps and I can see the messages sent using candump, just nothing on a reply sadly.

Just wondering if you might have any ideas for what I may be able to do?

Here's my cluster:


473501


Thanks,

Matt
 

·
Registered
2005 Outback XT 2.5T
Joined
·
198 Posts
I've learned elsewhere the cluster doesn't spit anything out on the can bus unless it goes through the handshake process first.
While I can't confirm this from my testing, this certainly seems plausible. The indicator "Er IU" on the display is the most obvious indicator that the CM is not happy, because it isn't talking to the Body Integration Unit. :(

From this, I tried sending in a can frame while simulating ignition by doing the following
[email protected]:~ $ while true; do cansend can0 016#02010000; sleep 0.1; done

I was expecting to see a response frame with ID 17 as per your comment, but unfortunately not having much luck :(
My research is HYPER focused on the immobilizer details, and I believe the 16:17 handshake is for the immobilizer. I assume that there is probably a more simple handshake that happens earlier in the sequence which makes the CM and the BIU play nice together.

I have been meaning to get my bench setup back up, so I'll see if I can fetch a full startup stream of CAN messages for you.

I suspect you're on to something, that your simulator will need to know the secret handshake to make the CM happy, and allow you to send further messages!
 

·
Registered
Joined
·
6 Posts
Discussion Starter · #7 ·
I have been meaning to get my bench setup back up, so I'll see if I can fetch a full startup stream of CAN messages for you.
That'd be awesome if you can! :)

A capture also while in motion with the speedometer and tachometer would also be amazing. Else were I've heard it may or may not use CAN for the actual movement, and instead use waveforms like on older CMs but looking at each pin with the wiring I can't see any that match the description for only being VSS, or RPM etc.

It's a bit of a silly project for me since I don't have a BIU or ECU for that matter, but it would be cool to get it working :)

Appreciate the help!!
 

·
Registered
2005 OBXT Limited, VF37, STI intake, 5MT
Joined
·
1,610 Posts
IIRC, during my CAN sniffing, the CM is silent until IMMO handshake is successful. The exception is the high speed/low speed CAN tests during boot, but that's it. Then the CM just listens to CAN messages (such as the Er** codes, CEL on/off, etc).

But it looks like the tach is driven off of a dedicated output from the ECM rather than CAN messages. Probably a standard sine wave output (FSM states a 0-13+V "waveform" signal). Granted, the stepped motor itself is driven by the CM, but it receives a non-CAN signal. I haven't verified this personally, but that how Subaru did it up through the 08+ pure CANBUS stuff.
 

·
Registered
Joined
·
6 Posts
Discussion Starter · #9 ·
IIRC, during my CAN sniffing, the CM is silent until IMMO handshake is successful. The exception is the high speed/low speed CAN tests during boot, but that's it. Then the CM just listens to CAN messages (such as the Er** codes, CEL on/off, etc).

But it looks like the tach is driven off of a dedicated output from the ECM rather than CAN messages. Probably a standard sine wave output (FSM states a 0-13+V "waveform" signal). Granted, the stepped motor itself is driven by the CM, but it receives a non-CAN signal. I haven't verified this personally, but that how Subaru did it up through the 08+ pure CANBUS stuff.

Hey thanks!

The wave form stuff sounds correct, I've got a scope and was playing around with pwm on an arduino last week in hope that I might be able to do this.

But I've been stuck not knowing what pins exactly to try with that. I've scoured over the manual and tried to map up what each pin does:

473559


I thought there would be a pin for the taco, a pin for the speedo, and perhaps two more for fuel and engine temp.

Just curious what you think I should try?

Thanks for the help!
 

·
Registered
2005 OBXT Limited, VF37, STI intake, 5MT
Joined
·
1,610 Posts
Looking at the MY05 USDM FSM, "A20" (connector i10) on the CM seems to link directly to the tach. Granted, the diagram just says input into the controller, but looking at the wiring diagrams and pinout for the H4DOTC ECM, pin 23 (ECM connector B134) leads directly to the CM (aside from splitting to a TCM input, if applicable).

So, for direct connection to the CM/ECU, there are only these inputs:

Engine output (tach)
Oil pressure sender (actually grounds at the sender, CM supplies power)
MIL

The fuel gauge connects directly to the BIU and the ECT connects directly to the ECM. Which would make sense, as you can read fuel level via the OBD2 port. So, I assume the ECT and fuel level are on the low-speed CAN as they do not need updated at 500kbs (non-critical).

Speedo is likely also driven by the ABS control module CAN messages as the wheel speed sensors input to it rather than the CM directly. The only input from the ABS is from the CANBUS. The only CM connection is for the ABS and Brake warning lights (grounds/controlled through the ABS module).
 

·
Registered
Joined
·
6 Posts
Discussion Starter · #11 ·
Thanks for the comments.

I was able to get the speedo driven directly on i10 pin 19 using SimHub with an Arduino Nano which was a great surprise!

Unfortunately no luck getting the Tacho driven. I tried following https://github.com/SHWotever/SimHub/wiki/Arduino-After-Market-Tach-support hoping that by using the TIP120 transistor (I used a TIP122 as couldn't get 120) with signal connected to i10 pin 20 (ECM) that it would be happy but sadly not.
 

·
Registered
2005 Outback XT 2.5T
Joined
·
198 Posts
That'd be awesome if you can! :)

A capture also while in motion with the speedometer and tachometer would also be amazing. Else were I've heard it may or may not use CAN for the actual movement, and instead use waveforms like on older CMs but looking at each pin with the wiring I can't see any that match the description for only being VSS, or RPM etc.

It's a bit of a silly project for me since I don't have a BIU or ECU for that matter, but it would be cool to get it working :)

Appreciate the help!!
So, I've been SUPER busy/delinquent on this.. My car is still in the midst of an engine swap, so I won't be able to give you anything from the car while in motion, tho I may be able to grab that later.

However, I have confirmed that the CM does spit out CAN frames of it's own, even when completely disconnected from the BIU, so I suspect there may be something wrong with your setup.

A21 is CAN high, or +
A22 is CAN low, or -

Code:
CAN ID    BYTES
17        00 00 00 00 00 D3
64        80 A9 00 00 00 00 00 01
65        00 00 00 8D 17 18 00 00
257        00 00 00 00 00 00 00 00
258        00 00 00 00 00 00 00 00
And when the BIU and CM are disconnected, this is the BIU's half of the conversation.

Code:
CAN ID    BYTES
16        00 00 00 00
32        02 01 00 00 00 00 07 00
33        00 00 00 00 00 00 01 00
34        00 00 0F 26 00 00 00 00
35        00 00 00 40 00 00 00 FF
128        FF 00 00 FF 00 00 84
129        00 00 00 00 FF 00 00 00
130        4C 1C 0B 00 03 00 00 00
305        00
Chances seem pretty good that the signal(s) you're after are probably in the 30's range, I threw some random messages at those and was able to see various indicator lights toggle on/off, and I was even able to set the temp gauge and gear position, which was fun.
 
1 - 12 of 12 Posts
Top