Openpilot: How do I make this work for Toyota Rav4 2016

[nojvek]

It has adaptive cruise, 6 radars, 6 cameras and lane detection already. I would love to make it work with open pilot.

[geohot]

Would love to support this car, and I think it's a very reasonable next target.

You need to reverse engineer how the LKAS and ACC are being commanded. I would get access to TIS, the Toyota Information System, that has schematics for that car. Then tap the CAN bus that the forward camera sits on and sniff it.

[nojvek]

Thanks for the reply. I don't consider myself a CAN bus hacker but its always something I really wanted to learn.

https://techinfo.toyota.com/techInfoPortal/appmanager/t3/ti?_pageLabel=ti_whats_tis&_nfpb=true

I'll try to get a 2 day subscription and dabble my head into it.

I have made it a goal of 2017 to make my car follow lanes automatically.

I just hope this doesn't violate the lease.

[spant]

Could you just check which cars available in India could be a target for this?

[geohot]

We will be releasing an updated version of openpilot soon with a car abstraction layer, showing the exact list of things you need to find.

But assume you will definitely need the gas, brake, and steering control packets. Best way, tap forward camera CAN, engage ACC and LKAS, and figure out which packet did it.

[nojvek]

Sounds great. I'll keep an eye out and purchase the CAN related equipment.

I was always under assumption that the bus would be heavily encrypted so no
one could tamper with it.

What you're saying is, it's basically frames as C structs that need to be
decoded right?

On Tuesday, December 6, 2016, George Hotz [e-mail] wrote:

We will be releasing an updated version of openpilot soon with a car
abstraction layer, showing the exact list of things you need to find.

But assume you will definitely need the gas, brake, and steering control
packets. Best way, tap forward camera CAN, engage ACC and LKAS, and figure
out which packet did it.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/commaai/openpilot/issues/23#issuecomment-265365804,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AA-JVIHmWHEW9ROBX4PxqPqBpqUDQiDPks5rFlAEgaJpZM4LGCf3
.

[geohot]

Oh no, not encrypted at all. You can also use a comma neo board to interface to CAN, then boardd from openpilot to receive CAN frames. The encoding for the Honda is in the DBC files.

[nojvek]

Took a look at the dbc files.
https://github.com/commaai/openpilot/blob/master/dbcs/acura_ilx_2016_can.dbc

Is the format documented anywhere? Trying to make sense of the different
fields.

The comma team painstakingly reverse engineered and built this files right?

Once I get the neo equipment, I'll see how far I go and get back to you.

On Tuesday, December 6, 2016, George Hotz [e-mail] wrote:

Oh no, not encrypted at all. You can also use a comma neo board to
interface to CAN, then boardd from openpilot to receive CAN frames. The
encoding for the Honda is in the DBC files.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/commaai/openpilot/issues/23#issuecomment-265366525,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AA-JVAwcFVNakbATGxojh-IMy-7jhLz9ks5rFlFNgaJpZM4LGCf3
.

[jon-mullen]

Looks like it didn't come from a manufacturer, they usually have a list of modules and some versioning stuff in there.

Might want to check out https://github.com/ebroecker/canmatrix.

Hopefully a couple examples help:

Messages:

BO_ 0x0E4 STEERING_CONTROL: 5 ADAS

(BO_ = following is a message)
(0x0E4 = message number in hex)
(STEERING_CONTROL = message name)
(5 = message length in bytes)
(ADAS = message sender module name)

Each signal:

SG_ STEER_TORQUE : 0|16@1- (1,0) [-3840|3840] "" Vector__XXX

(SG_ = following is signal)
(STEER_TORQUE = signal name)
(0 = signal starting bit)
(16 = signal length in bits)
(1- = treat those 16 bits as a twos-complement signed integer)
(1 = multiply signed integer by 1)
(0 = then add zero)
(-3840|3840 = resulting range)
("" = no unit)
(Vector_XXX = receiving module for this signal)

One more signal from a different msg, this one's unsigned with a nontrivial factor:

SG_ XMISSION_SPEED : 0|16@1+ (0.002759506,0) [0|70] "m/s" Vector__XXX

(SG_ = following is signal)
(XMISSION_SPEED = signal name)
(0 = signal starting bit)
(16 = signal length in bits)
(1+ = treat those 16 bits as unsigned integer)
(0.002759506 = multiply unsigned integer by 0.002759506)
(0 = then add zero)
(0|70 = resulting range)
("m/s" = unit)
(Vector_XXX = receiving module for this signal)

The value tables (VAL_) at the bottom spell out what the values mean for the state-encoded signals.

[nojvek]

Great. This is useful.
https://github.com/ebroecker/canmatrix/blob/master/canmatrix/dbc.py

Looks like it didn't come from a manufacturer

Is this something that manufacturers usually publish in their information
system that could be accessed by a subscription?

Regards.

On Wednesday, December 7, 2016, jon-mullen [e-mail] wrote:

Looks like it didn't come from a manufacturer, they usually have a list of
modules and some versioning stuff in there.

Might want to check out https://github.com/ebroecker/canmatrix.

Hopefully a couple examples help:
Messages: BO_ 0x0E4 STEERING_CONTROL: 5 ADAS

(BO_ = following is a message)
(0x0E4 = message number in hex)
(STEERING_CONTROL = message name)
(5 = message length in bytes)
(ADAS = message sender module name)
Each signal: SG_ STEER_TORQUE : 0|16@1- (1,0) [-3840|3840] "" Vector__XXX

(SG_ = following is signal)
(STEER_TORQUE = signal name)
(0 = signal starting bit)
(16 = signal length in bits)
(1- = treat those 16 bits as a twos-complement signed integer)
(1 = multiply signed integer by 1)
(0 = then add zero)
(-3840|3840 = resulting range)
("" = no unit)
(Vector_XXX = receiving module for this signal)
One more signal from a different msg, this one's unsigned with a
nontrivial factor: SG_ XMISSION_SPEED : 0|16@1+ (0.002759506,0) [0|70]
"m/s" Vector__XXX

(SG_ = following is signal)
(XMISSION_SPEED = signal name)
(0 = signal starting bit)
(16 = signal length in bits)
(1+ = treat those 16 bits as unsigned integer)
(0.002759506 = multiply unsigned integer by 1)
(0 = then add zero)
(0|70 = resulting range)
("m/s" = unit)
(Vector_XXX = receiving module for this signal)

The value tables (VAL_) at the bottom spell out what the values mean for
the state-encoded signals.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/commaai/openpilot/issues/23#issuecomment-265388459,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AA-JVHMFPMIs9vtsM76z5CYoXJLrv9vfks5rFnDugaJpZM4LGCf3
.

[geohot]

No, we had to reverse engineer it. Good luck finding them.

(though I hear rumors the Tesla DBC file is actually hidden inside the Tesla if you know where to look)

[TheMutley]

The DBC files are Vector's proprietary format for CAN database and that is usally what everybody who is serious about CAN is using (OEM, Tier1 etc..). These files can usually be opened with CANdb++ which is available for free when you download the CANalyzer demo. Now, I found out that the files DBC files generated by CANMatrix when switching from another database format to DBC are not directly compatible with CANdb++. I had to do some modifications to them in order to be able to open them. It's worth it since this software is very useful when constructing your very own DBC.

[hableel]

I have 2013 Honda accord without LKAS, ACC.

So in order to control steering the car must have LKAS ?

What about brakes. Standerd cruise control disengage when braking.

Is the functionality of controlling steering and brakes limited by turning ACC,lkas on or that just the way neo designed?

[nojvek]

@hableel, NEO is basically going to send steering angle, acceleration and
brake commands to the car's CAN bus. The car needs to be able to understand
those commands.

If the car is not supported by openpilot then this means you'll have to
hook into the correct bus and reverse engineer the commands your self.

On Mon, Dec 12, 2016 at 2:50 PM, hableel [e-mail] wrote:

I have 2013 Honda accord without LKAS, ACC.

So in order to control steering the car must have LKAS ?

What about brakes. Standerd cruise control disengage when braking.

Is the functionality of controlling steering and brakes limited by turning
ACC,lkas on or that just the way neo designed?

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/commaai/openpilot/issues/23#issuecomment-266578649,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AA-JVOXTx763SkXKR9ccmqeZmvH0uedPks5rHc-XgaJpZM4LGCf3
.

[hableel]

@nojvek cars equipped with necessary systems will understand command because its just sniffed from it. but will it accept commands when turning off lkas,,acc ? other cars that don't have this functionality i don't what they can do because they are not designed to change steering angle.

My car change steering resistance based on speed and brakes. maybe there is a way to control steering angle as well but I'm not sure

[adam-nelson]

Thanks @geohot for OOS the project. I myself aren't a coder (Apart from html/css/xml) and have an interest in improving self driving or driver assisted technology. Because I am geek and want to understand

How friendly is ford when comes to reverse engineering cars from 2010 onwards?

Whats the simple checklist for car suitability for self driving or assistance and can I create aftermarket parts that add features to the car.

In Australia. We recently opened a testing track for autonomous vehicles similar to what happened in the US and industry is still a grey area, But local queensland and victorian government seems keen to develop technology. Which likes of Bosch being involved

I just don't know what I can try to form a team in Australia that could develop an OOS project like this and pay for development

[nojvek]

I look forward to day when cars expose, camera, radars, throttle and
steering over a common protocol.

My canbus to USB has arrived by mail, I'll get back on how the reverse
engineering goes.

On Thursday, December 15, 2016, Adam Nelson [e-mail]
wrote:

Thanks @geohot https://github.com/geohot for OOS the project. I myself
aren't a coder and have an interest in improving self driving or driver
assisted technology. Because I am geek and want to understand

How friendly is ford when comes to reverse engineering cars from 2010
onwards?

Whats the simple checklist for car suitability for self driving or
assistance and can I create aftermarket parts that add features to the car.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/commaai/openpilot/issues/23#issuecomment-267317602,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AA-JVO7fl3Jj3zGfE2w2Us4JJGSJjPPJks5rITRcgaJpZM4LGCf3
.

[rmueller83]

Perhaps this will help you to get started
http://illmatics.com/car_hacking.pdf (Toyota CAN messages start on page 41 with further description on page 93)
http://illmatics.com/car_hacking_poories.pdf
http://illmatics.com/can%20message%20injection.pdf

[adam-nelson]

I think you also need to packet sniff a car

On Fri, Dec 16, 2016 at 7:48 PM, rmueller83 [e-mail]
wrote:

Perhaps this will help you to get started
http://illmatics.com/car_hacking.pdf http://url
http://illmatics.com/car_hacking_poories.pdf http://url
http://illmatics.com/can%20message%20injection.pdf http://url

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/commaai/openpilot/issues/23#issuecomment-267556368,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AE9Ev3AwwQHA4vbz9t_h1o1WfDgyXE5Xks5rIl5hgaJpZM4LGCf3
.

[olmerg]

Hi, I am reading this thread and I want to recommend this can analyzer software Busmaster it use dbf files and personnally is easier than Vector programs.