1. Attachments are working again! Check out this thread for more details and to report any other bugs.

Door lock code via CAN

Discussion in 'Prius v Technical Discussion' started by azukinakurumi, Mar 9, 2013.

  1. azukinakurumi

    azukinakurumi Junior Member

    Joined:
    Feb 23, 2013
    4
    8
    0
    Location:
    Osaka,Japan
    Vehicle:
    2011 Prius Alpha
    Model:
    N/A
    Does anyone know the code to lock/unlock doors via CAN?

    I have 2011 Prius Alpha(7seat).
    I am making a circuit to lock/unlock door via CAN using MCP2515 + MCP2551+ AVRMega328, but I could not get it yet...
    I have already known the ID of the code to get status of the doors lock/unlock is 0x638.
    I tried sending several codes include the ID 0x638, but I can not make lock/unlock doors.

    please tell me the code if you know.
     
    #1 azukinakurumi, Mar 9, 2013
    Reverse Engineer and schwiz like this.
  2. azukinakurumi

    azukinakurumi Junior Member

    Joined:
    Feb 23, 2013
    4
    8
    0
    Location:
    Osaka,Japan
    Vehicle:
    2011 Prius Alpha
    Model:
    N/A
    I had tried to find the code to lock/unlock doors many times, and I have gotten it!
    The lock code is SID=0x750, DLC=0x8, DATA0=0x40, DATA1=0x05, DATA2=0x30, DATA3=0x11, DATA4=0x06, DATA5=0x80, DATA6=0x00, and the unlock code is same except only DATA5=0x40.
    (When I write in the format of the scangauge, this code is 075040053011068000 ?)

    I continue to make a circuit for the door lock depending on the value of the car speed.
    # I know that there is a product with this feature, of course ;)

    Thank you.
     
    #2 azukinakurumi, Mar 18, 2013
    Reverse Engineer, Cristino, Chazz8 and 1 other person like this.
  3. schwiz

    schwiz New Member

    Joined:
    Jun 10, 2013
    10
    0
    0
    Vehicle:
    2013 Prius v wagon
    Model:
    Two

    Can you tell me how you are connecting to the CAN bus? Pictures of your circuit set up would be cool too! Also, any tips on how to get started with a similar project, good stuff to read, etc. Thanks!
     
    #3 schwiz, Jun 11, 2013
  4. trtracer

    trtracer Junior Member

    Joined:
    Oct 1, 2012
    3
    1
    0
    Vehicle:
    2012 Prius
    Model:
    N/A
    How did you find out the code? I tried to control the a/c but without luck.
     
    #4 trtracer, Jun 25, 2013
  5. azukinakurumi

    azukinakurumi Junior Member

    Joined:
    Feb 23, 2013
    4
    8
    0
    Location:
    Osaka,Japan
    Vehicle:
    2011 Prius Alpha
    Model:
    N/A
    to schwiz:
    I have made circuit like this (attached).

    This circuit receives/sends a signal from/to the car via CAN-BUS, and translates the signal to datas, and sends/receives to/from iPhone. I make iPhone jailbreaked, and use software "mobile terminal" and "minicon" to view/send datas.

    thanks.
     

    Attached Files:

    #5 azukinakurumi, Jun 26, 2013
  6. azukinakurumi

    azukinakurumi Junior Member

    Joined:
    Feb 23, 2013
    4
    8
    0
    Location:
    Osaka,Japan
    Vehicle:
    2011 Prius Alpha
    Model:
    N/A
    to trtracer:
    I find the code by mehtod below.
    1. I got the CD-ROM "TOYOTA electrial manual for prius alpha", and finded the control unit locking/unlocking doors. (That is "multiplex body control")
    2. I readed some forums and finded the code of "multiplex body control". (That is SID=0x750 and DATA0=0x40)
    3. I readed ISO 14230-3 and find the code to control actuator. (That is DATA2=0x30 and DATA4=0x06)
    And I understanded that DLC is fixed value "8", and DATA1 is the value of length after DATA2.
    4. I tried sending datas like below and received the data from the car and finded valid identifier (PID).
    *If the data include negative response id "0x7F 0x11"(serviceNotSupported), the identifier is NOT valid.
    SID DLC DATA0 DATA1 DATA2 DATA3 DATA4
    ----------------------------------------------------------
    0x750 0x08 0x40 0x03 0x30 0x00 0x06
    0x750 0x08 0x40 0x03 0x30 0x01 0x06
    0x750 0x08 0x40 0x03 0x30 0x02 0x06
    .
    .
    0x750 0x08 0x40 0x03 0x30 0xFF 0x06
    5. I tried sending datas like below and received the data from the car and finded valid value of data length (DATA1)
    *If the data include negative response id "0x7F", the value of DATA1 is NOT valid.
    (ex: DATA3=0x11)
    SID DLC DATA0 DATA1 DATA2 DATA3 DATA4 DATA5 DATA6 DATA7
    ----------------------------------------------------------
    0x750 0x08 0x40 0x04 0x30 0x11 0x06 0x00
    0x750 0x08 0x40 0x05 0x30 0x11 0x06 0x00 0x00
    0x750 0x08 0x40 0x06 0x30 0x11 0x06 0x00 0x00 0x00
    6. I tried sending datas like below and look door lock changed or not , and find the code of lock/unlock
    SID DLC DATA0 DATA1 DATA2 DATA3 DATA4
    ----------------------------------------------------------
    0x750 0x08 0x40 0x05 0x30 0x11 0x06 0x00 0x00
    0x750 0x08 0x40 0x05 0x30 0x11 0x06 0x00 0x01
    0x750 0x08 0x40 0x05 0x30 0x11 0x06 0x00 0x02
    0x750 0x08 0x40 0x05 0x30 0x11 0x06 0x00 0x04
    0x750 0x08 0x40 0x05 0x30 0x11 0x06 0x00 0x08
    0x750 0x08 0x40 0x05 0x30 0x11 0x06 0x00 0x10
    .

    0x750 0x08 0x40 0x05 0x30 0x11 0x06 0x80 0x00
     
    #6 azukinakurumi, Jun 26, 2013
    Reverse Engineer and schwiz like this.
  7. Pplus_man

    Pplus_man New Member

    Joined:
    Mar 14, 2017
    4
    0
    0
    Location:
    Germany
    Vehicle:
    2016 Prius+ MPV
    Model:
    N/A
    Tested it on my 2016 P+ - with an ELM327 - and it works for my P+ too.
    (which means - the body-ECU for the 2017 P+ is still the same as for the P3)


    >atcea40
    OK

    >atsh750
    OK

    >3011008000 <--- locks doors
    NO DATA

    >3011000080 <--- unlocks hatch
    NO DATA

    >3011004000 <--- unlock doors "30=write, 11=LID, 004000=data"
    NO DATA

    Unfortunately - I've not yet found a way how to READ actually the status back.
    theoretically - to a doc I found it should work with:

    21=read, 11=LID, 01=once, 03=3 bytes => 21110103 - should read out the lock state.
    expected answer should be something like 61 11 xx yy zz (( or 7F21 = error!))

    But it doesn't :-(
     
    #7 Pplus_man, Nov 22, 2017
  8. ErikJ

    ErikJ New Member

    Joined:
    Jan 3, 2018
    23
    6
    0
    Location:
    Palo Alto, CA
    Vehicle:
    2015 Prius Plug-in
    Model:
    Plug-in Base
    I can confirm that these codes still work on a 2014 Plug-In Prius: (the code is written for Python-CAN)
    Code:
    lockAllDoors     = can.Message(data=[0x40, 0x05, 0x30, 0x11, 0x00, 0x80, 0x00, 0x00], arbitration_id=0x750, extended_id=False, timestamp=time.clock())
unlockAllDoors   = can.Message(data=[0x40, 0x05, 0x30, 0x11, 0x00, 0x40, 0x00, 0x00], arbitration_id=0x750, extended_id=False, timestamp=time.clock())
unlockDriverDoor = can.Message(data=[0x40, 0x05, 0x30, 0x11, 0x00, 0x20, 0x00, 0x00], arbitration_id=0x750, extended_id=False, timestamp=time.clock())
openHatch        = can.Message(data=[0x40, 0x05, 0x30, 0x11, 0x00, 0x00, 0x80, 0x00], arbitration_id=0x750, extended_id=False, timestamp=time.clock())
     
    #8 ErikJ, May 8, 2018
(You must log in or sign up to post here.)