Interior CAN in the Fiat Stilo

I just read the codes for the steering wheel remote control in a Fiat Stilo.

Here they are:

3c4 04 00 - source
3c4 80 00 - VOl+
3c4 40 00 - VOL-
3c4 10 00 - tune up
3c4 08 00 - tune down
3c4 20 00 - mute

Regards,
Peer.

And here are a few more details I found:

180:00 xx 00 00 00 00 Dashboard indicator lights.
xx = 60 - Illumination of the dashboard control panel.
xx = 68 - Headlight.
xx = 6C - Nebel Forne.
xx=6A - Rear Fog Light
xx=6E - Fog both.

180:00 00 xx 00 00 00 Dashboard indicator lights.
xx = 60 - both turn signals.
xx = 40 - Turn signal, left.
xx = 20 - Turn signal, right.

281:00 00 00 00 00 00 xx xx Speed/RPM

2A0:xx xx 00 00 Speed (80 00 = 0 km/h)

380:xx 00 00 00 00
00 00 00
xx=02 - Interior lighting.
xx = 20 - Handbrake.
xx=08 - Instrument panel lighting.

380:00 00 xx 00 00 00 00 00 Reverse gear.
xx=4c - Gear engaged (76DEZ)

380:00 xx 00 00 00 00 00 00 open door:
xx=04 - Driver's door.
xx=08 - Front passenger door.
xx=40 - Rear door.
xx=0C - both doors.
xx = 4C - Rear + both doors.
xx = 44 - Rear + Driver
xx = 48 - Rear seat + Passenger seat.

388:00 xx 00 00 00 00 right window
xx = 05, completely.
xx = 04, briefly.
xx=02, briefly.
xx= 03, completely on.

3C2:00 00 xx
xx = Brightness of the lights, from 00 to 70.

The line in the MFD (where the date or radio station name and frequency is displayed).
545:xx xx xx xx xx xx rear display.
565:xx xx xx xx xx xx xx front part of the advertisement.

Interestingly, the text cannot be displayed directly in that area.
If I send the hexadecimal value '565:53 54 49 4c 4f 50 43', it should actually display 'SILOCARPC'.
'IzF8H3*E' appears on the display.
I haven't been able to identify any connection yet.

Here are the HEX values that display 'NO CD' on the screen:
545:00 00 00 00 00 00
565:00 00 00 00 00 00 00

And 'SEEK' is created using all of these values:
545:45 04 17 01 03 01
545:45 04 17 01 01 01
545:45 04 17 01 05 01

Therefore, the MFD will have an even more important role to play.
Regards,
Peer.

Here are some CAN codes from the interior of the Fiat Stilo:

180 00 00 xx 00 00 00

xx=04 = roger beep
xx=01 = rr indicator bulb failure.
xx=02 = r indicator bulb failure.

180 00 xx 00 00 00 00

xx=78 = high beam (floodlight?)
xx=10 = light signal

380 xx 00 00 00 00 00 00 xx

xx=05 = city in (steering)

281 00 xx 00 00 00 00 00 00

xx=80 = cruise control off.
xx=82 = ' ' a

281 00 00 xx 00 00 00 00 00

xx=40 = air conditioning on.

286 00 00 xx 00 00 00 00 00

xx=00 = asr off.
xx=80 = asr one

3A8 00 00 00 xx 00

xx=10 = lock. door handle lock to closed.
xx=08 = ' ' ' on'


Okay, that's all for now, and Peer, thanks again for the other codes you've already figured out!

best regards,
Gert.

@C1500

How did you manage to display something on the screen using CANHACK?

I haven't had any success so far; I've only been able to execute a few commands.

Here are some more B-CAN data (50 kbps) from a Fiat Stilo:

281 8 00 00 00 xx 00 00 00 00

xx = engine water temperature offset -40 degrees, range: -40 to 215 degrees.


281 8 00 00 00 00 xx xx 00 00

xx = fuel consumption factor 0.0022, range 0 to 132 L/hour.


281 8 00 00 00 00 00 00 xx 00

xx = engine speed (rpm)
factor = 32
0 to 8000 rpm


286 8 00 00 0x xx 00 00 00 00

x xx = vehicle speed, 13 bits (use the last bit of the 5th byte as well!).
factor = 0.0625 0 to 512 km/hour (10 ms)


2A0 4 0x xx 00 00

x xx = vehicle speed (as above, but slower: 100 ms)


380 8 00 00 00 xx 00 00 00 00

xx = battery voltage 7 bits (do not use the first bit) factor 0.16.
0 to 18 V.


380 8 00 00 00 00 00 xx 00 00

xx = fuel level, 0-100%.


388 6 xx 00 00 00 00 00

xx = external temperature. Factor: 0.5. Offset: -40. Range: -39.5 to 87.5 °C.


683 6 xx xx xx xx xx xx

xx xx xx xx xx xx = time + date (hh mm dd mm yyyy)


6D3 8 xx xx x0 00 00 00 00 00

xx xx x = total odometer reading (0 to 999,999 km)


6D3 8 00 00 00 xx xx 00 00 00

xx xx = km's to service (bit 25 to 40 - last bit of the 5th byte not included).
(to be used!) 0 to 20,000 km.


6D3 8 00 00 00 00 00 xx 00 00

xx = days to service (9 bits - use the first bit of the 7th byte as well!)
0 to 366 days.


6D3 8 00 00 00 00 00 00 0x xx

x xx = average fuel consumption (direct representation in hexadecimal xx,x)


700 6 00 00 xx xx xx xx

xx xx xx xx = active nodes (binary representation of node numbers 32 to 0).
(0 = inactive, 1 = active)


See you next time.

best regards,
Gert

It seems that someone here can communicate with Fiat/Alfa Romeo's CAN bus system.

I'm working on an embedded project for my Alfa 147 bus. I will be using the internal CAN interface from the Microchip PIC18F6680.

I think I have a 50 Kbps connection, but I'm unable to communicate at all.

'Can someone provide me with more specific data regarding the CAN bus system used in Fiat/Alfa Romeo vehicles?'

You're welcome.

Hello Arizzello,

When you connect the CAN interface and its software to your OBD connector (pins 6 and 14 for CAN high and low), you will have instant communication with your car (at 50 kbps) without any issues. What kind of information do you need?

Best regards,

Gert.

I'm developing a standalone device (without a personal computer) that uses a PIC18 microcontroller to display data read from a bus (fuel, temperature, etc.). To do this, I need to connect to the internal CAN hardware.

'I need some more hardware and protocol-specific data to set up the transmissions.'

Where can I find some literature?

I don't understand how you got the news onto the MFD. I hope this forum isn't dead yet.

I just remembered that I'm still looking for the signal that opens the trunk.

Unfortunately, I haven't found anything yet.

It definitely has to work, since I can also open it with the remote control.
(Instead of locking and unlocking, it should open.)

Has anyone found anything yet?

Best regards, Peer.

Hello Peer,

To open the tailgate, send the following data via the B-CAN bus (50 kbps):

7B0 8 04 02 10 81 00 00 00 00

then, within 5 seconds (first create the reports in the sending window):

7B0 8 04 03 30 0F 07 00 00 00

This command opens the tailgate for 700 milliseconds.

Okay, hier ist die Übersetzung:

'Please post whether it worked.'

best regards,
Gert.

Hello Gert,
I am unable to confirm the codes. I just checked the radio to be on the safe side, and it was working perfectly.
I also waited for the 5 seconds. Test car, Stilo Multiwagon.
Regards,
Stephan.

@yellowstilo

I read somewhere that you could control certain commands with a data rate of up to 50 kbps using the KWP2000 protocol.

For instance, the 6D3.8 unit includes an odometer, service kilometer counter, and service day counter.

If I were to send the command 6D3 8 00 00 00 00 00 00 00 00, would that reset my odometer to zero?
0, service in 0 km and 0 days?

Is it possible to send a command to retrieve the information saved in 63D or any of the other three-digit hexadecimal combinations?

I was planning to...
Experiment a bit with this through the OBD socket, connecting a terminal via the KWP2000 protocol. Am I going the right way, or what?

Hello Botunge,

I spent a lot of time figuring out the codes for the service reset, so I'm not going to just hand them out easily.
I've already offered these codes for sale to groups of members in some forums, hoping to keep the cost per person reasonable, but it seems there's not much interest.
Probably, in addition to the identifier and the total byte count, the reports you want to send also require the receiver address and the number of data bytes to be transmitted.

Sure, here is the translation of the text from German to English:

'gruss'
'greetings'
yellowstilo

Thanks for the reply. I found a place where you were trying to sell the codes, but my question was more about...

'If I send the command 6D3 8 00 00 00 00 00 00 00 00, would I damage anything in the car? (You mentioned earlier that the address 6D3 is for the odometer, and I wouldn't want it to be reset). Or is it safe to experiment a bit and send some commands through the KWP2000 interface?'

In general, it is always risky to send commands without knowing the meaning of all the different bits.
What you're trying to send is essentially a copy of the messages periodically sent by one or more nodes on the network. You need to address them using the correct hexadecimal receiver address and specify the number of data bytes that follow.
If you read all my posts carefully, you can figure out how to do this...
good luck,

yellowstilo