Back to Project Index http://graham.auld.me.uk E-Mail me
VAN Intro
USB VAN Monitor
Pioneer Headunit Control
VAN Line Protocol
VAN Frame Check Sequence
VAN Bus Packets

VAN Bus Packets - Detail:

Here follows what I know about the packets for each IDEN on the bus:

Yellow text is a guess I've made from looking at log files - will need confirming in vehicle.

IDEN 464 AirCon?
Example 464 WA0 0000000000 8CDA A Engine not running
Decode
464 WA0 0000000000 8CDA A
IDEN Write & Req ACK Unknown data Checksum ACK
Notes: Regular from AirCon

 

IDEN 4D4 Audio Settings
Example 4D4 RA- 8614810131023F3F444386 ???? A Not seen in my car - no HU installed
Decode
4D4 RA0 8614810131023F3F444386 ???? A
IDEN Read & Req ACK Unknown data Checksum ACK

Databyte 86 14 81 01 31 02 3F 3F 44 43 86
Meaning Sequence
Header
Audio properties bitfield
0001 0000 → Loudness on
? ? Source
0x51 = Radio
0x52 = Built in cd
Volume
(bit7 = 1 during update)
Bass
(bit7 = 1 during update)

 

Treble
(bit7 = 1 during update)

 

Fader
(bit7 = 1 during update)

 

Balance
(bit7 = 1 during update)

 

Sequence
Footer

 

 

Notes: Radio -> Display
I can't begin to decode this until I put the headunit back in the car.

 

IDEN 4DC AirCon
Example 4DC WA0 800016123EFFFF C8E4 A Engine not running
Decode
4DC WA0 800016123EFFFF C8E4 A
IDEN Write & Req ACK A/C status data Checksum ACK
Databyte 80 00 16 123E FF FF
Meaning 00=Off
80=Auto (AC off)
C0=Auto AC on but not running?
C1=Auto AC on and running?
E1 = Rear window heater on
? internal temperature /2?
0x16=22
22/2=11 degrees
? ? ?

Databyte 0:
Possible meanings:

7 6 5 4 3 2 1 0
Auto AC Enabled Rear window heater ? ? ? ? AC compressor running


 

Notes: Lots of guessing here

 

IDEN 4EC CD Changer info
Example None Not seen in my car - no HU installed
Decode ?
Notes: I can't begin to decode this until I put the headunit back in the car.

 

IDEN 4FC Lights status
Example 4FC WA0 80000371F000FFFF5C48FF 5A96 A Engine not running
Decode
4FC WA0 80 00 03 71 F0 00 FF FF 5C 48 FF 5A96 A
IDEN Write & Req ACK Data Checksum ACK
Databyte 80 00 03 71 F0 00 FF FF 5C 48 FF
Meaning ? ? ? gauge?   Lights gauge? gauge?      

Databyte 5:
Lights:

7 6 5 4 3 2 1 0
Dipped beam High beam Front fog Rear fog Right indicator Left indicator ? ?

 

Notes: BSI-->Dashboard

The bit wise info for the lights byte is correct in my car

 

IDEN 524 Car Status 2
Example 524 W00 000001002001000100FF00000000 E28A N Engine not running
Decode
524 W00 00 00 01 00 20 01 00 01 00 FF 00 00 00 00 E28A N
IDEN Write Data Checksum No ACK
Databyte 00 00 01 00 20 01 00 01 00 FF 00 00 00 00
Meaning ? ? ? ? byte4 Handbrake byte 6 ? byte 8 byte 9 ? ? ? ?

Databyte 1:
Related to engine startup, maybe 0x02 for engine on?

Databyte 3:
Toggled when starting engine?

Databyte 4:

7 6 5 4 3 2 1 0
? ? key in? ? ? ? ? ?

key in ref 5E4 byte 1 which goes from 20 to 00 in similar time period?

Databyte 5:
Handbrake

7 6 5 4 3 2 1 0
? ? ? ? ? ? ? Handbrake on

Databyte 6:

7 6 5 4 3 2 1 0
? ? ? Left stick button pushed ? ? Seatbelt warning on ?

Databyte 8:

7 6 5 4 3 2 1 0
? ? ? ? ? ? ESP/ASR deactivated Car locked

Databyte 9:

01=door open
41=ESP/ASR deactivated
44=auto lighting active
45=auto wipers active

Notes: COM2000 --> Dashboard?

I suspected this was mostly for the benefit of the multifunctional display - but it doesn't get acknowledged or ask for one! (well not with the engine off anyway)

 

IDEN 54E SatNav Stuff
Example 1 54E RA0 810080000081 28FA A Engine Off - Satnav accessed
Example 2 54E RA0 820400000082 58B6 A Engine Off - Satnav accessed
Example 3 54E RA0 830800000083 8282 A Engine Off - Satnav accessed
Example 4 54E RA0 849000000084 8356 A Engine Off - Satnav accessed
Example 5 54E RA0 850301000085 CDE6 A Engine Off - Satnav accessed
Example 6 54E RA0 864000000086 A67E A Engine Off - Satnav accessed
Decode
54E RA0 864000000086 A67E A
IDEN Read & Req ACK Unknown data Checksum ACK
Notes: The example packets appeared in that order multiple times through me setting a destination

 

IDEN 554 Radio Info (sort of mostly)
Example  1 554 RA- 87D10980F0020065F214A100534B59524F434B200087 A Not seen in my car - no HU installed
Example 2 554 RA- 81D3 91 53 4B 59 52 4F 43 4B 20 81 A
Decode
554 RA0 87 D1 09 80 F0 02 00 65 F2 14 A1 00 53 4B 59 52 4F 43 4B 20 00 87 ???? A
IDEN Read & Req ACK Data Checksum ACK

Databyte 0:
Part of header footer pair for message (starts and ends in 87) - this is another *data updated* header and footer
These headers and footers are common to many messages that carry updated information

Databyte 1:
D1 = Radio frequency data (probably for radio display)
D3 = Radio preset data (probably for displaying preset choices when you scroll the remote wheel)
D6 = CD track info

When D1 - Frequency data (like Example 1 above):

Databyte 87 D1 0980 F0 02 00 65 F2 14 A1 53 4B 59 52 4F 43 4B 20 00 87
Meaning Header Freq Info Frequency
(0980*.05)+50=99.00MHz
?  Byte 7   ? ? ? RDS available
(non zero)
SKYROCK{space} ? Footer

Byte 7:
Icons

7 6 5 4 3 2 1 0
? ? ? ? ? ? RDS TA

When D3 - Radio Preset Data

Databyte 81 D3 91 53 4B 59 52 4F 43 4B 20 81
Meaning Header Preset Info Byte 2 SKYROCK{space} Footer

Byte 2:
Preset number and type

7 6 5 4 3 2 1 0
This is a preset? (seems always set) (some reports of this rather than bit 4 indicating RDS or frequency) ? RDS data avaliable (Display frequency if this is zero) Preset Number

 

When D6 - CD track info (I've not logged one of these yet so there's no example packet - take with pinch of salt)

Databyte ? D6 00 03 00 00 01 01 20 ?
Meaning Header Preset Info ? 0x13 for first packet after changed track ? 00:01 mm:ss current track position track 1 of 20 on CD Footer

I think total CD minutes:seconds are in there somewhere too, possibly the number of CD from the changer too? All seems to be BCD though so you can read the numbers directly.

Notes: Radio --> Display

Probably requested by multifunctional display?

 

IDEN 564 Car Status
Example 564 RA0 840000000000008000FF0039391D0353004303530043FFFF011384 DE8A A Engine not running
Decode
524 RA0 84 00 00 00 00 00 00 80 00 FF 00 39 39 1D 03 53 00 43 03 53 00 43 FF FF 01 13 84 DE8A A
IDEN Read & Req ACK Data Checksum ACK
Databyte 84 00 00 00 00 00 00 80 00 FF 00 39 39 1D 03 53 00 43 03 53 00 43 FF FF 01 13 84
Meaning Header ? ? ? ? ? ? Doors ? ? Byte 10 trip 1 mean speed trip 2 mean speed ? trip 1 distance trip 1 fuel consumption Trip 2 distance trip 2 fuel consumption instantaneous fuel consumption 0x0113= 275 miles fuel left Footer

Databyte 0 and 26:
Header & Footer sequence byte

7 6 5 4 3 2 1 0
Sequence byte ? ? ? ? Sequence number (constantly incrementing probably used to indicate changed data or new packet)

Databyte 7:
Doors open

7 6 5 4 3 2 1 0
Front Right Front Left Rear Right Rear Left Boot Lid ? ? ?

Note to self: check petrol cap and glove box to see if they modify this

Databyte 10:
Buttons

7 6 5 4 3 2 1 0
? ? ? ? ? ? ? Right stalk button pushed
Notes: BSI-->Display
Probably read by display unit to decide what to display

 

IDEN 5E4 Display Settings?
Example 5E4 WA0 20FF F934 A Engine not running
Decode
5E4 WA0 20FF F934 A
IDEN Write & Req ACK Unknown data Checksum ACK

Byte 0 - I've seen it change from 20 to 00 in a capture where key was removed and capture left running
reference 524 Databyte 4 with my key in guess???

Bytes 0:1

00 01 - Sent by display during power up before it's ready to display anything
20 1E - Display is ready
20 1F - ?
20 FF - ?

Notes: Display writes these apparently - quite regularly

 

IDEN 64E SatNav Stuff
Example 64E RA0 80050180 0B7A A Engine Off - Satnav accessed
Decode
64E RA0 80050180 0B7A A
IDEN Read & Req ACK Unknown data Checksum ACK
Notes: This example packets appeared after me using the satnav to set a destination

 

IDEN 664 Car Status
Example 664 WA0 00000F04242C00FF00FF00 9ED8 A Engine not running
Decode
524 WriteA0 00 00 0F 04 24 2C 00 FF 00 FF 00 9ED8 A
IDEN Write & Req ACK Data Checksum ACK
Databyte 00 00 0F 04 24 2C 00 FF 00 FF 00
Meaning Buttons 1 ? Buttons 2 ? ? ? ? ? ? ? ?

Databyte 0:
Buttons 1

7 6 5 4 3 2 1 0
? ? ? ? ? ? Hazard lights ?

Databyte 2:
Buttons 2

7 6 5 4 3 2 1 0
? Door lock ? ? F = brightness (perhaps this cycles between levels?)

 

 

Notes: Dashboard->BSI

Suspect this is broadcast by the dash board dials

 

IDEN 6CE SatNav Stuff
Example 1 6CE RA0 894D20515448000148454C454E0001484F4D45000189 752E A Engine Off - Satnav accessed
Example 2 6CE RA0 0511560053434F544C414E4400414245524445454E53484952450005 FAB0 A Engine Off - Satnav accessed
Example 3 6CE RA0 97003235003235000197 D088 A Engine Off - Satnav accessed
Example 4 6CE RA0 00105600454E474C414E440048414D50534849524500414E444F5600 4B70 A Engine Off - Satnav accessed
Example 5 6CE RA0 894552000044436C6F7365200043414D454C4F540030000189 DC1E A Engine Off - Satnav accessed
Decode
6CE RA0 89 4D 20 51 54 48 00 01 48 45 4C 45 4E 00 01 48 4F 4D 45 00 01 89 A67E A
IDEN Read & Req ACK Nav data to screen Checksum ACK

Each packet is bound by a header & footer of the same byte.
I shall roughly decode these as they are ASCII displayed by the screen during destination setting.

Example 1:

89 4D 20 51 54 48 00 01 48 45 4C 45 4E 00 01 48 4F 4D 45 00 01 89
Header M [Space] Q T H     H E L E N     H O M E     Footer

This contains 3 of my destinations stored in memory (as it happens the first 3 to be displayed on opening the satnav screen)

Example 2:

05 11 56 00 53 43 4F 54 4C 41 4E 44 00 41 42 45 52 44 45 45 4E 53 48 49 52 45 00 05
Header   V   S C O T L A N D   A B E R D E E N S H I R E   Footer


Being a recent destination area - this pops up on my satnav screen when you go past choosing a memory and into looking up an address.

Example 3:

97 00 32 35 00 32 35 00 01 97
Header   2 5   2 5     Footer

Hmm, 2 possible house numbers? I can't remember what comes on the screen next!

Example 4:

00 10 56 45 4E 47 4C 41 4E 44 00 48 41 4D 50 53 48 49 52 45 00 41 4E 44 4F 56 00
Header   V E N G L A N D   H A M P S H I R E   A N D O V  

This looks like me entering an address

Example 5:

89 45 52 00 00 44 43 6C 6F 73 65 20 00 43 41 4D 45 4C 4F 54 00 30 00 01 89
Header E R     D C l o s e [Space]   C A M E L O T   0     Footer

This looks like it follows on from Example 4

 

Notes: The example packets appeared in that order multiple times through me setting a destination.

The packets appear in sequence and example 5 is regularly on the bus after I set a destination, the car was in a garage though so had no GPS reception, and couldn't start directions - I expect more packets like these once navigation starts. This seems to be the display reading what to show.

6CE - ASCII chars House Number and Street set for navigation (start&end 0x89) also memory lookup -

 

IDEN 74E SatNav Stuff
Example 74E RA0 811B00000005000000000000000000000000000000000000000081 6A06 A Engine Off - Satnav accessed
Decode
74E RA0 811B00000005000000000000000000000000000000000000000081 6A06 A
IDEN Read & Req ACK Unknown data Checksum ACK
Notes: This example packets appeared after me using the satnav to set a destination

 

IDEN 7CE SatNav?
Example 7CE RA0 87113C1007010200000000000000000000200087 89DC A Engine Off
Decode
7CE RA0 87113C1007010200000000000000000000200087 89DC A
IDEN Read & Req ACK Unknown data Checksum ACK
Notes: This packet is on the bus regularly without satnav access but because I couldn't find any mention of it on the web and it looks a bit like other satnav messages with a similar IDENT I guess it might be from there. At some point I will unplug the SatNav and see if it vanishes.

Header&footer seems to run from 0x80 to 0x87 over some captures accompanied by some bit changes (LSB bytes 1 and 2)

 

IDEN 824 Speed&RPM
Example 824 W00 00000000000000 5498 N Engine not running
Decode
824 W00 00 00 00 00 00 00 00 5498 N
IDEN Write Data Checksum No ACK
Databyte 00 00 00 00 00 00 00
Meaning RPM (x10) Speed (x100) Km/h Sequence number

 

Notes: BSI--> Dashboard/Broadcast

I guess this must come out of the BSI via the ECU

 

IDEN 8A4 Dashboard Gauges
Example 8A4 W00 8F033C1A6E907D 4EB8 N Engine not running
Decode
8A4 W00 8F 03 3C 1A 6E 90 7D 4EB8 N
IDEN Write Data Checksum No ACK
Databyte 8F 03 3C 1A 6E 90 7D
Meaning Byte 0 Byte1 Water temp 0x3C=60/2=30 degrees?

FF until key set to Ignition

Oil level Fuel level Oil temp 0x90=144/2=72 degrees?

this value takes at least one bit from the previous byte.

Outside temp 0x7D-0x50=45/2=22.5 degrees?

Databyte 0:

7 6 5 4 3 2 1 0
? ? ? Heartbeat Dial brightness

Databyte 1:

7 6 5 4 3 2 1 0
? ? ? Economy mode active Door open warning light?(don't think so now) Engine running Ignition on Accessories on (drops out while starting car)

 

Notes: BSI--> Dashboard/Broadcast

I guess this must come out of the ECU via the BSI

 

IDEN 8C4 Radio Buttons
Example 8C4 WA- 8A4440 ???? A Not seen in my car - no HU installed
Decode
8C4 WA0 8A 44 40 ???? A
IDEN Write & Req ACK Data Checksum ACK
Databyte 8A 44 40
Meaning ? ? Buttons pushed

Databyte 2:
Buttons pushed

7 6 5 4 3 2 1 0
? Button released ? buttons as below

First AND mask the byte with 0x1F then:

0x01 = 1
0x02 = 2
0x03 = 3
0x04 = 4
0x05 = 5
0x06 = 6
0x10 = audio up
0x11 = audio down
0x16 = audio
0x1B = radio
0x1D = CD (maybe tape on other units?)
0x1E = CDC

OR/AND

Bytes 2 and 3 like so...
 

C2 11 “Audio setting down button” pressed (note: only sent when changing audio settings)
C2 12 “Audio setting up button” pressed (note: only sent when changing audio settings)
C2 16 “Audio button” pressed
22 13 “Seek- button” pressed (note: only sent when cdc input is active)
22 14 “Seek+ button” pressed (note: only sent when cdc input is active)
22 17 “MAN button” pressed (note: only sent when cdc input is active)
C2 1B “Radio button” pressed
C2 1D “CD button” pressed
C2 1E “CDC button” pressed
   
  Notes for the keys above:
  1. When a button is released, bit 6 of the second byte is set (for example C2 5D when “CD button” is released)
  2. If a button is pressed longer than 2 seconds, a new packet is sent with bit 7 set, then also bit 6 is set and a new packet is sent every second. When the button is released, bit 7 are set to zero and a final packet described in note 1 above is sent.
   
21 40 Volume knob has been turned
24 40 Either RDS or TA button has been pressed and released

The port also tells the display to read new data (for example RDS data or cd time information) from port 0x554.

 

Notes: Radio -> Display

I can't begin to decode this until I put the headunit back in the car.

 

IDEN 8CE SatNav
Example 8CE WA0 0001 7DA2 A Engine not running
Decode
8CE WA0 0001 7DA2 A
IDEN Write & Req ACK Unknown data Checksum ACK
Notes: Appeared after using remote to access SatNav

IDEN 8D4 Radio control
Example 8D4 ??? ???????? ???? ?  
Decode
8D4 11 00 Switch off radio?
  11 C0 Update settings for Loudness On
  11 C2 Update settings for Loudness Off
  11 E0 Update settings for Speed Volume On
  11 E1 Update settings for Speed Volume Off
  12 01 Switch to Radio
  12 02 Switch to internal CD
  12 03 switch to CD Changer (CDC)
  14 xx xx xx xx Update fader, balance, bass and treble
  27 21 Read preset memory address 1
  27 22 Read preset memory address 2
  27 23 Read preset memory address 3
  27 24 Read preset memory address 4
  27 25 Read preset memory address 5
  27 26 Read preset memory address 6
  D1 Tell radio to return radio info when reading from port 0x554
  D3 Tell radio to return preset stations when reading from port 0x554
  D6 Tell radio to return CD/track info when reading from port 0x554
Notes: Display-->Radio

Taken from old rt3 wiki, I have not confirmed this data

 

IDEN 8FC Odometer reading
Example 8FC RA0 81030D4081 ???? A Engine Start
Decode
7CE RA0 81 03 0D 40 81 89DC A
IDEN Read & Req ACK Data Checksum ACK
Databyte 81 03 0D 81 81
Meaning Header 0x030D40=20000.0km Footer
Notes: This is probably the dash reading mileage from the BSI at startup. The value is in kilometres even in UK vehicles configured for miles

 

IDEN 94E SatNav
Example 94E WA0 10FF01000000000001 C4AC A Engine not running
Decode
94E WA0 10 FF 01 00 00 00 00 00 01 C4AC A
IDEN Write & Req ACK Unknown data Checksum ACK
Notes: Appeared after using remote to access SatNav

 

IDEN 984 Time?
Example 1 984 W00 007100010C CCE4 N Engine not running
Example 2 984 W00 008900010C B930 N Engine not running (time approx 22:50-23:05)
Decode
984 W00 00 71 00 01 0C CCE4 N
IDEN Write Data Checksum No ACK
Databyte 00 71 00 01 0C
Meaning ? Increases every 23:59-->00:00 ? 01 hours 0C (12) minutes?

 

Notes: Display -> Broadcast

I'm not convinced, this doesn't appear on the bus all that often - I guess once a minute is enough tho...

Also the info I've seen from other people is that the hours and minutes are in BCD... I have two captures from my car that are NOT BCD???

 

IDEN 9C4 Radio remote control
Example 9C4 WA0 2098 2764 A Engine not running
Decode
9C4 WA0 2098 2764 A
IDEN Write & Req ACK Data Checksum ACK
Databyte 20 98
Meaning Byte 0 Wheel position (starts at 0x80 and returns there on overflow)

Databyte 0:

7 6 5 4 3 2 1 0
seek up seek down ? ? volume up volume down source ?

bits 4 and 5 are set in some way when you roll the wheel position past 0x00 or 0xFF and the number is reset to 0x80. I suspect some mechanism that says which direction it rolled over in to allow you to keep track of the wheel rotation.

 

Notes: COM2000 --> Broadcast

Transmitted regularly by the stalk - all but bits 4&5 are understood, I think bit 0 is a spare for some other button.

 

IDEN 9CE SatNav
Example 9CE RA0 80005D0000821F819E00C88169022180 08E8 A Engine not running
Decode
9CE RA0 80 00 5D 00 00 82 1F 81 9E 00 C8 81 69 02 21 80 08E8 A
IDEN Read & Req ACK Unknown data bound by 0x80 Checksum ACK
Notes: Appeared after using remote to access SatNav

 

IDEN B0E Not a clue
Example B0E W00 FFAEAC580AFD9F7E4DC55DE4000000 CB74 N Engine not running
Decode
B0E W00 FF AE AC 58 0A FD 9F 7E 4D C5 5D E4 00 00 00 CB74 N
IDEN Write Unknown data Checksum No ACK
Notes: Don't know what this is, it's regularly on the bus with no engine running. Byte 9 increments 00-FF and rolls over (incrementing byte 8). Seems to be broadcast by something that's not interested in getting an ACK - this is similar to other packets that probably come from ECU via BSI?

 

IDEN E24 Vehicle Identification Number
Example E24 W00 564633384252485A463831353030303030 ???? N Engine not running
Decode
E24 W00 56 46 33 38 42 52 48 5A 46 38 31 35 30 30 30 30 30 ???? N
IDEN Write ASCII Data [VF38BRNZF81500000] (not my VIN) Checksum No ACK
Notes: BSI-->Radio/Broadcast

Regularly broadcast, once again, no ACK requested - probably from ECU via BSI

This may be part of the radio security... only run if it sees a matching VIN on the bus.?

 


Author: Graham Auld
Dated: 19th July 2009