Toyota RAV4 V (XA50) 2019+ climate control panel hacking (STM32G474RE)

An STM32 HAL example of communicating over the LIN bus with the climatronic panel.

Motivation

If you are familiar with Ford Mustang VI (S550) 2015+ instrument panel cluster hacking, you already know the drill 🙂 Engaging classrooms/labs. Hands-on training on the LIN bus communication. We need at least two nodes to play with the bus. The LIN bus has the master-slave architecture. A slave node built from scratch using a Nucleo board, a LIN transceiver, a display, a couple of push buttons plus rotary encoder knobs (to let your trainees interact with some common components of such HMIs¹), and a breadboard with a power supply would cost you around 30 EUR. For the same money you can play with a state-of-the-art control panel featuring two encoder knobs, several push buttons with LED indicators, a display, and a dimmable backlight. It's gonna be fun to turn all that stuff alive and interact with it. Using such training aids is definitely fun for me and I hope that this fun can be contagious. And you can learn a lot interacting with production devices, e.g. that complying with the standard is essential if you want the LIN device to respond to a master device we are going to build here.

How to deal with car modules that use LIN bus to communicate

Similarly to the car modules that use CAN bus to communicate, probably the most convenient way would be to get your hands on a working car and sniff the bus. If this is not the case for you, as was not the case for me with Toyota RAV4, still we have some options.

Option 1. Choose a module that has been hacked by other hobbyists. And by hacking I don't mean here any illegal activity. I mean completely legal reverse engineering done by hobbyists who enjoy e.g. adding features and extending functionality of their privately owned cars. Now you can focus on porting their projects to your favorite STM32 uC.

Option 2. LIN uses 6-bit identifiers. It is then fairly easy (not very time consuming) to trigger the response of the device such as HMI. Use a bus sniffer to catch the response and then to observe how the response changes with pressed buttons or turned knobs. Mission accomplished 😎 Beware of completely undocumented devices that have to be configured/initialized over the bus before they enter their normal mode of operation, e.g. before they start measuring a distance. The brute force method to find the proper configuration sequence would be impractical in most cases. Modules that often do not need any initialization sequence over the LIN interface and thus are ready to visibly act on commands/requests immediately after powering them up are:

• wiper actuators,
• window winders,
• automated charging flaps,
• HVAC actuators (to position the flaps of the air conditioning system),
• automatic folding side view mirrors,
• switch and rotary knob panels,
• indicator and display panels.

Why Toyota RAV4 V (XA50) climatronic panel?

Because of bitzero.tech. Thank you, Jacob Schooley ❗

Missing files?

Don't worry 🙂 Just hit Alt-K to generate /Drivers/CMCIS/ and /Drivers/STM32G4xx_HAL_Driver/ based on the .ioc file. After a couple of seconds your project will be ready for building.

Tools

Reverse engineering communication without a bus sniffer or at least a protocol decoder? Do not waste your precious time. Here are the tools I use at the home lab:

• LUC plus uCCBViewer (approx. 20 EUR),
• DSLogic Plus² plus DSView,

and the one I enjoy at the university:

• PLIN-USB plus PLIN-View Pro.

Wiring diagram

For more visit /Assets/Images/.

If you are new to the STM32 UART/LIN³ internal peripheral and the LIN protocol

• LIN Bus Explained - A Simple Intro (CSS Electronics)
• Introduction to the LIN bus (Kvaser)
• LIN Bus Simplified: The Ultimate Guide in 2024 (AutoPi)
• LIN Overview
• STM32 as the Lin Master || Configure & Send Data (ControllersTech)
• Using Lin Transceivers to communicate between master and slave (ControllersTech)
• Master – slave communication using LinBus (ControllersTech)
• LIN Bus Basics for Beginners
• LIN Specification Package Revision 2.2A

Exemplary hardware for breadboarding

• Dual LIN Click (Mikroe)
• Gravity 130 DC motor module (DFRobot)⁴

Sources and inspirations

• Hacking My Car's Climate Controls: LIN Reverse Engineering
• Hacking My Car's Climate Controls, Part 2: Building the Interceptor
• ToyotaLinInterceptor
• eCarEdu=teoria+praktyka (in Polish)

For a complete parser visit /Assets/Parser/. Thank you, Mateusz Buraczewski ❗

Issues encountered and not solved

void HAL_UARTEx_RxEventCallback(UART_HandleTypeDef *huart, uint16_t Size);

is never called if

#define RX_TX_BUFFER_SIZE 12

does not match the length of the actual response, which seems to contradict the idea of receiving to idle

HAL_UARTEx_ReceiveToIdle_DMA(&huart3, RxData, RX_TX_BUFFER_SIZE);
__HAL_DMA_DISABLE_IT(&hdma_usart3_rx, DMA_IT_HT);

My bet is that it is something related to UART configured as LIN, because an identical HAL code works perfectly fine for UART as the "regular" UART - tested on the NEO-6M-V2 GPS module.

BTW, a nice application note regarding STM32 UART DMA RX and TX is available here.

Call for action

Create your own home laboratory/workshop/garage! Get inspired by ControllersTech, DroneBot Workshop, Andreas Spiess, GreatScott!, ElectroBOOM, Phil's Lab, atomic14, That Project, Paul McWhorter, and many other professional hobbyists sharing their awesome projects and tutorials! Shout-out/kudos to all of them!

Warning

Control engineering - try this at home ❗

190+ challenges to start from: Control Engineering for Hobbyists at the Warsaw University of Technology.

Stay tuned ❗

Footnotes

1. Human-machine interface ↩

2. Any logic analyzer will do the job, even the one for 10 EUR, if compatible with a software that offers a LIN bus decoder, e.g. Logic 2, DSView or KingstVIS. The max data transfer speed allowed by the LIN standard is just 20 kBaud. ↩

3. The LIN bus uses the UART peripheral. ↩

4. The fan is here just to have more fun. ↩