BMWignition: remote start - Page 1
Forum section: electronics / projects

author: P1X3
author_rank: Contributor
timestamp: September 04, 2014, 06:00:58 pm
content: This is a project I have been working on for quite a while, and went through couple prototypes. However, this is probably one of the better prototypes, which would hopefully make it the final.TL;DR; This "module" of mine replaces physical standard ignition switch that is installed in a car, and takes control of vehicle's ignition state (off, accessories, ignition, starter turn). Also it is connected to vehicles LIN, which is used for locking/unlocking doors, but is not limited to that.Some pictures of board with controller.Demo video.What is not pictured is a board with 1k resistor connected to the base of 2N2222, whose emitter is grounded and collector is connected to relay's 85 pin. I did add diode between 85 and 86 as suggested by some to extend relay's life, which is 50A automotive relay.I have made an android app that connects to arduino via bluetooth (HC-06) and sends bit-masked byte commands. Making the app was a learning experience of it's own. Started with a simple activity containing couple buttons, and ended-up with a service and a custom widget. Arduino code is pretty straight forward.Almost up to date sources are on my github:https://github.com/P1X3/BMWignitionIn the future I would love to get a custom PCB instead of perfboard, but sadly that won't be happening anytime soon.Thanks to everyone who helped me out with MCP2025 overheating issues. Questions and feedback are welcomed.

author: wraper
author_rank: Unknown
timestamp: September 04, 2014, 06:17:07 pm
content: Need to note that such devices were popular in former Soviet countries a while ago. They often used to start a car in the morning to heat up before owner drives to his job (very cold weather in the winter). Very serious problem was that if gearbox is left in not neutral position, car drives by itself to the nearest obstaclebecause starter usually have enough power to do that. What I want to say is that such things posses a real danger, so must be done very carefully.

author: Marco
author_rank: Super Contributor
timestamp: September 04, 2014, 06:24:56 pm
content: Quote from: wraper on September 04, 2014, 06:17:07 pmSeems to be a bit of a conundrum. If you park your car for really cold weather you want no parking break and keep it in first gear. If you park your car for remote start you want to put it on parking break and keep it in neutral. I don't see much overlap ... remote start seems only useful for starting the AC in hot weather.

author: P1X3
author_rank: Contributor
timestamp: September 04, 2014, 06:34:31 pm
content: Quote from: wraper on September 04, 2014, 06:17:07 pmThat is one of the biggest concerns and fears, leaving car in a gear and trying to start it. My dad has a habit of leaving car in gear, and I can see why it would be a good idea, however, I don't have that habit. I am kinda curious how far starter could pull the car with e-brake.Quote from: Marco on September 04, 2014, 06:24:56 pmThat is one of the advantages, especially considering that AC can be controlled via arduino, so for cold mornings heater can be turned on and during hot days ac will be on.

author: SeanB
author_rank: Super Contributor
timestamp: September 04, 2014, 06:39:29 pm
content: Simplest is an interlock to detect that the vehicle is in neutral. Auto transmission has that built in in the form of the starter interlock, and it can be added to a manual transmission with a little work on the linkages to detect the mid position of the levers.Remote start generally can also be combined with remote stop, which is good for those with turbo vehicles where you want the engine to idle for 5 minutes after running to allow the turbo to cool down and run down to idle with cooling and lubrication present.Generally the starter motor can move the vehicle in first gear even if the park brake is on, and if the engine starts as well you can drive into the first obstacle at quite a speed as the ECU will be trying to get the engine to fast idle during start, and will overfuel and overshoot the fast idle speed for a period while it tries to regulate.

author: P1X3
author_rank: Contributor
timestamp: September 04, 2014, 06:54:48 pm
content: While staying on topic, here is a question.As I mentioned in OP, I am using 50A automotive SPST relays to send power to different terminals via arduino. For the final product I wanted a PCB that would host microcontroller and relays.I have found spst sockets for pcb, but I have concerns about passing 50A@12V through PCB as well as possible interference with microcontroller. Perhaps having 1K resistor and 2N2222 for relays on same board as microcontroller, but have relays somewhere else in non-pcb socket.

author: SeanB
author_rank: Super Contributor
timestamp: September 04, 2014, 07:14:18 pm
content: Most automotive relays have 1/4in or 10mm faston connections for the power side, so you can just use the appropriate 1/4in or 10mm push on connections for high current connectors. coil connections can be lighter gauge wire though.

author: zapta
author_rank: Super Contributor
timestamp: September 04, 2014, 07:28:31 pm
content: Very nice project. Hopefully it's also safe ;-)How do you interface with the LIN bus? Read only? Do you also inject signals (e.g. emulating window button press)?BTW, my car (not a BMW) has multiple LIN bus segments, each with its own set of slaves. I need to tap in different places to get access to different signals.

author: P1X3
author_rank: Contributor
timestamp: September 04, 2014, 08:37:51 pm
content: Quote from: zapta on September 04, 2014, 07:28:31 pmThis has been in a car for almost a year with almost no issues. This is third prototype without LIN controller.I am using MCP2025 transreceiver to send and receive data. The bus in my car is single wire 9600kbits 8E1. There are actually two of those (K&I) but messages are routed through the master (instrument cluster).So in my case I can tap into either bus. Luckily the only other bus in the car is CAN, but I have no interest in it.Yes, I can inject signals to control windows, lights, locks, etc, but car seems those messages as a toggle from diagnostics.

author: Wilksey
author_rank: Super Contributor
timestamp: September 04, 2014, 08:56:54 pm
content: Nice project!I have a 2008 BMW 120 which has push button start, you have to press the clutch in before it will start, I think that's it's safety mechanism! lolWhat did you do just out of interest, to bypass the immobiliser? Alarm companies use these "magic" boxes, which work as a bypass for factory and they then rely o their own immobiliser to kill the ignition etc.

author: Andreas
author_rank: Super Contributor
timestamp: September 04, 2014, 09:10:02 pm
content: Quote from: Wilksey on September 04, 2014, 08:56:54 pmThats for shure not the only mechanism.All systems against unintended movement have to be redundant.You need (at minimum)- 2 independant clutch sensors which are used for plausibility check against each other. (error lamp on switches not plausible)- a fail safe ECU either 2 processors or a intelligent challenge response watchdog with full monitoring of hardware.With best regardsAndreas

author: P1X3
author_rank: Contributor
timestamp: September 04, 2014, 09:24:00 pm
content: Quote from: Wilksey on September 04, 2014, 08:56:54 pmEdit: I am very jealous of your 1 series, especially if it is a hatchback. We don't get those in USWell, my BMW is 2002 so electronics aren't as advanced. In my case clutch sensor is simple 12V switch, so it was easy to simulate that. I actually hooked it up with starter relay so clutch press is being simulated only when starter relay is active. I was going to wire it to 12V directly, but that wouldn't be too good.Immobilizer has a direct communication line with ECU, which enables fuel&injection system when correct rolling code is received. Second arduino is taking care of that when it receives an okay from arduino in pictures. This way I can still use a key for immo to read it and authorize engine start in case of second arduino failing. When I come to think of it, I might have to make another prototype just to get rid of second arduino.

author: Niklas
author_rank: Frequent Contributor
timestamp: September 05, 2014, 06:16:26 am
content: Have you tested the behaviour of the power supply with low input voltage and low temperature? The battery voltage can dip significantly when the starter motor is running and cause problems like reset. A typical figure is 8 V for passenger cars and down to 6 V on trucks with a 12 V system. There is also a bunch of pulses that an automotive power supply must sustain without any impact on the functionality. Filtering and a local energy buffer capacitor would not be a bad idea to add.Is there a periodic communication on the LIN bus, some sort of watchdog functionality, or is it just On and Off messages? Just thinking of the consequences of a microcontroller reset when you are driving the car. GM and their ignition switch problem...

author: Andreas
author_rank: Super Contributor
timestamp: September 05, 2014, 09:16:49 am
content: Quote from: Niklas on September 05, 2014, 06:16:26 amHello,In modern cars (with start stop) the starter usually has to be functional down to 4V.With best regardsAndreas

author: Wilksey
author_rank: Super Contributor
timestamp: September 05, 2014, 11:42:15 am
content: Hi P1X3,Yes, it is a hatchback, in fact, here in the UK, the convertible is now known as the 2 series!The 3 series coup is the 4 series, gets confusing!I assume the immobiliser on later models are more advanced, though I did see a video of someone stealing a BMW within 3 seconds with a box that plugs into the OBD2 port, so it must not be *that* advanced! lol.So, you have a second Arduino communicating with the ECU feeding it codes? Is that correct?My only concern (as with remote starters in general) would be have I left it in gear! Not so bad on an automatic, but there is a hell of a jerk on the car if you do have it in gear when you are stationary and you let the clutch out, so I assume the same is true if you start it without the clutch safety switch?

author: P1X3
author_rank: Contributor
timestamp: September 06, 2014, 04:39:55 am
content: Quote from: Niklas on September 05, 2014, 06:16:26 amI had exactly same power supply converting for previous setup with only exception that it was 5V instead of 9V. As mentioned in post above, it has worked through summer and winder in Portland, US. The only problem is starting with almost dead battery. Basically there is enough juice in the battery to turn the engine, but voltage drop interfered with voltage converter. Happened only once when battery was almost dead, however I did used to have external power supply jack for arduino, so I could supply additional voltage from usb (phone, power bank) or even 9V battery.For some reason I didn't think of add it to current setup.In case of microcontroller reset, which too happened once in parking lot, car will shutdown. There is no side-effects to the car systems since it sees it is a regular shutdown. I would definitely love to have some sort of toggle relay or system to make sure car doesn't shutdown completely when micro-controller resets. For the time being, and your post actually gave me this idea, is to keep vehicle state in arduino's EEPROM and in case of reset vehicle's state will recover. Still, not a perfect solution, but assuming there was a reset, car will restart within startup time. But yes, messages are on and off. I would very much appreciate suggestions in regards this issues.LIN bus is simple single wire serial and it follows one of the ISO standards. There was a PDF with details somewhere, but I can't seem to find it.I might have made it confusing, but relays for sending power to vehicle terminals (acc, ign, starter) were not there. Those were added and connected in a way to send power to terminals and let arduino control it.Original ignition switch had two power wires (from battery or distribution block) and three terminal wires. Accesories and Ignition wires go from ignition switch to fuse box directly. Therefore, all power for controlled terminals comes through relays.Quote from: Wilksey on September 05, 2014, 11:42:15 amDamn, I just had the feeling that it was a hatchback. The closes hatchback we can get is probably Z3 Coupe (hatchback), but there are only so many of them in US.Yes, second arduino is dedicated for sending okay signal for ECU to enable fuel delivery and ignition. Surprisingly hooking up to ECU-IMMO communication was the easiest, and I had it ready a long while but was put in use with the current setup.

author: zapta
author_rank: Super Contributor
timestamp: September 06, 2014, 04:55:01 am
content: Quote from: P1X3 on September 04, 2014, 08:37:51 pmCan you explain how you inject signals to the Lin bus?If the stock button box responses to the frame id with its button status, how do you override it without a bus collision?

author: miguelvp
author_rank: Super Contributor
timestamp: September 06, 2014, 04:57:20 am
content: FWIW remote starters are extreemly popular in Chiberia (Chicago's last winter), actually any year in winter it was just worst this one.

author: P1X3
author_rank: Contributor
timestamp: September 06, 2014, 04:10:24 pm
content: Quote from: zapta on September 06, 2014, 04:55:01 amOkay, so messages on the bus have a structure. [Source device]    [Xor checksum]I am not the first one to inject signals to the bus and was able to find a list of devices and messages.https://docs.google.com/spreadsheets/d/1E8QdvsFi-PzDaTaVIeOEPyEFCfaLfX5H-UKAZf4vcoU/edit?usp=sharingCode:{0x3F, 0x05, 0x00, 0x0C, 0x03, 0x01, 0x34}Above is command to toggle door locks. 0x3F is source device and in this case it is diagnostics. 0x05 is length of the message after this length byte. 0x00 is destination device, which is global broadcast. 0x0C 0x03 0x01 is the payload telling receiving module what to do. Lastly 0x34 is checksum.Arduino sends this command to the bus as following:Code:byte UNLOCKMSG = {0x3F, 0x05, 0x00, 0x0C, 0x03, 0x01, 0x34};void handleCentralLocking(byte data){boolean lock = (data & (1 << 0)) != 0;digitalWrite(KBUS_WAKE, HIGH);delay(100);KBUS.write(UNLOCKMSG, 7);delay(100);digitalWrite(KBUS_WAKE, LOW);}I am a bit lazy with C++ and didn't bother to change this yet. Arduino is communicating with the bus through transreceiver MCP2025, which has CS/LWAKE pin that needs to be pulled high by microcontroller before transmitting data. LIN bus itself is always pulled high by the master (instrument cluster), and any device that want to talk on the bust must pull down and transmit data, which is exactly what transreceiving is doing.Every device on the bus receives the message, and is handled only by those that can handle it. There is no trust relationship and receiving device can not verify if message received was sent by the device itself or someone else.Also since there is a list of known devices, I can add my own device to the bus without collision with already existing device. This is how communication between two arduinos over bus is done. When other modules receive that message they just ignore it.

author: zapta
author_rank: Super Contributor
timestamp: September 06, 2014, 05:23:19 pm
content: Quote from: P1X3 on September 06, 2014, 04:10:24 pmThis looks like I-BUS, not LIN bus. LIN bus frames does not have source/destination bytes and the payload size is 2, 4 or 8 bytes (your spreadsheet have a few odd lengths). LIN bus also use a frame start marker (a long break which cannot be generated by a simple UART write) and sync byte (0x55) . Also, the checksum function is more complex than a simple XOR and frame header is self checksum'ed so slaves can verity the request from the master before appending their data to the frame.http://en.wikipedia.org/wiki/Local_Interconnect_NetworkIn a LIN bus the master always queries one slave at a time, the matching slave responses and everybody on the bus can read the response. The master cannot send data but the box of the master can contain also slaves which it can queries. If you want to inject signal for an existing slave you need to modify the bits it sends to the bus. Simply attaching an injector the bus and having it injecting signal causes a bus conflict with the real slave.This has a good description of the I-BUS protocol you are usinghttp://web.archive.org/web/20041204074622/www.openbmw.org/bus/BTW, I am using this OSHW LIN bus injector in my car to inject a Sport Mode button press whenever the ignition is turned on. It also look for certain button sequences to enable/disable that feature.http://hackaday.com/2014/04/19/a-lin-bus-signal-injector/

author: P1X3
author_rank: Contributor
timestamp: September 06, 2014, 05:39:08 pm
content: Quote from: zapta on September 06, 2014, 05:23:19 pmCorrect. I just keep referring to it as LIN bus for whatever reason. Perhaps it is a revision of LIN.Anyhow, this is where I got the LIN fromhttp://web.comhem.se/mulle2/IBUSInsideDRAFTREV5.pdf

author: Wilksey
author_rank: Super Contributor
timestamp: September 08, 2014, 11:54:54 am
content: Just out of curiosity,Is this the same as K and L (ISO9141 / ISO14230) on a standard automotive OBD2 interface?I am not sure what mine uses, I guess CAN bus.

author: aqibi2000
author_rank: Regular Contributor
timestamp: November 30, 2020, 05:36:33 am
content: Please people do not do this!Driving at 70mph and you get a master clear reset the car WILL turn off and you may not be able to prevent an accident and your airbags WILL be off since you’re not in ignition/engine running.Heck with EPAS you won’t even be able to steer since you won’t be in the right power mode

author: vk6zgo
author_rank: Super Contributor
timestamp: November 30, 2020, 06:19:52 am
content: The whole ideal of remote start freaks me out.They are also pushing them in Oz, where only in a few places does it consistently get that cold that a warmup is justified, & even with the hottest Summer days, the aircond will reduce the interior temp in about 5 minutes.The thought of having your car running without you being present raises the spectre of the "bogeyman" stealing a conveniently already running vehicle.Even the silly "start buttons" in the car are a leap backwards-----high tech my backside, cruddy pushbuttons are much cheaper than ignition key operated switches!And, by the way, "Get off my lawn!"

author: mikerj
author_rank: Super Contributor
timestamp: November 30, 2020, 01:01:30 pm
content: Quote from: aqibi2000 on November 30, 2020, 05:36:33 amYou will be able to steer unless a steering lock engages, but it will be heavy. However the thread is six years old, so I suspect your warning may be a bit late

author: vk6zgo
author_rank: Super Contributor
timestamp: November 30, 2020, 03:08:34 pm
content: Quote from: mikerj on November 30, 2020, 01:01:30 pmOops!