8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 1/25
Hackaday
Fresh hacks every day
Home
Hackaday ProjectsOur VideosSubmit a Tip
ForumsAbout
August 31, 2014
See the Semifinalists || Learn about The Hackaday Prize
CAN Hacking: Protocols
October 29, 2013 By Eric Evenchick 39 Comments
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 2/25
We’ve gone over the basics of CAN and looked into how CAN databases work. Now we will look at a few protocols that are commonly used overCAN.
In the last article we looked at CAN databases, where each bit of a message is mapped to a specific meaning. For example, bit 1 of a CAN message
with ID 0x400 might represent whether the engine is currently running or not.
However, for more complex communications we need to use protocols. These can map many meanings to a single CAN ID by agreeing on a structure
for sending and receiving data.
OBD-II
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 3/25
The standard OBD-II connector
Next time you’re in the drivers seat, look around your left knee. You’ll find a connector like the one above. This is the OBD-II connector.
The OBD-II protocol is not CAN specific, and can be implemented over UART and PWM channels as well as CAN. OBD-II became present incars when the California Air Resources Board demanded a diagnostic protocol for all vehicles sold in California in 1991. Since it’s always done over
CAN in newer vehicles, this connector gives you access to at least one vehicle CAN bus.
OBD-II is used for reading vehicle parameters and reading fault codes. By using the various OBD-II modes, you can read parameter IDs (PIDs)
containing information about the state of the vehicle. Wikipedia has a great article on the OBD-II modes and PIDs.
There’s a wealth of information out there about OBD-II, and you can buy a tool for under 20 bucks to read fault codes and clear the pesky check
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 4/25
engine light in your car. Instead of going into detail about OBD-II, lets talk about its big brother.
Unified Diagnostic Services
While many car enthusiasts are familiar with OBD-II, many haven’t heard of Unified Diagnostic Services (UDS). This is unfortunate, since OBD-II isjust a subset of UDS. While OBD-II only allows a limited set of services, UDS is the diagnostic protocol that manufacturers and technicians use. Itprovides all the services needed for diagnostics, calibration, and flashing firmware.
UDS has various services, such as ReadDataByIdentifier and TransferData, which are identified with a one byte Service ID (SID). The first 0x0FSIDs are reserved for OBD-II. The rest are defined either by standards, or by the manufacturer. Here’s a list of the standard UDS services, and theirhex identifiers.
DiagnosticSessionControl – 10 hex
ECUReset – 11 hex
SecurityAccess – 27 hex
CommunicationControl – 28 hex
TesterPresent – 3E hex
AccessTimingParameter – 83 hex
SecuredDataTransmission – 84 hex
ControlDTCSetting – 85 hex
ResponseOnEvent – 86 hex
LinkControl – 87 hex
ReadDataByIdentifier – 22 hex
ReadMemoryByAddress – 23 hex
ReadScalingDataByIdentifier – 24 hex
ReadDataByPeriodicIdentifier – 2A hex
DynamicallyDefineDataIdentifier – 2C hex
WriteDataByIdentifier – 2E hex
WriteMemoryByAddress – 3D hex
ClearDiagnosticInformation – 14 hex
ReadDTCInformation – 19 hex
InputOutputControlByIdentifier – 2F hex
RoutineControl – 31 hex
RequestDownload – 34 hex
Follow
Follow “Hackaday”
Get every new post delivered
to your Inbox.
Join 92,220 other followers
Enter your email address
Sign me up
Pow ered by WordPress.com
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 5/25
RequestUpload – 35 hex
TransferData – 36 hex
RequestTransferExit – 37 hex
UDS uses a frame structure to send data to controllers. Single Frames (SF) are for short messages, where all the data can fit into six bytes. If the data
is longer, a FirstFrame (FF) is sent to start the transaction, then Consecutive Frames (CF) are sent with data. Here’s a layout of how the frames arestructured.
The structure of SF, FF, and CF messages
OBD-II only uses the first frame structure, but the others are useful for longer data such as a firmware download.
To get into how all the services work, you’ll need a copy of ISO 14229. Unfortunately, it’ll cost you about $250 USD just for the PDF. Tools thatcan talk UDS are very expensive. However, with this basic knowledge you can get a grasp of what’s happening on the bus.
OpenXC
While UDS is a closed protocol, researchers at Ford have been working on creating an open platform for interfacing with vehicles. The result is theOpenXC Platform. OpenXC provides a protocol to read data from Ford vehicles over CAN.
To use it, you’ll need a vehicle interface. A chipKIT can be used with Ford’s open source firmware. Alternatively, you can buy a prebuilt solution from
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 6/25
CrossChasm. Once the vehicle interface is up and running, you can access data from the Android and Python APIs. We’ve featured a few OpenXChacks on Hackaday in the past.
It’s great to see an automotive manufacturer embracing open source, and hopefully Ford continues to work on the platform. That being said, theOpenXC protocol is read only, and limited to a fairly small set of messages.
Now that we’ve heard all about protocols, it’s time to get into building CAN hardware. Next week we’ll look at what hardware you need to startusing CAN in your own projects.
CAN Hacking
IntroductionsThe In-vehicle NetworkCAN ProtocolsBuilding CAN Hardware
CAN Hacking: The In-vehicle NetworkSmart Brake lights and more with OpenXCCAN Hacking: IntroductionsCAN Hacking: The Hardware
Apple And Raspberry Pis
Filed Under: Featured, Network Hacks Tagged With: automotive, CAN, CAN Hacking, ford, obd-ii, OpenXC, unified diagnosticservices
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 7/25
Comments
1. icanhazadd says:October 29, 2013 at 10:23 am
You forgot the break.
Reply Report commentSteveo says:
October 29, 2013 at 11:01 am
Give him a break
Reply Report commenticanhazadd says:October 29, 2013 at 3:57 pm
You toucha my comment I breaka your face!
Reply Report commentAnybodysguess says:October 29, 2013 at 6:30 pm
Ya, somebody needs to talk to this guy about using breaks.I don’t read every HaD article that is written, so I like the breaks, I only read what interests me.
Reply Report comment2. Q says:
October 29, 2013 at 10:30 am
Howdy. Great articles, some friends and I have been working on CAN hardware for a while now, located here:http://goodfet.sourceforge.net/hardware/goodthopter12/ – get ahold of me @theqlabs if you would like some free boards. Cheers.
Reply Report commentmatt says:October 30, 2013 at 12:51 am
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 8/25
Wow, free boards to “students, the unemployed, and the funemployed”. As someone who has been unemployed for a while kudos toyou.
Reply Report commentasdf says:November 1, 2013 at 1:39 pm
I swear, these goodfet guys are the only reason the msp430 is still around. Either way, kudos! Btw you sent me boards and I sent you ahand drawn postcard.
Reply Report comment3. draeath says:
October 29, 2013 at 10:40 am
There’s just something about ISO charging money for standards documents that ignites, well, all of my hatred.
Reply Report comment
Rick says:October 29, 2013 at 11:32 am
Charging money for data is so 20th century…
Reply Report commentka1axy says:
October 29, 2013 at 12:02 pm
Apparently, others feel the same way. Google is their friend, as well as yours…
Reply Report comment
treymd says:October 29, 2013 at 1:43 pm
By that you mean google is ISO’s friend I am sure. Lots of DMCA takedowns are the result of a search for 14229.
Reply Report commentflndr says:
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 9/25
October 29, 2013 at 6:35 pm
filetype:pdf is your Google friend.
It’s certainly more useful than my employer’s internal document library.
Reply Report comment
4. Tyler Cox says:October 29, 2013 at 10:47 am
I really cannot wait to find out more about this. I would love to create mods for my camaro.
Reply Report comment5. mike says:
October 29, 2013 at 11:15 am
i love this. please keep them coming!!!
Reply Report comment
6. Schwarz_Oa says:October 29, 2013 at 11:26 am
Hello Eric Evenchick, that is a nice research.
I would like to help you a little bit, actually I work with those CAN buses.
Reply Report comment
Shawn N says:October 29, 2013 at 4:15 pm
Schwarz_Oa,
What systems do you work with?
As far as the Medium-Speed CAN bus goes, Ford is only releasing binary firmware which only includes a subset of translations, and
they don’t actually release what the message IDs are.
I will post up a spread sheet of what I have so far as well as my OpenXC implementation of the JSON signals file.
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 10/25
I am planning on replacing my center console with an Android tablet, the next thing I need to do is sniff the Heat/AC controls so I can
write that into my andoid app as well.
Reply Report comment
7. Shawn N says:
October 29, 2013 at 12:03 pm
Ah somebody always beats me to Hackaday, but here what I’ve been up to:
Reply Report comment
Eric Evenchick says:October 29, 2013 at 3:57 pm
Awesome, shoot us a tip on that if you have some code or docs to share. Thanks!
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 11/25
Reply Report comment8. ee says:
October 29, 2013 at 1:08 pm
It should be noted that while OBD-II was not mandatory until 1996. Some 1995 and earlier model year vehicles have it, but not many. Prior toOBD-II, OBD (the original specification) did not require a generic connector, forcing shops to get expensive vehicle-specific diagnostic tools.
Much like the requirements for manufactures to not void vehicle warranties when after-market parts were used, OBD-II was partially ratified toallow independent shops to more easily diagnose emission-related problems, without paying exorbitant amounts for tools
Reply Report comment
John says:October 29, 2013 at 3:29 pm
On the other hand, some OBD-I implementations didn’t require a scanner at all and were able to signal faults using a led to flash outcode numbers.
Reply Report comment
J Merton says:October 30, 2013 at 3:43 am
Snap On scanners come with a set of plug adaptors for the older cars. Check eBay & Amazon for a used one
Reply Report comment
9. Cain W Benjamin (@Krazeecain) says:
October 29, 2013 at 1:17 pm
Ford just earned some serious respect from me. The expense of some of these OBD-II tools completely blew my mind, largely contributing to
my hatred of computers in cars (despite my love of computers in general!) I’m very glad somebody is working to change this a bit, and hopeother car makers follow suit.
Reply Report comment
10. David Anders says:October 29, 2013 at 3:36 pm
eric,
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 12/25
any chance of you copying all this content over the elinux.org wiki pages? this info would be a fantastic addition to the pages! (elinux.org issponsored by the Linux Foundation btw)
Reply Report commentEric Evenchick says:
October 29, 2013 at 4:00 pm
David,
I’d certainly like to add it to eLinux. The info there has saved me many times. Let me check with our not-so-evil overlords about this
though.
Reply Report commentDavid Anders says:
October 29, 2013 at 4:01 pm
Dandy!
Reply Report comment
11. drwho8 (@drwho8) says:October 29, 2013 at 3:45 pm
Oddly enough, take a look at the specifications behind MIL-STD-1553. It’s in much the same shape as the OBD families of methods of accessto vehicles (ground). Typically that one is found in military aircraft, although the Space Shuttle used it……..
Reply Report comment
12. Phillip Birmingham (Killbilly) says:October 30, 2013 at 8:35 am
“OBD-II only uses the first frame structure”
Does this mean “the structure labeled ‘First Frame'” or does it mean “the first in the list of three frame structures I just described?”
Reply Report comment
flndr says:October 30, 2013 at 4:11 pm
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 13/25
I’m not an expert on what subset of the standards ODB-II supports, but if it used the first frame (FF), it would also the consecutive
frame (CF) (because if the data could fit in a single frame, it would use the single frame format).
What the article doesn’t show is the 4th kind of frame, the flow control frame (FC). After the FF is sent, the receiver sends the FC frameto let the sender know if and how it should send the remaining consecutive frames.
You can find more info on this on Wikipedia under ISO-15765 if you don’t have access to the actual standards.
Reply Report comment
13. pcf11 says:
October 30, 2013 at 12:50 pm
I looked under the dash of my 1966 Volvo P1800S and I didn’t find one of these. Life is good!
Reply Report comment14. Yo says:
October 30, 2013 at 2:15 pm
Did anybody try this CAN logging software?http://rbei-etas.github.io/busmaster/
Reply Report commentJ Merton says:
October 30, 2013 at 2:41 pm
Poke around the pages. It requires special hardware.https://github.com/rbei-etas/busmaster
Reply Report commentJ Merton says:
October 30, 2013 at 2:43 pm
Note this is not the same link as above.
Reply Report comment
15. charliex says:
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 14/25
October 31, 2013 at 11:26 am
Here’s some of my CAN hacks from 2005+ onwards.
Real time tracing and changing of internal ecu tables while tuning
watching various internal ECU parameters ( showing a steady idle in this case)
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 15/25
I’d been developing a new gui back then, never finished it ( uses canned data for the test, but it normally reads it all off the CAN bus)
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 16/25
I wote the app to tie into multiple ecu types just via a DLL.
bouncy videos.
Reply Report comment
charliex says:October 31, 2013 at 11:29 am
(the video doesn’t come over the can bus, that’s a sample video from the smartycam/aim which it tied into.
linked the wrong one, put google earth into it too.
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 17/25
Reply Report comment
16. Blufires says:October 31, 2013 at 8:02 pm
My car’s VAN bus makes me sad every time I read one of these. The standards are so similar but I can’t find a single project about interfacing
with it.
Reply Report comment
17. EcoCAR2 says:November 3, 2013 at 10:47 am
What’s up EcoCAR2 – Waterloo?
Reply Report comment
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 18/25
18. Eric Fossum says:November 5, 2013 at 1:30 pm
Has anyone had luck with BMW interfacing? I have a ’95 E34 and a ’12 R1200R I’d love to talk to.
Reply Report comment
SamH says:November 12, 2013 at 10:12 pm
I also would like to know if anyone has done this on a pre ODBII. i have a 95 E36 I want to put a carputer in.
Reply Report comment19. Johnd558 says:
August 3, 2014 at 9:39 pm
if making snowfall leaps Hermes purses And totes operating 3ounce throwaway duplicate Hermes cups of coffee or even a conforms icle, pourthe juices a mixture on the road to these kind of people until it is they have been perfect possessions wall plug ecommerce better than nearly full.ecckabbkefkc
Reply Report comment
Leave a Reply
Enter your comment here...
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 19/25
Never Miss a Hack
Search
Search this website … Search
Categories
Select Category
In case you missed it
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 20/25
The Inaugural Hackaday.io Meetup
5 Comments
DEFCON: Blackphone
35 Comments
[Bil's] Quest for a Lost Finger: Episode I
86 Comments
50 Semifinalists Selected for Next Stage of The Hackaday Prize
151 Comments
Fear and Loathing at DEFCON 22
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 21/25
11 Comments
More Posts from this Category
Our Columns
Hacklet #13 – Chopper Royalty
6 Comments
Droning On: Maiden Flights
4 Comments
Retrotechtacular: Turn On the Magic of Colored Light
12 Comments
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 22/25
Ask Hackaday: Can Paper USB Business Cards Exist?
70 Comments
Hacklet #12 – Last Minute Hackaday Prize Submissions
10 Comments
More Posts from this Category
Recent comments
metai on Purely Mechanical Display Uses 804 Balls To Create a Kinetic Display
Eirinn on Homemade Triple Monitor Mount Looks Professionally MadeDainBramage1991 on Green Light Your Commute with America’s Unsecured Traffic LightsMike Schaale on Jeep Wrangler gets pressurized water right out of the bumper
ANON on Custom Racing Chair with a Kinect and Haptic FeedbackMichael on Green Light Your Commute with America’s Unsecured Traffic LightsPaul on Green Light Your Commute with America’s Unsecured Traffic Lightsgregkennedy on Rapid Fire Mod For A Wireless Mouse
Tony on Proximity Sensing LEDs Can Add a New Dynamic To Your ProjectsTony on Proximity Sensing LEDs Can Add a New Dynamic To Your Projects
Find Hacks by Date
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 23/25
October 2013
S M T W T F S
« Sep Nov »
1 2 3 4 5
6 7 8 9 10 11 12
13 14 15 16 17 18 19
20 21 22 23 24 25 26
27 28 29 30 31
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 24/25
Return to top of page
Copyright © 2014 · Genesis Framework · WordPress · Log in
8/31/2014 CAN Hacking: Protocols
http://hackaday.com/2013/10/29/can-hacking-protocols/ 25/25
Hackaday, Hack A Day, and the Skull and Wrenches Logo are Trademarks of Hackaday.com
Our Policies·Powered by WordPress.com VIP
Top Related