Can Bus specifications

The official (I think) CANBUS specification can be found at CIA, that stands for Can In Automation. There are both base and extended protocol. They seems to be very clear and intuitive and I think they will be very helpful as soon as we start coding some CAN sniffer or similar. I have to start thinking about how big the sniffed data will be and where to store that so that we can study it easily. Maybe the only choice for this is a database (for which I guess mysql would do pretty well).
We'll see soon. Coding time is approaching!

Great Can Bus hacked page on a Saab

I have found this really interesting page here. It is from a guy who reverse engineered the instrument bus on a Saab. This bus is called I-bus and is based on CAN bus. He gives a lot of information on how he did it, starting from locating the connector, attaching to the bus and interfacing with the PC, along with the tools he used.
It is very similar to what we would like to do and thus we can get lots of advices from it. There are important differences though. He bought ready-to-use CANBUS connectors while we are trying to do it by ourselves. Well actually he says that he tried to do it himself but could not make it work so he switched to commercial products, but he does not give much information on how he tried and what did not work.
The other big difference is that as he is using commercial products, he also has access to programs on Windows platform that can decode bus messages and help during reverse engineering. We won't have these programs because of our do-it-yourself choice and also because we plan to use Linux to get access to the bus by using a serial interface. This is clearly much harder to do but I hope it is not so hard that we will eventually be forced to switch to commercial products.
We will also have to develop our own programs on the Linux platform, but this should not be a big problem. We have to look around for already existing projects to see if we can reuse some code.

This page also gives us a real example of what the message on CANBUS looks like and how they are used by the car. He also explains how the information is spread on multiple messages as for the case of the radio display. Definitely an helpful page!

Can Bus Topology in the Vectra

I have found a very interesting document here: it is about the testing architecture developed at Opel for the Vectra. They call it Hardware-in-the-loop (HIL) simulation. Basically, due to the increasing number of ECU (Electronic Control Unit), they say that testing has become very difficult and thus they developed a new test methodology based on the dSpace product that gives the possibility to do automated testing of the components interaction and to reliably reproduce the failing tests.
Pretty interesting stuff but how does this relate to our adventure? It does because the document gives also some information about the can bus of the Vectra and has a picture of its topology. There are three busses in the car: low-speed, mid-speed and high-speed. This is the list of the ECUs for each bus:

• High-speed: Steering column integrated module, Yaw rate sensor, Electronic stability program, electro-hydraulic power steering, Automatic headlamp control, Automatic transmission control, Engine ECU

• Low-speed: Steering column integrated module, Body control module, Driver door module, Instrument panel cluster, Rear electronics central module, Shift lever module, Displays, Auxiliary heater, Passenger door module, Driver seat module, Parking assistant, Airbag, Sun roof module, Underhood electronics, Display module

• Mid-speed: Display module, Audio system, Car phone, CD changer, Electronic climate control, Global Positioning System, Navigation control unit, Telematics system

From this picture and list, we can deduce that two modules are acting as gateways between the different busses. They are the Display Module and Steering column integrated module. What they are exactly and what is their function, we don't know yet. I start now to wonder to which bus the can bus pins on the EOBD connector are attached. We will need more information on this and probably also to measure the speed of the canbus we have access to.

About CAN BUS

Here I have found a good introduction to the CAN bus.
It is a link level protocol, similar to ethernet, with CDMA (Collision Detect, Multiple Access) policy.
Every CAN bus peripheral can receive and send data on the same bus and has the capabilities to recognize where someone else is using the bus at the same time. A priority mechanism ensures that in this case only one transmission is completed.
Unlike ethernet, this protocol is content oriented, that means the each message does not have destination and source fields, but just an identifier that specifies the meaning of the data associated to the message. The meaning of the identifier is not specified in this standard as it is choosen by higher level applications.

Each message consists of an identifier, some flags and crc and the payload.
The identifier is 11bit wide in CAN bus version 2.0A and 29bits wide in version 2.0B

There are four different message types:

• Data frame: a frame containing node data for transmission
• Remote frame: a frame requesting the transmission of a specific identifier
• Error frame: a frame transmitted by any node detecting an error
• Overload frame: a frame to inject a delay between data and/or remote frames

The arbitration on the bus is based on the identifier. As the bus is AND wired, each time two components send a signal on the bus, the result on the bus is the logical AND between the two signals. This means that when collision happen, only one of the identifiers of the messages gets trasmitted to the bus (the one with most zeros); the transmitter can simultaneously read what is on the bus and if the identifier coincides they proceed to transmit the complete message.

This info on Wikipedia will probably be very useful to get data structures written in C or any other language I might choose for this adventure.

Getting the tools: part 1

After some time spent to think of what tools we need in this adventure, now the heart of the project has arrived:

This beauty is a PIC 18F4682 from Microchip. Among many other features, it spots:

• Enhanced CAN controller on board ( CAN version 2.0B up to 1Mbps)
• 1 EUSART ( for RS232 )
• 10 MIPS @ 40Mhz

This is another voyeuristic closeup of the microcontroller:
The microcontroller will be our interface to CAN bus, where we will try to listen communications on the bus and to talk with the other peripherals. It is not possible to interface directly a PC for electric problems (signals are transmitted on the bus by differential voltage) and protocol reasons (need of a dedicated hardware to understand message on the lines that normal PC doesn't have on board). Unfortunately this is not the only device that we need for the project. More has to come.

Stay tuned!

EOBD Connector Pin Layout

According to the info found on this page this should be the pin layout for the EOBD connector:

Pin 1 - Ignition positive
Pin 2 -
Pin 3 - Data Tacho / MUX network Late generation
Pin 4 - Chassis ground
Pin 5 - Chassis ground
Pin 6 - Data Climate control/CAN High ('IS' Late generation)
Pin 7 - K Line Data Engine management / Automatic gearbox management
Pin 8 - Cooling fan control information / MUX network Late generation
Pin 9 - Charge information
Pin 10 -
Pin 11 - Data BSI
Pin 12 - K Line Data ABS/ESP/GEP/Suspension control
Pin 13 - Data Air Bag/Headlight control
Pin 14 - CAN Low('IS'.. Late generation)
Pin 15 - Data Engine management
Pin 16 - Battery positive

The OPEL/Vauxhall Vectra should use the CAN BUS to exchange information between the various components. I wonder how the pin are placed on the actual connector, since it seems a bit different. We will have to attach probably to pins 6 and 14 to get access to the bus.

EOBD Connector Location

As I promised, here is the photo of the exact location of the connector on the Vectra. It is very easy accessible and I hope it will provide a very easy access to the car bus system.

EOBD on board diagnostic connector on the Vectra

Seems like my 2002 Vauxhall/OPEL Vectra supports the EOBD connector. I have found it near the gear shift lever and I'm now pretty sure about it thanks to this image:

found with Google Images. I'll post a picture of the exact location as soon as I can download photos from my mobile or get a decent camera.
This connector should provide access to all the internal diagnostic informations from the car like tire pressure, engine parameters, temperatures and more.
I have found some more info on it on Wikipedia. Seems like it's a standard for European vehicles since 2001 and should also include the CANBUS interface I'm interested in.
Now that I think about it, it should also be present on the other Vauxhall our family owns. I have to check this sooner or later!