You are on page 1of 23

8/31/2014 CAN Hacking: The Hardware 1/23
Fresh hacks every day
Hackaday Projects
Our Videos
Submit a Tip
August 31, 2014
See the Semifinalists || Learn about The Hackaday Prize
CAN Hacking: The Hardware
November 5, 2013 By Eric Evenchick 33 Comments
8/31/2014 CAN Hacking: The Hardware 2/23
So far we have discussed the basics of CAN, in-vehicle networks, and protocols used over CAN. Were going to wrap up with a discussion of CAN
tools, and parts to build your own CAN hardware.
Unfortunately, theres no set standard for CAN connections. The most common connector for high-speed CAN is a DE-9, with CAN high on pin 7
and CAN low on pin 2. However cables will differ, and many are incompatible.
CAN needs to be terminated, preferably by a 120 ohm resistance on either end of the bus. In practice, you can stick a single 120 ohm resistor across
the bus to deal with termination.
Follow Hackaday
Get every new post delivered
to your Inbox.
Join 92,220 other followers
Enter your email address
Sign me up
Powered by
8/31/2014 CAN Hacking: The Hardware 3/23
A good CAN tool will let you transmit and receive CAN messages, interpret live data using CAN databases, and talk CAN protocols. The tools with
this feature set are proprietary and expensive, but some hacker friendly options exist.
Based on [Travis Goodspeed's] GoodFET, the GoodThopter by [Q] uses the Microchip MCP2515 CAN to SPI controller to access the bus. The
open hardware tool lets you send and receive messages using Python scripts.
CAN Bus Triple
8/31/2014 CAN Hacking: The Hardware 4/23
The CAN Bus Triple device provides an interface to three CAN buses, and can be programmed in an environment similar to Arduino. The open
source code provided lets you muck with the second generation Mazda 3. Unfortunately, the hardware does not appear to be open source.
Saleae Logic
8/31/2014 CAN Hacking: The Hardware 5/23
Its not open source, but the Saleae Logic is a very handy and cheap tool for looking at CAN buses. It can capture, decode, and display CAN traffic.
This is most useful when youre building your own CAN hardware.
The Parts
If you want to design your own hardware for CAN, youll need two things: a CAN controller, and a CAN transceiver.
The CAN controller generates and interprets CAN messages. Theres many microcontrollers on the market with built-in CAN controllers, such as the
Atmel ATmega32M1, Freescale S08D, and the TI Tiva C Series. When using a built-in CAN controller, youll have to use an external oscillator,
internal oscillators are not sufficiently accurate for high-speed CAN. If you want to add CAN to an existing microcontroller, the MCP2515 is an
option. Its a standalone CAN controller that communicates over SPI.
8/31/2014 CAN Hacking: The Hardware 6/23
The transceiver translates signals from the controller to the bus, and from the bus to the transceiver. Different transceivers are needed for high-speed
and low-speed CAN networks. The NXP TJA1050 works with high-speed buses, and the ON Semi NCV7356 works with low-speed, single wire
Dev Boards
Theres a ton of development boards out there featuring microcontrollers with a CAN controller. The Arduino Dues SAM3 processor has a
controller, but theres no transceiver on the board. You can pick up a CAN bus shield, and the Due CAN Library to get started.
The ChipKIT Max32 is similar to the Due. It has two CAN controllers, but youll need to provide external transceivers to actually get on a bus.
Fortunately theres a shield for that. The ChipKIT is officially supported by Fords OpenXC Platform, so you can grab their firmware.
That concludes our discussion of CAN Hacking. Hopefully youre now ready to go out and experiment with the protocol. If you have questions, send
them along to our tip line with CAN Hacking in the subject, and well compile some answers. If you liked this series and want to suggest a topic for
the next set of posts wed love to hear that as well!
CAN Hacking
The In-vehicle Network
CAN Protocols
Building CAN Hardware
Filed Under: Featured, Network Hacks Tagged With: Arduino DUE, automotive, CAN, can bus triple, CAN Hacking, chipkit,
GoodFET, goodthopter, saleae logic
8/31/2014 CAN Hacking: The Hardware 7/23
1. Anybodysguess says:
November 5, 2013 at 10:13 am
DUDE! You got to start using breaks!
Reply Report comment
FrankTheCat says:
November 5, 2013 at 12:00 pm
Seriously, a break right before the Wiring section would be best. Please.
Reply Report comment
2. Gdogg says:
November 5, 2013 at 10:22 am
Looks like they connected the saleae wrong
Reply Report comment
NiN says:
November 5, 2013 at 2:41 pm
8/31/2014 CAN Hacking: The Hardware 8/23
They didnt, grey wire is ground, as you can see on the wire label. I suppose it would be more logical if black one was ground, with
channels color-coded same as resistor colors but hey, its Saleae(s) logic. :)
BTW, very nice clone, works with SL software&driver, but costs $9 :
Reply Report comment
xpert says:
November 5, 2013 at 4:02 pm
and what about inside ? is circuit same ? dave from EEVBlog teared-down original
Reply Report comment
Tyler Bletsch says:
November 5, 2013 at 4:11 pm
My understanding is that they all use the same Cypress chip, so whether its a Saleae or a USBee is just a matter of the
firmware. Now the ancillary components are probably worse, but my knockoff works just fine.
Reply Report comment
NiN says:
November 7, 2013 at 8:34 am
Yup, same Cypress chip. Isolation chip is also present.
Reply Report comment
3. Jcerecke says:
November 5, 2013 at 10:26 am
Does anyone know the difference/compatibility with the BMW iBus and standard CAN? Ive got a USB-iBus adaptor but wanted a dev board
that lives in the car permanently providing automation.
Reply Report comment
denis says:
November 5, 2013 at 1:07 pm
I used a Canbus shield to play with the 100kb k-bus on my E60. toook some faffing but worked eventually. I dont think the i-bus is a
8/31/2014 CAN Hacking: The Hardware 9/23
can bus in the sence of differential signalling etc but it is really well documented online, with only a quick google throwing up schematics
and ready-made interfaces, sure you can hook something to a microcontroller?
Reply Report comment
4. ejonesss says:
November 5, 2013 at 10:43 am
CAN needs to be terminated, preferably by a 120 ohm resistance on either end of the bus.
then does scsi qualify as a can device?
Reply Report comment
AS says:
November 5, 2013 at 1:04 pm
No Whered you get that idea? All transmission lines need to be terminated, otherwise you get reflections from the ends.
Reply Report comment
5. Hubert S. Cumberdale says:
November 5, 2013 at 10:46 am
what about OBD2 cables
Reply Report comment
6. wardy says:
November 5, 2013 at 12:00 pm
+1 for the Saleae Logic. Ive had mine for a couple of years and its still the go-to tool when messing with digital circuits. I was using mine even
today to prove that my Propeller chip was outputting well-formed asynchronous serial data at 2666667 baud. It was :)
I dont care that the Saleaes not open source, because its really very useful indeed.
It is a pity that Saleae are not developing the software anymore though.
Reply Report comment
7. Drake says:
November 5, 2013 at 12:22 pm
8/31/2014 CAN Hacking: The Hardware 10/23
Dont think it has been mentioned before but the 2CAN is able to bridge a CAN network to ethernet as well. Then sending and receiving data
can be done via UDP packets.
Reply Report comment
8. nleahcim says:
November 5, 2013 at 12:50 pm
Id suggest doing a little more research about proper CAN termination before giving blatantly wrong information. CAN is run on a 120 ohm diff
pair typically and thus needs to be terminated with 120 ohm resistors on *both* ends of the bus. Failure to do so will cause signal integrity
issues. With a short and/or slow bus, you probably will be fine with improper termination. But very frequently improper termination will cause
major problems.
Reply Report comment
randomcoderdude says:
November 6, 2013 at 12:53 am
Reply Report comment
adh says:
November 6, 2013 at 1:50 am
While I generally agree with 120R resistors on both ends being the only correct solution, it does seem to not matter much for short buses.
As with short runs of slow speed RS-485 the termination resistors are more important for correct idle bias than transmission line
termination itself. Two wire CAN also in fact isnt true differential bus because of how the protocol works, but two independent single
ended signals that are most of the time sensed as one differential pair, this has to do with how the arbitration and clock recovery works.
In all: I have seen some short-ish CAN buses with single 60R resistor in middle instead of 120R termination on ends (and that was
mostly in vehicles, so it seems to be pretty reliable solution, although weird and I would certainly not recommend doing that).
Reply Report comment
9. Tyler Bletsch says:
November 5, 2013 at 1:09 pm
Two questions I havent been able to find answers for:
8/31/2014 CAN Hacking: The Hardware 11/23
1. Is the CAN typically used by OBD-2 low- or high-speed, and what are these speeds? Ive seen 125kbps, 250kbps, and 500kbps
2. Is there any reason why you couldnt just bitbang this on a regular old microcontroller without extra chips? Its just 0-5V, two pins, and a
resistor, right? Im surprised that all the designs I see involve dedicated CAN chips without mention of manual signaling.
Reply Report comment
nleahcim says:
November 5, 2013 at 2:18 pm
Tyler CAN could definitely be bitbanged on an MCU that did not have the peripheral. However, you would be best served by having
a CAN transceiver in between the MCU and the CAN bus to handle the physical layer. Your typical CAN nus sits at 2.5V when idle
(weakly pulled to 2.5V), and then the CANL line will go below that and the CANH line will go above that during communication. So
thatd be tricky to replicate with just an MCU.
Reply Report comment
Tyler Bletsch says:
November 5, 2013 at 3:41 pm
Why would that be tricky? Wouldnt this circuit do it?
Reply Report comment
Tyler Bletsch says:
November 5, 2013 at 3:48 pm
Oh wait, I think I get it now it would be hard to detect the 2.5V state, you mean, right?
You could use the analog inputs on an AVR to do this they also function as digital IOs, so you can put a ground or 5V on a
line, or flip it to an analog in to differentiate 0 from 2.5 from 5.
Am I missing something?
Reply Report comment
Foxdie says:
8/31/2014 CAN Hacking: The Hardware 12/23
November 5, 2013 at 9:44 pm
Hi Tyler,
1. CAN has become a bit of an ambiguous term in the real world, when people say that their car has CAN or CANBUS this will,
more often than not, be a high speed two-wire CAN Bus operating at 500 Kbps. There are many different implementations however,
single wire, different speeds like youve already found.
2. Although on paper it looks like this is possible, again real world environments differ. Firstly, automotive electrical systems are full of
electromagnetic interference (typically from ignition systems and the alternator), additionally (particularly when a car engine is cranked by
a starter motor) massive surges can be sent through the power supply system (aka +VE or +12V) as the alternator starts to kick in, these
voltages often easily spike as high as +40V before settling down
What hasnt been covered in this document is single-wire CAN bus networks. They often bridge +VE (12.. well up to 40V) on the bus
to assert a wake-up signal to ECUs, they also dont use a 120 Ohm resistor to terminate each end of the bus (some implementations use
a 60 Ohm, some dont even use anything but I digress).
Reply Report comment
10. Harry says:
November 5, 2013 at 3:22 pm
I think NXP needs some love here, their LPC11C24 is a great little ARM micro that has an on board CAN transceiver and can be had on a
dev board (LPCxpresso) with a built in programmer for about $30. Fairly straightforward to program using NXPs open source libs as well.
Reply Report comment
11. tekkieneet says:
November 5, 2013 at 4:53 pm
Tyler: You could simplify the circuit (i.e. save 2 resistors) by having
a 10K pull up on one CAN bus line and a 10K pull down on the other one.
While you could hook up the AVR directly to the CAN bus, I would caution
to read the electrical spec on the CAN bus pins to make sure that they
would not exceed the maximum electrical spec on the AVR side!
8/31/2014 CAN Hacking: The Hardware 13/23
CAN bus transceivers from TI can handle -2V to 7V CMM range and handle
+/-36V shorts. I would use a proper transceiver for the protection.
Reply Report comment
12. Bradley says:
November 5, 2013 at 5:36 pm
Unfortunately, theres no set standard for CAN connections.
Umm, what about J1939? Yea, there is a standard. Just because some dont follow it, doesnt make the standards disappear.
Reply Report comment
xadh says:
November 6, 2013 at 2:00 am
J1939 is higher level protocol built on top of CAN that happens to specify some kind of connectors. That does not make these
connectors standard for other uses for CAN.
Reply Report comment
Francois says:
November 7, 2013 at 3:39 am
+1 J1939 is way more than just a connector, it provide a solution to the issues with Message Id, sender Id, priority and multi
packet messages. It also include a big set of predefined PGN (message) and SPN(channel) that should be sent on a truck.
i work every day with J1939 and i think its a very good high level protocol, even if the whole standard is adapted to Trucks, most
of the high level concepts could be used within any other projects. even if you dont use the J1939-71 messages descriptions, you
could do your own PGNs and SPN descriptions, just dont connect this on a real J1939 network on a truck, you could cause
troubles resulting in injuries or death
Reply Report comment
13. texane says:
November 5, 2013 at 11:43 pm
8/31/2014 CAN Hacking: The Hardware 14/23
if it can be useful to someone, I implemented dspic33f based serial to can
bridge whose code can be found here:
Documentation here:
Reply Report comment
14. Vaidas says:
November 6, 2013 at 1:11 pm
Hi everyone,
some time ago I started working on a new hacker-friendly board that would have CAN connectivity, microcontroller with integrated CAN
peripheral and Arduino compatibility. I came up with something I would call Elduino CAN128 :) If anyone is interested, more information can
be found on my blog:
It is just in a prototyping stage now and it would be nice to get your opinions about it :)
Reply Report comment
15. Paul Stoffregen says:
November 18, 2013 at 6:15 am
Im curious to try CAN, but my car is 19 years old.
I suppose I could just hook 2 microcontrollers together, but thats not very interesting. Im seen some ECU simulators, from $200 to $3000,
which seems pretty spendy.
Can any recommend a cheap source for an actual ECU or other CAN stuff I could just power up on my desk with 12 volts and have it send
CAN messages? Hoping to keep this under $50, if possible?
8/31/2014 CAN Hacking: The Hardware 15/23
Reply Report comment
Foxdie says:
November 18, 2013 at 6:54 am
Hi Paul,
Take a look at these pages;
To set up a basic network, youll need 2 of the breakout boards and one or more mbed LPC1768s. I say one or more because the
LPC1768 has 2 CAN controllers and you can use them both at the same time (ie. get it to talk with itself), or you can use two
LPC1768s and have 2 distinct nodes to play with.
When you connect the breakout boards together, dont be tempted to cross the CAN_H and CAN_L lines (CAN_H should go to
CAN_H etc) and make sure the 120 Ohm jumper is fitted on both boards. If you use one of the boards with a car, 99% of the time you
wont need this jumper fitted, its only for when youre building a network outside of an existing one that would already have these
terminating resistors fitted.
When youre ready to step up to deeper stuff, heres a working GMLAN-specific packet sniffer that outputs data to a USB serial port
that comes with the mbed;
Although its geared towards GMLAN SWCAN (General Motors implementation of a single-wire CAN Bus) you should be able to pull
a lot out of it for your own gains.
Ps. Yes, you can use one to simulate an ECU or a diagnostic tool, Ive reprogrammed Holden VE head units and done some other
stupid crap with mine;
Reply Report comment
Paul Stoffregen says:
November 18, 2013 at 11:11 am
Great. I have an mbed, so far sitting unused. But thats still just having a microcontroller talk to itself.
Im hoping to do something like what this guy did. Scroll down to the photos in week 2:
8/31/2014 CAN Hacking: The Hardware 16/23
Hes got a real ECU from some car or truck hooked up. Its sending messages, which the test on the microcontroller is receiving.
Any idea where I might buy such a thing? And also find enough info about it to get it powered up on my desk without the rest of
the intended car attached?
Reply Report comment
16. Paul Stoffregen says:
November 18, 2013 at 11:12 am
Reply Report comment
Leave a Reply
Enter your comment here...
8/31/2014 CAN Hacking: The Hardware 17/23
Never Miss a Hack

Search this website Search
Select Category
In case you missed it
8/31/2014 CAN Hacking: The Hardware 18/23
The Inaugural Meetup
DEFCON: Blackphone
[Bil's] Quest for a Lost Finger: Episode I
50 Semifinalists Selected for Next Stage of The Hackaday Prize
Fear and Loathing at DEFCON 22
8/31/2014 CAN Hacking: The Hardware 19/23
More Posts from this Category
Our Columns
Hacklet #13 Chopper Royalty
Droning On: Maiden Flights
Retrotechtacular: Turn On the Magic of Colored Light
8/31/2014 CAN Hacking: The Hardware 20/23
Ask Hackaday: Can Paper USB Business Cards Exist?
Hacklet #12 Last Minute Hackaday Prize Submissions
More Posts from this Category
Recent comments
metai on Purely Mechanical Display Uses 804 Balls To Create a Kinetic Display
Eirinn on Homemade Triple Monitor Mount Looks Professionally Made
DainBramage1991 on Green Light Your Commute with Americas Unsecured Traffic Lights
Mike Schaale on Jeep Wrangler gets pressurized water right out of the bumper
ANON on Custom Racing Chair with a Kinect and Haptic Feedback
Michael on Green Light Your Commute with Americas Unsecured Traffic Lights
Paul on Green Light Your Commute with Americas Unsecured Traffic Lights
gregkennedy on Rapid Fire Mod For A Wireless Mouse
Tony on Proximity Sensing LEDs Can Add a New Dynamic To Your Projects
Tony on Proximity Sensing LEDs Can Add a New Dynamic To Your Projects
Find Hacks by Date
8/31/2014 CAN Hacking: The Hardware 21/23
November 2013
Oct Dec
1 2
3 4 5 6 7 8 9
10 11 12 13 14 15 16
17 18 19 20 21 22 23
24 25 26 27 28 29 30
8/31/2014 CAN Hacking: The Hardware 22/23
Return to top of page
Copyright 2014 Genesis Framework WordPress Log in
8/31/2014 CAN Hacking: The Hardware 23/23
Hackaday, Hack A Day, and the Skull and Wrenches Logo are Trademarks of
Our Policies

Powered by VIP