CAN Controller Area Network

CAN (Controller Area Network) BUS is not a new network, but unlike more popular network names, CAN BUS is geared more for Embedded Controllers such as the ones found in modern automobile. So when I speak of CAN BUS 'Hacking', I am referring to automotive network reverse engineering.

The CAN BUS is now a required network on vehicles manufactured in the U.S. from 2008 and beyond. It's popularity among automotive OEMs is nearly universal. But unlike most open protocols such as TCP/IP and HTTP, CAN BUS is almost entirely implemented as a proprietary protocol. Thus if we want to understand it, we must 'hack' it.

I will be posting more about what exactly the CAN BUS is, but you can get more information on it from Wikipedia by clicking here.

One common misunderstanding about the vehicle network data is that it is limitless. The truth is that the only data on the network is the data that is required to be there. Nothing more, nothing less. What is required is different from vehicle to vehicle. For example some vehicles might have adaptive cruise control and this system might require vehicle dynamic information that is not required on vehicles that do not posses this system.

More and more data is being added to already heavily loaded networks, so automotive OEMs are adding more networks to accommodate more data. Good news for us, now we can get more info at higher data rates.

Diagnostics Messages vs. Normal Message

When I speak to most people about the vehicle network or CAN BUS there is a common misconception that there is only Diagnostic Messages or OBD II Messages. So what's the difference between Diagnostic Messages (such as OBD II) and Normal Messages on a typical CAN BUS?

Simply put Diagnostic Messages are Command/Response Messages. So if you want to get data from a controller, you have to send it a request. It will then respond to that request (hopefully). This is done using a common diagnostic protocol. There are only a handful that are used and they are typically specific to the OEM, however there is not much difference between OEMs on how they have implemented their flavor of Diagnostic Messages. That said all OEMs that sell vehicles in North America support the common OBD II protocol, those in Europe support the EOBD and in China, the new China OBD (Based on EOBD).

Normal Messages are the Messages that are transmitted between controllers. This data varies depending on the electronics systems and like the OEMs Diagnostic Protocol, this data is also proprietary. This data does not need to be requested (is nearly 100% of cases). This data is typically sent at a periodic rate by a controller as fast as it needs to be sent so that listening controllers get the most recent value. If you are doing data acquisition, this is the data you want.

Props

Blocking Diodes, Isolating Door Triggers and Sensors, Diodes Across the Coil of Relays

Here's another installer friendly component you should always have handy. Blocking diodes (1N4001/L) are one way valves used in electrical circuits. These are very simple devices that are often real time savers. Other than the amperage rating of the diode, there are only three basic things to remember:

1. Cathode (side with the stripe) 2. Anode (side without the stripe) 3. Anytime the cathode is more positive than the anode, no current will flow.

Isolating Door Triggers:
Some vehicles have two separate (-) door triggers that are isolated from each other, most commonly found on newer GM vehicles. One is for the driver's door and the second is for the rest of the doors. Below is an example of connecting them to one alarm trigger. If you were just to connect to one of these and not both, one or more doors of the vehicle would not be protected by the alarm. When installing an alarm in a vehicle with this type of door trigger (dome lamp) circuit, you must connect to both door triggers for all doors to trigger the alarm. If you were to tie each of these together without the blocking diodes, some features of the vehicle would no longer function properly. Some of the things that could happen are: the door chime / buzzer sounding when any door is opened, rather than just the driver's door, or indicators in the instrument cluster showing false information as to which door is actually opened, and so on.

This diagram would also apply to connecting the (-) outputs of two sensors, such as a glass mic and an impact sensor, to one input of an alarm.

If you have two or more positive triggers to isolate, simply connect the anode side of each diode to each trigger and the cathode sides to the positive input of the alarm.

















Unless specified, all diodes seen in these diagrams are rated at 1 ampere (1N4001/L).

Diode across the coil of a relay:
The diode provides a path for current when the current path to the relay is interrupted (i.e. switched off). This allows the coil field to collapse without the voltage spike that would otherwise be generated. The diode protects switch or relay contacts and other circuits that may be sensitive to voltage spikes.

Resistors, Resistor Color Codes, Resistor Color Code

Resistors, like diodes and relays, are another of the electronic parts that should have a section in the installer's parts bin. They have become a necessity for the mobile electronics installer, whether it be for door locks, praking lights, timing circuits, remote starts, LED's, or just to discharge a stiffening capacitor.

Resistors "resist" the flow of electrical current. The higher the value of resistance (measured in ohms) the lower the current will be.

Resistors are color coded. To read the color code of a common 4 band 1K ohm resistor with a 5% tolerance, start at the opposite side of the GOLD tolerance band and read from left to right. Write down the corresponding number from the color chart below for the 1st color band (BROWN). To the right of that number, write the corresponding number for the 2nd band (BLACK) . Now multiply that number (you should have 10) by the corresponding multiplier number of the 3rd band (RED)(100). Your answer will be 1000 or 1K. It's that easy.

* If a resistor has 5 color bands, write the corresponding number of the 3rd band to the right of the 2nd before you multiply by the corresponding number of the multiplier band. If you only have 4 color bands that include a tolerance band, ignore this column and go straight to the multiplier.

The tolerance band is usually gold or silver, but some may have none. Because resistors are not the exact value as indicated by the color bands, manufactures have included a tolorance color band to indicate the accuracy of the resistor. Gold band indicates the resistor is within 5% of what is indicated. Silver = 10% and None = 20%. Others are shown in the chart below. The 1K ohm resistor in the example (left), may have an actual measurement any where from 950 ohms to 1050 ohms.

If a resistor does not have a tolerance band, start from the band closest to a lead. This will be the 1st band. If you are unable to read the color bands, then you'll have to use your multimeter. Be sure to zero it out first!

Resistor Color Codes
Band Color	1st Band #	2nd Band #	*3rd Band #	Multiplier x	Tolerances ± %
Black	0	0	0	1
Brown	1	1	1	10	± 1%
Red	2	2	2	100	± 2 %
Orange	3	3	3	1000
Yellow	4	4	4	10,000
Green	5	5	5	100,000	± 0.5 %
Blue	6	6	6	1,000,000	± 0.25 %
Violet	7	7	7	10,000,000	± 0.10 %
Grey	8	8	8	100,000,000	± 0.05 %
White	9	9	9	1,000,000,000
Gold				0.1	± 5 %
Silver				0.01	± 10 %
None					± 20 %

SPDT and SPST Automotive Relays

SPDT Relay : (Single Pole Double Throw Relay) an electromagnetic switch, consist of a coil (terminals 85 & 86), 1 common terminal (30), 1 normally closed terminal (87a), and one normally open terminal (87) (Figure 1).

When the coil of an SPDT relay (Figure 1) is at rest (not energized), the common terminal (30) and the normally closed terminal (87a) have continuity. When the coil is energized, the common terminal (30) and the normally open terminal (87) have continuity.

The diagram below center (Figure 2) shows an SPDT relay at rest, with the coil not energized. The diagram below right (Figure 3) shows the relay with the coil energized. As you can see, the coil is an electromagnet that causes the arm that is always connected to the common (30) to pivot when energized whereby contact is broken from the normally closed terminal (87a) and made with the normally open terminal (87).

When energizing the coil of a relay, polarity of the coil does not matter unless there is a diode across the coil. If a diode is not present, you may attach positive voltage to either terminal of the coil and negative voltage to the other, otherwise you must connect positive to the side of the coil that the cathode side (side with stripe) of the diode is connected and negative to side of the coil that the anode side of the diode is connected.



SPST Relay : (Single Pole Single Throw Relay) an electromagnetic switch, consist of a coil (terminals 85 & 86), 1 common terminal (30), and one normally open terminal (87). It does not have a normally closed terminal like the SPDT relay, but may be used in place of SPDT relays in all diagrams shown on this site where terminal 87a is not used.

Dual Make SPST Relay : (Single Pole Single Throw Relay) an electromagnetic switch, consist of a coil (terminals 85 & 86), 1 common terminal (30), and two normally open terminals (87 and 87b). Dual make SPST relays (Figure 4) are used to power two circuits at the same time that are normally isolated from each other, such as parking lamp circuits on German automobiles.

The diagram below center (Figure 5) shows a dual make SPST relay at rest, with the coil not energized. The diagram below right (Figure 6) shows the relay with the coil energized. The coil is an electromagnet that causes the arms that are always connected to the common (30) to pivot when energized whereby contact is made with the normally open terminals (87 and 87b).

Diodes are most often used across the coil to provide a path for current when the current path to the relay is interrupted (i.e. switched off, coil no longer energized). This allows the coil field to collapse without the voltage spike that would otherwise be generated. The diode protects switch or relay contacts and other circuits that may be sensitive to voltage spikes. (JimR, contributor, install bay member)

Why do I want to use a relay and do I really need to? Anytime you want to switch a device which draws more current than is provided by an output of a switch or component you'll need to use a relay. The coil of an SPDT or an SPST relay that we most commonly use draws very little current (less than 200 milliamps) and the amount of current that you can pass through a relay's common, normally closed, and normally open contacts will handle up to 30 or 40 amps. This allows you to switch devices such as headlights, parking lights, horns, etc., with low amperage outputs such as those found on keyless entry and alarm systems, and other components. In some cases you may need to switch multiple things at the same time using one output. A single output connected to multiple relays will allow you to open continuity and/or close continuity simultaneously on multiple wires.

There are far too many applications to list that require the use of a relay, but we do show many of the most popular applications in the pages that follow and many more in our Relay Diagrams - Quick Reference application. If you are still unclear about what a relay does or if you should use one after you browse through the rest of this section, please post a question in the12volt's install bay.

Control Area Network

Controller area network (CAN or CAN-bus) is a vehicle bus standard designed to allow microcontrollers and devices to communicate with each other within a vehicle without a host computer

CAN-bus was designed for automotive applications but is also used in other areas. The protocol was officially released in 1986 by the Society of Automotive Engineers (SAE). CAN become become most available OBD standard for vehicles produced after 2007 yrs.

A modern automobile may have up to 50 electronic control units (ECU) for various subsystems. Usually the biggest processor is the engine control unit, others are used for transmission, airbags, antilock braking, cruise control, audio systems, windows, doors, mirror adjustment, etc. Some of these form independent subsystems, but communications among others are essential. The CAN standard was devised to fill this need. CAN is a multi-master broadcast serial bus standard for connecting electronic control units (ECUs).

The CAN bus may be used in vehicles to connect engine control unit and transmission, or (on a different bus) to connect the door locks, climate control, seat control, etc. Today the CAN bus is also used as a fieldbus in general automation environments.

The devices that are connected by a CAN network are typically sensors, actuators and control devices. A CAN message never reaches these devices directly, but instead a host-processor and a CAN Controller is needed between these devices and the bus.

The CAN data link layer protocol is standardized in ISO 11898-1 (2003).

There are several CAN physical layer standards:
ISO 11898-1: CAN Data Link Layer and Physical Signalling
ISO 11898-2: CAN High-Speed Medium Access Unit (uses a two-wire balanced signaling scheme. It is the most used physical layer in car powertrain applications and industrial control networks)
ISO 11898-3: CAN Low-Speed, Fault-Tolerant, Medium-Dependent Interface
ISO 11898-4: CAN Time-Triggered Communication (standard defines the time-triggered communication on CAN (TTCAN). It is based on the CAN data link layer protocol providing a system clock for the scheduling of messages)
ISO 11898-5: CAN High-Speed Medium Access Unit with Low-Power Mode
ISO 11992-1: CAN fault-tolerant for truck/trailer communication
ISO 11783-2: 250 kbit/s, Agricultural Standard - uses four unshielded twisted wires; two for CAN and two for terminating bias circuit (TBC) power and ground. This bus is used on agricultural tractors. This bus is intended to provide interconnectivity with any implementation adhering to the standard.
SAE J1939-11: 250 kbit/s, Shielded Twisted Pair (STP) - standard uses a two-wire twisted pair, -11 has a shield around the pair while -15 does not. SAE 1939 is widely used in agricultural & construction equipment
SAE J1939-15: 250 kbit/s, UnShielded Twisted Pair (UTP) (reduced layer)
SAE J2411: Single-wire CAN (SWC)

CAN-bus usually accessed via 6 and 14 pin of OBD II connector

OBD 2 CAN pinout

Pin	Signal	Description
4	CGND	GND
5	SGND	GND
6	CAN High
14	CAN Low
16	+12v	Battery power

OBD II Cable