Car to Arduino Communication: CAN Bus Sniffing and Broadcasting With Arduino

234,846

207

76

Introduction: Car to Arduino Communication: CAN Bus Sniffing and Broadcasting With Arduino

About: Geek at large.

From Wikipedia, the Controller Area Network (CAN) bus is a "vehicle bus standard designed to allow microcontrollers and devices to communicate with each other within a vehicle without a host computer." These devices can also be referred to as electronic control units (ECUs). Essentially the CAN bus is a bunch of linked ECUs within the vehicle that communicate with each based on a broadcast. Every ECU intercepts every broadcast, but individually decide whether or not to react to it.

Here's an example:

Let's imagine there's one ECU that controls the brake lights, one ECU that controls the car horn, and one ECU that controls the braking system. Whenever you blow the horn, the horn ECU sends a broadcast message out on the CAN bus network to every ECU it is connected to, including the brake light ECU and the braking system ECU. The brake light ECU intercepts that broadcast message, but chooses to ignore it because it has no relevance. The brake light ECU is really only waiting on the message from the brake system ECU. Also, the horn ECU doesn't react to the braking system ECU.

This broadcast system is broken down into different components; the two most important are message ID and message data.

For now, think of the message ID as an ECU address. The message data is the content. It is typically larger than the ID at around 8 bytes long.

Here's an example:

message ID: 620
data: 10 80 FF FF 80 20 00 80

The ECUs communicate with each other over a twisted wire pair holding CAN-high (CAN+) and CAN-low (CAN-). CAN-high and CAN-low are accessible through the OBD-II port under the steering wheel. This is how we'll get in!

Pro-tip: Use a wire tracer/tone generator to backtrace to other CAN Bus access points within your car.

Volkswagon has a good guide to how the CAN Bus network works: http://www.volkspage.net/technik/ssp/ssp/SSP_238.pdf

Step 1: Components and Assembly

Components:

1- Arduino UNO R3

2- Sparkfun (or other) CAN Bus Shield: https://www.sparkfun.com/products/10039

Note: Also available at SK Pang: http://skpang.co.uk/catalog/arduino-canbus-shield-with-usd-card-holder-p-706.html (SK Pang also supplies the needed CAN Bus library).

Note2: At the time of this writing, there were only 6 in stock at Sparkfun.

Note3: Sparkfun's CAN Bus shield also has a joystick (up, down, left, right, center), a micro SD slot, and support for GPS and LCD modules.

Note4: If you're feeling up to it, you can order the parts from Digikey and make your own using Sparkfun's provided EAGLE CAD drawing.

3- Wire pair or Sparkfun's OBD-II to DB9 cable:https://www.sparkfun.com/products/10087

Note: I found some old speaker wire that worked great.

4- breakable header pins - the CAN Bus shield doesn't include them: https://www.sparkfun.com/products/116


Assembly:

1- Break headers into 2x8 pin, 2x6 pin, and (optional - 1x4 pin sections)

2- Solder the headers to the CAN Bus shield.

Step 2: Familiarizing Yourself With the CAN Bus Library

    Once assembled, be sure to download the CAN Bus Library for use with your Arduino IDE.

    Library and Example files are located here:

    https://github.com/sparkfun/SparkFun_CAN-Bus_Ardui...

    Download link for Library and Examples:

    https://github.com/sparkfun/SparkFun_CAN-Bus_Ardu...

    • Library in the src/ folder
    • Sparkfun (and my) examples are in the examples/ folder

    CAN Bus Shield Initialization:

    #include <Canbus.h>  // don't forget to include these
    #include <defaults.h>
    #include <global.h>
    #include <mcp2515.h>
    #include <mcp2515_defs.h>
    
    void setup()
    {
    Serial.begin(9600);
    //Initialise MCP2515 CAN controller at the specified speed
    if(Canbus.init(CANSPEED_500))
    	Serial.println("CAN Init ok");
    else
    	Serial.println("Can't Init CAN");
    
    delay(1000);
    }

    Shield initialization will be required for all tasks. Here, we define our CAN bitrate and import our library. Every vehicle might use different bitrate speeds. For our example, we use 500 kbps.

    Available options are:

    CANSPEED_125 //CAN speed at 125 kbps
    CANSPEED_250 //CAN speed at 250 kbps
    CANSPEED_500 //CAN speed at 500 kbps

    If you're unsure of your vehicle's CAN bitrate, do some Googling...


    Read CAN Bus Messages:

    We are reading every message here. It can be a bit overwhelming as you see the traffic flow through.

    • ALL Messages
    void loop()
    { 
    tCAN message;
    
    if (mcp2515_check_message()) 
    	{
        if (mcp2515_get_message(&message)) 
    	{
                   Serial.print("ID: ");
                   Serial.print(message.id,HEX);
                   Serial.print(", ");
                   Serial.print("Data: ");
                   for(int i=0;i<message.header.length;i++)
                    {
                      Serial.print(message.data[i],HEX);
                      Serial.print(" ");
                    }
                   Serial.println("");
                 }}
    }

    Filtering will cut out a huge chunk of noise. (You'll see what I mean when you begin to sniff unfiltered.)

    • Filter Messages
    void loop()
    {
    tCAN message;
    
    if (mcp2515_check_message()) 
    	{
        if (mcp2515_get_message(&message)) 
    	{
            if(message.id == 0x631)	  //filtering based on CAN bus message ID.
                 {
                   Serial.print("ID: ");
                   Serial.print(message.id,HEX);
                   Serial.print(", ");
                   Serial.print("Data: ");
                   for(int i=0;i<message.header.length;i++)  
                    {
                      Serial.print(message.data[i],HEX);
                      Serial.print(" ");
                    }
                   Serial.println("");
                 }}}
    
    }

    message.header.length is the size of the CAN message.

    The above was filtered by message ID. We can also filter based on message data.

    if(message.id==0x631 and message.data[3]==0x04 and message.data[4]==0x0F)

    Notes:

    1- Messages can be longer than 3 digits.

    2- We are formatting incoming message IDs and message data as HEX.


    Write CAN Bus Messages:

    In order to write a CAN Bus message, we need to first assemble the message components: message ID, message size, and message data. The message is broken down by message.id, message.header.rtr, message.header.length, and message.data[].

    void loop() 
    {
    tCAN message;
    
            message.id = 0x631; //formatted in HEX
            message.header.rtr = 0;
            message.header.length = 8; //formatted in DEC
            message.data[0] = 0x40;
    	message.data[1] = 0x05;
    	message.data[2] = 0x30;
    	message.data[3] = 0xFF; //formatted in HEX
    	message.data[4] = 0x00;
    	message.data[5] = 0x40;
    	message.data[6] = 0x00;
    	message.data[7] = 0x00;
    
    mcp2515_bit_modify(CANCTRL, (1<<REQOP2)|(1<<REQOP1)|(1<<REQOP0), 0);
    mcp2515_send_message(&message);
    
    delay(1000);
    }

    The message ID and data are written in HEX (0xFF, for example), which is the same format we read with.

    mcp2515_send_message(&message); sends the message.

    Step 3: Connect and Read / Write

    The attached file, CAN_read_sample, is for simply reading all messages. I commented out filtering, so you should be able to modify it easily to include filtering of message ID and data.

    I also attached a file, CAN_write_sample, for writing a message.

    You have two options for connecting the Arduino to vehicle's CAN-high and CAN-low lines:

    1- Hack up some speaker wire (or any wire pair) and connect the CAN-H and CAN-L through-holes on the shield to the OBD-II port.

    CAN-H (shield) <-----> CAN-high (OBD-II)
    CAN-L (shield) <-----> CAN-low (OBD-II)

    2- Buy Sparkfun's OBD-II to DB9 Cable:https://www.sparkfun.com/products/10087. This also powers the Arduino through the car's 12v line. I haven't used it, but let me know how it works out... YMMV

    Connect the Arduino to your car and computer, load the code, open the serial monitor, and watch the magic.

    Step 4: What Next?

    As you begin to read CAN bus messages, start manipulating your car.

    • Unlock and lock the vehicle
    • Pop the trunk
    • Roll up and down windows
    • Sounding the alarm
    • Blow your horn
    • Turn on and off your flashers
    • Turn on and off your signal lights
    • Turn of and off your lights and high beams
    • Etc.

    Remember that filtering is your friend!

    See if you can find messages related to the above. Once you do, write the same messages back out through your Arduino using Step 2. See if you can unlock or lock your vehicle, pop the trunk, or blow your horn!

    I hope to share my findings in the future!

    Thanks for reading!

    3 People Made This Project!

    Recommendations

    • Tiny Home Contest

      Tiny Home Contest
    • Creative Misuse Contest

      Creative Misuse Contest
    • Fix It! Contest

      Fix It! Contest

    76 Discussions

    Hi, I tried this on my 2003 VW Golf mk4. I had to hookup my shield directly on the bus wires, located behind the dashboard to be able to read messages. Took me quite a while to find the right wires. You have to look for a pair of orange twisted cables connected to the green plug behind the dashboard. There are three orange pairs. Two of which are Orange/black and orange/brown. You have to use the light coloured pair. Orange/black is Can H and orange/brown is Can L (at 500kbps). Currently im collecting data and try to understand it. My goal is to implement cruise control and an active rev matching system, controlled by a windows 10 pc in the trunk, which is connected to a touchscreen in the front, replacing the radio and navigation system.

    Hi! I'm working on a project for my 1996 Saab 900 turbo. I wonder what message.id does. Is it an identifier that is sent to the ECU and the ECU then responds back with the same identifier so it's easier to know what it is responding to? Also I would like to know what message.header.rtr does. The last queston I have (for now) is if I need to do anything else to make it run at 615 kbps than to edit the Canbus.h file and change CANSPEED in the sketch?

    Regards,

    Christian

    I need to transmit and receive specific CAN messages for a project. I have to use a laptop with Busmaster on one end and the Arduino with the CAN shield on the other. When I send messages from the Busmaster to the Arduino I get an error. A CAN message isn't transmitted by busmaster. Is there anything else I need to add to the code?

    The setup is a laptop with busmaster sending CAN signals to the shield-arduino through a USB-DB9 connector. The Arduino is connected via USB to another laptop on whose serial monitor I wish to read the messages being transmitted by the first laptop. Also do I need to worry about adding 120 ohm resistors anywhere in this setup? Please help.

    1 more answer

    Yes, you will need at least one 120ohm resistor, in fact, canbus networks should terminate with 120ohm registers at BOTH ends (so resitance between lines is about 60)

    Hi. Great guide.

    I need an Analog 0-5V to CAN converter at work and the cheapest one I can find is about £400. So I am thinking of going the Arduino route and developing our own.

    I have a joystick that outputs in CAN but I cannot use it for reasons, and it is connected in a forklift truck (which uses CAN to communicate of course)

    I have a joystick that outputs in 0-5V which I can use, but of course, I need to translate the 0-5V to CAN exactly as the OEM.

    I am kind of struggling to figure out how to do this. Any help would be appreciated.

    1 reply

    Microchip CAN tranciever MCP2561-E/SN cost 1dollar..

    hello,


    Basically, I wanted to establish can communication between two arduino boards.
    For that, I have two sparkfun can-shields.
    I wanted to know,
    1.Can I connect them directly by using CAN_H and CAN_L pins provided on shield?(I tried direct connection, but I'm not able to receive can frame at the receiving arduino board)

    2. whether do i need to connect terminating resistors of 10 ohm at both ends?
    3.is there any API, where can we configure baudrate and can fram id etc?

    Thanks in advance.
    My mail id is: rkomeghadoot@gmail.com

    2 replies

    You need to terminate the wiring... a CAN bus needs a terminator at 120ohm in each end...

    I face same issues, do you had get the answer?Thankyou

    0
    None
    DieterW8

    Question 4 months ago

    Hello,

    i bought the "SparkFun CAN-BUS Shield" and
    hooked up on a Arduino Uno. After that, I uploaded the sketch
    "CAN_Read_Demo". I connected it to my car, but there was no data
    displayed on the serial monitor. Then I uploaded the sketch "SparkFun_CAN_Demo"
    to test the board.

    The serial monitor shows:

    CAN-Bus Demo

    CAN Init ok

    Please choose a menu option

    1.Speed

    2.RPM

    3.Throttle

    4.Coolant Temperature

    5.O2 Voltage

    6.MAF Sensor

    But when I enter a option (e.g. 1 for Speed) it shows
    following error:

    Vehicle Speed:

    Not a valid input.

    Please enter a valid option.

    Is the shield broken or did I something wrong?

    Hey, I did everything as it says, I hooked up the Arduino Ono on the bus shield, and I plugged obd2 - db9 cable between the car and the shield and all the time I get only one message "cant init can" I also tried to connect without the cable, And can - low and gnd and it shows me the same message, what am i doing wrong, please help me out

    1 more answer

    I just went through this, your CAN Bus shield is most likely configured for the incorrect "CS", chip select pin compared to your sketch/library. More than likely your CAN Bus shield is an aftermarket one. Fastest way to rectify this is to either correct the CS pin (it'll either be 9 or 10) in the code/library or physically jump the gold soldering dot on the back of the CAN Bus shield shorting the center dot to pin 10 dot AND use a blade or knife to cut the PCB print from the center dot to the pin 9 dot.

    I'm sure this is confusing as heck but flip JUST the CAN Bus shield onto its bottom and you'll see four different rows of soldering gold contacts labeled "CS, MOSI, MISO, SCK" from top row to bottom. The CS row is what you're interested in and you need to sever the TINNNNY wire going from the very left (9) gold contact to the center contact using a blade and physically solder the center contact to the very right contact dot (10). Note, none of this will apply to you if you have an original CAN Bus shield, its for aftermarket shields only.

    Can you help me why I can't detect the message?thankyou

    can't detect messag.JPG
    0
    None
    Chouby

    Tip 6 months ago

    For all Volkswagen family, VW, Audi, Skoda
    YOU NEED TO REQUEST DATA FROM THE PORT UNLESS YOU'RE DIRECTLY ON THE CANBUS WIRE
    EX: Canbus.ecu_req(ENGINE_RPM, buffer);

    1
    None
    SaverioV

    Question 6 months ago


    Hello!
    I have also arrived at this point, but now I would like to decode the hexadecimal strings to get the real values ​​but I do not know where to start! :(
    for example I read from wikipedia which id correspond to the RPM and I filtered, but now I do not know how to convert the string in INT could you help me? thank you so much :)

    Hello,

    I have read your instructable with great interest and have a doubt about the 4 pin headers needed to connect to the sparkfun can-shield. When are they used in the code? Or the hi/low information from the obd2 connector passes the information through the db9 connector on the shield? Browsing the code, I get the idea that it is only necessary to connect the sparkfun can-shield to the arduino and the rest is code.

    Can you clarify?

    Thanks alot for this awesome instructable.

    Thank you for your helpful guide. unfortunately i have some major problems with getting no messages, i soldered on the board an using no db9 connector cable, i am using canH canL and GND you can find an in detail post right here:
    http://forum.arduino.cc/index.php?topic=494722.msg...

    thank you!

    Hi,

    does anyone had a succesful connection with a VW? I connected it over Line 6 and 14 for CAN high and low. I tried both Sparkfun example CAN_Demo and ECU_Demo but nothing works. The Serial Monitor shows me only CAN init ok. I also tried different CAN Bus Speed 125, 250 and 500. I tried also the PID Request but that doesn't work too.

    1 reply

    Hi,

    i have the same problem with my 1998 Golf IV i only get the init, but this message is always shown, even if you are not connected to the cars can bus. I soldered on the board, can-h, can-l and ground, no messages. do you have any solutions?

    Hello,

    If I want to write a message to multiple ECUs, what should I do?