J1939 CAN Bus DIY

[kevinstotz]

Has anyone attempted to create their own scanner?

I have been researching this and it can be complicated, or it can be a bit easier, I am starting on the easier side.
At this point I am just trying to capture the J1939 data.
Ideally I would like to send the data to via bluetooth or WIFI to my mini server, that's later

I have a 9pin to db9 connector.
This connects to a usb to db9 adapter to my laptop.
I am able to use putty and open the com port on windows.
set the baud rate to 250000 b/s

This is about where my luck runs out. I am not getting a continuous stream of data. I get 1 ascii representation of some binary data displayed on putty. If I press keys on the keyboard I might get 3 or 4 more of those chars, but that's it.

I am looking for some help if anyone has any insights.

thanks for your help

[WIbluebird]

The Blue Fire app isn't perfect and its a little finicky but for $200 you don't have to deal with any of that.

Just my 2 cents.

[kevinstotz]

I am familiar with the Blue Fire app and I have a Scan Gauge D which does display the data. But I am looking for more flexibility and I want to deal with all of that.

[Power Hungry]

Originally Posted by kevinstotz

Has anyone attempted to create their own scanner?

I have been researching this and it can be complicated, or it can be a bit easier, I am starting on the easier side.
At this point I am just trying to capture the J1939 data.
Ideally I would like to send the data to via bluetooth or WIFI to my mini server, that's later

I have a 9pin to db9 connector.
This connects to a usb to db9 adapter to my laptop.
I am able to use putty and open the com port on windows.
set the baud rate to 250000 b/s

This is about where my luck runs out. I am not getting a continuous stream of data. I get 1 ascii representation of some binary data displayed on putty. If I press keys on the keyboard I might get 3 or 4 more of those chars, but that's it.

I am looking for some help if anyone has any insights.

thanks for your help

CAN messages are formatted very specifically. Treating it as a Serial Communication isn't going to work. You'll need to run it through a CAN -> UART transceiver, and then UART -> USB to be able to obtain any decipherable messages.

There are several devices available that will convert CAN to USB to give you the raw messages. After that, you have to handle the Node ID Masks and message packets on your own.

There are also a number of USB and Bluetooth converters that already handle the packetizing of the messages, but you usually end up using their IDE to handle porting the messages to your own applications.

It all depends on what you're trying to accomplish and how deep you want to dive into this.

[cadillackid]

I use a BB electronics device that takes J1708 and J1939 and turns it into serial where I have a script to interpret it.

I also have a copper hill USB to J1939 device that does the same. I capture and play with data on a raspberry pi and even manipulate it and send it on as a go-between. I think I went over some of it in my RedByrd transformation thread but you can let me know if you want any more specifics and I can get you part numbers of devices I ordered and play with.

[kevinstotz]

Thanks!
I found the Canable Pro which looks like a good entry point, unfortunately they are all sold out.

I found another guy that did his thesis on this and built it from the ground up. About $100 in pieces.

The other can to USB devices range in price from $200 to $1000 roughly.

What are your experiences with any of these can to USB devices

[kevinstotz]

Cadillacguy,

Wow. CopperHill has everything you can dream up for CAN development.
Raspberry pi, Arduino, or a simple can bus to mini USB adapter for $40

I could not find the device from cc ele. I think their company name changed. Nevertheless, can you provide the name of the device?

Thanks for your help

[Bert06840]

It depends what you are interested in - "building a scanner" can mean many things. If you're "just" into parsing standard/documented high level hex messages and translating them into human readable notifications, it is a totally different discussion than trying to reverse engineer a proprietary protocol with checksums, authentication, encryption and obfuscation.

So if you wanted to build something that allows you to unlock gears or update injector tables, you're in for a ride. This side of the game is only for the most determined high value hackers. There is even money to be made.

Implementing CAN on a low level isn't trivial either, it is very timing critical. Unless you do it for the heck of it, you want to use a peripheral that handles the physical and timing side of things. Microcontrollers with CAN are a dime a dozen.

So, it's a little bit like an hourglass - very hard at the top, hard at the bottom, easy in the middle. If you just want to collect date to plot graphs of published data and stuff, get a HDV100 like Cadillackid said. Plenty of fun, and pretty low hanging fruit.

[Bert06840]

Originally Posted by kevinstotz

Cadillacguy,

Wow. CopperHill has everything you can dream up for CAN development.
Raspberry pi, Arduino, or a simple can bus to mini USB adapter for $40

I could not find the device from cc ele. I think their company name changed. Nevertheless, can you provide the name of the device?

Thanks for your help

I think Cadillackid meant HDV100A3 the J1939 to RS232 converter. They are like $25 on ebay.

Using a naked CAN adapter is significantly harder, the HDV100A3 handles all the J1939 stuff for you. But if that's your thing, hey, why not.

[cadillackid]

Bert has it correct its the HDV100A3 and will do J1939 and J1708.. it will output it in different formats.. my bus is old enough that it uses 250k Baud so setting the RS232 end at 460K means no overruns in the buffer it is sending full bore.



this is the new / current version of the device.



the OP's CE bus still talks J1708 for diagnostics and then Talks J1939 for transmission and likely the ABS / Brake control as well.







https://buy.advantech.com/OBD-Adapte...-BB-HD3-A3.htm




yes it handles all of the heabvy hitting that i felt was useless as I had no reason to reinvent the wheel..


there are also IC's made for it the ELM325 chip is designed for J1708 and the ELM327 will do J1939 / OBD2.



the copperhill boards only do J1939 and not J1708

[kevinstotz]

As we are travelling I am trying to gather the pieces necessary.
I managed to buy a HDV100A3, a usb to db9 adapter, and a 9pin to db15. (the db15 was a female, so i got a gender bender to connect to the HDV100A3)

connecting those to my windows 10 laptop.
The COM port is COM9.
I set the baud rate to 115000
8,n,1,none

I am able to open the port via python-can.
bus type serial.
but I don't get any data displayed
I am using
can.viewer and i also tried can.logger.
Both show no data when the ignition key is turned to the on position.

this is the command i have been trying
python -m can.viewer -i serial -c COM9
Anyone have any advice

[cadillackid]

I have to look again but you have to tell the HDV what you want it to do.. whether you want to jump on the J1708 or J1939 bus and what kind of data you want to see.. there are some intro commands i send to mine.. 115200 baud wont cut it on a 250k data bus.. I was opening my port at 230400 or 460800 most of the time, a really nice adapter can open at 921600.



the HDV also puts headers on the data if you want it to which is more overhead .. you prob want raw data and with no headers..


you need to Claim an address on the data base. . I think the default for the HDV is to claim 172 which is a scan tool..



this is the document that tells what INTERNATIONAL uses for their source addresses.. this ios for old and new so many of these wont be present on a school bus..


you DONT want to claim any of these addresses.. if you do then various systems might be disrupted.. Unless you are wanting to do something custom.. for instance I have claimed myself as address 5 which is an Allison digital shifter. . and my Transmission responds to commands from it.. so I can gear up and gear down through software..



but if I had a real electronic shift pad and claimed address 5 (before it could) then my allison wouldnt work right from the dash.. the shifter would go Cat-Eye and be defunct till it could go online..



https://static.oemdtc.com/TSB/MC-10162034-0001.pdf

[kevinstotz]

Thanks.
Can you give me an example of a couple othere adapters.

I can't find any docs for this adapter. But maybe it just wants to be set up as a listener and then read the bus.

I'll try a couple things.

Or if you could send me the bit of code to get started. That would be helpful.

I initially want to get the data and plot it on a graph for trend information.


Thanks.

[kevinstotz]

So..the j1939 pgn and spn data. Did you manually enter that I do, or did you find it somewhere

[cadillackid]

how do you mean enter it manually? once I tell the HDV to start sending then it ships data in real time to the RS232 port. you can ship it with or without the HDV timestamp header. and / or in hex representation or as Binary in character values..



I diotn have the right laptop with me or id post a simple PHP script i wrote that took Hex data from the HDV saved to a file and spit out the human readable parameters..



ill try and grab that laptop here later or in the morning and post some of that. I didnt filter out any data on the HDV, I let it take everything from the datalink and send it.. using Hex can cause buffer overruns but it was nice for learning..



if the HDV is not set in Hex mode then each Byte from the J1939 will be sent straight to the serial port on it as a byte in the ASCII value that bye came from the link. your software will need to convert it to binary so it can be combined with other bytes in the frame and then bit mapped down to a PGN and SPN's.



now once you get a value for the bits then you do need to input in your software the conversion to make them human readable.



for instance SPN 91 that is inside of PGN 61443.


this is throttle position.


PGN 61443 reference tells you what bits within the PGN are what parameters.





you can see that TPS is Byte 2 and its 1 byte long. we are using 8 bit bytes.. so it is 8 bits.


its SPN is 91.








you can see there that each bit is 0.4% so if you decoded the value sent as 100 from the link, your software would multiply your number times 0.4 and get 40% throttle position. if the link sent you value 200 the actual TPS would be 80%


you need to input those conversions into your program as well as write a routine to parse the data coming in to get the PGN and then parse all its SPN;s out.. not every SPN is a Byte.. some are just partial bits within a byte.. thats why its important to parse all data vytes into binary so you can pick off individual bits you may want..

[kevinstotz]

Ya. I am able to get the data and decode it with the pgn and spn page in order to make sense of the data.

As I am reading more and more data, ie pgns and sons, then I want to display the data meaningfully.

This requires matching the data to the specific spn.
If someone wanted to make a real time, or even non real time, chart. Then you would read the data and pick your gauges you wanted to display and display the results.
But you need all that spn and pgn data in a database to display it easily and on the fly.

[cadillackid]

there are can DB files out there.. some people have made their own.. many people are running these programs on android or iOS devices where having a DB server running isnt going to happen.. so often the database is just a text file or a lookup table within the code.



https://www.csselectronics.com/pages...database-intro

[kevinstotz]

Cadillackid.

Were you able to send a "request for address claim" and get a response from the other nodes on the network.

I believe I am sending the command correctly, but no responses from any of the other nodes on the network, even if I try to request their address.

Or were you able to request a PGN specifically?

Thanks
Kevin

[cadillackid]

I was able to claim several different addresses. When I want to just request stuff I claim the diagnostic tool address.. I think it’s 172 on the IH. I was also able to claim 5 as a allison shift pad and also 15 as an ABS unit..

[kevinstotz]

Nice. I guess my request is wrong. I'll keep working on it