{"id":5050,"date":"2019-09-16T15:34:36","date_gmt":"2019-09-16T14:34:36","guid":{"rendered":"https:\/\/www.purplemeanie.co.uk\/?p=5050"},"modified":"2025-01-31T13:08:31","modified_gmt":"2025-01-31T13:08:31","slug":"ecu-diagnostics-part-11-logic-analyzer-on-the-can-bus","status":"publish","type":"post","link":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/16\/ecu-diagnostics-part-11-logic-analyzer-on-the-can-bus\/","title":{"rendered":"ECU Diagnostics – part 11 : Logic Analyzer on the CAN Bus"},"content":{"rendered":"\n

To test out my theories and the code I’d been writing, I needed a simple test and a way to make sure the code (and I) was doing what I thought it should be.<\/p>\n\n\n\n

The code part was easy, take the JSON files I’d created from the Easimap EC2 file and use it to ask for some simple data from the car.<\/p>\n\n\n\n

As it turns out the “checking the code” part was also fairly straight forwards. I’ve talked about the Saleae Logic Analyzers<\/a> in the past and how good they are. It also turns out that one of the software decoder modules they ship as standard is a CAN bus decoder. The idea is that you capture an analysis trace and then get the analyser software to decode the trace as CAN bus.<\/p>\n\n\n\n

Saleae also have instructions on how to set up a CAN bus capture<\/a>. They say that in most cases you can connect the analyser to CAN-L and set the analyser input to be high voltage (3.3v) and away you go.<\/p>\n\n\n\n

\"\"<\/a>
Saleae Logic Analyzer (red thing) connected to PiCAN2 on Raspberry Pi. Yellow wire connected to CAN-L, Black wire to Ground.<\/figcaption><\/figure>\n\n\n\n

You’ll notice that there’s also a TFT LCD sat on top of the Pi, that’s for a later project.<\/p>\n\n\n\n

Analyzer Setup<\/h3>\n\n\n\n

With the analyser input set to 3v3 and a 50MHz sample rate I could capture the 1MHz activity on the CAN bus. I tried some captures at slower sample rates but they weren’t so reliable – clearly the analyzer needs to significantly oversample the signal to get the timing right.<\/p>\n\n\n\n

Just for completeness, here’s a picture of the analyser leads connected to the PiCAN2…<\/p>\n\n\n\n

\"\"<\/a>
Saleae Analyzer connected to Raspberry Pi and PiCAN2<\/figcaption><\/figure>\n\n\n\n

Here’s a closeup of the connections…<\/p>\n\n\n\n

\"\"<\/a>
Analyzer connections to PiCAN2 closeup<\/figcaption><\/figure>\n\n\n\n

Anyways, that setup is well within the capabilities of the Saleae and gave very reliable results.<\/p>\n\n\n\n

\"\"<\/a>
Saleae Logic Analyzer Setup for CAN bus Capture on Channel 0<\/figcaption><\/figure>\n\n\n\n

Test Code<\/h3>\n\n\n\n

Just to check my theories I wrote this simple app to pull just a few data samples from the car’s ECU. I started with RT_ENGINESPEED (Engine RPM) and got back the result I was expecting (i.e. 0 RPM, as the car wasn’t running).<\/p>\n\n\n\n

Here’s the code, which can also be found here<\/a>.<\/p>\n\n\n\n

# TestECU\n# Application for testing python-isotp-mbe class\n#\n# 2019-08-26 John Martin\n#\n\nimport logging\nimport argparse\nimport json\nimport pprint\nimport mbe\nimport curses\n\nversion = \"0.1\"\n\nif (mbe.test_mode):\n  variables_to_follow = [\n      'RT_ENGINESPEED',\n    'RT_AIRTEMP1(LIM)',\n    'RT_COOLANTTEMP1(LIM)',\n    'RT_BATTERYVOLTAGE(LIM)',\n    'RT_SOFTCUTTIME',\n    'RT_HARDCUTTIME'\n  ]\nelse:\n  variables_to_follow = [\n    'RT_ENGINESPEED'\n  ]\n\ndef main():\n  parser = argparse.ArgumentParser(prog='mbepcap2txt', description='Takes an pcap with ISOTP formatted MBE transactions and makes it human readable.')\n  parser.add_argument('--interface',     '-i',                   help='The can interface to open', required=True)\n  parser.add_argument('--variables',     '-v',                   help='Input MBE variables filename', required=True)\n  parser.add_argument('--query_id',      '-q',                   help='CAN query ID (default 0x0cbe1101)', default=0x0cbe1101)\n  parser.add_argument('--response_id',   '-r',                   help='CAN resdponse ID (default 0x0cbe0111', default=0x0cbe0111)\n  parser.add_argument('--loglevel',      '-l',                   help='Logging level to show', choices=['INFO','DEBUG','WARNING', 'ERROR', 'NONE'], default=\"ERROR\")\n  parser.add_argument('--logfile',       '-f',                   help='If set logging will be sent to this file')\n  parser.add_argument('--version',       '-V', action='version', version='%(prog)s '+version)\n\n  args = parser.parse_args()\n\n  logging_level = getattr(logging, args.loglevel, None)\n  logging.basicConfig(level=logging_level, filename=args.logfile, filemode='w')\n\n  ecu = mbe.mbe()\n  \n  ret = ecu.set_options(args.variables, args.query_id, args.response_id, args.interface)\n  if(not ret):\n    logging.error(\"Unable to set options\")\n    exit()\n\n  if(ecu.add_variable_list_to_follow(variables_to_follow) != len(variables_to_follow)):\n    logging.warning(\"Ooops, didn't add all the vars I wanted to\")\n  else:\n    logging.info(\"Added all the variables we expected\")\n\n  ecu.bind()\n\n  results = dict()\n  if (ecu.process_all_pages(results) != False):\n    logging.debug(pprint.pformat(results))\n\nif __name__ == '__main__':\n  main()<\/pre>\n\n\n\n
When we run the code above it makes a single request to the car for Engine RPM and displays the results. Here are the ISOTP CAN bus packets for this test:<\/p>\n\n\n\n
REQUEST:  0100000000f87c7d<br>RESPONSE: 810000<\/pre>\n\n\n\n
As you can see in first packet, there’s a data request (0x01)  to page 0xf8 with 0x7c and 0x7d as the requested data address.<\/p>\n\n\n\n
Then in the response packet there’s a data response (0x81) with 0x0000 as the RPM. Bingo! And because the car engine wasn\u2019t running at the time, a response of zero RPM makes perfect sense!<\/p>\n\n\n\n
Here’s the 3 raw CAN bus frames that correspond to those ISOTP packets:<\/p>\n\n\n\n
#     CAN ID     Data\n[290] 0x0cbe1101 10 08 01 00 00 00 00 f8\n[291] 0x0cbe1101 21 7c 7d\n[292] 0x0cbe0111 03 81 00 00 00 00 f8 7c<\/pre>\n\n\n\n
And here’s what that looked like in the logic analyser. The three images are for each of the three CAN bus frames (you might need to click on the images to see them full scale)…<\/p>\n\n\n\n
\"\"<\/a>
CAN bus request: 0x0cbe1101 10 08 01 00 00 00 00 f8<\/figcaption><\/figure>\n\n\n\n
\"\"<\/a>
CAN bus request: 0x0cbe1101 21 7c 7d<\/figcaption><\/figure>\n\n\n\n
\"\"<\/a>
CAN bus response: 0x0cbe0111 03 81 00 00 00 00 f8 7c<\/figcaption><\/figure>\n\n\n\n
You can see details of the CAN bus protocol in full technicolor. The analyser software doesn’t show the start but you can see the ID, data and CRC. A more detailed discussion on the CAN bus protocol can be found in this post<\/a>.<\/p>\n\n\n\n
So my software is able to send a good ISOTP CAN bus request to the car and we get a good response back.<\/p>\n\n\n\n
It Works!<\/h3>\n\n\n\n
So… it works! We\u2019ve figured out how the three communications protocols work that these ECUs seem to use. There may be more to know but we can now use the more complicated protocol used by Easimap and dig deeper into the ECU.<\/p>\n\n\n\n
Now lets summarize all we know about the various protocols.<\/p>\n","protected":false},"excerpt":{"rendered":"
To test out my theories and the code I’d been writing, I needed a simple test and a way to make sure the code (and I) was doing what I thought it should be. The code part was easy, take the JSON files I’d created from the Easimap EC2 file and use it to ask […]<\/p>\n","protected":false},"author":1,"featured_media":5069,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[51,20],"tags":[34],"class_list":["post-5050","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-caterham-blog","category-ecu-diagnostics","tag-ecu-diagnostics"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/img_2013.jpg","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p8yl38-1js","jetpack-related-posts":[{"id":4726,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/08\/31\/ecu-diagnostics-part-1-introduction\/","url_meta":{"origin":5050,"position":0},"title":"ECU Diagnostics – part 1 : Introduction","author":"John Martin","date":"August 31, 2019","format":false,"excerpt":"So here we go for a marathon series of posts. I'll update this page with links to the completed posts as they come along... IntroductionECUs, OBD and CANTest SetupWireshark Patching and OBD-II ResultsThe Correlator Dead-EndReading MaterialECU Maps and MappingEasimap uses ISOTP (sort of)The Easimap Protocol TheoryDecoding EC2 FilesLogic Analyzer on\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":5192,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/20\/ecu-diagnostics-part-14-software-framework-mbe-py\/","url_meta":{"origin":5050,"position":1},"title":"ECU Diagnostics – part 14 : Software Framework mbe.py","author":"John Martin","date":"September 20, 2019","format":false,"excerpt":"This is hopefully a reasonably short post about the software framework I've developed to help read sensor data from the MBE 9A4 ECU. The software is written in Python 3 and is available here: Caterham-OBD. However, I'm going to talk about using one file only which is mbe.py.\u00a0 The idea\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":5086,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/16\/ecu-diagnostics-part-12-osi-7-layers-for-caterham-diagnostics\/","url_meta":{"origin":5050,"position":2},"title":"ECU Diagnostics – part 12 : OSI 7 Layers for Caterham Diagnostics","author":"John Martin","date":"September 16, 2019","format":false,"excerpt":"Communications protocols are often called protocol stacks... they're layers, or stacks, of different protocols... one layered on top of the other from lowest level (hardware\/physical) to highest level (software application). This is where the OSI 7 Layer model comes in... it standardises how we think about the layers and allows\u2026","rel":"","context":"In "ECU Diagnostics"","block_context":{"text":"ECU Diagnostics","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/ecu-diagnostics\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/ECU-OSI-Layers.png?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":5038,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/15\/ecu-diagnostics-part-10-decoding-ec2-files\/","url_meta":{"origin":5050,"position":3},"title":"ECU Diagnostics – part 10 : Decoding EC2 Files","author":"John Martin","date":"September 15, 2019","format":false,"excerpt":"Now we need to start proving some of our theories about how Easimap is actually talking to the ECU. And it seemed to me that if I was going to prove anything then I'd need to pass a lot of data through any theory I came up with, and that\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":4943,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/07\/ecu-diagnostics-part-5-the-correlator-dead-end\/","url_meta":{"origin":5050,"position":4},"title":"ECU Diagnostics – part 5 : The Correlator Dead-end","author":"John Martin","date":"September 7, 2019","format":false,"excerpt":"Hopefully this is a quick post... The story so far is that: We've got a test bench made of a Raspberry Pi, CAN bus decoder board and an OBD Y-cableThe Raspberry Pi can \"sniff\" all the packets sent between the car's ECU and something that can talk to the car,\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/Github-Correlator.png?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":4954,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/07\/ecu-diagnostics-part-6-reading-material\/","url_meta":{"origin":5050,"position":5},"title":"ECU Diagnostics – part 6 : Reading Material","author":"John Martin","date":"September 7, 2019","format":false,"excerpt":"Another quick one, really quick this time... Mark (CTRMint) had been doing his research and had told us about a book he was buying, and I just couldn't resist... The Car Hacker's Handbook The book isn't the cheapest of purchases, at least not in the UK. But for me it\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/51itpsaLlfL._SX376_BO1204203200_.jpg?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]}],"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/5050","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=5050"}],"version-history":[{"count":1,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/5050\/revisions"}],"predecessor-version":[{"id":10697,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/5050\/revisions\/10697"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/media\/5069"}],"wp:attachment":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=5050"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/categories?post=5050"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/tags?post=5050"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}