Another Level of CAN Diagnostics

Michael Mobile Technician Clinton, Utah Posted   Latest  

In response to my previous post about a troublesome Subaru, Geoff Welsh asked me to expand more on CAN tracing. I have to admit that I am still in the learning stage of this. Until a few months ago I had never seen it in action. It was so intriguing to me, I pursued learning more. In the Movie, the Matrix we see characters stream from top to bottom. Each stream is interpreted into a living virtual reality. CAN tracing is not quite there. You get the idea.

In current diagnostic tradition, we use scan tools, DVOMs, Test Lamps, Labscopes and other testing tools to help in diagnosing vehicle faults. The scan tool can give us live data, it can give us trouble codes. It can allow us to give commands and get a response. When checking a network, we can hook up a labscope and look at the structure of a signal. We see a voltage level, we can determine if there is interference. Wouldn't it be nice to know what those signals are saying? That is what CAN tracing does but in the language of a machine.

CAN was developed in the 1980s By Bosch. From my research, it was not implemented into a production vehicle until the 1990s. there are proprietary and older protocols being used today. There are new protocols out there being used and more to come. The bread and butter of the vehicles we see in the independent world is CAN. We are all used to pins 6 and 14 being the CAN terminals in the OBDII. Nowadays we see multiple terminals being used. Some manufacturers like Ford and FCA have multiple CAN channels on the back side of the Gateway.

For this discussion, we will focus on using pins 6 and 14. The CAN traffic we are looking at is between the scan tool and the OBDII port. What we can do is use an OBDII splitter and use one laptop to monitor the CAN traffic and a second laptop or scan tool to set commands and receive data. The purpose of this in my Subaru story was to see if the steering angle sensor was communicating on the CAN bus.

diag​.​net/file/f1q852yko…

diag​.​net/file/fd36y4rw9…

For those who have studied EEPROM work, you recognize hexadecimal numbering. With the standard base 10 numbering system we read numbers 1 to 10. Bianary On/Off is 1 or 0. Hexadecimal is base 16. 0 to 9 and A to F. Here is a website where you can convert text to hex. unit-conversion​.​info/texttools/hexa… Each pair of numbers translate to different characters. Keep in mind that A is not the letter A but represents the number 11. The letter a in hex is 41. The Number 1 in hex is 31. So if I want to know what VIN is loaded in a Ford airbag control module, you could dump the AS Built Data and convert it. In the example below I took the as built data for a ford and converted it. At the end of each set ford has a checksum. That is what the strange symbols and underscore are. To get the VIN, you would take out the checksum digits. 1FAHP2FW5BG169615

diag​.​net/file/f18w1xnan…

CAN messages are sent out in packets. It is similar to IP protocol used by computers. I am not an engineer so I could not explain all the layers and error correction protocols. I just accept that each packet of information is delivered and checked before moving to the next one. With the CAN trace, you see messages being broadcast. I am told that once you stare at the screen long enough you can understand what the HEX code is telling you. At my level, I just look for clues to help me. For instance, when looking at the Subaru, I connected and disconnected components to see what nodes would come up. The ABS/VSC module seemed to be the master as I got no stream without it connected.

diag​.​net/file/f3tszmlfq…

In the picture above, you can see multiple columns. In column 1 is the node ID. Smaller numbers are high priority and larger ones low priority. The steering angle sensor is node 2 which is a high priority. The nodes in the 500s are the scan tool. Node 75 the ABS module and node 70 the YAW sensor. So we see that they are all broadcasting on a regular basis. Also there is the Hex message and a time stamp. Each message is a broadcast from one of the nodes. It is what our scan tools translate into a language we understand. When we get a failure message on our scan tool it is because the tool does not see a success message from the node. It appears that some modules have multiple nodes.

There are many options for CAN tracing out there. Since I already had a Vector CANCardXLe I found software that would work with it. The software is usually fairly expensive. I got a quote of over $8000 from Vector. I don't think I will be a customer any time soon.

As this develops, I would like to offer a class covering this material in more detail. It will take some time to develop as there are still much research to be done. Hopefully this gives some idea of how this all works.

-Mike

+10
Randy Analyst
Denver, Colorado
Randy Default
 

I use vehiclespy, it will set you back about $6k to do what it looks like you want to do with much cheaper versions to do less. The $6k will let you do a lot more then what you show here. Just a suggestion, stop trying to think of hex in decimal. It is like learning a foreign language, you never truly understand until you start thinking in the new language.

+2 Default Ð Bounty Awarded
Michael Mobile Technician
Clinton, Utah
Michael Default
 

Randy, I get what you are saying about trying to convert for Hex to Decimal. The explanation was more to familiarize others with what those funky numbers are. If you know that the numbers mean something, the patterns start to open up. I will get there eventually. My problem is that unless I am working with this often I loose it and it take a bit to get back. I will look at vehiclespy and see if…

0 Default Ð Bounty Awarded
Randy Analyst
Denver, Colorado
Randy Default
 

Yeh, didn’t mean to come across that I was recommending it, just that I use it. I’m most curious to see what ways you find to use Something like it.

+1 Default Ð Bounty Awarded
Geoff Diagnostician
Lahaina, Hawaii
Geoff Default
   

Thanks for writing this up Mike. I believe, from the Engineer side, they could have easily had the modules spit out all their messages in plain English for us to see, but they think: A. We don't need it, B. We're too dumb anyway. Keep us posted as you translate more interesting things. Have you ever tried to speak with the guys who make ForScan? I bet they are pretty far along with this…

0 Default Ð Bounty Awarded
Dr. Engineer
Port Angeles, Washington
Dr. Default
 

Hi Mike: For purposes of keeping the response to a minimum, most technicians and engineers that I have had dialogue over the years understand that they need a CAN tool to read the messages. This is is a foregone conclusion. Whether it's a VectorCAN, NeoVI (Intrepid Tool), Shark, etc. tool, unless someone is going to dedicate 100's (or even 1000's) of hours to reverse engineer CAN data, it is a…

0 Default Ð Bounty Awarded
Michael Mobile Technician
Clinton, Utah
Michael Default
 

Hi Dr Mark, I don't think I could ever wrap my head around all the messages and what they mean. My thought is that if the scan tools let you down, you could look at the patterns in the CAN data for repeated or rejected messages to try and solve the issue at hand. In my case it helped me come to a conclusion. I think it is fun to look at the code and try to analyze it. I expect the more I study…

0 Default Ð Bounty Awarded