CAN Hacking: Protocols

We’ve gone over the basics of CAN and looked into how CAN databases work. Now we will look at a few protocols that are commonly used over CAN.

In the last article we looked at CAN databases, where each bit of a message is mapped to a specific meaning. For example, bit 1 of a CAN message with ID 0x400 might represent whether the engine is currently running or not.

However, for more complex communications we need to use protocols. These can map many meanings to a single CAN ID by agreeing on a structure for sending and receiving data.

Next time you’re in the drivers seat, look around your left knee. You’ll find a connector like the one above. This is the OBD-II connector.

The OBD-II protocol is not CAN specific, and can be implemented over UART and PWM channels as well as CAN. OBD-II became present in cars when the California Air Resources Board demanded a diagnostic protocol for all vehicles sold in California in 1991. Since it’s always done over CAN in newer vehicles, this connector gives you access to at least one vehicle CAN bus.

OBD-II is used for reading vehicle parameters and reading fault codes. By using the various OBD-II modes, you can read parameter IDs (PIDs) containing information about the state of the vehicle. Wikipedia has a great article on the OBD-II modes and PIDs.

There’s a wealth of information out there about OBD-II, and you can buy a tool for under 20 bucks to read fault codes and clear the pesky check engine light in your car. Instead of going into detail about OBD-II, lets talk about its big brother.

While many car enthusiasts are familiar with OBD-II, many haven’t heard of Unified Diagnostic Services (UDS). This is unfortunate, since OBD-II is just a subset of UDS. While OBD-II only allows a limited set of services, UDS is the diagnostic protocol that manufacturers and technicians use. It provides all the services needed for diagnostics, calibration, and flashing firmware.

UDS has various services, such as ReadDataByIdentifier and TransferData, which are identified with a one byte Service ID (SID). The first 0x0F SIDs are reserved for OBD-II. The rest are defined either by standards, or by the manufacturer. Here’s a list of the standard UDS services, and their hex identifiers.

UDS uses a frame structure to send data to controllers. Single Frames (SF) are for short messages, where all the data can fit into six bytes. If the data is longer, a FirstFrame (FF) is sent to start the transaction, then Consecutive Frames (CF) are sent with data. Here’s a layout of how the frames are structured.

OBD-II only uses the first frame structure, but the others are useful for longer data such as a firmware download.

To get into how all the services work, you’ll need a copy of ISO 14229. Unfortunately, it’ll cost you about $250 USD just for the PDF. Tools that can talk UDS are very expensive. However, with this basic knowledge you can get a grasp of what’s happening on the bus.

While UDS is a closed protocol, researchers at Ford have been working on creating an open platform for interfacing with vehicles. The result is the OpenXC Platform. OpenXC provides a protocol to read data from Ford vehicles over CAN.

To use it, you’ll need a vehicle interface. A chipKIT can be used with Ford’s open source firmware. Alternatively, you can buy a prebuilt solution from CrossChasm. Once the vehicle interface is up and running, you can access data from the Android and Python APIs. We’ve featured a few OpenXC hacks on Hackaday in the past.

It’s great to see an automotive manufacturer embracing open source, and hopefully Ford continues to work on the platform. That being said, the OpenXC protocol is read only, and limited to a fairly small set of messages.

Now that we’ve heard all about protocols, it’s time to get into building CAN hardware. Next week we’ll look at what hardware you need to start using CAN in your own projects.

security protocol

A sequence of operations that ensure protection of data. Used with a communications protocol, it provides secure delivery of data between two parties. The term generally refers to a suite of components that work in tandem (see below). For example, the 802.11i standard provides these functions for wireless LANs.

On the Web, TLS and SSL are widely used to provide authentication and encryption in order to send credit card numbers and other private data to a vendor. Following are the primary components of a security protocol. See cryptography, information security, PCT and IPsec.

Authenticates user identity. Authorizes access to specific resources based on permissions level and policies. See access control and authentication.

The cryptographic cipher combined with various methods for encrypting the text. See encryption algorithm, HTTPS and TLS.

Create, distribute and maintain the keys. See key management.

Ensures that the encrypted message has not been tampered with. See message integrity.

NHL updates concussion protocol

Read entire Concussion Evaluation and Management Protocol for 2016-17 season (PDF)

NEW YORK/TORONTO -- The National Hockey League (NHL) announced today the implementation of a number of new policies and procedures to enhance the NHL/National Hockey League Players' Association (NHLPA) Concussion Protocol. While it remains an individual Club's responsibility to identify a Player who requires removal from play and evaluation for possible concussion, the NHL and the NHLPA have agreed to provide additional support to help identify Players who require evaluation under the NHL/NHLPA Concussion Protocol. A new staff of Central League Spotters will monitor all games from the Player Safety Room in New York and will be authorized to require a Player's removal from play for evaluation for concussion if the Player exhibits certain visible sign(s) under the Protocol, following a direct or indirect blow to the head. In-Arena League Spotters and On-Ice Officials will complement the Central League Spotters and will also monitor play for signs of possible concussion.

Specified sanctions will be imposed on Clubs that violate the Concussion Protocol. Clubs that do not remove a Player who requires an evaluation will be subject to a mandatory minimum fine for a first offense, with substantially increased fine amounts for any subsequent offense. Additionally, any Player designated for a mandatory evaluation will not be permitted to re-enter the game unless and until he is evaluated by his Club's medical staff and cleared to play in accordance with the Protocol.

The staff of Central League Spotters that have been retained by the League are all certified athletic trainers who have clinical experience working in elite level hockey, and have received training on the visible signs of concussion in the Protocol. The Central League Spotters will observe every NHL game via television broadcast. The In-Arena League Spotters are also employed by the League as Off-Ice Officials. In-Arena Spotters also have received training on the visible signs of concussion and will be assigned to ensure that they will be dedicated solely to the spotting function during games in which they have been designated as the In-Arena Spotter. The In-Arena League Spotters will observe games live, in the arenas. While all Spotters (Central and In-Arena) will be able to communicate freely with one another during games, only the Central League Spotter will communicate with the Club's medical staff if a Player requires removal and evaluation under the Protocol. 

On-Ice Officials are also authorized to require a Player's removal for evaluation if they observe a Player displaying visible signs of concussion under the Protocol, following a direct or indirect blow to the head. In addition, On-Ice Officials now have the authority to mandate the removal of a Player from the game if the Player continues to play after the Central League Spotter has communicated to the Club medical staff that a mandatory evaluation is required.