In this blog post we will share some impressions of the car-hacking project we did back in 2016, where we connected the CAN bus of one of our company cars to the internet to read live sensor data.
CAN-Bus
The Controller Area Network (CAN bus) is a two wired bus system for vehicles, similar to KNX bus for buildings. The bus allows all the microcontrollers in the car to communicate with each other, from steering wheel position, throttle, to turn indicator. CAN bus was developed by Bosch in 1983 and is mandatory for all cars sold in the U.S. since 1996. The 1988 BMW 8 Series (E31) was the first production car using the CAN bus wiring system.
We tapped into the CAN bus of on of our company cars to get read access to all the sensors, just like on the suction excavator truck, but for this experiment we used a raspberry pi with a CAN bus shield for faster prototyping, instead of professional grade STM32 based embedded devices as used in the suction excavator.
We tapped into the CAN bus of on of our company cars to get read access to all the sensors, just like on the suction excavator truck, but for this experiment we used a raspberry pi with a CAN bus shield for faster prototyping, instead of professional grade STM32 based embedded devices as used in the suction excavator.
Below is a sample of data captured from the CAN bus. Each data packet consists of a identifier, followed by up to 8 bytes of HEX data.
Let's have a closer look at the last packet of the data capture:
In our case, the identifier 21A stands for the status of the lights. The data payload consists of the status for each lamp. The first byte (HEX 85) is used for the exterior lights. We have to convert HEX 85 to bytes:
The hex value converted to 8-bit binary will give us 8 individual status indicators, each bit stands for a specific light. First byte is the brake light, second one is the rear fog light and so on.
To parse the vast amount of data of the CAN bus, we wrote a small NodeJS program, which filters the relevant data and forwards it to connected clients over the internet using WebSockets. The client app shows a virtual dashboard of our car, where sensor readings are visualized in real time. When you turn the steering wheel, the steering wheel in the virtual dashboard of the app will turn as well. Same for pedal positions, RPM and speed gauge, turn indicator, fuel level etc. In a second app the motor data is visualized in a real time chart.
ID | Data ----------------------------- 2B2 # 00 00 00 00 64 00 25 0D 497 # 1C 42 FF FF FF FF FF FF 0A8 # 66 6A FD 60 FD F1 03 02 0A9 # 86 1A 72 CF 2A 72 CF 14 0AA # EB 7A FD 00 B8 0B 80 84 3B0 # FD FF 21A # 85 22 FC
Let's have a closer look at the last packet of the data capture:
21A # 85 22 FC
In our case, the identifier 21A stands for the status of the lights. The data payload consists of the status for each lamp. The first byte (HEX 85) is used for the exterior lights. We have to convert HEX 85 to bytes:
85 hex = 133 dec = "1 0 0 0 0 1 0 1" 8-bit binary
The hex value converted to 8-bit binary will give us 8 individual status indicators, each bit stands for a specific light. First byte is the brake light, second one is the rear fog light and so on.
To parse the vast amount of data of the CAN bus, we wrote a small NodeJS program, which filters the relevant data and forwards it to connected clients over the internet using WebSockets. The client app shows a virtual dashboard of our car, where sensor readings are visualized in real time. When you turn the steering wheel, the steering wheel in the virtual dashboard of the app will turn as well. Same for pedal positions, RPM and speed gauge, turn indicator, fuel level etc. In a second app the motor data is visualized in a real time chart.
GPS Tracking
The raspberry is also equipped with a GPS dongle to track the position of the car, which is shown in real time on a google map, combined with sensor readings from the CAN bus to display speed, RPM, fuel level.
In this project we just implemented read access to the CAN bus, however in the professional grade suction excavator truck the communication is bi-directional. It's even possible to drive the suction excavator truck "by wire" using CAN bus commands.
In this project we just implemented read access to the CAN bus, however in the professional grade suction excavator truck the communication is bi-directional. It's even possible to drive the suction excavator truck "by wire" using CAN bus commands.