Volvo S80 diagnostics message format

[Marcel van Lieshout]

Some parts of this message have been removed. Learn more about Nabble's security policy.

I agree with you on safety, which is why I stay away from the powertrain canbus and focus on the interior canbus. There are companies that sell additions for the canbus. Where do they get their information?

 

----- Original Message -----

From: johnd@...

To: canlist@...

Sent: Tuesday, August 18, 2009 10:10 PM

Subject: RE: [CANLIST] Volvo S80 diagnostics message format

Hi,

 

There's a good reason the manufacturers keep this secret. 

 

Many years ago now I designed a fuel injection and CD ignition system that was used for Honda VTEC engines on aircraft and hovercraft.  I used CAN for reporting engine information and for setting fuel injection and ignition parameters.  When tuning the engine on the dyno we could modify the engine on the fly with a program running on the PC with messages out a PPCAN to the ECU.  I also built a small dashboard instrument that showed RPM and other engine parameters and it just listened in on the CAN messages.

 

Given the risk of someone modifying something critical while in flight or even before a flight and the potential of an accident I never released the structure of the messages or how to change parameters.  Although this may not be as critical in a car, the potential of the car being compromised is still there and I don't think I'd want the potential lawsuit or even want to deal with warranty issues after a user put the parameters back to stock.

 

So although I'd really like to snoop on the CAN buses in my wife's new AUDI A3 with the 6 speed dual clutch automatic transmission I can understand why Audi doesn't want me to know this.  Especially since the computer blips the drive by wire throttle on down shifts.  Just imagine a blip when the clutch is engaged at a cross walk with a mother and her baby carriage in front of the car.

 

I'd rather not know.

 

John

 

Automation Artisans Inc.
http://www.autoartisans.com/ELS/
Ph. 1 250 544 4950

-----Original Message-----
From: canlist-owner@... [mailto:canlist-owner@...] On Behalf Of Sweede Speed
Sent: Tuesday, August 18, 2009 12:37 PM
To: canlist@...
Subject: Re: [CANLIST] Volvo S80 diagnostics message format

Al,

 

I'm interested in Volvo format and I understand that pretty much anyone that has access to it cannot share it. That is way I also said that simple request/reponse example would help. Does not even have to be explained what it contains. Just like if anybody would have monitored CANBUS while communicating with their car. If I had any single message I could send to the car and it would respond back, currently I do not have even that. Then I can start experimenting and putting together all the other information I have gathered to try to understand/guess the format. 93 bits with any known value limits down considerably from 93 bits all unknown values.

 

Thanks,

Sweede

>Sweede,
>I want to be clear on your question: do you want to know how to decode ISO 9141 or do you want to know how to decode information in Volvo >format?
>If you want the Volvo format, we can't help you: that information is proprietary and any of us that have had access to it have signed (or our company >has signed) non-disclosure agreements.  Potentially big legal (and financial) problems if that information were passed on to you.
>If you want ISO (or SAE), the documents are readily available, albeit expensive.  You might check with your local technical college (assuming they >have an automotive curriculum); they may have the documentation and allow you access to it.
>Regards,
>Al Pothoof
 

[John Dammeyer]

Some parts of this message have been removed. Learn more about Nabble's security policy.

If I was going to make something that added onto an existing CAN bus (and I have been asked) what I would do is look at the size of the market.  If it's large enough, odds are Volvo or Bosch or whoever is in charge of the body network probably has a licensing agreement. 

 

Alternatively, you park a monitor on the bus and start an analysis.  This can take a long time but you might get lucky.

 

John

 

 

Automation Artisans Inc.
http://www.autoartisans.com/ELS/
Ph. 1 250 544 4950

-----Original Message-----
From: canlist-owner@... [mailto:canlist-owner@...] On Behalf Of Marcel van Lieshout
Sent: Tuesday, August 18, 2009 1:32 PM
To: canlist@...
Subject: [CANLIST] Volvo S80 diagnostics message format

I agree with you on safety, which is why I stay away from the powertrain canbus and focus on the interior canbus. There are companies that sell additions for the canbus. Where do they get their information?

 

----- Original Message -----

From: johnd@...

To: canlist@...

Sent: Tuesday, August 18, 2009 10:10 PM

Subject: RE: [CANLIST] Volvo S80 diagnostics message format

Hi,

 

There's a good reason the manufacturers keep this secret. 

 

Many years ago now I designed a fuel injection and CD ignition system that was used for Honda VTEC engines on aircraft and hovercraft.  I used CAN for reporting engine information and for setting fuel injection and ignition parameters.  When tuning the engine on the dyno we could modify the engine on the fly with a program running on the PC with messages out a PPCAN to the ECU.  I also built a small dashboard instrument that showed RPM and other engine parameters and it just listened in on the CAN messages.

 

Given the risk of someone modifying something critical while in flight or even before a flight and the potential of an accident I never released the structure of the messages or how to change parameters.  Although this may not be as critical in a car, the potential of the car being compromised is still there and I don't think I'd want the potential lawsuit or even want to deal with warranty issues after a user put the parameters back to stock.

 

So although I'd really like to snoop on the CAN buses in my wife's new AUDI A3 with the 6 speed dual clutch automatic transmission I can understand why Audi doesn't want me to know this.  Especially since the computer blips the drive by wire throttle on down shifts.  Just imagine a blip when the clutch is engaged at a cross walk with a mother and her baby carriage in front of the car.

 

I'd rather not know.

 

John

 

Automation Artisans Inc.
http://www.autoartisans.com/ELS/
Ph. 1 250 544 4950

-----Original Message-----
From: canlist-owner@... [mailto:canlist-owner@...] On Behalf Of Sweede Speed
Sent: Tuesday, August 18, 2009 12:37 PM
To: canlist@...
Subject: Re: [CANLIST] Volvo S80 diagnostics message format

Al,

 

I'm interested in Volvo format and I understand that pretty much anyone that has access to it cannot share it. That is way I also said that simple request/reponse example would help. Does not even have to be explained what it contains. Just like if anybody would have monitored CANBUS while communicating with their car. If I had any single message I could send to the car and it would respond back, currently I do not have even that. Then I can start experimenting and putting together all the other information I have gathered to try to understand/guess the format. 93 bits with any known value limits down considerably from 93 bits all unknown values.

 

Thanks,

Sweede

>Sweede,
>I want to be clear on your question: do you want to know how to decode ISO 9141 or do you want to know how to decode information in Volvo >format?
>If you want the Volvo format, we can't help you: that information is proprietary and any of us that have had access to it have signed (or our company >has signed) non-disclosure agreements.  Potentially big legal (and financial) problems if that information were passed on to you.
>If you want ISO (or SAE), the documents are readily available, albeit expensive.  You might check with your local technical college (assuming they >have an automotive curriculum); they may have the documentation and allow you access to it.
>Regards,
>Al Pothoof
 

[Bram Kerkhof]

Some parts of this message have been removed. Learn more about Nabble's security policy.

A lot of companies that are active in this market rely on reverse engineering, which can go pretty far. I remember a case where the official/only importer for a well-known German constructor had to hire a third party company to reverse engineer the body CAN HLP because it wanted to be able to sell the vehicles with third party radios and navigation systems (the OEM head end implemented a number of functions other than just audio which were required to get the car to run). For most constructors, there are a very limited number of engineers that have access to the complete specification of the protocol; most only get access to the parts that are related to their work.

 

Personally, I don’t like the notion that the ‘secrecy’ of a CAN HLP helps implement security: the idea of security through obscurity is fundamentally flawed. The proper implementation of a device that is connected to the powertrain CAN of a vehicle should not depend of the protocol that happens to be used on that CAN bus: it is up to the developer of the device to ensure that it behaves properly, regardless of the protocol being used. Blipping the engine at an inappropriate time is a designer error; regardless of how it is encoded on the bus. Proper documentation of the protocol is always better than the information acquired via reverse engineering.

 

Same goes for your aircraft engine: if someone is dumb enough to crash a plane due to fiddling with the engine parameters while in-flight, it is pretty damn clear that the structure of the messages has nothing to do with it.

 

The secrecy regarding CAN implementation has more to do with protectionism than with security, which is a proper reason in itself.

 

As long as you are knowledgeable about CAN, and have enough common sense to know that you shouldn’t be transmitting stuff on the powertrain CAN bus unless you absolutely positively know what you are doing just go ahead and snoop the CAN bus on your wife’s shiny new A3. It is relatively easy (and fun ;-) to figure the basic stuff out.

 

cheers,

Bram

 

From: canlist-owner@... [mailto:canlist-owner@...] On Behalf Of Marcel van Lieshout
Sent: dinsdag 18 augustus 2009 22:32
To: canlist@...
Subject: [CANLIST] Volvo S80 diagnostics message format

 

I agree with you on safety, which is why I stay away from the powertrain canbus and focus on the interior canbus. There are companies that sell additions for the canbus. Where do they get their information?

 

----- Original Message -----

From: johnd@...

To: canlist@...

Sent: Tuesday, August 18, 2009 10:10 PM

Subject: RE: [CANLIST] Volvo S80 diagnostics message format

 

Hi,

 

There's a good reason the manufacturers keep this secret. 

 

Many years ago now I designed a fuel injection and CD ignition system that was used for Honda VTEC engines on aircraft and hovercraft.  I used CAN for reporting engine information and for setting fuel injection and ignition parameters.  When tuning the engine on the dyno we could modify the engine on the fly with a program running on the PC with messages out a PPCAN to the ECU.  I also built a small dashboard instrument that showed RPM and other engine parameters and it just listened in on the CAN messages.

 

Given the risk of someone modifying something critical while in flight or even before a flight and the potential of an accident I never released the structure of the messages or how to change parameters.  Although this may not be as critical in a car, the potential of the car being compromised is still there and I don't think I'd want the potential lawsuit or even want to deal with warranty issues after a user put the parameters back to stock.

 

So although I'd really like to snoop on the CAN buses in my wife's new AUDI A3 with the 6 speed dual clutch automatic transmission I can understand why Audi doesn't want me to know this.  Especially since the computer blips the drive by wire throttle on down shifts.  Just imagine a blip when the clutch is engaged at a cross walk with a mother and her baby carriage in front of the car.

 

I'd rather not know.

 

John

 

Automation Artisans Inc.
http://www.autoartisans.com/ELS/
Ph. 1 250 544 4950

-----Original Message-----
From: canlist-owner@... [mailto:canlist-owner@...] On Behalf Of Sweede Speed
Sent: Tuesday, August 18, 2009 12:37 PM
To: canlist@...
Subject: Re: [CANLIST] Volvo S80 diagnostics message format

Al,

 

I'm interested in Volvo format and I understand that pretty much anyone that has access to it cannot share it. That is way I also said that simple request/reponse example would help. Does not even have to be explained what it contains. Just like if anybody would have monitored CANBUS while communicating with their car. If I had any single message I could send to the car and it would respond back, currently I do not have even that. Then I can start experimenting and putting together all the other information I have gathered to try to understand/guess the format. 93 bits with any known value limits down considerably from 93 bits all unknown values.

 

Thanks,

Sweede

>Sweede,
>I want to be clear on your question: do you want to know how to decode ISO 9141 or do you want to know how to decode information in Volvo >format?
>If you want the Volvo format, we can't help you: that information is proprietary and any of us that have had access to it have signed (or our company >has signed) non-disclosure agreements.  Potentially big legal (and financial) problems if that information were passed on to you.
>If you want ISO (or SAE), the documents are readily available, albeit expensive.  You might check with your local technical college (assuming they >have an automotive curriculum); they may have the documentation and allow you access to it.
>Regards,
>Al Pothoof
 

 

[Marcel van Lieshout]

Some parts of this message have been removed. Learn more about Nabble's security policy.

To facilitate sniffing, is there a free tool available that can work with canbus traces instead of live canbus access? Open source would be great to be able to adapt the tool to a particular logfile type.

----- Original Message -----

From: canbus@...

To: canlist@...

Sent: Wednesday, August 19, 2009 11:54 AM

Subject: RE: [CANLIST] Volvo S80 diagnostics message format

A lot of companies that are active in this market rely on reverse engineering, which can go pretty far. I remember a case where the official/only importer for a well-known German constructor had to hire a third party company to reverse engineer the body CAN HLP because it wanted to be able to sell the vehicles with third party radios and navigation systems (the OEM head end implemented a number of functions other than just audio which were required to get the car to run). For most constructors, there are a very limited number of engineers that have access to the complete specification of the protocol; most only get access to the parts that are related to their work.

 

Personally, I don’t like the notion that the ‘secrecy’ of a CAN HLP helps implement security: the idea of security through obscurity is fundamentally flawed. The proper implementation of a device that is connected to the powertrain CAN of a vehicle should not depend of the protocol that happens to be used on that CAN bus: it is up to the developer of the device to ensure that it behaves properly, regardless of the protocol being used. Blipping the engine at an inappropriate time is a designer error; regardless of how it is encoded on the bus. Proper documentation of the protocol is always better than the information acquired via reverse engineering.

 

Same goes for your aircraft engine: if someone is dumb enough to crash a plane due to fiddling with the engine parameters while in-flight, it is pretty damn clear that the structure of the messages has nothing to do with it.

 

The secrecy regarding CAN implementation has more to do with protectionism than with security, which is a proper reason in itself.

 

As long as you are knowledgeable about CAN, and have enough common sense to know that you shouldn’t be transmitting stuff on the powertrain CAN bus unless you absolutely positively know what you are doing just go ahead and snoop the CAN bus on your wife’s shiny new A3. It is relatively easy (and fun ;-) to figure the basic stuff out.

 

cheers,

Bram

 

From: canlist-owner@... [mailto:canlist-owner@...] On Behalf Of Marcel van Lieshout
Sent: dinsdag 18 augustus 2009 22:32
To: canlist@...
Subject: [CANLIST] Volvo S80 diagnostics message format

 

I agree with you on safety, which is why I stay away from the powertrain canbus and focus on the interior canbus. There are companies that sell additions for the canbus. Where do they get their information?

 

----- Original Message -----

From: johnd@...

To: canlist@...

Sent: Tuesday, August 18, 2009 10:10 PM

Subject: RE: [CANLIST] Volvo S80 diagnostics message format

 

Hi,

 

There's a good reason the manufacturers keep this secret. 

 

Many years ago now I designed a fuel injection and CD ignition system that was used for Honda VTEC engines on aircraft and hovercraft.  I used CAN for reporting engine information and for setting fuel injection and ignition parameters.  When tuning the engine on the dyno we could modify the engine on the fly with a program running on the PC with messages out a PPCAN to the ECU.  I also built a small dashboard instrument that showed RPM and other engine parameters and it just listened in on the CAN messages.

 

Given the risk of someone modifying something critical while in flight or even before a flight and the potential of an accident I never released the structure of the messages or how to change parameters.  Although this may not be as critical in a car, the potential of the car being compromised is still there and I don't think I'd want the potential lawsuit or even want to deal with warranty issues after a user put the parameters back to stock.

 

So although I'd really like to snoop on the CAN buses in my wife's new AUDI A3 with the 6 speed dual clutch automatic transmission I can understand why Audi doesn't want me to know this.  Especially since the computer blips the drive by wire throttle on down shifts.  Just imagine a blip when the clutch is engaged at a cross walk with a mother and her baby carriage in front of the car.

 

I'd rather not know.

 

John

 

Automation Artisans Inc.
http://www.autoartisans.com/ELS/
Ph. 1 250 544 4950

-----Original Message-----
From: canlist-owner@... [mailto:canlist-owner@...] On Behalf Of Sweede Speed
Sent: Tuesday, August 18, 2009 12:37 PM
To: canlist@...
Subject: Re: [CANLIST] Volvo S80 diagnostics message format

Al,

 

I'm interested in Volvo format and I understand that pretty much anyone that has access to it cannot share it. That is way I also said that simple request/reponse example would help. Does not even have to be explained what it contains. Just like if anybody would have monitored CANBUS while communicating with their car. If I had any single message I could send to the car and it would respond back, currently I do not have even that. Then I can start experimenting and putting together all the other information I have gathered to try to understand/guess the format. 93 bits with any known value limits down considerably from 93 bits all unknown values.

 

Thanks,

Sweede

>Sweede,
>I want to be clear on your question: do you want to know how to decode ISO 9141 or do you want to know how to decode information in Volvo >format?
>If you want the Volvo format, we can't help you: that information is proprietary and any of us that have had access to it have signed (or our company >has signed) non-disclosure agreements.  Potentially big legal (and financial) problems if that information were passed on to you.
>If you want ISO (or SAE), the documents are readily available, albeit expensive.  You might check with your local technical college (assuming they >have an automotive curriculum); they may have the documentation and allow you access to it.
>Regards,
>Al Pothoof
 

 

[Kees Zagers]

Some parts of this message have been removed. Learn more about Nabble's security policy.

In the past some TV sets had their schematics on the inside of the back cover. Everyone who had some knowledge of electronics thought that he could repair his TV. A lot of high voltage damage occured to the TV sets (if you were lucky) or to the human being :-(. People who knew how a TV was really working did not need the schematics and they knew it was dangerous inside.

 

If a car manufacturer opens its CAN communication protocol the people which survived the TV set are now starting their CAN activities. The people that really first sniff the bus (and so they know what they are doing) don't need the protocol from the car manufacturer.

 

So far my 50 cts (it is a the holiday period anyway :-)

 

Kees Zagers

 

 

----- Original Message -----

From: canbus@...

To: canlist@...

Sent: Wednesday, August 19, 2009 11:54 AM

Subject: RE: [CANLIST] Volvo S80 diagnostics message format

A lot of companies that are active in this market rely on reverse engineering, which can go pretty far. I remember a case where the official/only importer for a well-known German constructor had to hire a third party company to reverse engineer the body CAN HLP because it wanted to be able to sell the vehicles with third party radios and navigation systems (the OEM head end implemented a number of functions other than just audio which were required to get the car to run). For most constructors, there are a very limited number of engineers that have access to the complete specification of the protocol; most only get access to the parts that are related to their work.

 

Personally, I don’t like the notion that the ‘secrecy’ of a CAN HLP helps implement security: the idea of security through obscurity is fundamentally flawed. The proper implementation of a device that is connected to the powertrain CAN of a vehicle should not depend of the protocol that happens to be used on that CAN bus: it is up to the developer of the device to ensure that it behaves properly, regardless of the protocol being used. Blipping the engine at an inappropriate time is a designer error; regardless of how it is encoded on the bus. Proper documentation of the protocol is always better than the information acquired via reverse engineering.

 

Same goes for your aircraft engine: if someone is dumb enough to crash a plane due to fiddling with the engine parameters while in-flight, it is pretty damn clear that the structure of the messages has nothing to do with it.

 

The secrecy regarding CAN implementation has more to do with protectionism than with security, which is a proper reason in itself.

 

As long as you are knowledgeable about CAN, and have enough common sense to know that you shouldn’t be transmitting stuff on the powertrain CAN bus unless you absolutely positively know what you are doing just go ahead and snoop the CAN bus on your wife’s shiny new A3. It is relatively easy (and fun ;-) to figure the basic stuff out.

 

cheers,

Bram

 

From: canlist-owner@... [mailto:canlist-owner@...] On Behalf Of Marcel van Lieshout
Sent: dinsdag 18 augustus 2009 22:32
To: canlist@...
Subject: [CANLIST] Volvo S80 diagnostics message format

 

I agree with you on safety, which is why I stay away from the powertrain canbus and focus on the interior canbus. There are companies that sell additions for the canbus. Where do they get their information?

 

----- Original Message -----

From: johnd@...

To: canlist@...

Sent: Tuesday, August 18, 2009 10:10 PM

Subject: RE: [CANLIST] Volvo S80 diagnostics message format

 

Hi,

 

There's a good reason the manufacturers keep this secret. 

 

Many years ago now I designed a fuel injection and CD ignition system that was used for Honda VTEC engines on aircraft and hovercraft.  I used CAN for reporting engine information and for setting fuel injection and ignition parameters.  When tuning the engine on the dyno we could modify the engine on the fly with a program running on the PC with messages out a PPCAN to the ECU.  I also built a small dashboard instrument that showed RPM and other engine parameters and it just listened in on the CAN messages.

 

Given the risk of someone modifying something critical while in flight or even before a flight and the potential of an accident I never released the structure of the messages or how to change parameters.  Although this may not be as critical in a car, the potential of the car being compromised is still there and I don't think I'd want the potential lawsuit or even want to deal with warranty issues after a user put the parameters back to stock.

 

So although I'd really like to snoop on the CAN buses in my wife's new AUDI A3 with the 6 speed dual clutch automatic transmission I can understand why Audi doesn't want me to know this.  Especially since the computer blips the drive by wire throttle on down shifts.  Just imagine a blip when the clutch is engaged at a cross walk with a mother and her baby carriage in front of the car.

 

I'd rather not know.

 

John

 

Automation Artisans Inc.
http://www.autoartisans.com/ELS/
Ph. 1 250 544 4950

-----Original Message-----
From: canlist-owner@... [mailto:canlist-owner@...] On Behalf Of Sweede Speed
Sent: Tuesday, August 18, 2009 12:37 PM
To: canlist@...
Subject: Re: [CANLIST] Volvo S80 diagnostics message format

Al,

 

I'm interested in Volvo format and I understand that pretty much anyone that has access to it cannot share it. That is way I also said that simple request/reponse example would help. Does not even have to be explained what it contains. Just like if anybody would have monitored CANBUS while communicating with their car. If I had any single message I could send to the car and it would respond back, currently I do not have even that. Then I can start experimenting and putting together all the other information I have gathered to try to understand/guess the format. 93 bits with any known value limits down considerably from 93 bits all unknown values.

 

Thanks,

Sweede

>Sweede,
>I want to be clear on your question: do you want to know how to decode ISO 9141 or do you want to know how to decode information in Volvo >format?
>If you want the Volvo format, we can't help you: that information is proprietary and any of us that have had access to it have signed (or our company >has signed) non-disclosure agreements.  Potentially big legal (and financial) problems if that information were passed on to you.
>If you want ISO (or SAE), the documents are readily available, albeit expensive.  You might check with your local technical college (assuming they >have an automotive curriculum); they may have the documentation and allow you access to it.
>Regards,
>Al Pothoof
 

 

[Funny N.]

Some parts of this message have been removed. Learn more about Nabble's security policy.

Sure it is doable, it doesn't matter who designed it, Volvo, Bosch, Denso, etc. In most of the case, it just a matter of time.

Here is an example on simulate the Auto ABS ECU CAN bus activities:
http://augroups.blogspot.com/search/label/ABS%20ECU%20CAN%20Simulator

What it does is: take a regular hall speed sensor signal, convert it to digital speed signal, then broadcast the vehicle speed just like regular Auto ABS ECU does. It helps people who needs using a used "engine equipped with CAN bus" for their own purpose. For instance, there are now many auto engines are installed on small airplanes, lots of Subaru engines are installed in VW vehicles. Without the Speed CAN signal simulator, the engine either won't run at all after a few minutes, or run in a limp home mode. The CAN signal simulator does make the engine working in a normal mode.

Funny N.
Au Group Electronics, http://www.AuElectronics.com
http://www.AuElectronics.com/products
http://augroups.blogspot.com/

---

From: John Dammeyer <johnd@...>
To: canlist@...
Sent: Wednesday, August 19, 2009 1:18:11 AM
Subject: RE: [CANLIST] Volvo S80 diagnostics message format

If I was going to make something that added onto an existing CAN bus (and I have been asked) what I would do is look at the size of the market.  If it's large enough, odds are Volvo or Bosch or whoever is in charge of the body network probably has a licensing agreement. 

 

Alternatively, you park a monitor on the bus and start an analysis.  This can take a long time but you might get lucky.

 

John

 

 

Automation Artisans Inc.
http://www.autoartisans.com/ELS/
Ph. 1 250 544 4950

-----Original Message-----
From: canlist-owner@... [mailto:canlist-owner@...] On Behalf Of Marcel van Lieshout
Sent: Tuesday, August 18, 2009 1:32 PM
To: canlist@...
Subject: [CANLIST] Volvo S80 diagnostics message format

I agree with you on safety, which is why I stay away from the powertrain canbus and focus on the interior canbus. There are companies that sell additions for the canbus. Where do they get their information?

 

----- Original Message -----

From: johnd@...

To: canlist@...

Sent: Tuesday, August 18, 2009 10:10 PM

Subject: RE: [CANLIST] Volvo S80 diagnostics message format

Hi,

 

There's a good reason the manufacturers keep this secret. 

 

Many years ago now I designed a fuel injection and CD ignition system that was used for Honda VTEC engines on aircraft and hovercraft.  I used CAN for reporting engine information and for setting fuel injection and ignition parameters.  When tuning the engine on the dyno we could modify the engine on the fly with a program running on the PC with messages out a PPCAN to the ECU.  I also built a small dashboard instrument that showed RPM and other engine parameters and it just listened in on the CAN messages.

 

Given the risk of someone modifying something critical while in flight or even before a flight and the potential of an accident I never released the structure of the messages or how to change parameters.  Although this may not be as critical in a car, the potential of the car being compromised is still there and I don't think I'd want the potential lawsuit or even want to deal with warranty issues after a user put the parameters back to stock.

 

So although I'd really like to snoop on the CAN buses in my wife's new AUDI A3 with the 6 speed dual clutch automatic transmission I can understand why Audi doesn't want me to know this.  Especially since the computer blips the drive by wire throttle on down shifts.  Just imagine a blip when the clutch is engaged at a cross walk with a mother and her baby carriage in front of the car.

 

I'd rather not know.

 

John

 

Automation Artisans Inc.
http://www.autoartisans.com/ELS/
Ph. 1 250 544 4950

-----Original Message-----
From: canlist-owner@... [mailto:canlist-owner@...] On Behalf Of Sweede Speed
Sent: Tuesday, August 18, 2009 12:37 PM
To: canlist@...
Subject: Re: [CANLIST] Volvo S80 diagnostics message format

Al,

 

I'm interested in Volvo format and I understand that pretty much anyone that has access to it cannot share it. That is way I also said that simple request/reponse example would help. Does not even have to be explained what it contains. Just like if anybody would have monitored CANBUS while communicating with their car. If I had any single message I could send to the car and it would respond back, currently I do not have even that. Then I can start experimenting and putting together all the other information I have gathered to try to understand/guess the format. 93 bits with any known value limits down considerably from 93 bits all unknown values.

 

Thanks,

Sweede

>Sweede,
>I want to be clear on your question: do you want to know how to decode ISO 9141 or do you want to know how to decode information in Volvo >format?
>If you want the Volvo format, we can't help you: that information is proprietary and any of us that have had access to it have signed (or our company >has signed) non-disclosure agreements.  Potentially big legal (and financial) problems if that information were passed on to you.
>If you want ISO (or SAE), the documents are readily available, albeit expensive.  You might check with your local technical college (assuming they >have an automotive curriculum); they may have the documentation and allow you access to it.
>Regards,
>Al Pothoof
 

[Bram Kerkhof]

Some parts of this message have been removed. Learn more about Nabble's security policy.

Ah… That brings back memories of the time I managed to trip a fuse/switch in the local power converter station for our street. I still don’t know exactly what went wrong, other than doing some ‘live’ measurements to the circuit board of a Hercules monitor and ending up with one of the probes of my multimeter being arc-welded to the innards of that thing. It really helped that the lights went out in half the street to convince my parents that I had absolutely nothing to do with it…  (I was 13 at the time, so cut me some slack ;-) – so you could say I’m a survivor :-P

 

There are CAN HLPs that have been opened (SAE J1939 being a very nice example here) and I don’t think that there is much impact on tinkering people… Currently CAN is simply too exotic as a technology for the hobbyist crowd to be tinkering with it. It will happen sooner or later, when some kind of CAN bus knowledge is required to keep “old cars” working, or to modify them. At that time the info will be available in some car enthusiast forum as reverse-engineered by a kid who isn’t old enough yet to drive, for an audience who has no clue on proper automotive design. Personally, I’d rather have known-good information from a trustable source.

 

Enjoy your holiday!

 

cheers,

Bram

 

From: canlist-owner@... [mailto:canlist-owner@...] On Behalf Of Kees Zagers
Sent: woensdag 19 augustus 2009 15:06
To: canlist@...
Subject: Re: [CANLIST] Volvo S80 diagnostics message format

 

In the past some TV sets had their schematics on the inside of the back cover. Everyone who had some knowledge of electronics thought that he could repair his TV. A lot of high voltage damage occured to the TV sets (if you were lucky) or to the human being :-(. People who knew how a TV was really working did not need the schematics and they knew it was dangerous inside.

 

If a car manufacturer opens its CAN communication protocol the people which survived the TV set are now starting their CAN activities. The people that really first sniff the bus (and so they know what they are doing) don't need the protocol from the car manufacturer.

 

So far my 50 cts (it is a the holiday period anyway :-)

 

Kees Zagers

 

 

----- Original Message -----

From: canbus@...

To: canlist@...

Sent: Wednesday, August 19, 2009 11:54 AM

Subject: RE: [CANLIST] Volvo S80 diagnostics message format

 

A lot of companies that are active in this market rely on reverse engineering, which can go pretty far. I remember a case where the official/only importer for a well-known German constructor had to hire a third party company to reverse engineer the body CAN HLP because it wanted to be able to sell the vehicles with third party radios and navigation systems (the OEM head end implemented a number of functions other than just audio which were required to get the car to run). For most constructors, there are a very limited number of engineers that have access to the complete specification of the protocol; most only get access to the parts that are related to their work.

 

Personally, I don’t like the notion that the ‘secrecy’ of a CAN HLP helps implement security: the idea of security through obscurity is fundamentally flawed. The proper implementation of a device that is connected to the powertrain CAN of a vehicle should not depend of the protocol that happens to be used on that CAN bus: it is up to the developer of the device to ensure that it behaves properly, regardless of the protocol being used. Blipping the engine at an inappropriate time is a designer error; regardless of how it is encoded on the bus. Proper documentation of the protocol is always better than the information acquired via reverse engineering.

 

Same goes for your aircraft engine: if someone is dumb enough to crash a plane due to fiddling with the engine parameters while in-flight, it is pretty damn clear that the structure of the messages has nothing to do with it.

 

The secrecy regarding CAN implementation has more to do with protectionism than with security, which is a proper reason in itself.

 

As long as you are knowledgeable about CAN, and have enough common sense to know that you shouldn’t be transmitting stuff on the powertrain CAN bus unless you absolutely positively know what you are doing just go ahead and snoop the CAN bus on your wife’s shiny new A3. It is relatively easy (and fun ;-) to figure the basic stuff out.

 

cheers,

Bram

 

From: canlist-owner@... [mailto:canlist-owner@...] On Behalf Of Marcel van Lieshout
Sent: dinsdag 18 augustus 2009 22:32
To: canlist@...
Subject: [CANLIST] Volvo S80 diagnostics message format

 

I agree with you on safety, which is why I stay away from the powertrain canbus and focus on the interior canbus. There are companies that sell additions for the canbus. Where do they get their information?

 

----- Original Message -----

From: johnd@...

To: canlist@...

Sent: Tuesday, August 18, 2009 10:10 PM

Subject: RE: [CANLIST] Volvo S80 diagnostics message format

 

Hi,

 

There's a good reason the manufacturers keep this secret. 

 

Many years ago now I designed a fuel injection and CD ignition system that was used for Honda VTEC engines on aircraft and hovercraft.  I used CAN for reporting engine information and for setting fuel injection and ignition parameters.  When tuning the engine on the dyno we could modify the engine on the fly with a program running on the PC with messages out a PPCAN to the ECU.  I also built a small dashboard instrument that showed RPM and other engine parameters and it just listened in on the CAN messages.

 

Given the risk of someone modifying something critical while in flight or even before a flight and the potential of an accident I never released the structure of the messages or how to change parameters.  Although this may not be as critical in a car, the potential of the car being compromised is still there and I don't think I'd want the potential lawsuit or even want to deal with warranty issues after a user put the parameters back to stock.

 

So although I'd really like to snoop on the CAN buses in my wife's new AUDI A3 with the 6 speed dual clutch automatic transmission I can understand why Audi doesn't want me to know this.  Especially since the computer blips the drive by wire throttle on down shifts.  Just imagine a blip when the clutch is engaged at a cross walk with a mother and her baby carriage in front of the car.

 

I'd rather not know.

 

John

 

Automation Artisans Inc.
http://www.autoartisans.com/ELS/
Ph. 1 250 544 4950

-----Original Message-----
From: canlist-owner@... [mailto:canlist-owner@...] On Behalf Of Sweede Speed
Sent: Tuesday, August 18, 2009 12:37 PM
To: canlist@...
Subject: Re: [CANLIST] Volvo S80 diagnostics message format

Al,

 

I'm interested in Volvo format and I understand that pretty much anyone that has access to it cannot share it. That is way I also said that simple request/reponse example would help. Does not even have to be explained what it contains. Just like if anybody would have monitored CANBUS while communicating with their car. If I had any single message I could send to the car and it would respond back, currently I do not have even that. Then I can start experimenting and putting together all the other information I have gathered to try to understand/guess the format. 93 bits with any known value limits down considerably from 93 bits all unknown values.

 

Thanks,

Sweede

>Sweede,
>I want to be clear on your question: do you want to know how to decode ISO 9141 or do you want to know how to decode information in Volvo >format?
>If you want the Volvo format, we can't help you: that information is proprietary and any of us that have had access to it have signed (or our company >has signed) non-disclosure agreements.  Potentially big legal (and financial) problems if that information were passed on to you.
>If you want ISO (or SAE), the documents are readily available, albeit expensive.  You might check with your local technical college (assuming they >have an automotive curriculum); they may have the documentation and allow you access to it.
>Regards,
>Al Pothoof