Looping CAN BUS signal or turning a reading into a input

Thread Starter

Atkinson01

Joined Jan 27, 2023
11
Hello you all I am trying to hack your canvas system. I am working on a vehicle that has a four wire can bus. I think that’s how you say it. It has a active terminator and a passive and controller in between… each controller, has a number of addresses where you can read data and inputs, and our being relayed via CAN my goal is to grab the reading, called desired fan speed, which is changing as the seconds are going, depending on engine, load, engine, temperature, hydraulic temperature, etc. and grabbing that information off of the bus, and somehow transforming it into a input and tell the ECU that is what is actually is happening so basically grabbing desired fan, speed and telling the ECU that is what is the actual fan speed is in other words I want to lie to the ECU if you will, or loop information is this possible you think I by no means am any expert in programming or software or anything. However, I do deal with electrical issues I can read schematics I’m a diesel technician on the quest to create something to illuminate a speed sensor and make things a little more mechanical without the computer knowing if you all have any idea on who I can talk to to help or where I can go to see any information, I would really appreciate it . Thank you very much. Have a good day.
 

Papabravo

Joined Feb 24, 2006
21,157
Hello you all I am trying to hack your canvas system. I am working on a vehicle that has a four wire can bus. I think that’s how you say it. It has a active terminator and a passive and controller in between… each controller, has a number of addresses where you can read data and inputs, and our being relayed via CAN my goal is to grab the reading, called desired fan speed, which is changing as the seconds are going, depending on engine, load, engine, temperature, hydraulic temperature, etc. and grabbing that information off of the bus, and somehow transforming it into a input and tell the ECU that is what is actually is happening so basically grabbing desired fan, speed and telling the ECU that is what is the actual fan speed is in other words I want to lie to the ECU if you will, or loop information is this possible you think I by no means am any expert in programming or software or anything. However, I do deal with electrical issues I can read schematics I’m a diesel technician on the quest to create something to illuminate a speed sensor and make things a little more mechanical without the computer knowing if you all have any idea on who I can talk to to help or where I can go to see any information, I would really appreciate it . Thank you very much. Have a good day.
This may be quite difficult to do because of the nature of the CAN bus. In the simplest arrangement of a 3 node bus consisting of the sensor, the ECU, and the interloper; the interloper CANNOT prevent the ECU from receiving, the CAN frames produced by the sensor. You can try to send bogus messages, but you would have to use the same identifier in the CAN frame that was used by the sensor. In a properly functioning network, it should not be possible for two nodes to produce a CAN frame with the same identifier. In short, I think it will not be possible to do what you want to do on a single network.

If you want to isolate the ECU from the sensor, then you could build a bridge between the two networks. Mostly you would store and forward messages until you decided to lie to the ECU for whatever purpose you had in mind. There would normally be a good deal of research involve in bringing up and configuring such a network so the sensor and the ECU were not aware of what was going on.

PS, I know a guy at Chrysler, who has worked on this exact problem of counterfeit devices and has implemented security measures on the CAN bus to prevent exactly this kind of mischief including bricking the ECU to prevent further malfeasance. If you take the bricked ECU to the dealership for repair or replacement, they will shrug their shoulders and you will have some explaining to do.
 

GetDeviceInfo

Joined Jun 7, 2009
2,192
Not that uncommon in the diy space. As mentioned, your sensor would sit behind a controller that would emulate it on the bus. The sensor itself then comms with the controller. Gives you room to vary the type of sensor, translated by the controller
 

Thread Starter

Atkinson01

Joined Jan 27, 2023
11
This may be quite difficult to do because of the nature of the CAN bus. In the simplest arrangement of a 3 node bus consisting of the sensor, the ECU, and the interloper; the interloper CANNOT prevent the ECU from receiving, the CAN frames produced by the sensor. You can try to send bogus messages, but you would have to use the same identifier in the CAN frame that was used by the sensor. In a properly functioning network, it should not be possible for two nodes to produce a CAN frame with the same identifier. In short, I think it will not be possible to do what you want to do on a single network.

If you want to isolate the ECU from the sensor, then you could build a bridge between the two networks. Mostly you would store and forward messages until you decided to lie to the ECU for whatever purpose you had in mind. There would normally be a good deal of research involve in bringing up and configuring such a network so the sensor and the ECU were not aware of what was going on.

PS, I know a guy at Chrysler, who has worked on this exact problem of counterfeit devices and has implemented security measures on the CAN bus to prevent exactly this kind of mischief including bricking the ECU to prevent further malfeasance. If you take the bricked ECU to the dealership for repair or replacement, they will shrug their shoulders and you will have some explaining to do.
So what I am trying to do is delete a variable speed. It’s a fan drive system that changes the speed of the fan depending on certain parameters of inputs to the ECU. I simply want to make the fan drive mechanical with a mechanical fan clutch like you would find on an older model semi truck, instead of having the computer reading, fan, speed and all that jazz, I rather just trick it somehow where you don’t have to mess with the ECU. You have to somehow create a component that you can plug into the bus. It grabs that message and converts it in whatever way I don’t know so that is the reason I’m trying to make this product. I’m not deleting anything illegal. I’m just trying to improve on something that always has issues. Do you have any contact of who can help? Thank you.
 

Papabravo

Joined Feb 24, 2006
21,157
...
You have to somehow create a component that you can plug into the bus. It grabs that message and converts it in whatever way I don’t know so that is the reason I’m trying to make this product. I’m not deleting anything illegal. I’m just trying to improve on something that always has issues. Do you have any contact of who can help? Thank you.
Nobody said you were "deleting anything illegal". What I am saying is that you CANNOT do what you want to do. I'm telling you that the way a CAN network is put together this is quite impossible. It is not possible to prevent any node on the network from seeing and receiving EVERY possible message that is transmitted as it is transmitted on a bit-by-bit basis. There is literally no way to "grab a message" and convert it in any way. As soon as you try to modify a message on the wire, the transmitting node will detect this attempt and throw a "bit error", by sending 7 dominant bits in a row triggering every other node on the network to do the same when they detect a bit stuffing error.

I have no contacts that can help you and you need to disabuse yourself of the notion that this is possible.
 

Sensacell

Joined Jun 19, 2012
3,432
Just emulate the fan controller?
This part must be far simpler, just make a box that "looks' like a normally functioning fan.
 

GetDeviceInfo

Joined Jun 7, 2009
2,192
Can u explain a bit
What does the ecu require from the fan module. Is it actual fan speed, an ack to its command message, or maybe a none error response. Do you know the Id of the module. Knowing this would allow you to replace the fan module with a custom device that keeps the ecu happy.
 

Thread Starter

Atkinson01

Joined Jan 27, 2023
11
So the ecu requires to see fan speed it desires it has two solenoids. One to speed up the fan speed and one to slow down. It sends hydraulic fluid to a three piston variable which tightens a belt speeding up the fan when it wants to lower the fan speed it sends current to the other coil, letting the fluid go back to sump. Intern, reducing fan speed, My goal was to simply get the data of the desired fan speed, and somehow mimic it to go back to the input of the ECU with some sort of controller or something, however Papa, bravo seems to think it’s impossible and I just somehow can’t take one person’s word for it. I don’t mean to start a controversy or anything. I appreciate your input. I don’t know really a 1/8 of what you know about the bus I’m sure. but technology nowadays, there’s gotta be a way in the service advisor for these tractors what we have is a four wire can power ground hi and low and we have one in the beginning and one in the end of the bus , and a couple controllers in between, one for steering one for engine and one for chassis, one for transmission etc. they all talk to each other somehow on the bus I know you can tap into the bus. So the ECU requires to see a desired speed and it’s not 100% accurate. It’s off a few hundred RPM but it wants to be in the ballpark and it does a pretty good job. I’m just trying to keep the ECU happy I can simply disconnect it in there will be a code, ringing and ringing and I was trying to prevent that from happening. I’m able to delete certain codes off the system with a company from Australia but I have to physically reflash the program the ECU that’s how I delete the exhaust filters without codes. I’m trying to get away from physically get away from going to each tractor I make this Manuel fan drive system for im looking to make something a tech can install on there own.
 

Thread Starter

Atkinson01

Joined Jan 27, 2023
11
I don’t know how it can be done. All I know is the ECU gives out a reading on the bus of what it desires for the fan speed. All I’m trying to do is grab that information, input it in some type of device or develop something that can grab that data also and without any other things knowing do something with the data and send a signal out into a separate wire which is gonna be the input for the fan controller speed I will make a harness to taps into the speed sensor for the input and it’ll just loop back around to the ECU like it thinks something is there telling it that’s the speed it’s a pretty easy concept to think about I just don’t know how to make it reality and according to papa it’s impossible
 

Attachments

GetDeviceInfo

Joined Jun 7, 2009
2,192
I’m actually exploring what you know about it, to speak appropriately. Not contradicting anyone, but an approach might be to monitor the bus for a device response, crash it with an arbitration grab, and transmit an alternative message. Depending on how stubborn the module is in retransmitting due to lost arbitration, buss bandwidth might suffer. It may only retry a few times, continuously, or maybe not care, waiting for another send command. If it devoured bandwidth, only lower priority devices would suffer.
 

Thread Starter

Atkinson01

Joined Jan 27, 2023
11
I’ll I have bought some tools to adapt the vehicle to the laptop to a monitor can bus messages and I’m working with a program engineer I think that’s what his title is anyways, there a company that develops chips and programs and other things software and we’re going to try to develop this tool. I was on this form just to see if I can get any additional information from different experts, maybe somebody has ran across this before I really appreciate your input. I will keep you updated on what we find and any information that is valuable. I will update thank you.
 

Papabravo

Joined Feb 24, 2006
21,157
From the nature of the discussion between the TS and @GetDeviceInfo, I think you may want to take a deep dive into CAN networks to understand why what you are proposing is unlikely to work. In particular on a CAN bus there is no way to predict how fast a node who has its transmission interfered with will recover and retry. I can tell you this, the retry is automatic in the hardware WITHOUT any intervention by the firmware. If you bust a transmission, the hardware of the node that was transmitting will likely be ready to go before you can blink. Assuming you can detect the loss of arbitration a second time.

This sounds to me like it would be a Mexican standoff with no traffic on the bus.

OTOH, if you enjoy tilting at windmills, by all means be my guest, and vaya con dios, amigo.
 

geekoftheweek

Joined Oct 6, 2013
1,201
So what I am trying to do is delete a variable speed. It’s a fan drive system that changes the speed of the fan depending on certain parameters of inputs to the ECU. I simply want to make the fan drive mechanical with a mechanical fan clutch like you would find on an older model semi truck, instead of having the computer reading, fan, speed and all that jazz, I rather just trick it somehow where you don’t have to mess with the ECU. You have to somehow create a component that you can plug into the bus. It grabs that message and converts it in whatever way I don’t know so that is the reason I’m trying to make this product. I’m not deleting anything illegal. I’m just trying to improve on something that always has issues. Do you have any contact of who can help? Thank you.
I am not familiar with the system you described, but I do know how a standard air driven fan clutch works. An air valve that is either on or off that is plumbed into your hub and you actually turn it on to turn the fan off.

I'm going to guess what you would need to do is eliminate your oil metering valve (the best way I can describe it) as it is most likely what actually communicates with the the ECU and mimic the messages it normally sends... pretty simple if you really think about it.

As for how exactly to do that I can't say. CAN buses are only two wires so I'm not sure what a four wire system would be called or how it would work? What exactly are you working on?
 

Thread Starter

Atkinson01

Joined Jan 27, 2023
11

Good morning since maybe using the can bus signal and duplicating, it sounds impossible. How about generating a speed signal that the ECU wants if the ECU wants more speed it provides 12 V to a certain circuit power in a coil instead of it providing 12 V to this coil what if it’s goes through a DC to DC converter and provides voltage at a certain circuit point “device” which intern hires the frequency of the speed signal we need, and when it stops it stops at that voltage, and when it needs lower speed signal, it provides 12 V to a different coil. Then intern we use that circuit and input it into this box and it lowers the frequency of the signal being output it, I found these videos , maybe there’s something in there that has an idea of what I’m trying to get to now the sensor is a 5 V sensor and the signal that the ECU needs to see is anywhere from 0 to 5 V. I don’t know I’m just thinking.
 

geekoftheweek

Joined Oct 6, 2013
1,201
@Atkinson01 chances are your sensor is a VR type sensor that expects a totally different waveform and you'll end up with a fault. From my experience there aren't too many square wave (Hall Effect) sensors in heavy equipment. What are you working on?

A lot of times when automotive CAN systems get mentioned I think people's intentions are to keep others from doing something dangerous that could put themselves and others in jeopardy more than anything else. I won't lie I'm not going to give you the answer for the same reason, but I would like to understand it and maybe point you in a direction that may be helpful.
 

Thread Starter

Atkinson01

Joined Jan 27, 2023
11
I am not familiar with the system you described, but I do know how a standard air driven fan clutch works. An air valve that is either on or off that is plumbed into your hub and you actually turn it on to turn the fan off.

I'm going to guess what you would need to do is eliminate your oil metering valve (the best way I can describe it) as it is most likely what actually communicates with the the ECU and mimic the messages it normally sends... pretty simple if you really think about it.

As for how exactly to do that I can't say. CAN buses are only two wires so I'm not sure what a four wire system would be called or how it would work? What exactly are you working on?
Thank you for your interest I will be describing this a little more in detail so you can understand
OK, and I’m working with a tractor that has a variable drive fan. the fan speeds up and slows down with hydraulic fluid what speeds up and slows down the belt or the fan is the ECU, the ECU sens 12 V signal to a coil to speed up, allowing hydraulic fluid to pass to the pistons that close the variable and intern speeds up the fan once 12 V is not applied anymore once the fan has achieved the speed the ecu was desiring,, via a two wire 5 volt speed sensor, signal back to the ECU it stops sending 12 V and it stays trapped with oil causing the fan to stay at that speed. If it needs to slow down it provides 12v to a different coil allowing that trapped oil to go back into return allowing the pistons to retract and the fan to slow down , so ultimately the speed sensor tells the ECU I need to speed up to reach desired speed ECU send the voltage to a coil to speed it up or if the speed sensor says I want to slow down it sends voltage to a different coil to slow down all I was trying to do is the ECU has an address that you can read the desired fan speed I was just trying to take that information off of the can and somehow mimic it to make an input of what it wants back to the ECU. However, this seems very hard to do or impossible, they say so what if we can use the 12 V signals from coils to turn on something that’ll create the wave or signal , mimicking, speed, sensor, higher and higher until it is reached, and if it needs to slow down, it uses a different circuit to slow that wave down . Does that make a little more sense? I was looking at those time timers that creates a wave length I don’t know if that’s something we can utilize.
 

Thread Starter

Atkinson01

Joined Jan 27, 2023
11
I’m trying to develop a product that I can distribute to correct the fan drives going out and down time for the customers I’m trying to improve a product basically the only way or reason I see through the can bus is because I just thought that might’ve been the easiest way to mimic the speed sensor is because it has a desired speed that you can see physically through the computer and it’s a two wire magnetic sensor. I don’t know 100% what wave it is but it’s just a standard speed sensor it like a crankshaft sensor uses or a camshaft sensor probably a square wave like you’re mentioning.
 

geekoftheweek

Joined Oct 6, 2013
1,201
if we can use the 12 V signals from coils to turn on something that’ll create the wave or signal , mimicking, speed, sensor, higher and higher until it is reached, and if it needs to slow down, it uses a different circuit to slow that wave down . Does that make a little more sense? I was looking at those time timers that creates a wave length I don’t know if that’s something we can utilize.
In all reality that sounds very possible. I am going to assume that at first start the ECU will check the speed to make sure it matches what it thinks it should be. Then it would either throw a code if it finds a mismatch, or begin altering the speed. Normally a two wire sensor is a VR type that you'll have to scope the waveform and figure out how to replicate it. I could be wrong and maybe there is something more to it.

The idea of tightening and loosening a belt sounds pretty stupid unless it is some sort of variator design which seems like an overly complicated answer to a simpler solution.

Your biggest hurdle is probably going to be getting it properly tested and approved for road use, or use in general. Insurance companies are going to want to make sure it doesn't create a hazard or problems they will have to pay for, the government will want to make sure you're not going to cause a bunch of wrecks, and manufacturers will do everything to fight it because they'll loose money on parts. I can almost guarantee there will be no way it will not void warranties. All those points may not mean a thing to you though... I have never seen such a fan setup so I am assuming you are not in North America anywhere.
 
Top