Practical Pico: CAN bus diagnostics and serial data decoding VIDEO

Practical Pico: CAN bus diagnostics and serial data decoding VIDEO

Hi welcome to Pico Technology My name is Barnaby Donohew I work here as an automotive applications
specialist Today we are going to take you through a practical
Pico session on CAN bus testing I am going to start the proceedings We are going to look at different ways to
connect to a CAN bus network After that I will start introducing some faults
onto the network So we can see how those effect the wave forms
you will see on your PicoScope screen My name is Steve Smith and my role is to look
at serial decoding within PicoScope It is about looking at each individual field
within a frame Looking at at the tools at your disposal And hopefully demystifying a lot of CAN Lovely we will begin by looking at the different
ways we can connect to a vehicle In this part of the presentation we are going
to look at different connection methods And different ways you can access your CAN
bus In the first method we are going to use a
pin out at the diagnostic link connector In the second method we are going to connect
at the same place At the diagnostic link connector but we are
going to use a break out box And then in addition we are going to show
you how to connect directly At an ABS control module You might need to do this because not all
vehicles give you Direct access to your CAN buses at your diagnostic
link connector The first thing we are going to do is connect
our scope Connect the blue test lead to channel A And the red test lead to channel B Now our test leads are connected to the scope We are going to connect the two earth fly
leads together And add a break out lead Then we will add a break out lead to channel
A and to channel B We are now ready to pin out at the connector OK so we are down here at the diagnostic pin
connector Which is the white connector on the edge of
your screen We are going to connect our three terminals We want our earth first which we will put
on terminal 5 Then I will put CAN high on terminal 6 next
to it Directly opposite that we have got CAN low
on terminal 14 An easy way to get to that is we have 16 15
14 from the top at the back OK so we are all set with our test leads connected
to our Diagnostics link connector via the break out
leads We have got CAN high in pin 6 and CAN low
in pin 14 Our earth connection is in pin 5 All sorted there The next thing we need to do is set up the
scope To allow for noise we are going to put plus
minus 10 volts On channel A and channel B We have got 50ms/div And 1MS across the screen Which should give us a nice horizontal resolution
so we can see plenty of detail Next thing we need to do is start the scope Lovely that is running and we will turn on
the ignition And there we go We have got a perfect CAN bus signal on the
screen We have CAN high going from 2.5v up to 3.5v And CAN low going from 2.5v down to 1.5v Perfect In our next connection example we are going
to use a 16 pin break out box To connect to our diagnostic link connector So let us do that Very simply we take the extension cable and
plug that straight in You can see that it lights up We have got a couple of lights of interest
here On in 16 we have a battery positive supply
being indicated On pin 5 we have a ground connection indicated Depending on if the ignition is on or off We will get different buses active as well Let us connect our scope into our break out
box And take our test leads Again we have our earth fly leads joined together We need to use some adaptors here to get our Times 1 test leads into the break out box Channel A is CAN high so that goes in pin 6 Channel B is CAN low so that goes in 14 We can put the earth fly leads in either ground
4 or 5 With that all connected we will start the
scope and turn on the ignition Straight away we can see just as before we
have got high and low signals As if we we connecting at the pins as we did
before Lovely OK so now we know two different ways that
we can connect at the diagnostic link connector In the next part of our presentation we will
look at actual testing for CAN bus faults You will see methods using back pinning of
how we can connect to A high speed CAN bus at an ABS control module Before we start to look at any wave forms
in the screen And to look at our CAN bus health and possible
faults The first thing we are going to do is a quick
CAN bus health check To do that we are going to look at the resistance
between the CAN high and the CAN low lines If you remember our CAN bus circuit is effectively
a parallel circuit On the high speed network so we have 120 ohm
resister at one end An ECU and another 120 ohm resistor at the
other end So when we look at the total resistance between
the high and low levels We get a total resistance of 60 ohms So that is what we expect to see If we do not see that then that is telling
us that Maybe we have a high resistance or an open
circuit or a faulty termination And we need to look further Before we connect up and do that two things
to remember Firstly switch off your ignition and take
the key out Secondly disconnect your battery I have already do that so we are good to go We are going to look at the total resistance
with everything connected up first We take the two pins that we looked at before The CAN high and low lines on the ABS circuit We have CAN high on 15 and CAN low on 11 Might be visa versa but that is OK in this
case Again back probing for convenience here Making sure we are not damaging any seals
or shielding With those in place all I need to do is get
our digital multi meter And look at the resistance Waiting for it and there we go we are at 61.7
or 8 ohms there That is lovely exactly what we expect and
that is good If it was not what you were expecting the next
thing we can look at Is the termination resistors at each end To do that we take out the back pinning probes We can disconnect the ABS module Knowing that we have one termination resistor
in the module And another resistor at the other end of the
line somewhere We are well placed to check for the resistances
at the two ends Again we will use break out leads for convenience I will look at the ABS control module first Bear with me while I get these connectors
in place That is the first one in on 15 15 14 13 12 11 lovely So now we can look at the resistance at the
end of those two On our ohm meter we are getting 126 ohms That is exactly what we would expect So that is proving that we have the termination
resistor in the ABS module Now if we look down the whole bus again finding
the same pins 15 there on this side of the connector 11
marvellous Take our digital multi meter what do we get Again 120 ohms perfect We can safely say that we have the correct
terminating resistances in the CAM bus circuit And that there are no faults on it at present In this part of the presentation we are going
to look at the common faults You might find in the CAN bus network and how they effect the wave forms on your screen For example there might be shorts to battery
positive or battery negative Shorts from CAN high to CAN low Open termination resistors or open circuits
generally All those types of things On this vehicle we have an ABS control module
nice and close at hand here That will give us access to the high speed
CAN network On that we will have the engine control module The ABS control module Instrument cluster If it has got it a transmission control module And even adaptive headlamp modules Plus of course the steering angle sensor So plenty we can look at using the same settings
we have already described in PicoScope We can just load up the settings from the
physical layer guided test We have got PicoScope channel A and channel
B connected as before Now all we need to do is connect our probes Back to the same connections no different We have got the earth fly lead and a good
connection available at our finger tips We need to back pin on the ABS control module Or there would be a lot of break out leads
involved otherwise We can back pin CAN high straight into pin
11 When doing this you have to be careful not
to damage any seals Or damage the shielding on the wires And then on pin 15 we have CAN low Just gently slide that in there and make sure
we have a good connection We have earth connected and CAN high and CAN
low PicoScope is connected so now we just need
to start the scope That is waiting for data Restart the engine We can see that we have a normal CAN signal
at the moment We know that at this present moment this vehicle
is functioning as it should So let us start looking at some different
faults that you might see On a day to day basis in your workshops The scope is already set up and we are going
to start it running It is waiting for data We will turn the ignition on The first thing we are going to look at is
a short to battery positive We will introduce the fault and look at the
change in the waveform We see immediately that the channel is over
ranging so we change To 20 volt range on channel A Now we can see that the CAN high has gone
up to battery voltage as we would expect Now we will look at CAN channel B we can see
that the CAN low is also Being dragged high with CAN high so they are
both Being dragged up towards battery positive What you must notice is that we no longer
have any bus or messages present on the network Now we are going to look at what happens when
we short CAN high to battery earth We shall start the scope and it is waiting
for data Turn on the ignition We will introduce the fault a short to battery
negative And we will see what happens to our waveforms We can see immediately that both CAN high
and CAN low Have been pulled down to battery negative Because we have shorted at CAN high it is
at zero volts CAN low is just a little bit above that Again we can see that there are no messages
present on the bus network You can see from the spikes that the control
units are attempting to communicate But there is no communication at present We can see in both cases a short to battery
positive or battery low in both cases The whole network is destroyed by those faults Our third short type fault is going to be
a short of CAN high to CAN low We are going to see what happens to our waveforms
in that case We are going to start the scope And turn on the ignition It is all operating normally and we can see
our messages We can see the fault has been introduced We have both lines at 2.5 volts This means that our control units cannot drive
voltages apart from each other It is a differential circuit so they are connected to each other and they are remaining at 2.5 volts Again you can see that communication has been
destroyed by this short type fault As it was with the others Now we are going to look at a different type
of fault We are going to see what might happen if we
have a termination resistor Missing from our network one of the two We are going to simulate this by removing
the ABS control unit from our network We know that our ABS unit has a termination
resistor in We have started the scope and are going to
turn on the ignition Now we have done that we can see that there
is some bouncing around in the signal It is not quite as stable as it was Little wavelets are occurring here and there This is symptomatic of a missing termination
resistor Remember we still have one in so we still
have communication present on the network This is a key difference between what we were
seeing earlier with our shorts We have still got communication but if you
do a resistance check on the network You would find that it would have a total
resistance of only 120 ohms Rather than the 60 ohms you might expect So that is the effect of a termination resistor
missing In our next example we are going to look at
what would happen If we had an open circuit on our CAN low line
whilst we are measuring at a control unit In this case our ABS control unit We are measuring at the ABS control unit We are going to collect some data We have normal signal Now we will introduce the open circuit See what happens and there we go Now we can see that our high and low lines
are doing exactly the same thing We have got a CAN high signal and our CAN
low signal is mirroring that That is because it is effectively connected
to the CAN high line Through the terminating resistor in the ABS
control unit The network is still able to drive a signal
but we happen to measuring Both of them in effect through the terminating
resistor We are going to introduce exactly the same
fault now an open circuit on CAN low But this time we are going to be measuring
at a location which does not Have a terminating resistor which has the
effect of connecting CAN high to CAN low We will start up our scope And turn ignition on and get the normal waveform As you can see it is all working normally
here now In a moment we will introduce the fault But what I want you to bear in mind that a
moment ago we had The two signals mirroring each other when
connected by a terminating resistor Now we see that CAN low has gone to zero volts And we still have CAN high doing its thing We have messages on the circuits so the control
units Are still able to drive a message onto the
bus At our measurement location now we have no
messages making their way through To our probe on the CAN low line Now we can see how critical measurement location
is to determining what the fault is The last fault we are going to look at in
our network faults Is the effect of a high resistance on CAN
high We are going to introduce a 2.2 Kohm resistor into the circuit and see what the effect is We will wait for some data We have got the normal messages appearing Now we are going to introduce the resistance
and see what happens We can see immediately that our CAN high data
is significantly distorted All the sharp transitions that you would normally
observe have disappeared They have all become rounded off That is in both directions as it goes up to
the high on CAN high And then back down to the 2.5 volts also on
CAN high We would expect to see the same thing if we
had a high resistance on CAN low For example if you had corrosion on a connector
or terminals You could well expect to see both of your
signals being distorted The key point is that we still have messages
on the network So a quick summary Shorts destroy the network High resistances do not and open circuits
might Welcome to the next part of our presentation
looking at serial decoding within PicoScope This is going to look at connection to the
vehicle The set up of the scope Application of serial decoding Maths channels And just how much information you can pull
out from serial decoding What there is of real use to us as technicians Can we decipher what computers are on line Just generally break the CAN down and demystify
the whole CAN frame Our set up process for connecting to the CAN
network on this vehicle Is via break out leads which we have installed
to the ABS ECU So channel A CAN high channel B CAN low And we will reference to chassis ground directly
at the battery negative terminal Connectivity to this vehicle for measuring
the CAN network We have a break out lead linked into the ABS
ECU We will use our Pico times1 test leads The blue is channel A the red is channel B Using our break out lead 4mm connectors on the end of our test lead
into the convenient break out lead And then we can link the grounds together Because they are both going to be referenced
to battery negative chassis ground We are all connected to the vehicle We will now connect to PicoScope to look at
the physical layer once again We will then apply maths to look at the differential
voltage We will apply serial decoding and look at How much detail is available in serial decoding We will use the export feature and the link
file We will also introduce not a fault but we
will disconnect one of the ABS computers And export the data a second time and see
if we can discover which ID’s are missing from the network Setting up PicoScope for CAN analysis CAN
capture We are going to go for quite a slow time frame
200 ms/div That is going to give us 2 seconds across
the screen And we will have this at 10m samples To see what that equates to in terms of sample
rate If we go to views view properties Over here you can see we have 5milion sample
per second which is perfect for CAN The voltage on CAN high is going to be 2.5
to 3.5 To allow for noise we will have this set to
10 volts So channel A is going to be 10 volts channel
B is going to be 10 volt We are on a x1 probe on both of them We will not use a trigger we will leave this
as free run We have got the channels labelled up already CAN bus high on A CAN bus low on B We are ready to go if we press the start button Turn the ignition on and we will capture CAN
data There we go That is moving at a steady pace across the
screen that we can interpret Rather than having it flashing up I press pause And then I can navigate back through the buffer There was first buffer and so on and so forth So here we have our capture CAN high channel A CAN low channel B This additional activity here this is quite
common If we were to zoom in on this you would see
there is ringing there It is quite normal with the x1 test leads There we go We could improve that We could add the high impedance test leads
TA 375 But using a math channel which we will go
through now We can improve on this noise What the math channel will do is take away
channel A from channel B A minus B which is the exact signal the CAN
controllers use That is the physical layer differential voltage
conversion If we go to tools math channels Built into the software you will see A minus
B Now you have a third channel that appears It has reduced some of that noise but if we
zoom in in there This is the exact values that the computer
is going to use To decipher what data is being transmitted The beauty of that then is that will provide
us with the correct Channel on which to activate serial decoding Pull theses waveforms up and drag them out
of the way Now we go tools serial decoding and create The network we are working on is CAN The data we are going to decode is on A minus
B It has tried to set this up automatically We know that A minus B will be zero 2 Volt Because 2.5 minus 2.5 is zero 3.5 minus 1.5 is 2 volt Zero 2 So the best crossing point is the mid section
of the maths channel here that is 1 volt We will allow for a little bit of hysteresis
on there We will bring that right down that is just
activity around the crossing point We do not want that to interfere with the
decode The baud rate we know it is high speed CAN So that will be 500 Kbaud Will turn on CAN high on this And we will give it a name CAN network with ABS on so the ABS ECU is
connected We are going to display the packets in the
graph and also in a decode table Click OK and OK once again And there is our serial decoded data Just drag that up so you can see a little
bit more If we scroll down The fact that all of that is in black means
that has decoded correctly Because if there had been any one of those
packets or frames in red We would know that that was a decode error To all intents and purposes the information
within the decode here is fine Now I mentioned baud rate if we go back to
settings here We assumed a baud rate of 500 Kbaud the speed But we can calculate that If we just zoom in on the smallest bit in
the CAN frame Let us go here That looks about right That is coming out at just over 2 Now let us go to this one here The delta there is 2 ms How does that translate Bottom right hand corner here The frequency of the signal between those
two points is just short of 500 khz You can see it there in the ruler legend So we know the speed of this network Had that been 250 kbs that would have come
out as 250 here And this would have been about 4 ms If we wanted to dig deeper into any message
I can click on here That will take me straight to packet 11 of
the current buffer All the information we need is there Had we got a buffer which had not decoded
correctly Click on all buffers to find one This will pull in all four buffers We scroll down to find one displayed in red But there is not one Quite often what can happen is we loose half
a CAN frame here Because we have come to the end of the screen
shot and it would flag up as red But in this scenario it has worked perfectly Let us take a close look then at packet 11
in buffer 2 The recessive and dominant voltages You hear this term a lot with CAN Our recessive voltage will be 2.5 and dominant
will be 3.5 on CAN high then 1.5 on CAN low It is the difference between those two So whenever we say dominant voltage that will
be When the bus is driven high and low And recessive is when the bus voltage is in
the rest state at 2.5 How that translates in logic is that recessive
is 1 Dominant is zero So let us look at the CAN frame in more data Just to highlight another feature here quickly
is If you hover over the CAN packet frame there
is a summary Of what you can see in the decode table The start time the ID etcetera let us have a look at timing Packet number 11 Start time 3.685 ms and the end time 3.919 To qualify that we will put the time ruler
at the start And one at the very end of this packet So we have 3.6 so we are not very far away
3.919 there There is an extra button here called statistics You can add that to get a little more information
about the maths channel The max voltage bear in mind 02 volt but we
are either spiking Or end of messages we have seen that raised
voltage there Minimum voltage peak to peak and packet time In this scenario is 234.2 ms we are 233 here If we were to zoom in a bit closer we could
dig a little deeper Let us dig a little deeper into Ids at this
stage We will choose another ID go for 1A0 I shall
explain why latter on Let us zoom in a little more on this whole
packet You may have heard the term 11 bit identifier
and 29 bit The ID here is 22 ms remember 1 bit is 2 ms So there are 11 bits in that ID The id 1A0 equates to a message content priority If we were to think about ABS A message from the ABS ECU would be high priority
hence a low value Whether that has come from the ABS or not
we are not sure at this stage There are a number of things we can do on
the vehicles Which will reveal that ID As we move along we see these points here
called stuff bit If I scroll along you will see wherever we
have five bits of the same level Five dominant or five recessive After every five bit of the same level The CAN protocol ensures it inserts a stuff
bit of the opposite orientation So if it is five recessive it will insert
one dominant and visa versa That is the CAN protocol Moving on to ID RTR that is a remote frame request So that might be an ECU that is requesting
feedback From a particular ECU on the network As you can see they are all zero at this point So everything on here is a transmission If one of those had been set to 1 in the RTR
column here It would suggest that the message content
from an ECU Is requesting information from another FDF is flexible data raid in this case it
is all zero This is for CAN FD where we can change the Speed the baud rate for the data for the payload This is conventional 11 bit non flexible data
rate CAN Here we have the data length If I remove statistics to give more room We can pull this out here We can see the data length here consists of
8 bytes of data 1 2 3 4 5 6 7 8 CRC cyclic redundancy check that is the CAN
interface Confirming that this data and the transmission
is correct This is the acknowledge bit all zeros All nodes that require that information have
confirmed They have received and understood This is confirming that the CRC is a valid
check Bit stuffing is all correct and in order And the summary here that the whole message
content is valid and correct IDE that is IDE extension is reserved for
future proofing Of CAN for additional length of IDs Looking at the decode table we can run through
the options We can short cut to the settings menu And make any amendments we need to here We may only want to decode data between the time rulers So we check this box here We will come to link file later We will look at export data now There is an option to export all this in CSV
format I will do that and call this ABS connected
as the abs ECU is connected I will save this on the desk to in our test
folder In view there is an option for you to change
the font size We looked at statistics earlier You may want to view the data in binary format decimal or ASC But keep that as HEX at this stage All buffers or just the current buffer Incidentally as we have just exported all
data we have exported all buffers The filter option is very useful If I were looking for just one ID like 1A0 There it will list just those Ids for us Fields so we can search buffer number Show just buffer 1 will take us straight to
buffer 1 To exit out of the filter we would delete
buffer To clear this field we have to go back to
current buffer Whilst we are on current buffer this is buffer
2 of 4 To have a look at the amount of data packets In one buffer only 3653 CAN frames packages
or messages So 3653 in 2 seconds This gives you an idea of the bus loading
at that point The amount of messages transmitted on the
network This was taken with ignition on but engine
off I think that is a worthy test Now we need to capture CAN data again But this time we will do the same capture And decode but with the ABS ECU disconnected And all of its associated IDs will then be
offline As we mentioned we now want to take the ABS
ECU offline So if we disconnect the ABS ECU Make sure that it can not reconnect in any
way Now we can carry out the same measurements
again Looking at the CAN data and export that data We should discover that there are missing
IDs now from the network It is important to note that if you are going
to do this Ensure that the ECU you are disconnecting
does not contain A termination resistor OK so our ABS ECU is now disconnected We will start PicoScope the settings have
not changed You can see that the software is waiting for
data there Nothing on A or B high or low And the maths has nothing to calculate So if we turn the ignition on now And there is our data coming in You can see that the maths is working And the decode table is starting to populate We will capture and save five buffers We will stop there Let us go back to buffer 3 Just scroll down we have plenty of data there We are now at 2600 And 29 messages Still in 2 seconds of screen time What we will do here now is export this data Before we do that we will export all buffers That is going to be buffer 4 which is partial 3 is complete 2 is complete 1 is complete Export and go back to the desktop test folder I will call this ABS off We can now examine these Excel files and find
missing IDs To recap where we are to this point We have exported a CAN decode table From the CAN network with the ABS ECU connected And then the same again but with the ABS ECU
disconnected So theory has it that a number of IDs will
be missing now Because remember the ID contains information
about messages and their priority Message content for example brake lights on
brake lights off Most probably and we have to be careful here
we cannot make assumptions here That message could originate from the ABS
ECU Let us look at the Excel files Will go to the test folder This is ABS connected so you will recognise
this straight away This is our decode table that we exported
from PicoScope One of the things we can do first of all is
go to the ID column And go to data and remove duplicates We will continue with the selected data only And remove duplicates from column E because
we know A number of IDs will be repeated Remember there are over 3000 messages with
the ABS ECU connected every 2 two seconds There is a warning here 11871 duplicates values
were found and removed 50 unique values remain If we scroll down we should see 50 There they are So let us copy those and place them in column
Q So those 50 unique IDs are all relevant to
the IDs transmitted on the CAN network with every
ECU online Especially the ABS To make life easier let us put these in the
correct order We will go A to Z so now they are in alphanumerical
order At this point we will save the data We will save it back in the test folder And we will save it as an Excel workbook Because that protects all the functions that
we have going on there It is still called ABS connected Let us minimise that and go back to ABS off So this is the exported data that we took
when we captured All the CAN traffic with the ABS ECU disconnected So same procedure again Column E has all our IDs We will go to data and remove duplicates With this current selection remove duplicates
from Column E 9369 this time 41 remain that is interesting So we have lost a number of Ids we had 50
on the previous Now we have 41 Copy that and move it across to Q Then put them in alphanumeric order We will copy this now and take this back to
our ABS connected So these are the IDs present with all ECUs
online And in this column we will paste all the IDs
with the ABS ECU offline So you see that we are a number short there It has placed the header actually at the bottom
ID At this point it might be a good idea To say ABS was off And in this column ABS on Save that once more Now what we want to do is reveal unique values
that are in this column Because they will reveal the IDs that are
missing from this column When the ABS ECU is disconnected For that we go Home Conditional formatting Let me highlight these two cells Duplicate values Format unique with light red fill Click OK And there we have our unique values Those are the IDs that are now missing When we disconnected the ABS ECU So ignore these which are just the titles
of the columns That have been placed at the foot of the column
not the head Hold down the control key first Highlight the unique values Copy those and paste them into column S So there we have it Those are our unique IDs of interest These are the IDs that are missing since the
ABS ECU was disconnected Let us see how we can analyse this further Returning to our captures now ABS ECU is reconnected And we are gathering data as before All ECUs online no faults CAN high channel
A CAN low channel B Maths is in there as well And the serial decode is functioning as you
can see We have a maximum of four buffers This is because we are at 5 million samples
a second With 10 million samples across the screen OK so let us pause at this point And go back to buffer 3 which is a full buffer Let us look at our IDs of interest So 1A0 that was missing when we disconnected
the ABS ECU So let us filter for that 1A0 And there they all are What is interesting here is that if you scroll
down and look at the Data payload you see that the only byte that
changes is the end one So it is numerical alphabetical back to numerical
and that continues That is with no input from the driver in any
way The ignition is on That byte is constantly changing So how could we use this information at this
stage We could bring in another channel And see if we can promote change within the
data here So thoughts around the brake pedal switch On channel C I have connected to the brake switch Located just beneath the master cylinder If I were to run this now Let the buffers fill up The software now is just looking at ID 1A0 It is collecting other ones as well If I minimise this you will see far better
the raw data Here is our brake pedal at rest The plan is to operate the brake pedal a number
of times And see if any of the events change The data bytes change from ID 1A0 So let us go and do that We will stop that capture and go back through
the buffer Here the brake pedal is at rest This is brake pedal on Off Back on again here And bring the decode table back Here we have an error frame so click on that
to see what it is Just minimise The reason that frame is in error is because
it is incomplete If I zoom out a little bit more And go back to that decode table Go back to the error frame which was the first
one here Packet 1 in the current buffer So we did not capture the whole frame Hence it was incomplete the second one was
fine We are searching just for filter 1A0 Zoom back out We know that in this are here the brake pedal
was pressed So we are hoping to see a change in the data
bytes here somewhere Let us pull these rulers in and ask the software
to decode the data Between those two points When the brake light went from off to on Back to off again To make an amendment we go back to the decode
between the rulers Click OK Now we are filtering for ID 1A0 and we are
looking for a change So that seems to be the same But there is a change here We go from 40 on this byte here To 48 Back to 40 again Let us see if we can close in on that a little
further So just decode between the rulers Let us come into this section here So now we are only decoding this area here If I minimise the decode table we can see
that That is the only area being decoded now All this area here is being ignored Bring the table back Yes 40 to 48 that is the point that the brake
pedal goes on It remains on let us pull this out here to there So we go from 48 Brake pedal on To 40 and let us see if we can really narrow
this down 40 is brake pedal off 48 we see how the brake pedal has gone off
at this point When we are measuring at the brake pedal switch
at the master cylinder If I drag this out Let us look at that in terms of time It was at approximately this point here where
the message was transmitted For brake pedal off So let us measure that time before it was
transmitted 20 ms We are drilling right down here We have some evidence now that 1A0 is an ID
from ABS Because when we press the brake pedal we see
that Our byte 2 there goes from 48 to 40 and back
from 40 to 48 Let me check that is the right way around It is 40with brake pedal off 48 with brake pedal on Our next ID to filter on would be 1AC So let us take a look at that Filter 1AC There we are they are all listed there But we are only interested here in what happened
when the brake pedal went on So let us decode between the rulers Go from here to here So 1AC seems to have activity regardless So just come back here before we switch the
brake light on Or press the brake pedal We so how these change here these bytes These bytes change here as well with no input But keep your eye on this one here it is 01
throughout I will drag the cursor to here and we go from
01 to 41 Pull that ruler out a bit more We are 01 here Brake pedal released And her brake pedal pressed we go to 41 So again that is looking like ABS ECU Because we know this ID is missing when we
disconnect the ABS ECU And also know we can promote a response in
the payload When we press the brake pedal And again just see how fast this responds
if we decode right over here To this area we are at 41 01 41 01 is brake pedal off Pull this out as carefully as we can We go from 41 to 01 Once again 30 ms or even less 20 ms So just decoding the data in that area there Let us have a look Just in that area there those messages indicate A change in the payload I will try and move these out of the way So from this point here To this point over here to put that in perspective We go from 41 to 01 And that span is 26 ms Because we have got this so refined now Just minimise this a little bit and come back
out And concentrate on an are clearly from brake
pedal off To brake pedal on because we know in that
area there We force a change in the payload from ID 1AC And 1A0 01 to 41 And 40 to 48 So let us look at other IDs Finally then looking at the other IDs that
we have got You will see here that I have started to populate
the results We know that 1A0 when the brake pedal was
on Byte 2 changed 1AC byte 6 changed I can tell you that 2A0 3A0 4A0 nothing changes
at all And this one here 4A8 byte 3 that does change I will run you through that now So filter 4A8 Lock the time rulers here by clicking on this
icon Byte 3 changes to 54 5E there when the brake pedal is off that
byte is always zero Unlock that again Brake pedal off is always zero Lock that when the brake pedal is on It is constantly changing that byte Whether that is reporting a change in pressure
I am not sure Because the byte is continually changing OK so what does that tell us We know that a total of nine IDs are missing When the BS ECU is disconnected We know that the operation of the brake pedal
forces a change To the data field In three IDs 1A0 1AC and 4A8 We know that ABS IDs have a high priority
as well Because the lower the numerical value the
higher the priority And we have got a 1A0 and a 1AC But there again that does not rule out the
remaining IDs at this stage Because we have done to force a confession
out of these IDs if you like Is operate the brake pedal It could be that ID 443 which is missing would
change its state If we were to spin a wheel for example So it is not definitive but it is all we have
got at this stage What else could we do to help with these IDs Or to convince us further that 1A0 for example
stems from the ABS This forum post goes some way to answering
those questions forum post search for who said what who is on line topic 21680 Here we have a CAN ID that I was chasing I
think it was 197 It was the shift lever of a BMW auto You can see that I have a current clamp connected to One of the CAN wires so that when I operate
the parking switch We see a change of state to one of the bytes
within the CAN message But also the current ramps up so we know at
that point in time The shift lever ID197 was transmitting on
the CAN line So that is one possibility The other one is to look at the electrical
signature During the transmission of a CAN message The values of the voltage have a characteristic
which you can determine You can measure the CAN frame dominant voltage This is when the bus is driven to high and
to low If you take that you get the value of those
voltages And that reveals an electrical signature about
the transmitting ECU Unique electrical signature from each CAN
node Basically what that is saying is when a node
is transmitting a payload message The dominant voltages are typical to that
ECU control unit And this final forum post topic 21680 I mentioned
earlier Looks at this exact process If I highlight this here you will see that
we are looking At the dominant values for CAN high And dominant values for CAN low During this period only this node is transmitting
a message on the bus So if we discover that electrical signature
from that ECU By doing some calculations using deep measure We can identify other ECUs with the same electrical
signatures We can start to group IDs together because
we know we have 1A0 and 1AC That we believe are stemming from the same
ECU If I just quickly move on down here This one looks at CAN high These are deep measure values We are looking at the maximum voltage for
CAN high here 3.5 we find out the modal value of that If I scroll down again you will see that process
using Excel Because we have exported this data from deep
measure into Excel To discover this unique value for the CAN
high voltage And we do the same for CAN low so we end up
with two values The modal value for CAN high and CAN low Then in Excel we plot them against one another Here is such a plot where 197 was the shift
lever with the BMW But here I got 517 and 335 that I was interested in Both of those are on top of one another you
cannot quite see it in the graph But I assure that they are They have the same electrical signature based
on this process Of grabbing the dominant high modal value
and the dominant low modal value During message transmission It serves as another tool to qualify your
ID Or that your Ids are stemming from the same source Using current to determine that it is that
node That computer which is transmitting the signal Then the procedure we have discussed by disconnecting the device And seeing if the ID goes missing Forcing the ID to change the data fields For example pressing the brake pedal forced
ID 1AC to change One of the bytes in the data message It is tough going let us be honest PecoScope is not a serial decoder in the true
sense of the word It is not going to log endless streams of
data We are limited by the amount of buffers We have three here previous capture we had
four That was about eight seconds of data and over
12000 messages With that said knowing that we have these
features That we have described over the last twenty
minutes You have a tool at your disposal that will
help you Identify and qualify and enable you to decode
and decipher A number of these IDs And perhaps some of the messages using a link
file as well I will discuss link files in the next video Looking now at the link file feature in our
serial decoder We are looking at the current buffer This is all the data from the current buffer No longer are we decoding between the rulers If we click on link Create a template is the first step We will put this on the desk top in the test
folder And call this links Go to the desk to again Go to test folder and open up the link Here we have our IDs We are interested in three IDs we have been
able to confirm Not confirm that is the wrong word at this
stage We believe at this stage stem from ABS ECU There was 1A0 1AC and 4A8 and the description
of that would be ABS If we close that That is our previous Excel file that we used
for filtering duplicates Back at PicoScope screen click on link then
we want to open our link file That is the file we have called link That has imported into this decode table But you see where 1A0 was or 1AC or 4A8 has
been replaced by ABS We have now renamed the IDs of interest 1A0
1AC 4A8 as ABS And they pop up twice here We could also search for those if we wanted
to We go ABS and there they all are So that is a very brief introduction to a
link file application It goes much deeper than that when you start
convert this data Into human readable data Thanks for watching That has been a heavy going video I know but
I hope it helps Take care I hope you found that useful That is an overview of the serial decoding
feature in PicoScope6 There is a lot more information on the forum Or on the website in the library section Thanks again from Steve and myself and we
will see you again soon Goodbye

About the Author: Michael Flood


  1. I watched this live, and knew I would have to watch it again. An interesting, informative, and fascinating video. An incredible tool. Thank you for sharing.

  2. Great job, Barney and Steve. There's a lot in this video, though I din't fall asleep. I liked the explanations which enable one to distinguish between different faults, and having example traces for each type of fault. Very well presented. Equally, I liked the walk through the serial data. Towards the end I was starting to think about other specific changes which might be identifiable, such as ABS pressure variations, as opposed to simple commands on or off. Just at this point the sound all but disappeared, though I believe you did briefly touch on this, as well as other possibles, like wheel speed information. (Must listen again !) )We keep hearing that serial decoding doesn't have any real use in diagnostics, but I get the impression it does in certain circumstances – especially if you can identify identifiers, and use the other 'simple' tools within the software – and Excel – to filter. Still, a fascinating subject and this really helps to better understand just how much serious 'waffling' is going on at any given moment among all the different 'passengers' on the Bus. I was at the back of the Bus so didn't take it all in, lol Look forward to the next one. Thanks.

  3. Terrific video, Steve and Barnaby. I’ll also be watching it again because there’s so much fascinating material in it. Now all I need is a car with CANbus. Yet another demonstration of the astonishing power of the PicoScope.

  4. Terrific video, Steve and Barnaby. I’ll also be watching it again because there’s so much fascinating material in it. Now all I need is a car with CANbus. Yet another demonstration of the astonishing power of the PicoScope.

  5. PICOSCOPE Automotive, The CAN Bus has voltages and decimals values but how does a technician know they are good or bad CAN bus signals? What are the most common CAN Bus failures that a technician looks for? and you give more examples about this

  6. BARNEY DONOHEW, how did you create "OPEN circuit module" you disconnect the CAN signal Low signal and only left the CAN High signal active or how did you create OPEN circuit CAN signals? My other question is most modules are hard to get out to disconnect without tearing the whole car apart. Can't I just remove each fuse at the cars fuse box one by one until the CAN bus signals returns back to normal? When measuring a CAN signals how can you tell if the CAN signals are 2.0A, 2.0B or CAN FD because they all look the same to me so how can you tell the differences so i know what to set the CAN Baud rate to? If you wanted to upgrade from CAN 2.0A to CAN 2.0B to CAN FD all you have to do is replace all the CAN transceivers to CAN FD transceivers? the CAN buss harness stays the same and all the CAN ECU modules stay the same only the CAN transceivers get replaced?

  7. Thanks, Every car as a TIPM central gateway circuit board which has Microcontroller chips and Transceiver chips which all the modules connect to the TIPM circuit board? I'm not sure what this TIPM circuit does can you explain more about TIPM circuit boards? When you get a checksum error how do you know if its the transmitter or the receiver because both or one or the other can cause a checksum error, so how do you troubleshoot to know if the transmitter is causing the checksum error or the receiver is causing the checksum error? The DLC connect has SAE J1850 signals and ISO9141 Signals, do you use these to troubleshoot failures in cars or what are these signals used for?

  8. What are CAN sniffers used for to do what or what have you used them for? Dodge & Chrysler cars use TIPM boards, How does a TIPM totally intergrated power module or central gateway work what does it do? There is different CAN signal names, CAN diagnostic, CAN isolation, CAN ground, what else?

  9. So you can do the same thing with an affordable DVOM that a three thousand dollar kit can wtf who uses this shit use a meter if everything looks good and other modules can communicate bad device simple…….. I work for a busy dealership and this shit is not needed……..

  10. What is the exact model number of the device used in this video ? And could we do the same things on a lower models like 2 or 3 series ?

  11. Hi, thanks for the video.How could you relate a problem to the various CAN faults you listed when an car would stay on one gear without shifting and when you turn off the engine and restart the car, the car starts shifting fine. What can faults could this problem fall into. Thanks.

Leave a Reply

Your email address will not be published. Required fields are marked *