This is the fourth in a series of articles by Jason Turner & Clinton Smith from REDARC Technologies. They are writing about the latest in CAN and developments in this rapidly changing field. In the last article we discussed the data side of CAN. In this, the fourth article we will investigate the higher level protocols that make up the CAN Application Layer. The CAN Application Layer determines what the messages actually are and what they mean.
If we return to an example that we wrote about previously regarding a letter being broken down into the OSI model; the ink and page make up the physical layer, the character set make up the data link layer, and the words and phrases make up the application layer. In this analogy, we could view different languages as being different application layer protocols. That is, whether a letter is written in French, English or German, the physical medium is the same, the character sets are (for the most part) the same, it is still defined as a letter regardless of which language it’s written in, but that doesn’t guarantee you’ll be able to understand it.
It’s the same with CAN, no matter what higher level protocol is used, if it uses the same bottom two layers it is still CAN, which guarantees that you will be able to read it, but doesn’t guarantee you’ll be able to understand it.
The three higher level protocols we will discuss, DeviceNet, CANopen and J1939 are like three different languages, they use the same medium but in order to understand the information you must understand the language, grammar and punctuation.
These three protocols are probably the most common CAN-based higher level protocols but they are not the only ones that exist, there are many more including CANaerospace, CAN Kingdom, MilCAN, SafetyBUS, and many others. Almost all trucks use J1939 and so it is likely that this may be the protocol you will find most relevant. As an aside, almost all passenger vehicles use proprietary protocols, so while you may be able to connect up your CAN diagnostic device to your car’s CAN bus and read the data, you won’t necessarily be able to interpret the messages.
DeviceNet was developed in the early ‘90s after a joint venture by Honeywell and Allen-Bradley to create a higher-level communication protocol fell through. Allen-Bradley continued development of the protocol and the result was DeviceNet. In 1994 Allen-Bradley made the protocol public and handed control of the protocol to the “Open DeviceNet Vendor Association” (ODVA), which is still responsible for the specification and conformance testing today. Because of its structure and origins, DeviceNet is mostly used in factory automation. It can handle up to 64 nodes, and can operate at three different rates 125, 250 or 500kbps.
The upper layers (including the application layer) are also called CIP or Common Industrial Protocol. It was previously known as “Communications and Information Protocol”. In the CIP Protocol, every network device represents itself as a series of objects. Each object is simply a grouping of the related data values in a device.
The physical layer of DeviceNet conforms to the CAN physical layer standard, but includes more specific detail, defining every aspect including cable and connectors.
Here is an example of a DeviceNet network. As you can see, the DeviceNet bus is essentially the backbone of the network, with other types of communication networks connected via gateways. This is very common for all types of CAN networks, with one main bus running through the system and multiple dedicated sub-busses connected via gateway devices.
Before going into detail regarding CANopen is, it is important to explain some of the terminology.
The COB is simply just another name for a CAN frame. The COB-ID is the message ID. A PDO is a “Process Data Object” and is used to send a single frame of data. An SDO is a “Service Data Object” and is used to send data over multiple frames. EDS is an “Electronic Data Sheet” which explains how a particular node works and an OD is the “Object Dictionary” which is a lookup table inside every node that each node uses to store information about the network.
CANopen is one of the most flexible protocols, and as such, is found in many different applications such as coffee makers, transportation systems, medical systems, and industrial applications. CAN was originally developed to be used in passenger cars, but the first applications came from other markets. In 1992, Holger Zeltwanger formed the CAN in Automation (CiA) organisation to promote CANs image and provide a path for future developments of the CAN protocol; this included development of a common CAN Application Layer protocol that could be used universally. In 1994, this CAL became CANopen, also known as CiA 301 and is currently up to revision 4.2.
CANopen generally uses the standard CAN data frame with 11-bit IDs, but there are some rare applications that do use extended CAN. Due to the way CANopen uses node IDs, it is limited to a maximum of 127 nodes. All CANopen nodes have an internal “Object Dictionary” which is a lookup table that holds all network-accessible data, such as the configuration of the network and the functionality of that node (16-bit indexes, 8-bit subindexes). All other nodes can read and write to each other’s ODs. For instance, an air conditioner controller node may write a particular byte into the OD of a sensor node instructing it to measure the ambient temperature, which it then does and then stores the result in a different location in its OD for the air conditioner controller node to read.
Since the OD of a node describes what the node does and how it operates, other nodes can read this information and from that they can work out how to interface with that node, like the air conditioner example described above. This allows CANopen to be a plug and play protocol, as new CANopen compliant nodes can be purchased off-the-shelf and added to the network, however there is a catch. All CANopen nodes must be uniquely identifiable as CANopen messages are generally peer-to-peer and thus the sender must know where to send its message. Therefore every CANopen node must have a unique ID, which often can be set with external switches or configured in software via a configuration program. Configuration programs can be quite complicated, but they can be very useful. Since every CANopen node must ship with an EDS that fully describes the operation of the device, these can be loaded into the configuration software which allows the entire system to be simulated on a computer. There is a lot more to discuss regarding CANopen however as it is a protocol more related to automation than automotive it is not one that you will encounter very often in the automotive field.
A protocol that will be encountered quite often is J1939 as it is designed for heavy vehicles and a J1939 CAN network is now standard in almost all European-made heavy vehicles. Outside of Europe, J1939 is becoming increasingly common, now appearing in most US build heavy vehicles, as well as appearing in some passenger cars.
In our experience the exciting part about J1939 is that all messages are defined by the standard. In fact, the application layer standard is just like a giant dictionary that explains what every message is and how to interpret it correctly. Other parts of the standard define how the message ID is broken up into sections and how to send messages that contain more than eight bytes given that a single CAN frame can only hold eight bytes of data. Two places where you may have already encountered J1939 are your body builder module and fleet management system. Both of these are gateways to the vehicles J1939 bus that may only allow a subset of J1939 messages to pass through, and may also include additional proprietary messages on one side of the gateway. We will now describe some of the specifics of J1939.
Almost all J1939 busses operate at 250kbps. We say “almost all” because there has recently been released an alternative physical layer standard (J1939/14) that allows for a faster implementation at 500kbps. The table shown in a previous article identified bus lengths up to 200m at 250kbps however the J1939 standard defines a maximum bus length of 40m. Up to 30 nodes are supported on a single J1939 bus, but rarely do you ever see close to this number in reality.
J1939 defines a transport protocol for fragmenting messages greater than 8 bytes upon transmission and then stitching them back together upon reception. This allows messages that are up to 1785 bytes long, in theory. Again, in reality, the largest message I have seen is the engine configuration message that can be up to 39 bytes long.
Unlike the other protocols mentioned, J1939 only uses extended CAN identifiers. If standard identifiers are observed on a J1939 bus, they are simply ignored. For this reason, some manufacturers use proprietary messages with standard IDs to ensure they will not interfere with the rest of the bus. The reason for using extended IDs is due to the way the ID field is divided.
If we take a look at the ID field we have 29-bits in total we can use. J1939 takes these bits and splits them up into groups. Working from the back, the last 8-bits form the source address of the transmitting node. There are preferred source addresses for most types of nodes, so generally each node just uses the predefined address (for example, Engine 1 has a preferred address of 0, for Transmission 1 it is 3). However, if a node cannot use preferred address for whatever reason, it must go through an address claim procedure defined in the standard.
The next byte to the left is called (Protocol Data Unit) PDU Specific and can be one of two things: it can either be the destination address of a node, or what is called a group extension. Which one of these this byte represents is determined by the value of the preceding byte.
This byte is called PDU Format, because it determines which format is used. If this value is below 240, then it means the message is intended for a specific node, and therefore the PDU-S byte represents the destination address (this is also known as a PDU1 message). If the value of PDU-F is 240 or above, then the message is a broadcast message that is not intended for any one node in particular, and therefore the PDU-S represents the group extension (this is also known as a PDU2 message).
We then come to the data page bit. The point of this bit is to essentially double the number of CAN messages available, but there is still plenty of room left in the standard for more messages to be defined, so currently this bit is always set to zero. Likewise the preceding bit is currently always zero; it was called a reserve bit but has recently been renamed Extended Data Page, and serves the same function as the data page bit.
Then at the very start of the ID there are three priority bits. Since arbitration is determined at the start of the ID field, J1939 uses these first three bits to prioritise its messages. Those messages with the highest priority have the lowest number in this section, and those with the lowest priority have the highest number (which is 7), to ensure the most important messages are not delayed by less important messages. Messages are defined by parameter group numbers, or PGNs. It is important to note where does this number come from? It is actually derived from the two middle bytes PDU-F and PDU-S. Unfortunately it not quite as simple at just that, there are some conditions. As just explained, there are two message format options: destination specific messages and group messages.
Determining the PGN of a group message is relatively simple, in this case it is simply the concatenation of the PDU-F and the group extension to give one 16-bit number. However, this same approach to determine the PGNs would not work for destination specific messages, as the PDU-S does not contain a fixed group extension, it contains a variable destination address, meaning the PGN would differ depending on the destination. That’s no good, so for the purposes of determining the PGN, destination specific messages treat the PDU-S as if it is zero, and concatenating it with the PDU-F to generate the 16-bit PGN. In simple terms, this just means that the PGN for a destination specific message is the PDU-F multiplied by 256. That means destination specific messages occupy the PGNs from zero to 61184, in steps of 256. And broadcast messages have PGNs from 61440 to 65535, in steps of one (4096 total, since the group extension can be any number from 0 to 255).
Now we know how to determine a PGN, but what exactly is it? As its name implies, it is simply a number used to identify a group of parameters. Every parameter in the J1939 standard is also given a number, these are called suspect parameter numbers (or SPNs). For every PGN, the following information is defined:
o Data length, which can be anything from two bits, to over 1400 bytes
o Resolution, which defines what the unit of measure is and how to scale the data to give real values
o Data range, which defines the real range of data after scaling
o Type, meaning whether the value has been measured (e.g. engine speed) or is a status value (e.g. current gear)
Supporting information, which essentially just gives any additional information that may be of assistance, such as in which PGN you will find this SPN.
We will now analyse an example PGN as shown above. This PGN, 61444, is also known as the Electronic Engine Controller 1 message (or EEC1); these English names are given in the standard simply to make life easier for those of us trying to use them. Here you can see all the information related to this PGN. At the top we see the transmission rate, which in this case is defined as engine speed dependent. In real systems however, this message is generally sent at a rate of 10ms. The data length for this message is eight bytes. Both the extended data page and data page bits are zero. The PDU format is 240, which makes it a PDU2 (or broadcast) message. The PDU specific, or rather group extension, in this case is 4 and the priority is 3, which makes it a fairly high priority message. The section at the bottom lists all the parameter numbers, their length, and where they are positioned in the message.
Let’s examine SPN number 190, that is Engine Speed. The definition for SPN190 shows that the data length is two bytes long and has a resolution of 0.125 rpm per bit, with zero offset. This gives the parameter the real range of 0 to 8031.875 rpm. This definition also shows that this is a measured value, and can be found in PGN 61444. If we take a closer look at the information in the PGN definition, we can see that the start position is listed as 4-5. Since this parameter is two bytes long, it is showing that it starts at byte four and spans all of bytes four and five.
This is a section of a real log as shown above, taken from recent vehicle. You will notice all the values are in hexadecimal, the reason for this is just that it is easier to work with for both humans and computers – once you get the hang of it. Now this is the raw data from the CAN bus, so this is how messages look regardless of the higher level protocol that is used. We know this truck is using J1939, so we take the first message as our example and split the ID up into the parts defined by J1939 as per the image below. This is where you can see that working in hex is easier, as each byte is signified by two digits the PDU and source address fields can be populated by just splitting up the ID into bytes.
So now we have formatted the ID into the J1939 form, and we can see that the PDU format byte is 0xF0, which is 240 in decimal. This makes it a PDU2 message, or group message, so the PGN can be derived by concatenating the PDU-F and PDU-S to give us the value 0xF004, or 61444 in decimal. Of course we have selected this example as PGN 61444 is the EEC1 message that we were just looking at. If you remember, bytes 4-5 give us the engine speed scaled by 0.125rpm/bit, so we can calculate the engine speed in this message.
A word of caution here, since byte four is the first byte, it means that it is the least significant byte or in other words the byte that goes furthest to the right. That means that the 16-bit number is not E02A, it is 2AE0. If we then convert this number to decimal and multiply by the scaling factor, voila we have an engine speed of 1372 RPM.
There is a lot more to J1939 than this, but because all messages are defined by the standard, there are a lot of tools for J1939 that can be purchased straight off the shelf. So much of what we have just covered is handled by the tools already, as the manufacturer of the tools can often supply software that has all the parameters pre-programmed.
A few of the main tools available that have CAN add-ons are as follows:
One of the advantages of these tools is that some will automatically split up and piece back together multi-frame messages, that is, messages that are longer than eight bytes. Some tools also have the ability to plot the parameters in real time, making it easier to visualise what is happening on the vehicle.
That now completes the article on higher level protocols that make up the CAN Application Layer.
This article was produced in the AEAC News and has been published with their permission.