Reverse engineering CAN messages using Motor and PCAN

Equipment Required

1) Windows OS
2) Kvaser Leaf Light v2
3) National Instruments CAN Breakout Box (Junction Box)
4) Arduino Uno
5) NI-Xnet Bus Monitor
6) MCP2515 CAN Bus Module
7) BTS7960 Motor Driver
8) Arduino Uno
9) MY1016Z2 DC Motor
10) Breadboard
11) Jumper Cables
12) DC Power Supply (up to 12V)
13) PCAN USB Peak-System

Software Setup

1) Install the PCAN View software using the following link:

https://www.peak-system.com/PCAN-View.242.0.html?&L=1

Hardware Setup

We use the same setup as in the previous experiment with a few changes.

1) We connect one end of the PCAN USB hardware to the PC and the other end
should be connected to the CAN Input.
Block Diagram

B-
B+

We will also make an extra connection between the Computer and the MCP2515 where we
will connect the PCAN USB to the CANH and CANL wires.

Python Script

from canlib import canlib, Frame

import sys

import time
chan = 0

if len(sys.argv) == 2:

chan = int(sys.argv[1])

print("Opening CAN Channel for Transmission %d" %(chan))

ch = canlib.openChannel(chan,canlib.canOPEN_ACCEPT_VIRTUAL)

print("%d. %s (%s / %s) " % (chan,

canlib.ChannelData(chan).channel_name,

canlib.ChannelData(chan).card_upc_no,

canlib.ChannelData(chan).card_serial_no))

if canlib.ChannelData(chan).custom_name != '':

print ("Customised Channel Name: %s "

%(canlib.ChannelData(chan).custom_name))

print("Setting Baud Rate to 500 Kbps")

ch.setBusParams(canlib.canBITRATE_500K)

print("Data Frame going on CAN Bus")

ch.busOn()

for i in range(255):

k = 100

frame1= Frame(id_=123,

data=[i, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00],

 dlc=8,

flags=0)

ch.write(frame1)

time.sleep(0.1)

for i in range(255,0,-1):

frame1= Frame(id_=124,

data=[i, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00],

dlc=8,

flags=0)

ch.write(frame1)

time.sleep(0.1)

for i in range(255):

k = 100

frame1= Frame(id_=125,

data=[i, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00],

dlc=8,

flags=0)

ch.write(frame1)

time.sleep(0.1)

for i in range(255,0,-1):

frame1= Frame(id_=126,

data=[i, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00],

dlc=8,

flags=0)

ch.write(frame1)
 time.sleep(0.1)

print("Going OFF CAN Bus")

ch.busOff()

print("Closing Channel")

ch.close()

Arduino Code
#include <SPI.h>

#include <mcp2515.h>

struct can_frame canMsg;

MCP2515 mcp2515(10);

int RPWM_Output = 5; // Arduino PWM output pin 5; connect to IBT-2 pin

1 (RPWM)

int LPWM_Output = 6; // Arduino PWM output pin 6; connect to IBT-2 pin

2 (LPWM)

int PWM1_Received_Nano = 0;

int PWM2_Received_Nano = 0;

int PWM3_Received_Nano = 0;

int PWM4_Received_Nano = 0;

void setup() {

Serial.begin(125000);

pinMode(RPWM_Output, OUTPUT);
 pinMode(LPWM_Output, OUTPUT);

mcp2515.reset();

mcp2515.setBitrate(CAN_500KBPS,MCP_8MHZ);

mcp2515.setNormalMode();

Serial.println("------- CAN Read ----------");

Serial.println("ID DLC DATA");

void loop() {

if (mcp2515.readMessage(&canMsg) == MCP2515::ERROR_OK) {

Serial.print(canMsg.can_id, HEX); // print ID

Serial.print(" ");

Serial.print(canMsg.can_dlc, HEX); // print DLC

Serial.print(" ");

for (int i = 0; i<canMsg.can_dlc; i++) { // print the data

Serial.print(canMsg.data[i], HEX);

Serial.print(" ");

delay(10);

//Anti Clockwise Rotation

//Serial.print("PWM_Received-");

//Serial.print(PWM_Received);

if( canMsg.can_id == 123){

PWM1_Received_Nano = canMsg.data[0];

analogWrite(LPWM_Output, PWM1_Received_Nano);

if( canMsg.can_id == 124){

 PWM2_Received_Nano = canMsg.data[0];

analogWrite(LPWM_Output, PWM2_Received_Nano);

//Clockwise Rotation

//Serial.print("PWM_Received-");

//Serial.print(PWM_Received);

if( canMsg.can_id == 125){

PWM3_Received_Nano = canMsg.data[0];

analogWrite(RPWM_Output, PWM3_Received_Nano);

if( canMsg.can_id == 126){

PWM4_Received_Nano = canMsg.data[0];

analogWrite(RPWM_Output, PWM4_Received_Nano);

Serial.println();

}}
 Instructions

1) Paste the Arduino code into the Arduino IDE and compile. Upload the code.

2) Paste the python script in the visual studio code editor. Replace the last 6 bytes of data

with your BITS ID in the following format:

If your ID is 2024A7PS1434H, replace the last 6 bytes with 0x0A, 0x07, 0x01, 0x04,

0x03, 0x04 (A71434) respectively.

3) Go to start → PCAN-View on the remote desktop. It will display the available PCAN

Hardware in the window. Set the bitrate to 500 kbit/s and click ok.
4) Run the python code → The motor will start rotating in an anticlockwise and then

a clockwise direction with varying speeds which can be seen through the IP
Camera Viewer App on the desktop.
5) PCAN-View will capture all the data transmitted on the CAN bus.

6) Now, go to the toolbar and click on the icon with the envelope on it, this will allow you
to generate a new message.

7) In the new message window, type the id of the message that you want to transmit (one
of the messages that has been read by PCAN).
8) Change the data to anything else that you would like to transmit.
 9) The motor will start malfunctioning once you start transmitting that data (you can see
the change in speed of the motor through an IP camera viewer).

Instructions to Open IPV4 Camera Viewer

1) Click on the IP Camera Viewer icon on your desktop. If it says no camera available.
2) Go to start → camera privacy settings → allow access.
3) Close and reopen the IP Camera Viewer.
4) Select the option webcam and it will show which camera is connected, click ok.
5) NOTE: Please close all the applications opened in RDP mainly Equipment
console and IP Camera viewer. If not closed, for the next student logging in will
not be able to access them as it will show applications are in use.
 Screenshots required
1. Python script containing your BITS ID

2. Data containing your BITS ID - Last 5 digits.

Eg: If your ID is 2023TH55551, take the last 5 digits of your ID and display it as 05 05
05 05 01
3. Replay message window.

4. Motor screen (IP camera viewer) with time.