Dr. Ken Tindell is the CTO of Canis Automotive Labs and this is his blog site, focusing on CAN bus and CAN security.
The latest update of the open source can2 protocol decoder is able to automatically infer the sender of a CAN frame. It uses the method of deterministic distortion of CAN signals that result in frames from a given node on the bus having consistently shortened or lengthened recessive pulses. The differences can be quite small - just 10 or 15 nanoseconds - but they can be picked up by a suitably…
This is a blog post about firmware updates, and I was inspired to write it by the news that NASA’s Curiosity rover on Mars has got an OTA update . The firmware image was about 21MB and took 11 days to send it over-the-air (or in this case, over-the-vacuum: Mars is currently 242 million kilometres from Earth). NASA has long included OTA update capabilities in space missions: the Voyager probes…
This is a detective story about how a car was stolen - and how it uncovered an epidemic of high-tech car theft. It begins with a tweet. In April 2022, my friend Ian Tabor tweeted that vandals had been at his car, pulling apart the headlight and unplugging the cables. It seemed like pointless vandalism, the kind of thing that makes it impossible to have nice things. Then three months later it…
The question: There is a CAN node that’s acting very strangely on a 500kbit/sec CAN bus. What is happening? The specific timings are very important clues. A single burst of pulses consists of: A dominant pulse of 34 microseconds Followed by 15 cycles of 50 microseconds recessive / 2 microseconds dominant The time between the end of the last 2 microsecond dominant pulse in a burst and the start of…
This is the second CAN Quiz Question on the CAN protocol. This one is quite hard and not only tests knowledge of the dark corners of the CAN protocol, it also highlights a couple of important system design issues. Question There is a CAN device that’s acting very strangely on a 500kbit/sec CAN bus. A logic analyzer trace is taken from the CAN TX pin (the output from the CAN controller that goes…
At first glance, an innocent little project for the Festive Season - Cheerlights on a Pico. Big Deal?! But look round the other end… Oooh! That looks rather like a CAN bus interface! The title of this blog is rather a lot to swallow in one go - you probably recognise most of the words in it, but have you ever seen them all together in the same sentence? No. Let’s break it down, starting with the…
CAN bus wiring has a big effect on how fast data can go on CAN. CAN bits are normally 2000ns (2 microseconds, or 500kbit/sec) or longer for slower buses (a J1939 CAN bus runs at 250kbit/sec and can be up to 40m long). But CAN FD has the promise of much faster speeds on conventional CAN bus wiring, up to 8Mbit/sec (i.e. 125ns bit times). Yet most of the automotive industry is using CAN FD at just…
CryptoCAN is an encryption scheme for CAN messaging developed by Canis Labs . It’s designed to fit the publish/subscribe method of communication that CAN was designed for, and has a simple job: take a plaintext CAN frame, convert it into two ciphertext frames for broadcast on CAN, and at receivers, push these frames through a decoder to get back to the plaintext frame. The ciphertext frames…
DRAMATIS PERSONAE : AAAAAchilles , a CTF player, ready to capture the flags. Ben Gardiner , the challenge designer, planning for anything but. SCENE : Car Hacking Village. Ben is sitting at a table. On the table is a piece of paper. ENTER AAAAAchilles : AAAAAchilles reads the words on the paper aloud AAAAAchilles : “Challenge name Just Decode It 2 . Here is a mystery ECU in a red case. It is…
The Raspberry Pi Pico is an excellent embedded platform, noted for its excellent documentation (and also the RP2040 microcontroller, one of the few that is currently not made from unobtainium). But one of the great features of this board is how it gets more and more support over time. And that’s why we used it as the basis for the CANPico. The CANPico currently has a MicroPython SDK for easily…