So for the past month I’ve been on travel for work in Arizona. Yesterday I was on my way home, and happened to be in Phoenix. As it turns out, scantool.net’s HQ is located in Phoenix so I dropped by for a visit. I had not initially realized how large of a staff they have on site, but a good number of them took time out of their day to talk to me and I really appreciate that. I actually wound up being there for several hours. Between discussions over CAN network and sitting in the Chevy Sonic I had rented to decode a variety of CAN messages using their can sniffer, it was a very eventful and interesting day.
Initially we got into discussions about CAN based OBD2 messaging, specifically the meanings of the different identifiers in 11bit vs 29bit. It seems that there were a few different modes of CAN That I was confused about the OBDLink MX’s return values for. There are a few different CAN modes that the OBDLink MX supports, the main differencing factors are 11vs29bit, and 15765 vs 11898 protocols. 15765 has an extra byte in the return for PCI, or Protocol Control Information field, defined here. This was of course, throwing my software through a loop since I wasn’t handling this, and this made for an extra byte on top of everything else. 11898 CAN does not have this identifier, since it is just RAW can values. The OBDLink does not actually return what is listed in the wikipedia article on CAN_Bus, adding even more confusion. The underlying CAN hardware internal to the OBDLink MX strips out start-of-frame, the RTR/IDE bits, and the DLC (unless otherwise requested to show it via ATD1 if I remember correctly).
Armed with this new information, we moved into a conference room, set up one of their wonderful OBD2 simulators, a Y cable, and a second laptop/tool to attempt to try out my new CAN Parser software to sniff what a CAN datatool is doing. Of course, as with anything technology we ran into a few issues. The first of which was the fact that I was running linux. When connecting over rfcomm using a bluetooth adapter on linux, you have to manually bind the rfcomm channel on your device to access /dev/rfcomm0. This is a bit of a hassle, since upon power cycling the device, or disconnecting screen from that particular pty, it breaks the connection and you have to unbind and rebind, which doesn’t seem to work 100% of the time. This is not an issue with the Obdlink MX, this is a linux issue since windows has no issues keeping the com port connected and active even under device powercycles. I will have to investigate more thoroughly if there is a method for easy connecting under linux.
The few times we actually got it to work, I realized that there were a lot of contingencies I did not actually plan for in the writing of my CanParse application. So after some mad random coding, and a bit of pizza and soda (thanks guys!), we moved out into the car. Jason, from what I can tell (forgive me if I get this wrong), one of the hardware guys hooked up his can sniffer to the Chevy Sonic, while I hooked up the OBDLink MX via Y-cable. Couple of weird things happened, including the rpm dial flickering up and down and random dingings of the door alarm, even when the door was closed. We figured this was just his can sniffer doing something weird, and moved on. Unfortunately I did learn that my CanParse application is missing a few key usefulness features that will be required before it is used in such a fashion to actually decode what is happening on the CAN bus. I will be detailing these in a later post as I write them into the code. Using Jason’s scan sniffer application, we were able to decode several things over the course of about two hours, including how to control the radio from the steering wheel controls, and how to identify when the lock/unlock and blinkers went on and off. We were unable to control the blinkers or locks, possibly due to a gateway node on the CAN network blocking our traffic, or us just not seeing the proper commands and only viewing notifications. Not entirely sure, but it was still very cool information to have. Just an example, but one could write a piece of hardware that monitors the CAN network, and logs lock-unlock events, turn signals, speed, rpm, a whole bunch of values to identify if someone is driving the car appropriately, or dangerously. I can think of a couple companies which could benefit from this, a couple who would want this, and a couple who NEED this
.
Couple of other key things to note that came out of this meeting. There is an asynchronous communications mode that is eventually planned (ATMA mode with bidirectional communication), however logistically it’s not simple, so it may not happen very soon. It is definitely on their minds though, which is a huge bonus to the CAN crowd. I know that pretty much anyone with a MX and a CAN car would benefit from this, so I can only hope that they implement it soon.
The other thing had to do with CAN masks, I’ll go over that in my next post along with ATMA/STMA/STM differences.
Couple of pictures.
Their offices, they have cubicles

This is the back side of the cubicles. They’re not too large. There is a little white fan looking thing to the left of the paper cutter. It is a Wimshurst Electrostatic Generator. And let me tell you, even through 4-5 people, it still hurts.

This is the lab, they have cool workbenches for assembling stuff ESD safe-like.

And last but not least, me standing with the guys who took so much time out of their days to talk to me and deal with all my questions. From left to right, Joe, Jason, Me, Vitaliy, Vitaliy. That’s right, there are two of them. And I thought it was a unique name
. Thanks again guys!





























