1.. SPDX-License-Identifier: (GPL-2.0-only OR BSD-3-Clause) 2 3can327: ELM327 driver for Linux SocketCAN 4========================================== 5 6Authors 7-------- 8 9Max Staudt <max@enpas.org> 10 11 12 13Motivation 14----------- 15 16This driver aims to lower the initial cost for hackers interested in 17working with CAN buses. 18 19CAN adapters are expensive, few, and far between. 20ELM327 interfaces are cheap and plentiful. 21Let's use ELM327s as CAN adapters. 22 23 24 25Introduction 26------------- 27 28This driver is an effort to turn abundant ELM327 based OBD interfaces 29into full fledged (as far as possible) CAN interfaces. 30 31Since the ELM327 was never meant to be a stand alone CAN controller, 32the driver has to switch between its modes as quickly as possible in 33order to fake full-duplex operation. 34 35As such, can327 is a best effort driver. However, this is more than 36enough to implement simple request-response protocols (such as OBD II), 37and to monitor broadcast messages on a bus (such as in a vehicle). 38 39Most ELM327s come as nondescript serial devices, attached via USB or 40Bluetooth. The driver cannot recognize them by itself, and as such it 41is up to the user to attach it in form of a TTY line discipline 42(similar to PPP, SLIP, slcan, ...). 43 44This driver is meant for ELM327 versions 1.4b and up, see below for 45known limitations in older controllers and clones. 46 47 48 49Data sheet 50----------- 51 52The official data sheets can be found at ELM electronics' home page: 53 54 https://www.elmelectronics.com/ 55 56 57 58How to attach the line discipline 59---------------------------------- 60 61Every ELM327 chip is factory programmed to operate at a serial setting 62of 38400 baud/s, 8 data bits, no parity, 1 stopbit. 63 64If you have kept this default configuration, the line discipline can 65be attached on a command prompt as follows:: 66 67 sudo ldattach \ 68 --debug \ 69 --speed 38400 \ 70 --eightbits \ 71 --noparity \ 72 --onestopbit \ 73 --iflag -ICRNL,INLCR,-IXOFF \ 74 30 \ 75 /dev/ttyUSB0 76 77To change the ELM327's serial settings, please refer to its data 78sheet. This needs to be done before attaching the line discipline. 79 80Once the ldisc is attached, the CAN interface starts out unconfigured. 81Set the speed before starting it:: 82 83 # The interface needs to be down to change parameters 84 sudo ip link set can0 down 85 sudo ip link set can0 type can bitrate 500000 86 sudo ip link set can0 up 87 88500000 bit/s is a common rate for OBD-II diagnostics. 89If you're connecting straight to a car's OBD port, this is the speed 90that most cars (but not all!) expect. 91 92After this, you can set out as usual with candump, cansniffer, etc. 93 94 95 96How to check the controller version 97------------------------------------ 98 99Use a terminal program to attach to the controller. 100 101After issuing the "``AT WS``" command, the controller will respond with 102its version:: 103 104 >AT WS 105 106 107 ELM327 v1.4b 108 109 > 110 111Note that clones may claim to be any version they like. 112It is not indicative of their actual feature set. 113 114 115 116 117Communication example 118---------------------- 119 120This is a short and incomplete introduction on how to talk to an ELM327. 121It is here to guide understanding of the controller's and the driver's 122limitation (listed below) as well as manual testing. 123 124 125The ELM327 has two modes: 126 127- Command mode 128- Reception mode 129 130In command mode, it expects one command per line, terminated by CR. 131By default, the prompt is a "``>``", after which a command can be 132entered:: 133 134 >ATE1 135 OK 136 > 137 138The init script in the driver switches off several configuration options 139that are only meaningful in the original OBD scenario the chip is meant 140for, and are actually a hindrance for can327. 141 142 143When a command is not recognized, such as by an older version of the 144ELM327, a question mark is printed as a response instead of OK:: 145 146 >ATUNKNOWN 147 ? 148 > 149 150At present, can327 does not evaluate this response. See the section 151below on known limitations for details. 152 153 154When a CAN frame is to be sent, the target address is configured, after 155which the frame is sent as a command that consists of the data's hex 156dump:: 157 158 >ATSH123 159 OK 160 >DEADBEEF12345678 161 OK 162 > 163 164The above interaction sends the SFF frame "``DE AD BE EF 12 34 56 78``" 165with (11 bit) CAN ID ``0x123``. 166For this to function, the controller must be configured for SFF sending 167mode (using "``AT PB``", see code or datasheet). 168 169 170Once a frame has been sent and wait-for-reply mode is on (``ATR1``, 171configured on ``listen-only=off``), or when the reply timeout expires 172and the driver sets the controller into monitoring mode (``ATMA``), 173the ELM327 will send one line for each received CAN frame, consisting 174of CAN ID, DLC, and data:: 175 176 123 8 DEADBEEF12345678 177 178For EFF (29 bit) CAN frames, the address format is slightly different, 179which can327 uses to tell the two apart:: 180 181 12 34 56 78 8 DEADBEEF12345678 182 183The ELM327 will receive both SFF and EFF frames - the current CAN 184config (``ATPB``) does not matter. 185 186 187If the ELM327's internal UART sending buffer runs full, it will abort 188the monitoring mode, print "BUFFER FULL" and drop back into command 189mode. Note that in this case, unlike with other error messages, the 190error message may appear on the same line as the last (usually 191incomplete) data frame:: 192 193 12 34 56 78 8 DEADBEEF123 BUFFER FULL 194 195 196 197Known limitations of the controller 198------------------------------------ 199 200- Clone devices ("v1.5" and others) 201 202 Sending RTR frames is not supported and will be dropped silently. 203 204 Receiving RTR with DLC 8 will appear to be a regular frame with 205 the last received frame's DLC and payload. 206 207 "``AT CSM``" (CAN Silent Monitoring, i.e. don't send CAN ACKs) is 208 not supported, and is hard coded to ON. Thus, frames are not ACKed 209 while listening: "``AT MA``" (Monitor All) will always be "silent". 210 However, immediately after sending a frame, the ELM327 will be in 211 "receive reply" mode, in which it *does* ACK any received frames. 212 Once the bus goes silent, or an error occurs (such as BUFFER FULL), 213 or the receive reply timeout runs out, the ELM327 will end reply 214 reception mode on its own and can327 will fall back to "``AT MA``" 215 in order to keep monitoring the bus. 216 217 Other limitations may apply, depending on the clone and the quality 218 of its firmware. 219 220 221- All versions 222 223 No full duplex operation is supported. The driver will switch 224 between input/output mode as quickly as possible. 225 226 The length of outgoing RTR frames cannot be set. In fact, some 227 clones (tested with one identifying as "``v1.5``") are unable to 228 send RTR frames at all. 229 230 We don't have a way to get real-time notifications on CAN errors. 231 While there is a command (``AT CS``) to retrieve some basic stats, 232 we don't poll it as it would force us to interrupt reception mode. 233 234 235- Versions prior to 1.4b 236 237 These versions do not send CAN ACKs when in monitoring mode (AT MA). 238 However, they do send ACKs while waiting for a reply immediately 239 after sending a frame. The driver maximizes this time to make the 240 controller as useful as possible. 241 242 Starting with version 1.4b, the ELM327 supports the "``AT CSM``" 243 command, and the "listen-only" CAN option will take effect. 244 245 246- Versions prior to 1.4 247 248 These chips do not support the "``AT PB``" command, and thus cannot 249 change bitrate or SFF/EFF mode on-the-fly. This will have to be 250 programmed by the user before attaching the line discipline. See the 251 data sheet for details. 252 253 254- Versions prior to 1.3 255 256 These chips cannot be used at all with can327. They do not support 257 the "``AT D1``" command, which is necessary to avoid parsing conflicts 258 on incoming data, as well as distinction of RTR frame lengths. 259 260 Specifically, this allows for easy distinction of SFF and EFF 261 frames, and to check whether frames are complete. While it is possible 262 to deduce the type and length from the length of the line the ELM327 263 sends us, this method fails when the ELM327's UART output buffer 264 overruns. It may abort sending in the middle of the line, which will 265 then be mistaken for something else. 266 267 268 269Known limitations of the driver 270-------------------------------- 271 272- No 8/7 timing. 273 274 ELM327 can only set CAN bitrates that are of the form 500000/n, where 275 n is an integer divisor. 276 However there is an exception: With a separate flag, it may set the 277 speed to be 8/7 of the speed indicated by the divisor. 278 This mode is not currently implemented. 279 280- No evaluation of command responses. 281 282 The ELM327 will reply with OK when a command is understood, and with ? 283 when it is not. The driver does not currently check this, and simply 284 assumes that the chip understands every command. 285 The driver is built such that functionality degrades gracefully 286 nevertheless. See the section on known limitations of the controller. 287 288- No use of hardware CAN ID filtering 289 290 An ELM327's UART sending buffer will easily overflow on heavy CAN bus 291 load, resulting in the "``BUFFER FULL``" message. Using the hardware 292 filters available through "``AT CF xxx``" and "``AT CM xxx``" would be 293 helpful here, however SocketCAN does not currently provide a facility 294 to make use of such hardware features. 295 296 297 298Rationale behind the chosen configuration 299------------------------------------------ 300 301``AT E1`` 302 Echo on 303 304 We need this to be able to get a prompt reliably. 305 306``AT S1`` 307 Spaces on 308 309 We need this to distinguish 11/29 bit CAN addresses received. 310 311 Note: 312 We can usually do this using the line length (odd/even), 313 but this fails if the line is not transmitted fully to 314 the host (BUFFER FULL). 315 316``AT D1`` 317 DLC on 318 319 We need this to tell the "length" of RTR frames. 320 321 322 323A note on CAN bus termination 324------------------------------ 325 326Your adapter may have resistors soldered in which are meant to terminate 327the bus. This is correct when it is plugged into a OBD-II socket, but 328not helpful when trying to tap into the middle of an existing CAN bus. 329 330If communications don't work with the adapter connected, check for the 331termination resistors on its PCB and try removing them. 332