kentindell
kentindell
  • 20
  • 48 608
Animated plot of a CAN signal against reflection coefficient
Shows how a CAN signal is distorted by reflections on the bus due to impedance mismatches, with bit asymmetry (where the rising edge is delayed) and glitches around the rising edge. This is why CAN receivers do not synchronize on a rising edge.
Переглядів: 273

Відео

CAN higher layer security add on function
Переглядів 332Рік тому
Description of the CryptoCAN scheme for protecting CAN frames, presented at the CiA Member's Day 2023.
Getting started with CryptoCAN
Переглядів 366Рік тому
A guide to getting started with CryptoCAN on the Raspberry Pi Pico with the CANPico board.
The MIN protocol
Переглядів 4212 роки тому
An overview of the MIN protocol and how it can be used to control an embedded device from host PC software via a Python API.
How software uses an I/O pin mux to get direct access to a CAN transceiver
Переглядів 5752 роки тому
CAN protocol attacks are mounted by software getting direct access to the RX and TX pins of a CAN transceiver, bypassing the on-chip CAN module. This short video gives an example of how the pin mux on the STM32F405 microcontroller is set up for CAN and how it is altered to give software access to the pins. Watch to the end for a tip on how to make CAN protocols attacks much harder!
Inspiration for CAN-HG
Переглядів 3052 роки тому
The inspiration for putting high-speed data inside classic CAN frames? Movie film. The movie industry had a similar problem: how to get lots of new digital sound data into old film format, retaining compatibility with old projectors. Their solution was really neat..
Defending CAN bus Part 4: CAN-HG
Переглядів 6582 роки тому
CAN bus is a wildly successful fieldbus protocol that is perfectly designed for vehicle applications (even including spacecraft that have gone to Mars). But that success in handling sensors and actuators means it's going to be attacked by anyone wanting to compromise a vehicle. So there has been lots of activity in how to improve the security of CAN bus. I have produced a four part video series...
Defending CAN bus Part 3: Security gateways
Переглядів 1,2 тис.2 роки тому
CAN bus is a wildly successful fieldbus protocol that is perfectly designed for vehicle applications (even including spacecraft that have gone to Mars). But that success in handling sensors and actuators means it's going to be attacked by anyone wanting to compromise a vehicle. So there has been lots of activity in how to improve the security of CAN bus. I have produced a four part video series...
Defending CAN bus Part 2: Cryptography
Переглядів 2,1 тис.2 роки тому
CAN bus is a wildly successful fieldbus protocol that is perfectly designed for vehicle applications (even including spacecraft that have gone to Mars). But that success in handling sensors and actuators means it's going to be attacked by anyone wanting to compromise a vehicle. So there has been lots of activity in how to improve the security of CAN bus. I have produced a four part video series...
Defending CAN bus Part 1: Attacks and intrusion detection
Переглядів 7 тис.2 роки тому
CAN bus is a wildly successful fieldbus protocol that is perfectly designed for vehicle applications (even including spacecraft that have gone to Mars). But that success in handling sensors and actuators means it's going to be attacked by anyone wanting to compromise a vehicle. So there has been lots of activity in how to improve the security of CAN bus. I have produced a four part video series...
Attacks on the CAN protocol
Переглядів 8313 роки тому
This talk describes how the CAN protocol itself can be attacked, and demonstrates five different attacks. It also outlines some methods in detecting the attacks and how they can be mitigated. The talk was first presented at the ASRG on 23rd September 2021.
CAN Quiz
Переглядів 6 тис.3 роки тому
What happens when two CAN controllers on an otherwise empty bus each at the same time transmit frames with same ID of 0x123 and payloads of 66 69 72 73 74 and 73 65 63 6f 6e 64 respectively? To find out, watch the video.
CANPico Wireshark
Переглядів 8473 роки тому
Showing a Canis Labs CANPico board used as a USB CAN adapter for Wireshark
The Janus Attack
Переглядів 1,7 тис.3 роки тому
The Janus Attack is a low-level attack on CAN protocol itself, where a CAN frame contains two different payloads, with a targeted CAN controller seeing a different payload to other CAN controllers.
An intro to the CANPico board
Переглядів 12 тис.3 роки тому
A short introduction to the Canis Labs CANPico CAN hardware for the Raspberry Pi Pico. Demonstrates sending CAN frames with the MicroPython CAN API and a logic analyzer with a CAN protocol decoder.
PulseView and CAN decoder demo
Переглядів 6 тис.3 роки тому
PulseView and CAN decoder demo
Ethernet atomic broadcast
Переглядів 3334 роки тому
Ethernet atomic broadcast
Demonstration of priority inversion on CAN bus
Переглядів 8294 роки тому
Demonstration of priority inversion on CAN bus
Priority inversion on CAN
Переглядів 1,6 тис.4 роки тому
Priority inversion on CAN
The CANHack toolkit
Переглядів 4,5 тис.4 роки тому
The CANHack toolkit

КОМЕНТАРІ

  • @GaganHCLGupta
    @GaganHCLGupta Місяць тому

    Hi, Can we use "Min" in half duplex mode i.e. master slave communication mode? Master sends the queries, slave responds.

    • @kentindell
      @kentindell 25 днів тому

      Yes, absolutely. That's how I've used it before: the MCU listens for a command, sends a response. But it can do more sophisticated things like the master asking for a periodic sampling of a sensor until sending a "STOP" command.

    • @GaganHCLGupta
      @GaganHCLGupta 25 днів тому

      @@kentindell Ok thanks. Did you use the min protocol with or without "transport protocol"? Will it be possible to use Min with transport protocol in half duplex mode?

    • @kentindell
      @kentindell 25 днів тому

      @@GaganHCLGupta Yes, it was originally without transport mode and intended to be used as datagram messages. So you can use it like that with a simple controller asking the MCU for a response. For simple systems that's completely fine. For more complex systems, where there might be side-effects from re-send of a request after a timeout, you can add some sequence number to the request (and so duplicate requests are removed) or you could just switch the transport back on.

    • @GaganHCLGupta
      @GaganHCLGupta 25 днів тому

      @@kentindell Ok thanks. Do you know if "Will it be possible to use Min with transport protocol in half duplex mode?"

    • @kentindell
      @kentindell 25 днів тому

      @@GaganHCLGupta Yes, once the response message has been sent and been ACK'd it should go quiet.

  • @GaganHCLGupta
    @GaganHCLGupta Місяць тому

    Hi, Can we use "Min communication" in half duplex mode?

  • @fixerofthings
    @fixerofthings 2 місяці тому

    You had a number of different things going on in the video. For the sigrok/pulseview analyzer it seems you used a standard saleae logic analyzer on the CAN bus receive line to capture the bits and a CAN decoder plugin that performed the actual CAN protocol analysis. Is that correct? For my use case I just want to monitor automotive CAN bus traffic.

  • @bennguyen1313
    @bennguyen1313 10 місяців тому

    Have you tried plotting can bus data using Wireshark (with CSS' CANvas-Wireshark plugin) or with PlotJuggler DBC? Lots of open-source tools for viewing can data, SavvyCan , Cangaroo , BusMaster, CANalyzat0r , CANtact-app , WhileNotInfinite/CANStream, Strym, CANdevStudio, TDahlmann/canpp , or DanielMartensson/OpenSourceLogger.... However, most of these applications use SocketCan, which require Linux/VM.. I'd like to say with Windows only. BTW, PCAN-Explorer looks perfect for real-time, except not sure if it can open an existing trc file, and have it replay the plot in the panel. Also, it is very expensive and not sure if it supports non-PCAN usb adapters.

  • @olivierhenley7048
    @olivierhenley7048 Рік тому

    I love your tiger sweater! It's so cool.

    • @kentindell
      @kentindell Рік тому

      Thank you! It's more than 40 years old and my favorite sweater.

  • @baldrickaus
    @baldrickaus Рік тому

    Just what I was looking for. Reminds me of years ago, working on serial protocols between fuel dispensers and forecourt controllers. Also used between door access controllers and their command centers. All running on current loop.

  • @CreeewDeeeTaaay
    @CreeewDeeeTaaay Рік тому

    Good lord, that tiger jumper is AMAZING 🤩 Interesting topic, but I thought you deserved kudos for fashion 😎

    • @kentindell
      @kentindell Рік тому

      Thank you! It's more than 40 years old, designed on an 8-bit home microcomputer to produce the knitting pattern.

  • @cbkt35
    @cbkt35 Рік тому

    Thanks man appreciate your work. Lots of good info!

  • @H3fAlUmP
    @H3fAlUmP Рік тому

    Very nice work on this. I wish ask you about the MicroPython SDK. I don't have the CANPico board, rather some cheep CAN board (SN65HVD230) and RP pico. How can I initialize all the CAN functions with my choice for pins? Thanks.

    • @kentindell
      @kentindell Рік тому

      That's a CAN transceiver, not a CAN controller. So only the CANHack functions will work. You can breadboard up a CANHack solution, as described here: kentindell.github.io/2021/02/06/canhack-pico/

    • @H3fAlUmP
      @H3fAlUmP Рік тому

      @@kentindell I see, thanks for help. :)

  • @AzureSky6612
    @AzureSky6612 2 роки тому

    Do you have C libraries if I don't want to use Thonny/Python?

    • @kentindell
      @kentindell 2 роки тому

      It's on the list to do. The MCP2517FD drivers are separate in the firmware source code and in C (they consist of SPI drivers for the bottom half and the remaining driver for the top half). The intention is to cut them into a C SDK and then refer to them in the MicroPython firmware so it's a common code base.

    • @kentindell
      @kentindell 2 роки тому

      Oh, I forgot: if you don't want to use Thonny you can use rshell (pip install rshell). It's a command line interface to MicroPython that handles the file system as well as jumping in to REPL.

    • @AzureSky6612
      @AzureSky6612 2 роки тому

      @@kentindell Good to know

  • @peterevans7480
    @peterevans7480 2 роки тому

    How do i get the can2 decoder into Pulse view? I have purchased your CANPico and I have got it in the mail today here in Australia. Looks great.

    • @kentindell
      @kentindell 2 роки тому

      You can set an environment variable, but the simplest is to put it in your home directory on Linux: ~/.local/share/libsigrokdecode/decoders or on Windows: %ProgramData%\libsigrokdecode\decoders You can also use the environment variable SIGROKDECODE_DIR to point to where the decoders are.

  • @ctrmint
    @ctrmint 2 роки тому

    Hi, Enjoying the boards. I've been experimenting with two transmitting to each other. Just as a casual observation I found that the RX board always buffers 1 sent frame into a frame list, then all the following sent frames are available in the following buffer/frame list. Say 6, 8 bytes frames are sent, I always get 1(list) + 5(list). ..Starting the loop |- Frames has length: 1 |- Decoded message: __hello_, Timestamp: 2436748169, Arbitration ID: 291, CAN ID: CANID(id=S123), DLC: 8, Index: 0, Tag: 0, Is Extended: <bound_method>, Is Remote: <bound_method> |- Frames has length: 5 |- Decoded message: message4, Timestamp: 2436748399, Arbitration ID: 291, CAN ID: CANID(id=S123), DLC: 8, Index: 0, Tag: 0, Is Extended: <bound_method>, Is Remote: <bound_method> |- Decoded message: message3, Timestamp: 2436748621, Arbitration ID: 291, CAN ID: CANID(id=S123), DLC: 8, Index: 0, Tag: 0, Is Extended: <bound_method>, Is Remote: <bound_method> |- Decoded message: message2, Timestamp: 2436748843, Arbitration ID: 291, CAN ID: CANID(id=S123), DLC: 8, Index: 0, Tag: 0, Is Extended: <bound_method>, Is Remote: <bound_method> |- Decoded message: message1, Timestamp: 2436749065, Arbitration ID: 291, CAN ID: CANID(id=S123), DLC: 8, Index: 0, Tag: 0, Is Extended: <bound_method>, Is Remote: <bound_method> |- Decoded message: __world_, Timestamp: 2436749289, Arbitration ID: 291, CAN ID: CANID(id=S123), DLC: 8, Index: 0, Tag: 0, Is Extended: <bound_method>, Is Remote: <bound_method> Is this expected behaviour? Thanks

    • @kentindell
      @kentindell 2 роки тому

      That's to be expected: the code is spinning round recv(), a frame comes in (via an ISR), it goes off to process it. The time taken to print is actually very slow, and in that time another 5 frames arrive. They're all processed together, the next time round the loop, that printing is very slow, and so on. Instead of printing the whole frame, try printing just the number of frames. And then try removing even that print and simply appending the length to a list, and at the end of the test run printing that list.

    • @kentindell
      @kentindell 2 роки тому

      You'll get another strange effect on transmitting: if you transmit a list of frames, starting low priority and going up to high priority, the frames will likely be transmitted in priority order except for the first one: the first one starts transmitting as soon as it's put into the controller (assuming the bus is mostly idle) then the subsequent frames are stacked up, with the controller choosing to send the highest priority first.

    • @ctrmint
      @ctrmint 2 роки тому

      @@kentindell thanks for the info and support, I’ll take onboard your feedback and experiment some more.

  • @ctrmint
    @ctrmint 2 роки тому

    Amazing videos, I'm certainly looking forward to getting stuck into this. Out of interest is there out of the box support for higher level protocols such as J1939? Thanks

    • @kentindell
      @kentindell 2 роки тому

      Working on some support for the trigger API so that it can trigger on specific J1939 CAN ID fields. Hope to have something released soon.

  • @arseneapegouinzeugang2544
    @arseneapegouinzeugang2544 2 роки тому

    halllo I am trying to initialise a can (c = CAN ) but i receive this Error RuntimeError: Cannot put MCP2517/18FD into config mode what can i do to fix that THX

    • @kentindell
      @kentindell 2 роки тому

      That's an error message to say that the CAN controller chip refuses to be reset. It shouldn't normally happen.

    • @kentindell
      @kentindell 2 роки тому

      It sets the C1CON register REQOP field to 4 (request configuration mode) and then reads the OPMOD field to see if it went into configuration mode. Out of reset this it the default, so it should always be OK after power on. This means either the SPI interface isn't working or the CAN controller chip isn't working. One possibility is that the power supply is below voltage and the controller isn't coming out of reset cleanly. Does it do this on a powered USB hub?

    • @kentindell
      @kentindell 2 роки тому

      A thought: can you also try adding hard_reset=True parameter to the initialization call?

    • @arseneapegouinzeugang2544
      @arseneapegouinzeugang2544 2 роки тому

      @@kentindell yes it is usb powered

    • @arseneapegouinzeugang2544
      @arseneapegouinzeugang2544 2 роки тому

      @@kentindell i do it but i have de same error

  • @kentindell
    @kentindell 2 роки тому

    The hardware and tools used in this video are: CANPico board: www.skpang.co.uk/products/canpico-board?variant=39816530886851 Busmaster tool: rbei-etas.github.io/busmaster/ Kvaser Leaf CAN adapter: duckduckgo.com/?q=kvaser+leaf&t=osx The CANHack toolkit: github.com/kentindell/canhack The can2 protocol decoder for PulseView is also available at the above repository. PulseView: www.sigrok.org/wiki/Downloads

  • @jeremyloveslinux
    @jeremyloveslinux 2 роки тому

    Have you considered using the PIO functionality to build up an internal CAN controller?

    • @RSC2194
      @RSC2194 2 роки тому

      i think we cant

    • @kentindell
      @kentindell 2 роки тому

      The CANHack board has a transceiver but no controller and uses software on the RP2040 to bit bang the CAN protocol. It's primary purpose is to demonstrate CAN protocol attacks. You can run this software on the CANPico board because we designed it to have direct access to the TX and RX pins of the transceiver. It's possible to use the PIO to provide the raw CAN bitstream but there's a lot more to the protocol than just the bits, and the second CPU core would have to be dedicated to the job.

  • @wadowicegwadowiceg8093
    @wadowicegwadowiceg8093 2 роки тому

    Very clear and extremely informative. Thank you VERY much for teaching this !

  • @KinzRulz
    @KinzRulz 2 роки тому

    How did the receiver manage not to give CRC errors?

    • @kentindell
      @kentindell 2 роки тому

      Because the Janus frame includes two CRCs as well as payloads. If you go to 7m06s you'll see the two bit patterns of each sequence printed out.

    • @KinzRulz
      @KinzRulz 2 роки тому

      @@kentindell Ah got it, 2 payload and CRC One is actual while the other is spiking only at 50% sampling point. Each receiver based on their sample point sees different data and CRC, so both acknowledges it. Wondering how the receiver controller managed phase errors and ReSync Jump Width due to more transitions from recessive to dominant introduced due to spiking.

    • @kentindell
      @kentindell 2 роки тому

      It exploits CAN sync rules: CAN only syncs on falling edges, only once per bit, and only if the previous bit sampled as a recessive.

    • @KinzRulz
      @KinzRulz 2 роки тому

      @@kentindell Thank you very much for your time and explanation.

  • @Денис-ж3ф5р
    @Денис-ж3ф5р 3 роки тому

    needless to say that nearly nobody wants to work on improving the knowledge on threads.

  • @arseneapegouinzeugang2544
    @arseneapegouinzeugang2544 3 роки тому

    HI Can i use this CANpico With a Sparkfun Thing Plus RP 2040 ? THX

    • @kentindell
      @kentindell 3 роки тому

      I don't think the Sparkfun Thing has the same pin layout, but I'm pretty sure if you deal with that with jumper leads then it should work: the CANPico interfaces via SPI and a couple of GPIO pins.

  • @shwetaraikar5684
    @shwetaraikar5684 3 роки тому

    What is can rx Line in pulse view and can we connect can tx line to one of the channel

    • @kentindell
      @kentindell 3 роки тому

      A CAN transceiver has two digital pins: CAN TX is the output of the CAN controller, and CAN RX is input to the CAN controller. Decoding CAN RX is the same as decoding the CAN bus. You can decode CAN TX too: you just add a second decoder to the CAN TX line in the logic analyzer. But the decoder will flag a potential error because the TX line is missing the ACK=0, but otherwise this is fine. Generally you only bother to decode RX because what is sent on TX gets looped back, but you very often want to connect the TX pin to the logic analyzer at the same time because you can then see whether the device was transmitting or receiving: if it's receiving then it will send recessive bits except for ACK=0, if it's transmitting then TX and RX lines will look the same.

  • @mjodr
    @mjodr 3 роки тому

    My first test: ua-cam.com/video/DfaKMz5eQnQ/v-deo.html

  • @mjodr
    @mjodr 3 роки тому

    Is this fast enough to read CAN frames from a GM MEFI 6 computer? Trying to diagnose a marine LS3. There's lots of documentation available, just trying to figure out if it's all possible.

    • @kentindell
      @kentindell 3 роки тому

      It should be fast enough to read a fully loaded 500kbit/sec bus. You can also use the hardware filtering API on the CANPico to cut out frames you want to ignore. If you wanted to look at specific situation you could use the logic analyzer trigger API on the CANPico and a Sigrok logic analyzer running the can2 protocol decoder to see what happened before/after the event. More on can2 here: kentindell.github.io/can2

    • @mjodr
      @mjodr 3 роки тому

      @@kentindell Thanks. I think that pretty much answers all my questions. I was hoping I could filter before/during/after capture to lessen the load. So that's awesome. Thanks.

  • @gomond1
    @gomond1 3 роки тому

    Hi Doc, I just purchased some of the boards and pico's but the can chips are out of stock for the next year or so, is there a Maxim or TI equivalent as I am excited to get them going .

    • @kentindell
      @kentindell 3 роки тому

      Hi! You can use MCP2517FD CAN controllers instead of MCP2518FD - they're functionally almost identical (the firmware runs wiht both).

  • @joehodgy
    @joehodgy 3 роки тому

    Playing with mine today from SKPang - just one thought for v2.0 - just include mounting capabilities, either corner holes or move the tracks away from the Pico's own mounting holes :) Great stuff though!

    • @kentindell
      @kentindell 3 роки тому

      Good idea, will add to the list!

    • @joehodgy
      @joehodgy 3 роки тому

      @@kentindell Thanks :) glad to see you planning for the future too!

  • @edinetgrunhed6000
    @edinetgrunhed6000 3 роки тому

    impressive board with CAN capability, only issue is price but hopefully cost will comedown in the future

  • @kentindell
    @kentindell 3 роки тому

    Useful links for things mentioned in the video: - The CANPico board can be bought from SK Pang here: www.skpang.co.uk/products/canpico-board - The firmware, reference manuals, schematics and Kicad design files are all on the YesWeCAN GitHub repo: github.com/kentindell/canhack - How to install firmware on the Raspberry Pi Pico: projects.raspberrypi.org/en/projects/getting-started-with-the-pico/3 - The Thonny IDE: thonny.org - The Canis Labs open source logic analyzer CAN protocol decoder: kentindell.github.io/can2 - The canpico.py Python examples file: github.com/kentindell/canhack/blob/master/pico/micropython/canpico.py

  • @0xh3nry22
    @0xh3nry22 4 роки тому

    It was so informative, thanks for all the efforts you put to make it. I loved it