Difference between revisions of "Can-hacking"

Revision as of 14:01, 4 April 2013

Our electric wheel chair appears to use a derivative of the CAN bus for it's control network, we need some tools for working on this. There are some different ways to go, however on something like this we need known-good tools to start out with. If anyone wants to go in on a CANUSB cable we can begin hacking on this wheel chair controller. From what I've read this cable essentially gives you a serial interface to the CAN bus, use minicom/hyperterminal/etc. to read data off the bus and to inject commands into it. In theory we could watch the joystick issue commands to the controller and then write some arduino code to mimic the joystick.

CANUSB interface cable money

We need $150 to buy this, who wants to go in?

• Nathan - $40
• Jay - $40
• Jenett - $40

CAN Interfaces

• CANUSB cable: [1]
• Microchip CAN bus anal tool ($130): [2]
• USA reseller $139: [3]
• ATMega162 with CAN interface / development platform: [4]

USA reseller appears to be imagecraft again, appears to be the RS232 device on the above page.

• SJA1000 IC used by the CANDIP-M162 board:

http://www.nxp.com/#/pip/pip=[pip=SJA1000]|pp=[t=pip,i=SJA1000]

• DX key - parallel port DXBUS interface sold by Dynamic Controls (no longer sold):

Documents relating to our wheel chair, controller, and the DX Bus protocol

• Ours is the Alante 202: [5]
• Maker of the controller: [6]
• Wheel chair parts list, including Dynamic controller parts: [7]
• Document including pinouts (see p. 36) from Invacare [8]

Dolphin after-market joystick made for our wheelchair series

Raptor PS servicemanual_Vedlegg 1_dolphin-installation-manual.pdf [9]

1. page 22:

The DX Hand Held Programmer (HHP) is the normal programming tool used by dealers, allowing easy adjustment of all commonly adjusted Drive Program parameters.

Warning : The DX HHP is for use only by wheelchair manufacturers, their authorised dealers and support personnel. It is not intended for use by the wheelchair user.

The DX HHP Manual should be read and understood before attempting to use it.

Fault codes: [10]

Other peoples tribulations on this same subject

Make: [11]

Engineering project using DXBUS protocol, they used a DX hardware interface to control the chair via a laptop: [12]

A Smart Electric Wheelchair Using UPnP They used some parallel port interface to insert their laptop into the system to issue commands: [13]

Others asking about reversing the DX Bus protocol: [14]

Hacking

Interfacing to DXBUS with a PIC

1. PIC dxbus hacking (dosman's note: this search no longer finds schematics for the controller, included for completeness only):

[15] ... Google this --- Dynamic DX Joystick Controller schematic -- and you will get a rather larger [93 page PDF file] that explains the whole specification. This is suppose to be THE 1101 joystick module. ...

1. DXBUS info (SLM integration):

[16]

1. from the manual:

... Programmable parameters relating to the SLM are contained in the DX Remote (UCM Remote) and the SLM programs. These programs can be modified using the PCD (Programming Configuration Diagnostic) tool. ...

Verification that DXBUS is based on CAN

DXBUS appears to be partially or fully based on the CAN bus based on several references. This is from the Dolphin joystick manual (page 50): [17]

CAN short fault Cause:

1. Short between CANL and CANH.

Action: < The short may be within a module or within a DX Cable, or the exposed DXBUS contacts may be shorted by foreign material. Ensure that all DXBUS contacts are clean.

CAN L fault Cause:

CANL failure.

Action < Check for a short from CANH to another DXBUS wire, or a short

More info

Quote from the paper from the paper Schedulability Analysis of CAN based Systems with Precedence Constraints [18]

DXBus is a four wire communications system (two power lines and two data lines, CANL and CANH) with a maximum length of 15 meters and a transmission rate of 2/19 Mbits/s. Basically, DXBus uses CAN protocol with some extensions, i. e. special voltage values on the data lines are used for “emergency stops” or power up. CAN identifiers are assigned to modules and not to messages. As a result, 1 byte in the message data field must be used to indicate the message type, and up to 7 bytes for message data. During normal operation, DX modules communicate using Network Variables (NVs). NVs are transmitted periodically (during time slot), with period either 20ms (fast NV) or 200ms (slow NV). A more detailed description of DXBus can be obtained from [10]. In this paper, we focus on the processes associated to DXSIR functions. DXSIR is a wheelchair with two driver wheels