CAN总线在汽车电子中用的最广，汽车中的(ECU (Electronic Control Unit, 电子控制单元)可以通过CAN总线进行通信，同时汽车上还存在OBD(On-Board Diagnostic, 车载诊断系统)接口，使得诊断仪器可以方便地从中获取车辆信息。

• OBD-II接口

相关文档请参考https://en.wikipedia.org/wiki/On-board_diagnostics

（截图来自https://en.wikipedia.org/wiki/On-board_diagnostics）

可以看到OBD-II接口包含CAN总线信号。

ISO 15765 CAN (250 kbit/s or 500 kbit/s). The CAN protocol was developed by Bosch for automotive and industrial control. Unlike other OBD protocols, variants are widely used outside of the automotive industry. While it did not meet the OBD-II requirements for U.S. vehicles prior to 2003, as of 2008 all vehicles sold in the US are required to implement CAN as one of their signaling protocols.

• pin 6: CAN High
• pin 14: CAN Low
• CANH signal voltage level: 3.5V (min/max 2.75 to 4.50)
• CANL signal voltage level: 1.5V (min/max 0.5 to 2.25)

这里我们可以看到，CAN总线通信速率为250kbps或者是500kbps。

• OBD-II协议

相关的文档请看这里：http://www.obdtester.com/obd2_protocols

An OBD2 compliant vehicle can use any of the five communication protocols: SAE J1850 PWM, SAE J1850 VPW, ISO9141-2, ISO14230-4 (KWP2000), and since 2003 also ISO 15765-4/SAE J2480.

1. ISO15765-4 (CAN-BUS)

The most modern protocol, mandatory for all 2008+ vehicles sold in the US. Uses pins 6 and 14 (referenced to signal gound), communication is differential.

Four variants of ISO15765 exist. They differ only in identifier length and bus speed:

• ISO 15765-4 CAN (11 bit ID,500 Kbaud)
• ISO 15765-4 CAN (29 bit ID,500 Kbaud)
• ISO 15765-4 CAN (11 bit ID,250 Kbaud)
• ISO 15765-4 CAN (29 bit ID,250 Kbaud)

Fiat/Alfa/Lancia used also fault-tolerant CAN-BUS at 50 kbaud, not compatible with OBD2 standard.

2. ISO14230-4(KWP2000)

Very common protocol for 2003+ vehicles using ISO9141 K-Line. Uses pin 7.

Two variants of ISO14230-4 exist. They differ only in method of communication initialization. All use 10400 bits per second.

• ISO 14230-4 KWP (5 baud init,10.4 Kbaud)
• ISO 14230-4 KWP (fast init,10.4 Kbaud)

3. ISO9141-2

Older protocol used mostly on European vehicles between 2000 and 2004. Uses pins 7 and optionally 15.

4. SAE J1850 VPW

Diagnostic bus used mostly on GM vehicles. Uses pin 1, communication speed is 10.4 kB/sec.

5. SAE J1850 PWM

Diagnostic bus/protocol used mostly on Ford. Uses pins 1 and 2, communication signal is differential and it’s rate is 41.6kB/sec.

• 通过OBD-II接口获取车辆信息

由https://en.wikipedia.org/wiki/OBD-II_PIDs#CAN_.2811-bit.29_bus_format可知，OBD-II诊断器最开始的时候，会使用7DFh的CAN ID进行查询，这个CAN ID扮演的类似广播地址。通过这个CAN ID我们就可以知道总线上有哪些ECU。

ECU的物理地址范围为7E0h ~ 7E7h, 而对应的响应地址为物理地址+08h, 所以响应地址的范围为7E8h ~ 7EFh。

当使用7DFh进行查询时，我们就可以得到响应地址，从而推算出物理地址：

1. 通过candump命令将CAN总线中的通讯数据dump出来：

pi@raspberrypi:~ $ sudo ip link set can0 type can bitrate 500000
pi@raspberrypi:~ $ sudo ip link set can0 up
pi@raspberrypi:~/can-utils $ ./candump -cae -t z can0,0:0,#FFFFFFFF
 (000.000000)  can0  0C7   [4]  04 00 00 00               '....'
 (000.000305)  can0  0F9   [8]  80 00 D0 00 00 00 00 00   '........'
 (000.000592)  can0  199   [8]  0F FF 47 2C B8 D4 00 FF   '..G,....'
 (000.006405)  can0  19D   [8]  80 00 3F FE 10 00 00 FF   '..?.....'
 (000.006672)  can0  1AF   [3]  00 00 09                  '...'
 (000.006940)  can0  1F5   [8]  0F 0D 00 00 00 00 03 00   '........'
 (000.012463)  can0  0C7   [4]  04 00 00 00               '....'
 (000.012737)  can0  0F9   [8]  80 00 D0 00 00 00 00 00   '........'
 (000.013007)  can0  199   [8]  4F FF 47 2C B8 D3 00 FF   'O.G,....'

当我们只想接收特定ID的信息时，如只接收7DFh及7E0h ~ 7EFh的数据时，我们可以通过如下命令：

pi@raspberrypi:~/can-utils $ ./candump -cae -t z can0,7df:fff can0,7e0:ff0

2. 查询总线上的ECU:

在另外一个终端发送如下命令：

pi@raspberrypi:~/can-utils $ ./cansend can0 7df#020100

NOTE:

7df#020100: 地址为7dfh, 使用PID type 为SAE Standard, 02: number of additional data bytes, 01: mode – show current data, 00: PID code – 查询01模式下所支持的PID

这时candump命令窗口会显示如下命令：

pi@raspberrypi:~/can-utils $ ./candump -cae -t z can0,7df:fff can0,7e0:ff0
 (000.000000)  can0  7DF   [3]  02 01 00                  '...'
 (000.004397)  can0  7EA   [8]  06 41 00 80 00 00 01 AA   '.A......'

这里我们可以看到candump将我们执行的cansend命令的数据也dump出来的，同时可以看到当前CAN总线上有一个ECU: 7EAh, 对应的物理地址为7EAh – 08h = 7E2h，这就意味着我们可以通过如下命令单独给7E2h ECU发送命令：

pi@raspberrypi:~/can-utils $ ./cansend can0 7e2#020100

此时candump窗口显示如下信息：

pi@raspberrypi:~/can-utils $ ./candump -cae -t z can0,7df:fff can0,7e0:ff0
...
 (793.907507)  can0  7E2   [3]  02 01 00                  '...'
 (793.912842)  can0  7EA   [8]  06 41 00 80 00 00 01 AA   '.A......'

NOTE:

7EA [ 8] 06 41 00 80 00 00 01 AA:

－ 7EA: PID Type – SAE Standard

－ [8]: 8个字节的数据

－06：有6个额外数据： 41 00 80 00 00 01

－ 41：Custom mode – show current data

－00: PID code – 对应发送命令

－ 80 00 00 01: 所支持的pid：

80 00 00 01
-> 1000 0000 0000 0000 0000 0000 0000 0001
   `-- 01h -- Monitor status since DTCs cleared
                                         `-- 20h -- PIDs supported [21 - 40]

执行cansend can0 7e2#020101可以得到如下信息：

pi@raspberrypi:~/can-utils $ ./candump -cae -t z can0,7df:fff can0,7e0:ff0
...
 (1722.647542)  can0  7E2   [3]  02 01 01                  '...'
 (1722.649973)  can0  7EA   [8]  06 41 01 83 04 00 00 AA   '.A......'

执行cansend can0 7e2#020120可以得到如下信息：

pi@raspberrypi:~/can-utils $ ./candump -cae -t z can0,7df:fff can0,7e0:ff0
...
 (1894.447987)  can0  7E2   [3]  02 01 20                  '.. '
 (1894.455847)  can0  7EA   [8]  06 41 20 80 01 80 01 AA   '.A .....'

80 01 80 01
-> 1000 0000 0000 0001 1000 0000 0000 0001
   `-- 21h -- Distance traveled with malfunction indicator lamp (MIL) on
                     `-- 30h -- Warm-ups since codes cleared
                       `-- 31h -- Distance traveled since codes cleared
                                         `-- 40h -- PIDs supported [41 - 60]

• 相关的参考文档：

1. http://www.obdtester.com/obd2_protocols
2. https://en.wikipedia.org/wiki/OBD-II_PIDs
3. http://qiita.com/suzutsuki0220/items/7cfdeb334efa4ffe3070
4. https://en.wikipedia.org/wiki/On-board_diagnostics