Electronic – CAN bus reverse-engineering

canmicrocontrollerrobotics

I am struggling with CAN bus reverse-engineering. It might be a silly question, but it irritates me.

Enter image description here

These are traffics that arise from pressing buttons A and B which is lifting up the 1. Axis of the robot at the end.

Pressing down button A changes the value "09" in 181h node and
button B changes the value "C8" in 281h.

If I am not wrong, I have to feed RPDOs to replicate the lifting up action instead of sending the messages "0A 00 09 00 00 00 00 FF" to 181h and "00 00 00 C8 6F BD 00 FF" to 281h. So basically I resent the messages from RPDOs back to RPDOs.

Enter image description here

Is there anything wrong until now? (It must be…otherwise it would have worked.)

As you can see from the above screenshot I manullay sent the messages by pressing each line with the space bar. And it seems like that between my Tx messages lots of Rx messages show up. Is this maybe the reason why the robot shows no reaction?

Enter image description here

UPDATE:

The TPDO message "0A 00 09 00 00 00 00 FF" that arises from the pressing down button A gets ignored because whenever I write a TPDO message 0A 00 09 00 00 00 00 FF, it gets overwritten with its default value 0A 00 0A 00 00 00 00 FF so fast that my message is like "not arrived" at all.

The transmission type of TPDO is currently asynchronous with event timer of 50 ms. This leads that my TPDO somehow overwritten with default value 0A 00 0A every 50 ms. How do I handle this problem? I thought this asynchronous transmission type with 50 ms means that the TPDO has to be checked every 50 ms and if there was a change -> transmission. But where does this 0A 00 0A 00 00 00 00 FF default value come from then?

Another question: I thought the whole time that I have to write the RPDOs value back to RPDO to replicate the action. But it seems like that only from pressing down the button A the RPDOs does not change at all. Then how can I replicate the pressing button A action at all?

UPDATE 2: The bit rate is 125 kbit/s. I am using CANopen so that I can control the robot with my computer, instead of using the remote controller. The robot that I am using is Brokk 170. Below you can find an Excel file where the recorded CAN messages are. Those CAN messages arose when I powered up the robot using the robot controller.

I transmitted the messages until the message with number 107, since the value 0A 00 0A 00 00 00 00 FF indicates that the robot is now powered up. But somehow the transmitted sequence does not power up the robot. Now I am trying to find a way to block the messages from the remote controller.

https://drive.google.com/open?id=1Du4J27KykzrTtCquFt29uMa_qhpZP4Ov

Best Answer

This looks like CANopen traffic (RPDO is also mentioned in the question). 0x80 is SYNC, and it seems it is send at regular intervals (about every 26 ms, 38-39 Hz). And some device responds to the SYNC messages by sending out messages with ID 0x181 and 0x281. But that is just a guess at this point.

It could also be that the content of ID 0x181 and 0x281 are set points to a servo (thus the same device sends out 0x80, 0x181, and 0x281) and that the feedback position is contained in the 0x301 messages.

It should be possible to correlate physical positions of the robot with the messages. A set point is (probably) set immediately and the actual positions are lacking behind.

Note: 181h is not a node, and you are not sending messages to it. 181h is a CAN message ID. As it is likely CANopen, 0x181 is the message "PDO1, transmit" for the device with ID 1. Note that it is not always clear if the device ID indicates what device sends it or if the device is the destination.

Type            Function code: Device ID range:
                Binary Decimal ID in  Hex             Decimal
                               CAN ID
--------------------------------------------------------------------
NMT             0000   0       No     0 - 0             0 -    0
SYNC            0001   1       No     0x80  -  0x80   128 -  128
Emergency       0001   1       Yes    0x81  -  0xFF   129 -  255
Time stamp      0010   2       No     0x100 - 0x100   256 -  256
PDO1, transmit  0011   3       Yes    0x181 - 0x1FF   385 -  511
PDO1, receive   0100   4       Yes    0x201 - 0x27F   513 -  639
PDO2, transmit  0101   5       Yes    0x281 - 0x2FF   641 -  767
PDO2, receive   0110   6       Yes    0x301 - 0x37F   769 -  895
PDO3, transmit  0111   7       Yes    0x381 - 0x3FF   897 - 1023
PDO3, receive   1000   8       Yes    0x401 - 0x47F  1025 - 1151
PDO4, transmit  1001   9       Yes    0x481 - 0x4FF  1153 - 1279
PDO4, receive   1010  10       Yes    0x501 - 0x57F  1281 - 1407
SDO, transmit   1011  11       Yes    0x581 - 0x5FF  1409 - 1535
SDO, receive    1100  12       Yes    0x601 - 0x67F  1537 - 1663
NMT error ctrl  1110  14       Yes    0x701 - 0x77F  1793 - 1919
Related Topic