Hack Your Car With NI CAN Interfaces and LabVIEW Visão geral Hacking your car? Imagine the possibilities, right? I’m sure several of you are thinking about all of the things you’d like to do to your car to improve the performance, aerodynamics, or just the appearance. But before you start asking about the best way to equip your car with the latest spinning rims and spoilers, let me set the record straight: vehicles have very complex electronic systems that perform a number of tasks to keep you safe, comfortable, and happy. So when I say “hack your car,” I’m talking about hacking into the electronic networks in your vehicle. Throughout this article, I’ll give a brief introduction to the history of why you can hack your car, the type of information you can get, and how you can do it using NI products. Índice 1. A Brief History of On-Board Diagnostics 2. What Information Can You Read? 3. How to Hack Your Car Yourself With NI Tools A Brief History of On-Board Diagnostics Thanks to smog, you can hack into your car’s electronics. Seriously. Federal regulations around vehicle emissions have been a driving force for making vehicle diagnostic information readily available to the public. Let’s look at a simple example of why these standards have emerged. In an over-simplified ideal situation, each car has a closed-loop emissions system. The general flow for this process is that an electronic control unit (ECU) specifies the exact air-to-fuel mixture ratio that is combustible in an engine, the vehicle’s catalytic converter transforms some of the dangerous exhaust gases into environmentally friendly substances, oxygen sensors measure the reaction and provide feedback to the ECU, and the ECU uses this feedback to adjust the air-to-fuel ratio to maintain optimal engine exhaust performance.
Figure 1. A simplified closed-loop emissions system in a vehicle involves an ECU, an engine, a catalytic converter, and oxygen sensors. This sounds like a great system, but what happens when something goes wrong, like an oxygen sensor failure? Unfortunately, when this happens it creates an open-loop emissions system because there is no feedback to the ECU about the emissions from your car. Your car will still work properly, but it could create more pollution. The problem is that there’s actually little incentive for the average driver to get their car fixed in this situation because this open-loop
system usually causes the car to perform better as the engine typically errs on the side of being fuel-rich, and thus more powerful!
Figure 2. When an oxygen sensor fails in a car’s emissions system, there is no feedback provided to an ECU, which creates an open-loop emissions system. This is where on-board diagnostics come in. Governing bodies have made several attempts to create regulations for enforcing emissions standards. The most common and well-known is called On-Board Diagnostics II (OBD-II), which first became a federal requirement in 1996. Since 2008, all of the required diagnostic information in OBD-II must be sent on a controller area network (CAN) bus in the vehicle. For more information on CAN and how CAN communication works, reference this CAN overview article. What Information Can You Read? The main specification (SAE J1979) for on-board diagnostics defines a number of test modes and parameters that can be read from your vehicle. Rather than review all of the defined services, we’ll focus on the ones that are particularly interesting to vehicle hackers, including $01–04. - Service $01—Get real-time diagnostic data: This service is especially useful in reading realtime data from your car and can be used for creating real-time displays or data-logging-specific vehicle parameters. Within this service, you can request certain parameter IDs (PIDs) that correspond to a value or variable from an ECU, such as engine speed, vehicle speed, and more. There are common PIDs that can be read in most vehicles, but keep in mind that there may be some PIDs that are vehicle- or OEM-specific. - Service $02—Get freeze frame data: Have you ever heard the joke about the mysterious black box in your car that lets the government watch your every move? Well, this is not used by the government to keep a close eye on you. Whenever a fault code occurs in a car, a short history of data leading up to that fault is recorded. This is an extremely powerful tool for fault analysis. - Service $03—Get trouble codes: Some of you may think of this as the bread and butter for an auto parts store. This service returns diagnostic trouble codes (DTCs) that explain why your check engine light is turning on. - Service $04—Clear trouble codes: Have you ever paid an auto parts store $100+ USD to turn off your check engine light? You may want to stop reading now. This is the service used to do that. But before you start calling this service on your own to turn off the check engine light, remember that your engine still stores the DTCs for some time and also records the last time the light was turned off, so it still needs to be done by a professional. How to Hack Your Car Yourself With NI Tools Now we get to the good part. How can you hack your own car to get this information? Here are the NI tools you need:
- NI LabVIEW: This system design software is for developing your own vehicle diagnostic application. - NI Automotive Diagnostic Command Set: This is the key software component you can use with LabVIEW software and NI CAN hardware interfaces. This command set has high-level and intuitive APIs for interfacing with vehicle diagnostics while abstracting the user from the lowlevel details of the diagnostic protocols. - NI USB CAN Interfaces: These CAN interfaces are portable and interface with the diagnostic vehicle network. - CAN OBD-II Cable: The CAN cable connects your NI CAN interface directly to the OBD-II port on your car. After you have all of the tools, you can then develop your desired application in LabVIEW and connect your system directly to your vehicle.
Figure 3. Hack your own car by connecting your laptop with your application, developed with the Automotive Diagnostic Command Set, to your NI CAN interface and then cable directly to your OBD-II port. Here is an example user interface of an application I developed to read some of the information from my car. You’ll see I have some of the typical information that most cars have on their dashboards, and I also have access to several other things that I find interesting to monitor.
Figure 4. Example Application From Hacking Your Car Now have fun and start hacking!
- Noah Reding Noah Reding is a product manager for the automotive industry at National Instruments. He holds a bachelor’s degree in electrical engineering from Vanderbilt University. Learn more about the NI Automotive Diagnostic Command Set.