1 .. SPDX-License-Identifier: (GPL-2.0-only OR BSD-3-Clause)
3 ELM327 driver for Linux SocketCAN
4 ==================================
9 This is the non-upstreamed version of the elmcan driver.
10 Please see out-of-tree.rst for compilation/usage hints.
17 Max Staudt <max-linux@enpas.org>
24 This driver aims to lower the initial cost for hackers interested in
25 working with CAN buses.
27 CAN adapters are expensive, few, and far between.
28 ELM327 interfaces are cheap and plentiful.
29 Let's use ELM327s as CAN adapters.
36 This driver is an effort to turn abundant ELM327 based OBD interfaces
37 into full fledged (as far as possible) CAN interfaces.
39 Since the ELM327 was never meant to be a stand alone CAN controller,
40 the driver has to switch between its modes as quickly as possible in
41 order to fake full-duplex operation.
43 As such, elmcan is a best effort driver. However, this is more than
44 enough to implement simple request-response protocols (such as OBD II),
45 and to monitor broadcast messages on a bus (such as in a vehicle).
47 Most ELM327s come as nondescript serial devices, attached via USB or
48 Bluetooth. The driver cannot recognize them by itself, and as such it
49 is up to the user to attach it in form of a TTY line discipline
50 (similar to PPP, SLIP, slcan, ...).
52 This driver is meant for ELM327 versions 1.4b and up, see below for
53 known limitations in older controllers and clones.
60 The official data sheets can be found at ELM electronics' home page:
62 https://www.elmelectronics.com/
66 How to check the controller version
67 ------------------------------------
69 Use a terminal program to attach to the controller.
70 The default settings are 38400 baud/s, 8 data bits, no parity, 1 stopbit.
72 After issuing the "``AT WS``" command, the controller will respond with
82 Note that clones may claim to be any version they like.
83 It is not indicative of their actual feature set.
87 How to attach the line discipline
88 ----------------------------------
90 Every ELM327 chip is factory programmed to operate at a serial setting
91 of 38400 baud/s, 8 data bits, no parity, 1 stopbit.
93 The line discipline can be attached on a command prompt as follows::
101 --iflag -ICRNL,INLCR,-IXOFF \
105 To change the ELM327's serial settings, please refer to its data
106 sheet. This needs to be done before attaching the line discipline.
108 Once the ldisc is attached, the CAN interface starts out unconfigured.
109 Set the speed before starting it:
111 # The interface needs to be down to change parameters
112 sudo ip link set can0 down
113 sudo ip link set can0 type can bitrate 500000
114 sudo ip link set can0 up
116 500000 bit/s is a common rate for OBD-II diagnostics.
117 If you're connecting straight to a car's OBD port, this is the speed
118 that most cars (but not all!) expect.
120 After this, you can set out as usual with candump, cansniffer, etc.
124 Known limitations of the controller
125 ------------------------------------
127 - Clone devices ("v1.5" and others)
129 Sending RTR frames is not supported and will be dropped silently.
131 Receiving RTR with DLC 8 will appear to be a regular frame with
132 the last received frame's DLC and payload.
134 "``AT CSM``" not supported, thus no ACK-ing frames while listening:
135 "``AT MA``" will always be silent. However, immediately after
136 sending a frame, the ELM327 will be in "receive reply" mode, in
137 which it *does* ACK any received frames. Once the bus goes silent
138 or an error occurs (such as BUFFER FULL), the ELM327 will end reply
139 reception mode on its own and elmcan will fall back to "``AT MA``"
140 in order to keep monitoring the bus.
145 No full duplex operation is supported. The driver will switch
146 between input/output mode as quickly as possible.
148 The length of outgoing RTR frames cannot be set. In fact, some
149 clones (tested with one identifying as "``v1.5``") are unable to
150 send RTR frames at all.
152 We don't have a way to get real-time notifications on CAN errors.
153 While there is a command (``AT CS``) to retrieve some basic stats,
154 we don't poll it as it would force us to interrupt reception mode.
157 - Versions prior to 1.4b
159 These versions do not send CAN ACKs when in monitoring mode (AT MA).
160 However, they do send ACKs while waiting for a reply immediately
161 after sending a frame. The driver maximizes this time to make the
162 controller as useful as possible.
164 Starting with version 1.4b, the ELM327 supports the "``AT CSM``"
165 command, and the "listen-only" CAN option will take effect.
168 - Versions prior to 1.4
170 These chips do not support the "``AT PB``" command, and thus cannot
171 change bitrate or SFF/EFF mode on-the-fly. This will have to be
172 programmed by the user before attaching the line discipline. See the
173 data sheet for details.
176 - Versions prior to 1.3
178 These chips cannot be used at all with elmcan. They do not support
179 the "``AT D1``" command, which is necessary to avoid parsing conflicts
180 on incoming data, as well as distinction of RTR frame lengths.
182 Specifically, this allows for easy distinction of SFF and EFF
183 frames, and to check whether frames are complete. While it is possible
184 to deduce the type and length from the length of the line the ELM327
185 sends us, this method fails when the ELM327's UART output buffer
186 overruns. It may abort sending in the middle of the line, which will
187 then be mistaken for something else.
191 Known limitations of the driver
192 --------------------------------
196 ELM327 can only set CAN bitrates that are of the form 500000/n, where
197 n is an integer divisor.
198 However there is an exception: With a separate flag, it may set the
199 speed to be 8/7 of the speed indicated by the divisor.
200 This mode is not currently implemented.
202 - No evaluation of command responses.
204 The ELM327 will reply with OK when a command is understood, and with ?
205 when it is not. The driver does not currently check this, and simply
206 assumes that the chip understands every command.
207 The driver is built such that functionality degrades gracefully
208 nevertheless. See the section on known limitations of the controller.
210 - No use of hardware CAN ID filtering
212 An ELM327's UART sending buffer will easily overflow on heavy CAN bus
213 load, resulting in the "``BUFFER FULL``" message. Using the hardware
214 filters available through "``AT CF xxx``" and "``AT CM xxx``" would be
215 helpful here, however SocketCAN does not currently provide a facility
216 to make use of such hardware features.
220 Communication example
221 ----------------------
223 This is a short and incomplete introduction on how to talk to an ELM327.
226 The ELM327 has two modes:
231 In command mode, it expects one command per line, terminated by CR.
232 By default, the prompt is a "``>``", after which a command can be
239 The init script in the driver switches off several configuration options
240 that are only meaningful in the original OBD scenario the chip is meant
241 for, and are actually a hindrance for elmcan.
244 When a command is not recognized, such as by an older version of the
245 ELM327, a question mark is printed as a response instead of OK::
251 At present, elmcan does not evaluate this response and silently assumes
252 that all commands are recognized. It is structured such that it will
253 degrade gracefully when a command is unknown. See the sections above on
254 known limitations for details.
257 When a CAN frame is to be sent, the target address is configured, after
258 which the frame is sent as a command that consists of the data's hex
267 The above interaction sends the frame "``DE AD BE EF 12 34 56 78``" with
268 the 11 bit CAN ID ``0x123``.
269 For this to function, the controller must be configured for 11 bit CAN
270 ID sending mode (using "``AT PB``", see code or datasheet).
273 Once a frame has been sent and wait-for-reply mode is on (``ATR1``,
274 configured on ``listen-only=off``), or when the reply timeout expires and
275 the driver sets the controller into monitoring mode (``ATMA``), the ELM327
276 will send one line for each received CAN frame, consisting of CAN ID,
279 123 8 DEADBEEF12345678
281 For 29 bit CAN frames, the address format is slightly different, which
282 elmcan uses to tell the two apart::
284 12 34 56 78 8 DEADBEEF12345678
286 The ELM327 will receive both 11 and 29 bit frames - the current CAN
287 config (``ATPB``) does not matter.
290 If the ELM327's internal UART sending buffer runs full, it will abort
291 the monitoring mode, print "BUFFER FULL" and drop back into command
292 mode. Note that in this case, unlike with other error messages, the
293 error message may appear on the same line as the last (usually
294 incomplete) data frame::
296 12 34 56 78 8 DEADBEEF123 BUFFER FULL
300 Rationale behind the chosen configuration
301 ------------------------------------------
306 We need this to be able to get a prompt reliably.
311 We need this to distinguish 11/29 bit CAN addresses received.
314 We can usually do this using the line length (odd/even),
315 but this fails if the line is not transmitted fully to
316 the host (BUFFER FULL).
321 We need this to tell the "length" of RTR frames.
325 A note on CAN bus termination
326 ------------------------------
328 Your adapter may have resistors soldered in which are meant to terminate
329 the bus. This is correct when it is plugged into a OBD-II socket, but
330 not helpful when trying to tap into the middle of an existing CAN bus.
332 If communications don't work with the adapter connected, check for the
333 termination resistors on its PCB and try removing them.