Chapter 5

J1939.c CAN Bus plus RS232 (continued)

"Address Claiming" simulation with Vector's CANoe

<< back to main page
<< previous chapter (CAN bus software emulators)
(Michael Eisele's Xtm CAN bus simulator) next chapter >>

Abstract of the 1rst chapter:
Microchip provided source code zip for J1939.c CAN library pdf (Kim Otten et al.), plus Application Maestro generated code UARTIntC.c, were used to implement a bare-bones system with a 2-node CAN bus, where node #129 upon receiving commands from #128 to toggle a LED also output strings "ON" and "OFF" thru the RSR23.

Abstract of the 2nd chapter:
We kept the 2 nodes #128 and #129 exchanging messages, and added a 3rd node, #130, listening to them, and reporting to the PC. Everything addressed to our smart node #130 was send to our PC's Terminal program, dumping the affected RxBuffers to the UART.

Abstract of the 3rd chapter:
Our smart node #130 was put in ListenOnly mode, all masks to zeros - a true "spy", now.
But because the firmware J1939.c generates so few messages, the overall result is not much exciting.

Abstract of the 4th chapter:
So we want to improve our basic firmware, but that means going deeper into understanding the SAE J1939 protocol (automotive, commercial vehicles, etc.).
We could use some help in that, and luckily there are at least 2 free "demos" available which we can use to simulate the bus.

Don't want to miss the next chapter? just drop me an email to subject: J1939 CAN, and I will notify you.
No other use will be made of your e-mail address.

Who needs a CAN/J1939 simulator? Well, if you are learning CAN/J1939 surely you can use it, among others, to test if the NMT behaviour (network management) you have coded and believe is OK, is indeed conforming to the SAE standard.
> is a wonderful tool for that, and on top of its price can't be beaten (yes, the limited but functional demo is free).
It does a lot more than what we need or can understand (!), but let us have a look at just a small parcel of it.

  1. The J1939 "Address Claiming" simulation with CANoe 
  2. The CAPL language
  3. And it comes with fancy graphic panels, too
  4. What's next?

The "Address Claiming" simulation with CANoe

First, Address Claiming is one J1939 network management process (NMT), Address Claimed is a message - one of the Address Management Messages.
Continuing from the previous chapter, start CANoe, accept the disclaimer, then open the file:

MyProjectFolder\AddressCaliming\AddressClaiming_CN.cfg (ignore the warning "The configuration does not contain a chip...").

Please remember that we copied 2 complete folders from:

Program Files\CANoe 5.2\Demo_J1939_CN\Database
Program Files\CANoe 5.2\Demo_J1939_CN\MoreExamples\AddressClaiming

to our own project folder; then with a text editor, we edited AddressClaiming_CN.cfg to point to the new path of Database\J1939.dbc.

Your screen will look like:

opening screen shot

Now start the simulation with Start\Start menu or F9, wait a momment then stop (red spot).
You will have something like that:

NMT trace stopped

The left pane is the "Trace NMT" (NMT: Network Management Traffic, in our case messages like Address Claimed).
Clicking one of the + (plus) signs to expand the last trace line, shows the NAME fields:

trace expanded

In the expanded line we can see the several fields of the Address Claimed message for Node 3.
The nine fields from ArbitraryAddressCapable to IdentityNumber fields form the NAME as described in SAE J1939-81.

Notice that ArbitraryAddressCapable == 1. Quoting SAE J1939-81:

3.3.2 Arbitrary Address Capable CA
An Arbitrary Address Capable CA is one that can select its source address from any appropriate SA (including those in the range 128 to 247 inclusive) based on internal algorithms, and then claim that address.
This CA, in cases of address conflict, is also able to re-calculate its address and re-claim (unless all 120 of the addresses between 128 and 247 are used).
The value in the Arbitrary Address Capable field in the NAME (See Section indicates whether or not a CA has this capability.

(where CA means Controller Application)
Because in our simulation we have graphic "panels" where we can select a new address for the node, it was defined as Arbitrary Address Capable - there is indeed no algorithm to do it, we just type in a new address, the same way a field technician could change a dip switch.

You have 2 tabs at the bottom of the main window: Setup and Measurement. Click Setup to be back to the first view, then on the left pane double-click over CAN Networks\Nodes\Node3 (ECU 2).
The CAPL browser opens. CANoe's help describes what CAPL is:

Communication Access Programming Language

The CAPL language allows you to write programs for individual applications. For example, in the development of network nodes, the problem often arises that the remaining bus nodes are not available yet for tests. The system environment can be emulated with the help of CAPL, e.g. the data traffic of all remaining stations can be emulated.

With CAPL you can also write programs to analyze data traffic which are adapted to your problem, or programs for a gateway – a connection element between two buses – so that data can be exchanged between different CAN buses.

The emphasis in modeling lies in the description of the node‘s bus behavior, for which the language capabilities of CAPL are normally sufficient.

CAPL browser, Node 3

If you study the ACL message ACL :: 0x18EEFEFE, first thing you will notice is that the ID 0x18EEEFEF is just wrong...
But don't waste time around it, these strings are not used anywhere.

0x18 = 11000 (priority 110 = 6 OK, then R and DP bits 0 also OK)
0xEE = 238 is PDU format, OK
0xFE = 254, null address, is fact is the Cannot Claim Address message (the Cannot Claim Address message is the same PGN as the Address Claimed message but has a source address of 254, the null address).
0xFE is wrong, it should read 0xFF, PDU specific.

This is what SAE J1939-81 tell us:

No valid claim may be made for Address 254, the null address. An Address Claimed message sent with address 254 as the source address is a Cannot Claim Address message (see
The Address Claimed message should always be sent to the global address (255) to provide all ECUs on the network the information to maintain a current address to NAME correspondence. The Address Claimed message should be sent to the global address (255) even when requested in a destination specific message. The Address Claimed message is an exception to the requirements on request messages specified in SAE J1939-21. (SAE J1939-21 defines that a request message that is directed to a specific address be responded to with the destination set to the requester.) Address Claimed Message
Transmission rate: As required
Data length: 8 bytes
Data page 0
PDU format: 238
PDU specific: 255 (global address)
Default priority: 6
Parameter group number: 60928 (00EE0016)
Source Address 0 to 253 (Address claimed for the Controller Application)

NAME of Controller Application
Byte: 1 Bits 8-1 Least significant byte of Identity Number See
Byte: 2 Bits 8-1 Second byte of Identity Number See
Byte: 3 Bits 8-6 Least significant 3 bits of Manufacturer Code See
           Bits 5-1 Most significant 5 bits of Identity Number See
Byte: 4 Bits 8-1 Most significant 8 bits of Manufacturer Code See
Byte: 5 Bits 8-4 Function Instance See
           Bits 3-1 ECU Instance See
Byte: 6 Bits 8-1 Function See
Byte: 7 Bits 8-2 Vehicle System See
        Bit 1 Reserved See
Byte: 8 Bit 8 Arbitrary Address Capable See
           Bits 7-5 Industry Group See
           Bits 4-1 Vehicle System Instance See

So 0x18EEFEFE is probably a "typo", but it does no harm, that string is never used, is just there to make the database look better...
Next message, AC :: 0x18FED8FE is correct (Commanded Address, PGN 65240, PF 254, PS 216, SA
Next message, RQST :: x018EAFEFE (Request PG (request for Address Claimed) PGN 59904, PF 234, PS DA but the destination address cannot be FE, again it really does not matter, SA)

The CAPL language

Back to CAPL browser, to the code in the left-top pane:

* Node3 - Simple node with address claiming Version 1.0
* Copyright 2005, Vector Informatik GmbH - All right reserved
* History:
* 1.0 (Jr) Created
// Constants
const int kNullAddr = 0xfe;   // Null address
const int kGlobalAddr = 0xff; // Global address
const int kSuccess = 0;       // Nodelayer function returns 0 on success
const int kInitialized = 0;   //
const int kClaiming = 1;      //
const int kOnline = 2;        //
const int kOffline = 3;       //
char gNodeName[32] = "Node3"; // Name of the node, is used for output to write window

// simulation constants
// communication variables
BYTE gECUAddress = kNullAddr; // Address of this ECU
BYTE gECUState = kInitialized;// Communication state of the ECU
BYTE gACLPending = 0;         // 1, if sending ACL
BYTE gACLRqPending = 0; // 1, if sending request for ACL was received during address claiming
pg ACL TX_ACL;                // TX Buffer: Address Claiming
pg ACKM TX_ACKM;              // TX Buffer: Acknowledge
pg HB_Node3 TX_HB;            // Tx Buffer: Heartbeat
msTimer ACLTimer;             // Timer for address claiming
msTimer TX_HB_Timer;

// Definition of debugging constants
const int kDbgInfo = 10;
const int kDbgWarning = 5;
const int kDbgError = 1;
const int kDbgQuiet = 0;

// General global variables
int gDbgLevel = kDbgWarning; // Set debug level for output to write window

Let us look also in CAPL browser at Functions\EnterClaiming():

* Start address claiming
void EnterClaiming()
cancelTimer( ACLTimer );
cancelTimer( TX_HB_Timer );

// send address claiming PG and wait 250ms
TX_ACL.SA = gECUAddress;
TX_ACL.DA = kGlobalAddr;
TX_ACL.ArbitraryAddressCapable = Node3.NmJ1939AAC;
TX_ACL.IndustryGroup = Node3.NmJ1939IndustryGroup;
TX_ACL.VehicleSystem = Node3.NmJ1939System;
TX_ACL.VehicleSystemInstance = Node3.NmJ1939SystemInstance;
TX_ACL.Function = Node3.NmJ1939Function;
TX_ACL.FunctionInstance = Node3.NmJ1939FunctionInstance;
TX_ACL.ECUInstance = Node3.NmJ1939ECUInstance;
TX_ACL.ManufacturerCode = Node3.NmJ1939ManufacturerCode;
TX_ACL.IdentityNumber = Node3.NmJ1939IdentityNumber;

gACLPending = 1;

output( TX_ACL );

putValue( EvNode3_Address, kNullAddr );

setTimer( ACLTimer, 250 );

writeDbgLevel( kDbgInfo, "<%s> start address claiming for address %d", gNodeName, TX_ACL.SA );

You will notice the CAPL code mixes "microcontroller" like code with code controlling the simulation interface (environment). For example, function putValue () assigns a value to a environment variable, setTimer() sets a timer, and defines time events in CAPL.
When this timer event occurs, i.e. when a certain period of time elapses, the associated on timer procedure is called.

Under the Environement item you will find events that are generated by (or control) the user interface, like the graphic panels, the example below occurs when the panel (generated by Node1.cnp) is used to change the Claimed address:

panel node 1

* Change address
on envVar EvNode1_ChangeAddress
  DWORD address;

  if (getValue(this) == 1) {
     address = getValue( EvNode1_NewAddress );
     if (address < kNullAddr) {
       Node1StartUp( address );
     else {

Changing the node address in the panel rises the on envVar event trigging the procedure to modify the Node1 start up address.

Now, I don't understand why, but this procedure runs always twice after we click on the panel button, once with getValue(this)== 1, then with getValue(this) == 0 (as you can check by adding a line like:

write ("%d ",getValue(this));

on top of the procedure, to have it printed on the "write (sort of console)" window.

Let us try to change Node1 address to 3, thus causing a conflict with the existing Node3.
Like this we force the virtual nodes and CAN bus to do some work!
The NMT trace window displays:

node1 claims address 3

The first 3 lines show the start up claimed adresses at start up as usual.
After some time (about 5.5s), I forced virtual Node1 to address 3, which it claimed on the virtual CAN bus.
The last line shows us that poor Node3 droped the challenge... it is telling everybody (all = 255) that now its address is 254 (null). Why? back to SAE J1939-81:

If a CA receives an Address Claimed message claiming its own source address, it should compare the NAME that was received in the Address Claimed message with its own
NAME and determine which CA has a higher priority NAME (lower numeric value as described in
If the CA receiving the Address Claim determines that it has the higher priority NAME it may then transmit an Address Claimed message containing its NAME and address. However if it has the lower priority NAME it should either attempt to claim a different address or send a Cannot Claim Address message.
A CA that loses address arbitration in this manner (...)

Address Claimed             PGN   PF  PS  SA  DCL DATA
            Address Claimed 60928 238 255 SA  8   NAME
Cannot Claim Source Address 60928 238 255 254 8   NAME

Because Node3 NAME's IdentityNumber is 3, higher then Node1's 1, it looses arbitration against Node1, and drops out.
As we see, the CANoe is a wonderful tool to play with CAN/J1939.

Even if one does not know what he is doing, the simulator gives the right responses, and from them you can learn-as-you-play. Of course, if one writes bad CAPL behaviour, there goes all the good behaviour!

But Vector's CANoe has a powerful feature called CAPL Generator J1939:

To simplify the design of a simulation, there is a CAPL code generator available for the J1939, ISO11783, and NMEA2000 options. This permits the generation of CAPL source code using the underlying communication relationships between individual ECUs (electronic control units).

I think (but never checked it:=) that this is a sort of wizard, that will keep us from making terrible mistakes regarding J1939 behaviour.
Anyway, the most critic aspect is the NMT, and CANoe's examples provide us with many chances to test our understanding of J1939 NMT.

And it comes with fancy graphic panels

The graphic panels, controlled by mouse or keyboard, can be created with a Panel Editor. With them, the user can interactively change the values of discrete and continuous environment variables during the simulation, as well as display signals.
They use the ActiveX controls (.dll, .ocx) which those familiar with VisualBasic and .NET will already know.
Some showy samples follow:
vehicle ECU panel  accelerator panel

The TextBox Vehicle Speed showing "0" is named "EnvVar:EvPT_Engine1Speed"; This name and the individual panel name are used to access the control with specific CAPL commands.  An environment variable is assigned to the element, in this case: "EvVECU_VehicleSpeed" (same to the analog gauge).
The CAPL code that updates the panel runs in the system Timer routine and is:

// update envVars
putValue( EvVECU_VehicleSpeed, vehicleSpeed * 3.6 );
putValue( EvTECU_OutputShaftSpeed, axleSpeed );
putValue( EvTECU_InputShaftSpeed, engineSpeed );
if (transmissionRatio > 0) {
   putValue( EvEMS_SimulationMode, 1 );
   putValue( EvEMS_EngineSpeed, engineSpeed );
else {
   putValue( EvEMS_SimulationMode, 0 );

What is next?

This is going slower than antecipated, as I am not able to write more then one chapter every 12 days.

But as our goal is to simulate our small system with 3 PIC nodes, adding more and more messages, validating them with CANoe and then porting to the firmware, the next step is to improve the NMT of the thing.

Stay with us, may be we will get somewhere!

Don't forget: if you don't want to miss the next chapter, just drop me an email to subject: J1939 CAN, and I will notify you.
No other use will be made of your e-mail address.

And that's all, folks.
Please let me know of any broken links, missing parts etc. you may find here.
Next issues will become more sophisticated - I hope!.

Send Flowers
Free Hit Counter

<< back to main page
<< previous chapter (CAN bus software emulators)
(Michael Eisele's Xtm CAN bus simulator) next chapter >>

©Rec  (