Sniffing at CANopen

The week is at its end, and especially today was a good day for the engineer-becoming-can-abled. Yesterday evening I struggled mightily so I went to bed hoping that a good nights sleep would help... It did.

The situation so far:

  • This week I got 2 Maxon Epos 24/1 modules including motors loaned to me (Thanks!), which are both CANopen devices.
  • I have a Trinamic TMCM-303 board I bought approx 6 weeks ago
  • 2 USBtin devices
  • breadboards, wires, solder, connectors, shrink tube.
  • Macbook Pro with Parallels VM's on which I have my Debian Jessie development VM.

As with all mechanical development I started with the first step. Making sure I have a working CAN bus. That means the physical bus. Since I wanted to test if messages are sent and received via the hardware (wires) I used the 2 USBTin devices to make the bus. These have a jumper to enable the 120 Ohm endresistor, and both should provide the correct bus voltage.


  1. Put the 2 devices in the USB hub and tell Parallels to use the devices with the Jessie VM (as of now I'll call it the dev-VM).
  2. In the dev-VM open a terminal and do ls /dev/ttyACM*. USBtin devices will register as ttyACM{nr} so this resulted in /dev/ttyACM0 /dev/ttyACM1
  3. See below the output of the terminal and how get the can interfaces up.
    bas@mbp-jessie:~$ ls /dev/ttyA*
    /dev/ttyACM0  /dev/ttyACM1
    bas@mbp-jessie:~$ sudo bash
    [sudo] password for bas:
    root@mbp-jessie:/home/bas# slcand -f -o -c -s8 /dev/ttyACM0 can0
    root@mbp-jessie:/home/bas# slcand -f -o -c -s8 /dev/ttyACM1 can1
    root@mbp-jessie:/home/bas# ifconfig can0 up
    root@mbp-jessie:/home/bas# ifconfig can1 up
  4. Above sets the can interfaces to 1000kbit bus speed (-s8)
  5. Open 2 new terminals
    in the first one type candump can0 can1 and in the second one type cansend can0 001#
  6. Output in cansend terminal:
    bas@mbp-jessie:~$ cansend can0 001#
    Output in candump terminal:
    bas@mbp-jessie:~$ candump can0 can1
    can0 001 [8] 01 04 00 00 00 00 C8 CD
    can1 001 [8] 01 04 00 00 00 00 C8 CD
  7. We have created a Cansocket hardware bridge :) Fun, isn't it.

I wired the Trinamic TMCM-303 board (from now on just 303-board) with it's CAN pins to a position on the breadboard between the 2 USBtin devices. In the middle of the bus. And I sent it some CAN data that I gained from the RS232 connection from the Trinamic IDE.

I saw the motor move, played around a little, but this board is not CANopen, so spending more time won't get me to CANopen. Therefor I removed the 303-board and connected the loan-maxon-epos-device to the bus (picture below).


I powered up the device and in the can dump terminal I can see:
bas@mbp-jessie:~$ candump can0 can1
can0  702   [1]  00
can1  702   [1]  00

HOORAY! the maxon device booted itself and made itself known to the world (the "2" in 702 is the node number... which is "2" for this device. My first CANopen message.
I found a nice handout here.

Enter CanFestival. This is an open source CANopen master/slave stack written in C (we'll eventually need C to write code for the HAL of Machinekit). There are other stacks like CANopenNode which runs on embedded platforms. But I have to start somewhere.

  1. Cloned from my repo which is a for of Michael's repo, which comes from the SVN source.
  2. cd ~/Canfestival-3
  3. ./configure --can=socket --enable-lss --enable-lss-fs
  4. make
  5. sudo make install
    I had to use sudo for rights issues, i got the following error during install:
    mkdir -p /usr/local/include/canfestival
    mkdir: cannot create directory ‘/usr/local/include/canfestival’: Permission denied
  6. cd ~/Canfestival-3/examples/CANOpenShell
  7. make
  8. show me where the driver for Socketcan is, but more important how it's named:
    bas@mbp-jessie:~$ sudo find / -name libcanfestival*
  9. I need that because on page 21 and 22 of this document is an example how to open CANopenShell. So now we use to start CANopenShell like this (one line):
    bas@mbp-jessie:~/Canfestival-3/examples/CANOpenShell$ ./CANOpenShell,can0,1M,0,1
    which then tells us:
  10. And look at candump terminal:
    bas@mbp-jessie:~$ candump can0
    can0  702   [1]  00
    can0  700   [1]  00

    this shows that we booted the master!
  11. The next thing to do is to type "help" when inside the CANopenShell, here's the output:.
    MANDATORY COMMAND (must be the first command):
    load#CanLibraryPath,channel,baudrate,nodeid,type (0:slave, 1:master)NETWORK: (if nodeid=0x00 : broadcast)
    ssta#nodeid : Start a node
    ssto#nodeid : Stop a node
    srst#nodeid : Reset a node
    scan : Reset all nodes and print message when bootup
    wait#seconds : Sleep for n secondsSDO: (size in bytes)
    rsdo#nodeid,index,subindex : read sdo
    ex : rsdo#42,1018,01
    wsdo#nodeid,index,subindex,size,data : write sdo
    ex : wsdo#42,6200,01,01,FFNote: All numbers are hex
    help : Display this menu
    quit : Quit application
  12. ok, type "scan" and behold in the CANopenShell:
    Wait for Slave nodes bootup...Slave 2 boot up
    I saw the LED on the device change to red and start blinking again. The candump terminal now looks like this:
    bas@mbp-jessie:~$ candump can0
    can0  702   [1]  00
    can0  700   [1]  00
    can0  000   [2]  81 00
    can0  702   [1]  00

I had Wireshark sniffing at can0 so these packets also made it to Wireshark.


At this time I gave myself a slap on the shoulder, got a victory beer, and slapped my other shoulder for good measure.

I'm now at the beginning of the beginning.

Hope you enjoyed it!
Don't be afraid to leave a reply.


4 thoughts on “Sniffing at CANopen

  1. Thanks for the details of CANopen CanFestival, I liked the the above detailed explanation. I would like to check, any success you got while executing the commands at step 9: getting info of node, reading and writing at sdo?
    rsdo#nodeid,index,subindex : read sdo
    wsdo#nodeid,index,subindex,size,data : write sdo

    I have faced difficulties @

    Any pointers or details will be a great help!

    • Hi Shrikant,
      When you have started CANopenshell you can send an SDO like so:

      #### Read SDO ####
      NodeId : 05
      Index : 1a00
      SubIndex : 00

      Result : 2

      meaning that the value of subindex 0 of register 0x1a00 is "2"
      0x1a00 is the mapping of TPDO1 in my case

      the can message which you can see with candump is:
      can0 605 [8] 40 00 1A 00 00 00 00 00
      can0 585 [8] 4F 00 1A 00 02 00 00 00

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.