[SOLVED] How to control DowKey Microwave Coaxial Switch with CAN interface?

[Andrey_irk]

Hi everyone!

I've bought a coaxial switch on ebay (model number 411HC-480832A-3A).
It's a 18GHz transfer switch with CAN interface made by DowKey. On their web site I've only found information about using special translator boards to communicate with the CAN switches via Ethernet or GPIB. But I don't have any of them. What I want is to communicate with my switch directly via CAN interface. In order to do that I have to know how to setup the bus and what kind of higher level protocol they use to make it switch.
I wrote a letter to DowKey, but they didn't answer.
Does anyone familiar with that kind of switches? Does anybody know how to communicate with it?

It has a AVR micro in it with a MCP2510 CAN controller and ULN2003 to swith the coils of the switch. So it's possible to just reprogram the thing, but it would be better to find the protocol.

Just in case - datasheet is attached down below.

[DBecker]

What type of CAN tools do you have?

If you have nothing, the easiest way to start is with an 'ELM' Bluetooth OBD2 reader.  They are only a few dollars, and you can easily send the 'AT' commands it uses without writing a program.  The drawback is that they don't report all errors, and it's a minor hassle hooking up to the pins.

The first step is to figure out the communication speed.  You can do that by stepping through all of the common speeds and seeing if the remote device responds with an ACK when you send a frame at that speed.  In some cases the device will periodically send a frame with its status, but probably not this one.

Once you know the speed, you step through all of the 11 bit short IDs to see if you can trigger a response.

If you can't figure it out this way, you might try to hook a logic analyzer ($7 USB logic analyzer used with Sigrok) up to the SPI connection.  The programming SPI is probably shared with the  MCP2510.  You'll need to decode the address the Rx filter is programmed with.  Once you know the CAN ID, then it's just the tedious iterative process of stepping through every one and two byte message to check for a response.

Update: Online documents suggest that the DowKey products operate at 10 Kbps, which is absurdly low for CAN.  You should expect a whole pile  of steaming stuff as suggested by this manual section 'The UI device may demonstrate a “speed limit” when comes to how rapidly the Operator may
actuate keys and still get the correct response on the LCD: the Operator is encouraged to find a comfortable cadence when operating the keypad.'

[Andrey_irk]

What type of CAN tools do you have?

If you have nothing, the easiest way to start is with an 'ELM' Bluetooth OBD2 reader.  They are only a few dollars, and you can easily send the 'AT' commands it uses without writing a program.  The drawback is that they don't report all errors, and it's a minor hassle hooking up to the pins.

The first step is to figure out the communication speed.  You can do that by stepping through all of the common speeds and seeing if the remote device responds with an ACK when you send a frame at that speed.  In some cases the device will periodically send a frame with its status, but probably not this one.

Once you know the speed, you step through all of the 11 bit short IDs to see if you can trigger a response.

If you can't figure it out this way, you might try to hook a logic analyzer ($7 USB logic analyzer used with Sigrok) up to the SPI connection.  The programming SPI is probably shared with the  MCP2510.  You'll need to decode the address the Rx filter is programmed with.  Once you know the CAN ID, then it's just the tedious iterative process of stepping through every one and two byte message to check for a response.

Update: Online documents suggest that the DowKey products operate at 10 Kbps, which is absurdly low for CAN.  You should expect a whole pile  of steaming stuff as suggested by this manual section 'The UI device may demonstrate a “speed limit” when comes to how rapidly the Operator may
actuate keys and still get the correct response on the LCD: the Operator is encouraged to find a comfortable cadence when operating the keypad.'

Thank you for your suggestions.

I have a USB->CAN converter which I've made from a STM32 Discovery board and a CAN bus transceiver. So I can use it to reverse engineer the thing.

I thought that here are people who are familiar with these switches and can help.

Anyway, maybe someone will eventually reply.

[Andrey_irk]

Eventually I've figured out how to drive it. Hovewer, I haven't done a complete reverse engineering of the protocol.
So here is the configuration of the bus:
CAN bit length 100uS so the frequency is 10kHz.
Phase segments are 1Tq+1Tq+3Tq+3Tq, Tq = 12,5uS
sync jump 1Tq
It has a standard 11bit identifier which is 0b00000000000.
Filter is configured to receive standart identifiers too, but the ID can vary. There is even a command which allows to change it. I actually lost some time before I understood it, because after decoding a MCP2510 setup sequence I was using a std I found there, but after a while the switcher stopped receiving messages, because it was waiting for a different ID and I had to find a new one. There are two ways to find it - you can either hook to a MCP interrupt pin or decode a startup sequence (SPI). My latest ID is 0x201, but it doesn't actually matter.
In all answers it will transmit 4 bytes. It looks like the first byte is a commant and it matches to the firest byte of the request it received.

In order to switch it you should send it 2 bytes. The first byte is always 0x1 and it seems to be a "switch" command. The second byte in my case is either 1 or 2 depending on in which position the switch is. So if it is in the first position - you should send it {1,2}, otherwise - {1,1}. It doesn't send anything back after these commands.

Apart from that it responded to commands starting from 0x3 and 0xa. One of them has to be a request of the position, but I can be wrong and I don't want to figure it out actually.

I hope it will save someone's time someday.