dataTaker CANgate User manual

~®
Intelligent Data Logging Products
CANgate™
User's Manual
A guide to:
programming
wiring
communications
www.datataker.com

UM-0086-A2 CANgate User’s Manual Page 2
CANgate User’s Manual
© Copyright 2007-08 Thermo Fisher Scientific Australia Pty Ltd ABN 52 058 390 917
UM-0086-A2
Warranty
Thermo Fisher Scientific Australia Pty Ltd (“Thermo Fisher”) warrants the instruments it manufactures against defects in
either the materials or the workmanship for a period of three years from the date of delivery to the original customer. This
warranty is limited to, and purchaser’s sole remedy for a breach of this warranty is, the replacement or repair of such defects,
without charge, when the instrument is returned to Thermo Fisher or to one of its authorized dealers pursuant to Thermo
Fisher’s return policy procedures.
The obligations set forth above shall be void with respect to any damage to the instrument resulting from accident, abuse,
improper implementation or use, lack of reasonable care, loss of parts, force majeure, or any other third party cause beyond
Thermo Fisher’s control. Any installation, maintenance, repair, service, or alteration to or of, or other tampering with, the
instruments performed by any person or entity other than Thermo Fisher without its prior written approval, or any use of
replacement parts not supplied by Thermo Fisher, shall immediately void and cancel all warranties with respect to the
affected instruments.
Thermo Fisher shall not be liable for any incidental, indirect, special, punitive or consequential loss or damages resulting
from or arising out of the use of the instrument, In no event shall Thermo Fisher’s liability with respect to the instrument, the
use thereof, this warranty statement or any cause of action related thereto, under any circumstances exceed the purchase
price of the instrument actually paid by purchaser.
Where Thermo Fisher supplies to the customer equipment or items manufactured by a third party, then the warranty
provided by the third party manufacturer shall pass through to purchaser, but only to the extent allowed by the original
manufacturer or third party supplier.
EXCEPT AS EXPRESSLY PROVIDED IN THIS WARRANTY STATEMENT, THERMO FISHER DISCLAIMS ALL OTHER
WARRANTIES, WHETHER EXPRESS OR IMPLIED, ORAL OR WRITTEN, WITH RESPECT TO THE INSTRUMENTS,
INCLUDING WITHOUT LIMITATION ALL IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR ANY
PARTICULAR PURPOSE. THERMO FISHER DOES NOT WARRANT THAT THE INSTRUMENTS ARE ERROR-FREE
OR WILL ACCOMPLISH ANY PARTICULAR RESULT. ANY ADVICE OR ASSISTANCE FURNISHED BY THERMO
FISHER IN RELATION TO THE INSTRUMENTS SHALL NOT GIVE RISE TO ANY WARRANTY OR GUARANTEE OF ANY
KIND, AND SHALL NOT CONSTITUTE A WAIVER BY THERMO FISHER.
The Purchaser shall be solely responsible for complying with all applicable local, state and Federal laws with respect to the
installation, use and implementation of the equipment.
Trademarks
dataTaker is a registered trademark of Thermo Fisher Scientific Australia Pty Ltd
CANgate is a trademark of Thermo Fisher Scientific Australia Pty Ltd
All other brand and product names are trademarks or registered trademarks of their respective holders.
Regulatory Notices
This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the
FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is
operated in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy and, if not
installed and used in accordance with the instruction manual, may cause harmful interference to radio communications.
Operation of this equipment in a residential area is likely to cause harmful interference in which case the user will be required
to correct the interference at his own expense.
Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to
operate the equipment.
CANgate Firmware Covered in This Manual
This version of the CANgate User’s Manual (UM-0086-A2) applies to CANgate products running version 1.28 (or later)
firmware.
WARNING
dataTaker products are not authorized for use as critical components in any life support system where failure of the product is
likely to affect the system’s safety or effectiveness.

UM-0086-A2 CANgate User’s Manual Page 3
Contents
Contents ..........................................................................................................3
Introduction .....................................................................................................5
About CANgate ................................................................................................................ 5
About This Manual ........................................................................................................... 5
Acronyms ......................................................................................................................... 6
CANgate Hardware..........................................................................................7
Connectors and LEDs ...................................................................................................... 7
Host RS232 Port ................................................................................................................... 7
CAN/GPS/Power Port ...........................................................................................................7
LEDs...................................................................................................................................... 7
Connecting CANgate........................................................................................................ 8
Host Computer Connection................................................................................................... 8
Data Logger Connection ....................................................................................................... 8
CAN/GPS/Power Connections .............................................................................................. 9
CAN Bus Type and Termination ........................................................................................... 9
Inside CANgate .............................................................................................................. 10
Accessing CANgate Internals ............................................................................................. 10
Configuration Switches........................................................................................................ 11
Using CANgate ..............................................................................................12
Memory Slots ................................................................................................................. 12
Memory Slot Commands and Protocol Hierarchy .......................................................... 13
Entering Commands....................................................................................................... 13
Run Mode and Program Mode ....................................................................................... 14
Command Summary .....................................................................................15
Command Reference ....................................................................................16
Commands and Parameters .......................................................................................... 16
Slot Definition Commands.............................................................................................. 16
RECV – Receive Standard-ID CAN Messages................................................................... 16
RECVE – Receive Extended-ID CAN Messages................................................................ 17
SEND – Transmit Standard-ID CAN Message.................................................................... 17
SENDE – Transmit Extended-ID CAN Message................................................................. 17
RQST – Request OBD Data ...............................................................................................17
RECVJ – Receive J1939 Messages ................................................................................... 19
RQSTJ – Request J1939 Data............................................................................................ 20
GPS – Receive NMEA-0813 Messages.............................................................................. 20
FORMAT Sub-command.....................................................................................................21
Other Commands ........................................................................................................... 22
BEGIN – Begin Program Entry............................................................................................ 22
END – Finish Program Entry...............................................................................................22
RP – Poll Memory Slot ........................................................................................................23
CONNECT – Set CAN Bit Rate........................................................................................... 23
VERBOSE – Enable Extended Messages .......................................................................... 23
VERSION – Display Firmware Version ............................................................................... 24
RESET – Clear Memory Slots............................................................................................. 24
SNOOP – Report CAN/GPS Activity ................................................................................... 24
SNOOPJ – Report J1939 Activity ....................................................................................... 24
NETLOAD – Measure CAN Traffic Load............................................................................. 25
SETADDR – Set CANgate Address.................................................................................... 25

UM-0086-A2 CANgate User’s Manual Page 4
GPSBAUD – Set GPS Port Baud Rate ............................................................................... 25
GPSSEND – Send Commands to GPS ..............................................................................26
STATUS – List Memory Slot Status .................................................................................... 26
STATS – Display Communications Statistics...................................................................... 26
DIAG – Set Diagnostic Mode .............................................................................................. 27
Notes and Examples .....................................................................................28
Extracting and Formatting Bit Fields............................................................................... 28
J1939 PGNs & SPNs ..................................................................................................... 28
Broadcast PGNs..................................................................................................................28
Request PGNs ....................................................................................................................29
Reusing Request Data ................................................................................................... 29
Multi-Packet J1939 Messages........................................................................................ 30
Terminal Control............................................................................................................. 30
KWP2000/OBD-II/ISO-14230 Requests......................................................................... 30
Reading Fault Codes...................................................................................................... 31
OBD-II.................................................................................................................................. 31
J1939................................................................................................................................... 31
Using CANgate with a DT8x Data Logger ...................................................................... 32
Escaping Control Characters .............................................................................................. 32
Serial Sensor Direct Mode ..................................................................................................33
Using CANgate with DeLogger....................................................................................... 33
Troubleshooting.............................................................................................................. 33
Error Messages .............................................................................................................. 35
Upgrading CANgate Firmware ....................................................................................... 37
Appendix........................................................................................................38
CANgate Specifications.................................................................................................. 38
CAN Interfaces .................................................................................................................... 38
GPS Interface...................................................................................................................... 38
Host (Data Logger/Computer) Interface.............................................................................. 38
LED indicators ..................................................................................................................... 38
Connectors .......................................................................................................................... 38
Host Software...................................................................................................................... 38
Power Supply ...................................................................................................................... 39
Power Consumption ............................................................................................................ 39
Physical ............................................................................................................................... 39
Environmental ..................................................................................................................... 39
OBD-II Modes and PIDs................................................................................................. 40
Modes.................................................................................................................................. 40
PIDs..................................................................................................................................... 40
DTCs (Fault Codes) ............................................................................................................ 42

UM-0086-A2 CANgate User’s Manual Page 5
Introduction
About CANgate
CAN (Controller Area Network) is a data communication system widely used in the automotive industry.
The dataTaker CANgate allows a data logger (such as the dataTaker DT80) or a host computer to be interfaced to a CAN
network. CANgate is equipped with two standard CAN interfaces, plus a serial interface for connecting to an NMEA-0183
compatible device such as a GPS unit. Data may then be returned to the host computer or data logger via a second RS232
interface.
CANgate is capable of performing a range of functions; such as sending and receiving raw CAN messages or performing
higher-level functions to interface with ISO-14230/OBD-II and SAE-J1939 compatible devices.
The CAN ports are "hot-pluggable" and all CANgate settings are saved in non-volatile flash memory so that the unit will
resume its configured tasks following a power interruption.
Typical CANgate application
About This Manual
This document is primarily a reference manual which describes the commands used to configure the CANgate. It is assumed
that the reader has some familiarity with the operation of CAN-based systems and the various communication protocols
which operate over CAN.
Note that dataTaker DeLogger software provides an easy-to-use "front end" which will generate the required logger and
CANgate commands in order to monitor and record the parameters of interest from the CAN bus. If DeLogger is used then
detailed knowledge of the CANgate commands described in this manual is not required.
DT80/DT800
Data Logger
or
Host Computer
ECU
ECU
CAN bus 1
CAN bus 2
GPS
CANgate
CAN
12V DC power
RS232 / NMEA-0183
RS232 /
ASCII data/commands
CAN

UM-0086-A2 CANgate User’s Manual Page 6
Acronyms
Abbreviation Meaning
CAN Controller Area Network
CRLF Carriage Return, Line Feed
ECU Electronic Control Unit
GPS Global Positioning System
ID Identifier
ISO International Standards Organisation
NMEA National Marine Electronics Association
OBD On Board Diagnostics
PGN Parameter Group Number
PID Parameter Identifier
SAE Society of Automotive Engineers
SPN Suspect Parameter Number
OBD On Board Diagnostics
DTC Diagnostic Trouble Code
PDU Protocol Data Unit

UM-0086-A2 CANgate User’s Manual Page 7
CANgate Hardware
Connectors and LEDs
CANgate consists of a small aluminium box with a DE9 connector on each end and six LEDs on the top face.
Host RS232 Port
The female DE9 is used to connect to an RS232 port on a host computer or data logger. The pin-out follows the standard
DTE (Data Terminal Equipment) layout as used on a PC. That is:
Pin Signal Function
1 -
2 RXD Receive Data input
3 TXD Transmit Data output
4 -
5 GND Ground
6 -
7 RTS Request To Send output
8 CTS Clear To Send input
9 -
Note that the RTS and CTS pins are only used if hardware handshaking is selected (see Configuration (P11))
CAN/GPS/Power Port
The male DE9 is used to:
supply power to CANgate (10-30V DC)
connect to two separate CAN buses
connect to the RS232 interface (and possibly power) on a GPS unit
The pin-out is as follows:
Pin Signal Function
1 5V out +5Vdc output (200mA max)
2 GND Ground
3 CAN1-HI CAN port 1 – high (+)
4 GPS RXD GPS port – Receive Data input
5 CAN1-LO CAN port 1 – low (–)
6 CAN2-HI CAN port 2 – high (+)
7 CAN2-LO CAN port 2 – low (–)
8 GPS TXD GPS port – Transmit Data output
9 POWER in +10-30V DC power input
LEDs
The LEDs are used to indicate activity on the various ports:
LED Label LED Colour Function
Power red on while CANgate is powered
RS232 Tx red flashes when characters are transmitted to host port
RS232 Rx green flashes when characters are received from host port
CAN 1 Rx blue flashes when a CAN frame is successfully received from CAN port 1
CAN 2 Rx red flashes when a CAN frame is successfully received from CAN port 2
GPS Rx green flashes when characters are received from GPS port
Note that the CAN LEDs will only flash on receipt of CAN frames which match CANgate's current hardware filter settings. If
CANgate has not yet been programmed to receive CAN data then the LEDs will not flash, even if there is traffic on the
connected bus.

UM-0086-A2 CANgate User’s Manual Page 8
Connecting CANgate
Host Computer Connection
The supplied host computer serial cable is wired as a standard "null modem" cable:
Host computer serial connection wiring diagram
If the host computer does not have an RS232 port then a USB to serial adapter may be used.
Data Logger Connection
The supplied data logger serial cable is designed to connect to the serial sensor port on a DT80 series logger.
Data logger serial connection wiring diagram
Note: By default, the CANgate host port operates at a high baud rate (57600 baud). At this speed, the maximum cable length
for the host computer or data logger connection is approximately 5 metres, assuming good quality shielded cable is used. If
a longer cable is required, the CANgate baud rate should be reduced (see Configuration (P11)), eg. at 9600 baud a cable
length of 40m is normally possible.
1
RXD – 2
TXD – 3
4
GND – 5
6
RTS – 7
CTS – 8
9
1 – Tx Z
2 – Rx A
3 – RTS Y
4 – CTS B
5 – D GND
BLUE
RED
GREEN
YELLOW
WHITE
DE9 female
terminal block
CANgate
DT80 series
data logger
1
RXD – 2
TXD – 3
4
GND – 5
6
RTS – 7
CTS – 8
9
1
2 – RXD
3 – TXD
4
5 – GND
6
7 – RTS
8 – CTS
9
DE9 female DE9 female
CANgate Host
Computer

UM-0086-A2 CANgate User’s Manual Page 9
CAN/GPS/Power Connections
The supplied terminal adapter plug (DE9 male to 9-way terminal block) provides convenient screw terminal connections to
the CAN/GPS/POWER connector. Alternatively, a custom cable can be made up using a conventional DE9 plug.
A typical wiring configuration is shown below:
Diagnostic connector and GPS wiring diagram
Note A vehicle with an SAE J1962 diagnostic connector may not necessarily use a CAN network. If CAN is not used then the
indicated pins will either be not connected or in some applications may have a different function. Ensure that the vehicle does
actually use high speed CAN before connecting CANgate to the diagnostic connector.
CAN Bus Type and Termination
The CAN protocol can operate over a number of different physical layers. A physical layer is a specification defining the low
level electrical characteristics of the network, eg. allowable bit rates, voltage levels, cable type and so on.
It is important to note that CANgate only supports the high speed CAN physical layer, as defined in ISO 11898-2 / SAE
J2284. This is by far the most widely used physical layer. The important characteristics of this standard are:
two wire, 5V differential signalling
bit rate 10kbps – 1Mbps
twisted pair cable, 120 Ωcharacteristic impedance
A high speed CAN network is required to have a linear topology. There is a single twisted pair "backbone" cable which can
be up to 40m long. Electronic control units (ECUs) are then connected to the bus using short stub connections (max length
0.3m). (These limits are for 1Mbps operation and can be increased somewhat for lower bit rates.)
At each end of the bus, correct termination is required. This typically consists of a resistor (wired across the two bus lines)
that matches the impedance of the cable (ie. 120 Ω). The termination resistance provides the correct DC load for the CAN
output drivers, and minimises signal "reflections", which can distort the CAN signals and cause errors.
DE9 male
1
J1850+ – 2
3
CHAS GND – 4
SIG GND – 5
CAN HI – 6
ISO 9141 K – 7
8
9
J1850- – 10
11
12
13
CAN LO – 14
ISO 9141 L – 15
BATTERY – 16
Vehicle
Diagnostic
Connector
(SAE J1962)
1 – 5V out
2 – GND
3 – CAN1 HI
4 – GPS RXD
5 – CAN1 LO
6 – CAN2 HI
7 – CAN2 LO
8 – GPS TXD
9 – POWER
SAE J1962 male
GPS
CANgate
RXD
TXD
GND
Power
Connector to suit
GPS unit

UM-0086-A2 CANgate User’s Manual Page 10
Connecting to an Existing CAN Network
A typical CAN network might be wired as follows:
Typical layout of a vehicular CAN network
In this case the vehicle has five ECUs connected to the CAN bus, plus a diagnostic connector. ECUs 1 and 5 are at the ends
of the main bus, so they incorporate termination resistors. ECUs 2, 3 and 4 connect to the bus via short stub connections and
do not include a termination resistor.
Notice that CANgate incorporates weak termination (2.6k Ω). This value is high enough so as not to significantly increase
the DC load on the already terminated bus, yet low enough to provide some damping of reflections on CANgate's stub
connection to the bus. This allows the length of the stub to be extended to around 2-3 metres. Note that some of the ECUs
may also include weak termination to allow their stub connections to be extended slightly.
Connecting to a Single ECU
If CANgate is connected to a single ECU (eg for laboratory testing) then an external termination resistor may be required
Direct connection to a single ECU
In this case a short (1m) cable is used so the two 120 Ωresistors are combined into one 60 Ωresistor. If a long cable is used
then 120 Ωresistors should be placed at each end. This assumes that the ECU is not terminated (or weakly terminated). If
the ECU includes its own 120 Ωtermination then an external 120 Ωresistor is only required at the CANgate end of the cable.
Note that if the cable is short and the bit rate moderate then you may well get away with no external termination, ie.
CANgate's internal weak termination may be adequate.
Inside CANgate
Accessing CANgate Internals
If it is necessary to alter the settings on the internal DIP switch then CANgate will need to be disassembled, as follows:
1. Disconnect any cables from the CANgate connectors.
2. Remove the two Philips-head screws on the right hand ("Host RS232") end of the case.
3. Remove the aluminium end plate and plastic surround.
4. Push on the connector at the other end of the case. The printed circuit board (PCB) should slide out.
ECU
CANgate
2.6 KΩ60 Ω
ECU 1
120 Ω
ECU 2
ECU 3
ECU 5
120 Ω
ECU 4
CANgate
2.6 KΩ
DIAG PORT
CAN-LO
CAN-HI
stub stub
stubstub

UM-0086-A2 CANgate User’s Manual Page 11
To reassemble:
1. Slide the printed circuit board into the topmost slot in the case (the one closest to the front panel label). The male DE9
should be at the right hand ("Host RS232") end of the case.
Note: It is normal for one of the solder connections on the PCB near the male DE9 connector to make contact with the
case.
2. Replace the plastic surround, then the end plate.
3. Fasten the two screws
CANgate internal view
Configuration Switches
By default, the CANgate's host RS232 port is configured for 57600 baud, hardware flow control (RTS/CTS), 8 data bits, no
parity, 1 stop bit. This should be suitable for most applications, however these settings can be changed by setting the internal
DIP switch, as shown below. The factory default is all switches OFF.
Switch 1 Switch 2 Switch 3 Switch 4 Switch 5 Switch 6 Switch 7 Switch 8
57600 off off off x x x x off
38400 off off ON x x x x off
19200 off ON off x x x x off
9600 off ON ON x x x x off
Host port
baud rate
115200 ON off off x x x x off
hardware x x x off x x x offHost port
flow control software x x x ON x x x off
Factory Defaults ON ON ON ON ON ON ON off
Bootstrap Mode x x x x x x x ON
Note: Switch numbers refer to the numbers printed on the switch itself. Ignore the labels marked on the printed circuit board.
Note: The switch settings are only checked immediately after power up. Changing the switches during operation has no
effect.
The Factory Defaults setting can be used to force CANgate to revert to a factory default state, ie. verbose mode off, both
CAN ports disabled, GPS baud rate 4800, all memory slots cleared. Set the switches as indicated above (ie. switches 1-7
ON), then cycle the power – all LEDs should illuminate briefly – then return the switches to their normal setting and cycle the
power again.
The Bootstrap Mode switch provides an alternative way of entering Bootstrap Mode, which is only used when upgrading
CANgate firmware.

UM-0086-A2 CANgate User’s Manual Page 12
Using CANgate
Memory Slots
By default, CANgate will not send or receive any CAN messages. In order to do anything useful, it must first be programmed.
CANgate is programmed by sending commands to set up one or more memory slots. Each memory slot can be configured
to perform one of the following functions:
Slot type Class Action
RECV
RECVE
passive receive CAN messages with a specified identifier value, extract the specified data field and return
its value as a formatted ASCII value
RECVJ passive receive CAN messages relating to a specified J1939 PGN number, extract and return the
specified data field
GPS passive receive NMEA-0183 messages of the specified sentence type, extract and return the specified
data field
SEND
SENDE
active send a CAN message
RQST active request an ISO-14230 parameter, wait for the reply, extract and return the specified data field
RQSTJ active request a J1939 PGN, wait for the reply, extract and return the specified data field
As can be seen, there are two classes of slots: passive and active.
For RECV, RECVE, RECVJ and GPS slots, CANgate passively receives all matching messages then returns the last known
data value either at a fixed rate, or when requested by the host (data logger or computer). Statistical calculations can
optionally be performed, resulting in a min/max/average value being returned instead of an instantaneous value.
For SEND, SENDE, RQST and RQSTJ slots, CANgate will take the specified action (ie. transmit a message and possibly
wait for a reply) either at a fixed rate or when requested by the host.
In all cases, one memory slot corresponds to one data value of interest. So if a particular type of CAN message contains six
separate values packed into its data area, of which four are of interest, then you would set up four memory slots – each one
configured to extract a different subfield.
Up to 150 memory slots (which are referred to by number, 1-150) can be set up. Slot configurations are automatically saved
to flash memory so that operation will automatically resume following a power interruption.
One further memory slot, Slot 0, is provided. This is intended to be used as a "scratch pad" for one-off requests, ie. it may be
reprogrammed many times during operation. This slot's configuration is not saved to flash.

UM-0086-A2 CANgate User’s Manual Page 13
Memory Slot Commands and Protocol Hierarchy
CAN networks can use a number of different higher level communications protocols. The following diagram illustrates the
protocols used by each type of memory slot.
CANgate protocol hierarchy
As can be seen, the RECV, RECVE, SEND and SENDE memory slot types operate on raw CAN messages. A raw CAN
message consists of an 11 or 29 bit identifier, plus 8 bytes of data.
RQST memory slots allow parameters to be requested using standard automotive OBD (On Board Diagnostics) requests.
The ISO 15765-2 network layer protocol is responsible for breaking up the request and response messages into multiple
CAN frames, if required.
RECVJ and RQSTJ memory slots allow broadcast and requested parameters to be read from a J1939 network. J1939 also
incorporates a network layer which can break long messages up into multiple CAN frames.
Finally, GPS memory slots allow fields of interest to be extracted from the NMEA-0183 data stream produced by a GPS
device.
Entering Commands
CANgate memory slots and other settings are configured by sending textual commands via the host port. The available
commands are detailed in the Command Reference (P16).
If CANgate is directly connected to host computer then these commands can be entered using a terminal program (eg.
DeTransfer).
If CANgate is connected to the serial sensor port on a DT80/DT800 series data logger then the logger would be programmed
to transmit commands and receive data using the 1SERIAL channel type. Refer to the logger User Manual for more details.
CANgate commands are not case sensitive.
Most commands have a set number of space-separated parameters. All parameters must be specified, unless a parameter
is marked as optional.
A parameter's data type will be specified as either:
floating point – enter a decimal value, eg. 1.25, -4, 0.9907
integer – enter a decimal or hexadecimal value, eg. 2309, 0xff07, -10 (hexadecimal values are prefixed by 0x)
RECV RECVE
SEND SENDE
NMEA-0183
GPSRQST
R
ECV
J
RQSTJ
ISO 14230-3 / OBD-II
Diagnostic Services
Application Layer
SAE J1939-71
Vehicle Application Layer
ISO 15765-2
Network Layer
SAE J1939-21
Data Link / Network Layer
CAN 2.0B PROTOCOL / ISO 11898-2
Data Link / Physical Layer
GPS PORTCAN PORT 2CAN PORT 1

UM-0086-A2 CANgate User’s Manual Page 14
hex data – enter a string of hexadecimal digits, eg. 12ff09270045db08. To make long strings easier to read, one
or more underscores (or any other non-hex, non-whitespace character) can optionally be inserted between bytes, eg:
12ff0927_0045db08. The hexadecimal prefix 0x can also be included if desired.
string – enter an ASCII string inside quotation marks, eg. "big top", "\007Alert ", "\r\n"
Control characters may be inserted into strings using a backslash followed by three decimal digits representing the ASCII
code, eg. \013 will insert a carriage return. To insert an actual backslash character, use \\. As a shortcut, carriage return,
newline (CR-LF) and tab characters may be inserted using \r, \n and \t respectively.
Note: If DeTransfer is used to send commands to CANgate then each backslash must be entered as \\ in the DeTransfer
Send window. So if you want the string to contain an actual backslash character you would need to enter \\\\ in
DeTransfer.
Commands must be terminated by a carriage return or a semi-colon (;) character.
Comments may be included using an apostrophe (') character. All characters after the apostrophe up until the end of the
line will be ignored.
Run Mode and Program Mode
CANgate has two operational modes.
Run Mode is the normal mode of operation. Following power-up, CANgate always starts in Run Mode.
In Run Mode, all configured memory slots will receive and/or transmit their programmed CAN or GPS messages, and return
data to the host system as required.
Whilst in Run Mode, any of the commands described in the Command Reference (P16) may be entered. However, only
Memory Slot #0's configuration may be changed. Commands that attempt to modify any of the other memory slots will be
ignored – the only way to update these slots is to switch to Program Mode.
Program Mode is entered by sending the BEGIN command. This command will erase all existing memory slots and prepare
CANgate for receiving new definitions.
In Program Mode, the CAN and GPS ports are not active. The only commands that are accepted in this mode are the slot
definition commands – RECV, RECVE, SEND, SENDE, RECVJ, RQST, RQSTJ and GPS.
These commands are prefixed by the number of the memory slot to define, eg:
12 RECV 1 0x712 1 2
will define memory slot #12.
When all required memory slots have been defined, the END command will save all memory slot details (except Slot #0) to
non-volatile flash memory and return to Run Mode.

UM-0086-A2 CANgate User’s Manual Page 15
Command Summary
{ slot } RECV CANport RxID { startByte{.bit} endByte{.bit} sampleRate } { FORMAT options }
{ slot } RECVE CANport RxID { startByte{.bit} endByte{.bit} sampleRate } { FORMAT options }
{ slot } SEND CANport TxID hexData { sampleRate }
{ slot } SENDE CANport TxID hexData { sampleRate }
{ slot } RQST CANport hexData { startByte{.bit} endByte{.bit} ECUaddr sampleRate } { FORMAT options }
{ slot } RECVJ CANport PGN { startByte{.bit} endByte{.bit} ECUaddr priority sampleRate } { FORMAT options }
{ slot } RQSTJ CANport PGN { startByte{.bit} endByte{.bit} ECUaddr priority sampleRate } { FORMAT options }
{ slot } GPS "header" fieldNum { option sampleRate } { FORMAT options }
…
FORMAT { rawFormat } { scale offset } { "formatString"} { stats }
BEGIN
END
RP { slot1 slot2 }
CONNECT CANport bitrate
VERBOSE state
VERSION
RESET
SNOOP CANport | GPS { snoopTime }
SNOOPJ CANport { snoopTime }
NETLOAD { CANport }
SETADDR CANport address
GPSBAUD baudRate
GPSSEND "text"
STATUS
STATS { CLEAR }
DIAG mode

UM-0086-A2 CANgate User’s Manual Page 16
Command Reference
Commands and Parameters
In this section, literal text (to be entered exactly as shown) is shown thus: RECV.
Variable parameters are shown as: CANport.
Optional parameters are surrounded by braces. If multiple parameters are surrounded by braces, eg.
CMD param1 param2 { param3 param4 }
then one or more of the parameters may be omitted, starting with the rightmost parameter. That is, you can specify either:
CMD param1 param2 or
CMD param1 param2 param3 or
CMD param1 param2 param3 param4
If parameters have their own individual braces, eg.
CMD param1 param2 { param3 } { param4 }
then each optional parameter can be either specified, or not. So as well as the above choices you could also specify:
CMD param1 param2 param4
All optional parameters have a defined default value, which is what will be used if the parameter is not specified.
Remember that CANgate commands are not case sensitive, so recv is equivalent to RECV.
Slot Definition Commands
RECV – Receive Standard-ID CAN Messages
{ slot } RECV CANport RxID { startByte{.bit} endByte{.bit} sampleRate } { FORMAT formatOptions }
where:
slot is the memory slot being defined (integer, 0-150). If not specified then 0is assumed. If CANgate is in Run Mode
then zero is the only value that can go here.
CANport is the CAN port to use (integer, 1-2)
RxID is the 11-bit CAN identifier to listen for (integer, 0-0x7FF)
startByte{.bit} is the starting bit position of the field of interest within the 8-byte CAN data field. Bytes are numbered
from 1 to 8, bits are numbered from 8 (MSB) down to 1 (LSB). If startByte is not specified then 1is assumed. If .bit is
not specified then .8 is assumed.
endByte{.bit} is the ending bit position (inclusive) of the field of interest within the 8-byte CAN data field. If endByte is
not specified then 8is assumed. If .bit is not specified then .1 is assumed.
sampleRate is the rate at which to return values to the host (integer, in ms, must be multiple of 100ms). May also be
ALL, in which case a value is returned on receipt of every matching CAN message. If this parameter is 0or not
specified, the memory slot will only return data when it is polled by the host system (using the RP command).
formatOptions specify how the data value is to be formatted when it is returned to the host system; see FORMAT
Sub-command (P21) for more details. if not specified, data will be returned in raw hexadecimal format.
A RECV memory slot captures all messages on the specified CAN port with the specified standard identifier, and extracts the
required data field. When polled (using the RP command), or at the intervals specified by the sampleRate parameter, the slot
will return the most recent value for the data field. If no messages have been received, nothing will be returned (other than
the configured static formatting text, which is specified by the FORMAT sub-command and by default is just CRLF).
The SNOOP command (P24) can be used to determine which CAN identifiers are being broadcast on a CAN network.
Note: If the sampleRate parameter is set to ALL, it is not guaranteed that every CAN message will be returned. Many CAN
networks operate at high speed, and some parameters are broadcast at very frequent intervals. The rate at which these
messages arrive may exceed the bandwidth of the host RS232 connection, or the processing capabilities of the CANgate.
Examples
RECV 1 0x220
Receive messages on CAN port 1 with ID 0x220. When polled, return all 8 data bytes (in hexadecimal) of the most recent
message.
RECV 1 0x603 1 2 FORMAT "P1:%d\n"
Receive ID 0x603 messages. When polled, return the first two data bytes as a single decimal integer, prefixed by P1:.
Remember – if DeTransfer is used to send the above command then it would need to be entered as
RECV 1 0x603 1 2 FORMAT "P1:%d\\n"

UM-0086-A2 CANgate User’s Manual Page 17
RECV 1 0x603 3.8 3.5 ALL FORMAT .25 "%f,"
As each ID 0x603 message is received, return the value of the upper 4 bits of data byte 3 (0-15). This is then scaled by a
factor of 0.25 and returned as a floating point number (range 0-3.75) followed by a comma.
RECV 1 0x112 4 8 1000
Once per second (1000ms), return the most recent values of data bytes 4-8 of received ID 0x112 messages.
RECVE – Receive Extended-ID CAN Messages
{ slot } RECVE CANport RxID { startByte{.bit} endByte{.bit} sampleRate } { FORMAT formatOptions }
This command is exactly the same as RECV, except that the CAN identifier is an extended mode (29 bit) identifier, as
opposed to a standard mode (11 bit) identifier.
The allowable range for RxID is therefore 0-0x1FFFFFFF
SEND – Transmit Standard-ID CAN Message
{ slot } SEND CANport TxID hexData { sampleRate }
where:
slot is the memory slot being defined (integer, 0-150). If not specified then 0is assumed. If CANgate is in Run Mode
then zero is the only value that can go here.
CANport is the CAN port to use (integer, 1-2)
TxID is the CAN identifier to include in the transmitted message (integer, 0-0x7FF)
hexData is up to 8 bytes of hex data to include in the transmitted message. Non hex characters (eg. _) may be
inserted between bytes to make the string easier to read.
sampleRate is the rate at which to send messages (integer, in ms, must be multiple of 100ms). If this parameter is 0or
not specified, the memory slot will only send a message when it is polled by the host system (using the RP command).
When polled, a SEND memory slot transmits a raw CAN message. No data is returned to the host system.
Note that it is not possible to set up a RECV slot on the same CAN port to monitor messages sent by CANgate. If this is
required, connect the two CAN ports together and set up the RECV slot on the other port.
Examples
SEND 2 0x302 1122FF07; RP
This will immediately send a CAN message on CAN port 2. The message's identifier will be 0x302 and the data field will be
1122FF07. The DLC (data length code) field in the CAN frame will be set to 4.
SEND 2 0x119 FF110203_040599CC 2000
Every 2000ms, send the indicated 8-byte data field with CAN ID 0x119.
SENDE – Transmit Extended-ID CAN Message
{ slot } SENDE CANport TxID hexData { sampleRate }
This command is exactly the same as SEND, except that the CAN identifier is an extended mode (29 bit) identifier, as
opposed to a standard mode (11 bit) identifier.
The allowable range for RxID is therefore 0-0x1FFFFFFF
RQST – Request OBD Data
{ slot } RQST CANport hexData { startByte{.bit} endByte{.bit} ECUaddr sampleRate } { FORMAT formatOpt }
where:
slot is the memory slot being defined (integer, 0-150). If not specified then 0is assumed. If CANgate is in Run Mode
then zero is the only value that can go here.
CANport is the CAN port to use (integer, 1-2)
hexData is 1-39 bytes of data to include in the transmitted request message. The first byte is the ISO-14230 mode
byte, the remainder of the data are parameters. The number and meaning of the parameters vary depending on the
mode byte. Non hex characters (eg. _) may be inserted between bytes to make the string easier to read. See OBD-II
Modes and PIDs (P40) for more details on some common OBD request messages.
startByte{.bit} is the starting bit position of the field of interest within the received message. Bytes are numbered from
1, bits are numbered from 8 (MSB) down to 1 (LSB). If startByte is 0or not specified, a default value is chosen based
on the mode byte. If .bit is not specified then .8 is assumed.
endByte{.bit} is the ending bit position (inclusive) of the field of interest. If endByte is 0or not specified then this will be
the last received byte in the message. If .bit is not specified then .1 is assumed.

UM-0086-A2 CANgate User’s Manual Page 18
ECUaddr is the address of the ECU to which to send the request (integer, 0-7, or 256). If 256 is specified (which is
the default), a non-specific request is made. For ECUs which do not use the standard OBD-II CAN IDs, you can
alternatively specify an explicit CAN ID here, in hexadecimal (e.g. 0x220); this is discussed further below.
sampleRate is the rate at which to send messages (integer, in ms, must be multiple of 100ms). If this parameter is 0or
not specified, the memory slot will only send a message when it is polled by the host system (using the RP command).
formatOpt specify how the data value is to be formatted when it is returned to the host system; see FORMAT
Sub-command (P21) for more details. if not specified, data will be returned in raw hexadecimal format.
A RQST memory slot transmits a request message to an ISO-14230/OBD-II compatible ECU, and waits for a reply. Then:
if a reply is forthcoming, the required bytes are extracted from the reply message, formatted if required, and returned
to the host.
if an ISO-14230 negative reply code is received, this is reported to the user (if the Verbose flag is on), and no data is
returned.
if nothing is received then CANgate will time out after approximately 400ms and abort the request.
The request will be sent using CAN ID (0x7E0 + ECUaddr). If ECUaddr = 256, this indicates a "functionally addressed
request", which will instead be broadcast using CAN ID 0x7DF.
The message data consists of a single mode byte (or service identifier), followed by a variable number of parameters.
Modes 0x01-0x0F are standardised ("legislated") OBD-II modes (defined in SAE-J1979 or ISO-15031), while modes
0x10-0x3F are manufacturer extended modes (specified in ISO-14230, although details of data and parameters are
manufacturer specific).
CANgate will then listen for a response with CAN ID 0x7E8-0x7EF (ECU #0 will reply using ID 0x7E8, ECU #1 with ID 0x7E9,
and so on). The response message's mode byte will be either:
a copy of the request mode byte with bit 6 set – this is a positive response and the mode byte will generally be
followed by one or more data values, or
the value 0x7F – this is a negative response and indicates that an invalid request was made.
All messages are transmitted using the ISO-15765 network layer protocol. This protocol fragments long messages into
multiple CAN frames and then reassembles them.
CANgate recognises a few of the common ISO-14230 mode byte values and sets the default startByte value appropriately,
so that header information in the response is skipped. In particular:
Mode default startByte Comment
0x01, 0x02, 0x33 3 skip first 2 bytes (mode, PID) in response
0x22 4 skip first 3 bytes (mode, ID-hi, ID-lo) in response
other 2 skip first byte (mode) in response
All received data, from startByte through to the end of the message (or endByte if specified), will be returned to the host.
Note: The response time for ISO-14230/OBD-II commands depends upon the particular ECU and can vary greatly. CANgate
will only send out one request at a time; if it is asked to make many requests simultaneously then the requests will be placed
in a queue and executed sequentially. If no reply is received within 400ms then CANgate will assume the ECU is dead and
make the next request.
Note: Some ECUs do not use the standard CAN identifier range (0x7E0 – 0x7E7). In this case an arbitrary CAN ID (0x000 –
0x7F7) can be specified explicitly as the ECUaddr. This should be specified in hexadecimal. CANgate will then send the
request using the specified CAN ID, and expect a response with CAN ID ECUaddr + 8. The following two commands are
therefore equivalent:
RQST 1 010C 3 0 1
RQST 1 010C 3 0 0x7E1
In both cases the request will be sent with CAN ID 0x7E1 and the response will be expected to have CAN ID 0x7E9.
Examples
RQST 1 010D FORMAT "%d\n"
When polled, send a message on CAN port 1 requesting the current value (mode = 0x01) of Parameter ID (PID) 0x0D, which
is vehicle speed (see OBD-II Modes and PIDs (P40)). The speed will be returned as a single decimal integer (0-255 km/h)
followed by CRLF.
RQST 1 1800FF00 2 2 0; RP
This will immediately send a message on CAN port 1 to ECU #0 to ReadDTCByStatus (mode = 0x18), returning all currently
active fault codes (parameter byte 1 = 0x00) for all fault code groups (parameter byte 2-3 = 0xFF00). The ECU will return a
mode byte, fault code count, and a variable length string of 3-byte SAE-J2012 format fault codes. The slot selects just fault
code count (byte 2) and returns it in the default format (hexadecimal).

UM-0086-A2 CANgate User’s Manual Page 19
RECVJ – Receive J1939 Messages
{ slot } RECVJ CANport PGN { startByte{.bit} endByte{.bit} ECUaddr priority sampleRate } { FORMAT fmtOpt }
where:
slot is the memory slot being defined (integer, 0-150). If not specified then 0is assumed. If CANgate is in Run Mode
then zero is the only value that can go here.
CANport is the CAN port to use (integer, 1-2)
PGN is the J1939 Parameter Group Number (integer, 0-131071)
startByte{.bit} is the starting bit position of the field of interest within the received message. Bytes are numbered from
1, bits are numbered from 8 (MSB) down to 1 (LSB). If startByte is 0or not specified then 1is assumed. If .bit is not
specified then .8 is assumed.
endByte{.bit} is the ending bit position (inclusive) of the field of interest. If endByte is 0or not specified then this will be
the last received byte in the message. If .bit is not specified then .1 is assumed.
ECUaddr is the address of the ECU (source address) from which to receive messages (integer, 0-255, or 256). If
256 is specified (which is the default), messages are received from any source address.
priority (integer, 0-7, default:6) specifies the expected value of the priority field (bits 28-26 in the CAN ID)
sampleRate is the rate at which to return values to the host (integer, in ms, must be multiple of 100ms). May also be
ALL, in which case a value is returned on receipt of every matching CAN message. If this parameter is 0or not
specified, the memory slot will only return data when it is polled by the host system (using the RP command).
fmtOpt specifies how the data value is to be formatted when it is returned to the host system; see FORMAT
Sub-command (P21) for more details. if not specified, data will be returned in raw hexadecimal format.
A RECVJ memory slot operates in a similar way to a RECVE slot. That is, it listens for CAN messages with a particular
extended identifier, extracts the required data field then returns it to the host when polled (or at regular intervals, or after
every message is received). The difference is in the way the identifier is specified.
The SAE-J1939 protocol assigns meaning to various parts of the 29-bit CAN identifier, as follows:
CAN ID bit J1939 interpretation
28-26 Priority
25 Reserved
24 Data Page, which is effectively bit 16 of the PGN
23-16 Parameter Group Number (PGN) MSB (bit 15-8) – if < 240 then this identifier has PDU1 (directed
message) format, otherwise it has PDU2 (broadcast message) format
15-8 if PDU1 format: destination address (implied PGN LSB = 0)
if PDU2 format: PGN LSB, or "group extension" (implied destination address = 0)
7-0 source address
CANgate will receive messages where:
the Priority field matches priority, and
the 17-bit PGN/Datapage fields match PGN (for PDU1 format, any destination address will be accepted), and
the source address field matches ECUaddr (if ECUaddr = 256, any source address will be accepted).
PGN numbers, and the layout of the data fields therein, are defined in the SAE J1939/71 (Vehicle Application Layer)
standard.
The SNOOPJ command (P24) can be used to determine which J1939 PGNs are being broadcast on a CAN network. See also
J1939 PGNs & SPNs (P28).
The J1939 protocol also supports multi-packet broadcast messages. These messages use a fixed PGN value in the CAN
identifier (PGN 59904, 60160 or 60416); the actual PGN is embedded in the CAN data field. CANgate will receive
multi-packet broadcasts where the embedded PGN value matches PGN.
Note that there are some special considerations to be aware of regarding multi-packet transfers; see Multi-Packet J1939
Messages (P30).
Examples
RECVJ 2 61444 1 8 256 3
Receive messages on CAN port 2 (from any ECU) which relate to PGN 61444 – which contains various engine controller
parameters – and return the entire message to the host when polled. Only messages with priority 3 will be received.

UM-0086-A2 CANgate User’s Manual Page 20
RQSTJ – Request J1939 Data
{ slot } RQSTJ CANport PGN { startByte{.bit} endByte{.bit} ECUaddr priority sampleRate } { FORMAT fmtOpt }
The parameters for a RQSTJ slot are the same as for a RECVJ slot (except that ALL is not a valid setting for sampleRate),
but they are used in a somewhat different way.
When a RQSTJ slot is polled, CANgate will send a message to request a particular parameter group (PGN). The format of
this request message is defined in SAE J1939/21 (Data Link Layer). The request will be sent to destination address
ECUaddr, or to the broadcast address if ECUaddr = 256. The source address will be set to CANgate's configured address
(see SETADDR – Set CANgate Address (P25)).
CANgate will then listen for a response with an appropriate CAN identifier, the same as a RECVJ slot.
Some PGNs have more than 8 bytes of data (which is the limit of a single CAN frame) associated with them. In this case the
ECU will respond with a multi-packet transfer. This may take the form of a multi-packet broadcast, or it may be a
point-to-point transfer using the J1939 transport protocol. CANgate will accept either type of response.
Note that there are some special considerations to be aware of regarding multi-packet transfers; see Multi-Packet J1939
Messages (P30).
See also Request PGNs (P29).
Note: As is the case with ISO-14230 (RQST slots), the response time will depend upon the particular ECU. J1939 requests
are queued in the same way as ISO-14230 requests – CANgate will only send out one request at a time, and will time out
after approximately 400ms if there is no response.
Examples
RQSTJ 2 65254 1 1 0 6 1000 FORMAT .25
Once per second (1000ms), send a request on CAN port 2 for PGN 65254 (time/date) to the ECU with address 0, and expect
a reply with priority 6. The first byte of the response (seconds x 4) is extracted and returned.
GPS – Receive NMEA-0813 Messages
{ slot } GPS "header" fieldNum { option sampleRate } { FORMAT formatOptions }
where:
slot is the memory slot being defined (integer, 0-150). If not specified then 0is assumed. If CANgate is in Run Mode
then zero is the only value that can go here.
header is the NMEA-0183 sentence header string, without the leading $character (string, eg."GPGLL")
fieldNum specifies the data field of interest in the NMEA-0183 string (integer, 1-19). The field immediately following
the sentence header is field #1.
option (single character: Dor Mor N, default:N). If N(normal) is specified then the indicated field is returned as is.
Otherwise, the indicated field and the next field are interpreted as a latitude or longitude value with format
DDDMM.mmmmm,h– DDD = degrees, MM.mmmmm = minutes, h= hemisphere (N, S, Eor W). If option = Dthen
the degrees component is returned, ie. DDD, which will be prefixed by a minus sign if h= Sor W. Similarly, if option =
Mthen the minutes component is returned, ie. MM.mmmmm, which will also be prefixed by a minus sign if h= Sor W.
sampleRate is the rate at which to return values to the host (integer, in ms, must be multiple of 100ms). May also be
ALL, in which case a value is returned on receipt of every matching GPS message. If this parameter is 0or not
specified, the memory slot will only return data when it is polled by the host system (using the RP command).
formatOptions specify how the data value is to be formatted when it is returned to the host system; see FORMAT
Sub-command (P21) for more details. Note that GPS data is always treated as a string; scaling options will be ignored.
The FORMAT clause is therefore only useful for adding before and after text.
If a GPS receiver is connected to CANgate then positional data (latitude, longitude, elevation, etc.) can be returned along
with measured CAN parameters.
A GPS receiver will transmit position messages via its RS232 interface, typically about once per second. These messages
are formatted according to the NMEA-0183 protocol. NMEA-0183 defines many different sentences, each of which consists
of an identification string followed by a number of comma separated data values. For example, the sentence:
$GPGLL,3749.1965,S,14458.9940,E,073510.22,A
provides a basic positional fix, containing the current latitude (37° 49.1965' S, 144° 58.9940' E), and the time the fix was
taken (07:35:10.22 UTC). Other sentence types (eg. $GPGGA) provide more detailed information, including elevation,
accuracy, number of satellites in view, etc.
A CANgate GPS memory slot is used to parse incoming NMEA-0183 data and then return specific fields to the host. This will
capture all messages with the specified ID string, and extract the required data field. When polled (using the RP command),
or at the intervals specified by the sampleRate parameter, the slot will return the most recent value for the data field. If no
messages have been received, or if the specified field does not exist in the received messages, then nothing will be returned
(other than the configured static formatting text, which is specified by the FORMAT sub-command and by default is just
CRLF).
Table of contents
Other dataTaker Data Logger manuals