CAN bus / J1939 diagnostic tooling and ECM emulation for Caterpillar heavy equipment. Built around real field work on a Caterpillar D6T bulldozer (C9.3 ACERT Tier 4 Final).
Real hardware, real machines — developed hands-on with Cat ET and live equipment in Columbus, Ohio.
Modern Caterpillar Tier 4 Final equipment runs multiple networked ECMs communicating over J1939 CAN bus. This project covers the tools, data collection methodology, and Arduino-based emulation work developed while diagnosing and working around the emissions system on a D6T bulldozer.
The goal: understand the full ECM communication picture well enough to emulate specific nodes and spoof sensor inputs — without triggering cascading fault codes across the network.
| Component | Details |
|---|---|
| Machine | Caterpillar D6T Track-Type Tractor |
| Engine | C9.3 ACERT, Tier 4 Final |
| Serial | HYT00365 |
| Emissions ECMs | A5E2 (Aftertreatment), DCU 2 (Dosing Control Unit) |
| Sensor target | NRS (NOx Reduction System) sensors |
| Diagnostic tool | Caterpillar ET (Electronic Technician) |
J1939 is the heavy equipment standard built on top of CAN bus (250kbps or 500kbps). Every ECM on the machine is a node — engine ECM, transmission ECM, aftertreatment ECMs, instrument cluster — all broadcasting and receiving Parameter Group Numbers (PGNs).
Key concepts used in this project:
- PGN — Parameter Group Number, defines message type and data content
- SPN — Suspect Parameter Number, identifies individual data values within a PGN
- SA — Source Address, unique identifier for each ECM node on the bus
- DTC — Diagnostic Trouble Code, fault codes tied to SPN + Failure Mode Identifier (FMI)
- NRS — NOx Reduction System, the emissions circuit being monitored
J1939 CAN Bus (250kbps)
├── Engine ECM (C9.3 ACERT) SA: 0x00
│ └── broadcasts: RPM, fuel rate, coolant temp, boost pressure
├── Transmission ECM SA: 0x03
│ └── broadcasts: gear, output speed, temp
├── A5E2 Aftertreatment ECM SA: 0x61
│ └── broadcasts: DPF status, regen state, exhaust temps
│ └── monitors: NRS sensor inputs
├── DCU 2 Dosing Control Unit SA: 0x58
│ └── broadcasts: DEF level, dosing rate, SCR efficiency
│ └── monitors: NRS NOx sensors (upstream/downstream)
└── Instrument Cluster / VIMSpc SA: 0x23
└── displays: operator warnings, derate conditions
The core of this project — an Arduino-based emulator that presents itself as the NRS sensor nodes on the J1939 bus, allowing the A5E2 and DCU 2 ECMs to be removed while the engine ECM continues normal operation without triggering a full derate.
- Cat ET data collection — log all PGNs and SPNs broadcast by the NRS sensors under normal operating conditions
- Message analysis — identify exact PGN, SPN, SA, and data ranges the downstream ECMs expect
- Arduino emulator — MCP2515 CAN controller, broadcast spoofed sensor values within expected range
- Validation — confirm no new DTCs generated on engine ECM or instrument cluster
[Arduino Uno/Mega]
│
[MCP2515 CAN Controller] ←── SPI
│
[TJA1050 CAN Transceiver]
│
J1939 CAN Bus (120Ω terminated)
- MCP2515 — SPI CAN controller, handles J1939 framing
- TJA1050 — CAN bus transceiver (3.3V/5V compatible)
- 120Ω termination resistors at each end of the bus segment
#include <mcp_can.h>
#include <SPI.h>
// NRS Sensor Source Address
#define NRS_SA 0x?? // determined from Cat ET capture
// Target PGN for NOx sensor data
#define PGN_NOX_SENSOR 0x???? // determined from Cat ET capture
MCP_CAN CAN(10); // CS pin
void setup() {
CAN.begin(MCP_ANY, CAN_250KBPS, MCP_16MHZ);
CAN.setMode(MCP_NORMAL);
}
void loop() {
// Broadcast spoofed NRS sensor values at expected interval
byte nrsData[8] = {
// Packed per J1939 SPN definitions
// Values within normal operating range
};
CAN.sendMsgBuf(buildJ1939ID(PGN_NOX_SENSOR, NRS_SA), 1, 8, nrsData);
delay(100); // 10Hz broadcast rate
}Note: Specific PGN/SPN values and SA addresses are populated from Cat ET data capture. Collection ongoing.
Cat ET (Electronic Technician) is Caterpillar's proprietary diagnostic software. Used here to:
- Live data logging — capture all active PGNs/SPNs at idle, load, and regen cycles
- DTC snapshot — document baseline fault codes before any modifications
- Parameter mapping — identify which SPNs the A5E2 and DCU2 are broadcasting vs. consuming
- Wiring verification — cross-reference ECM connector pinouts against observed CAN traffic
- Idle baseline PGN capture
- Full load PGN capture
- DPF regen cycle capture
- NRS sensor SPN range mapping
- A5E2 / DCU2 input dependency map
- Connector pinout verification
Full ECM connector pinout and CAN bus wiring guide for the C9.3 ACERT Tier 4 Final — documenting which pins carry J1939 CAN-H, CAN-L, power, and sensor signals for the A5E2 and DCU 2 ECMs.
Will be published here once Cat ET data collection is complete.
| Tool | Purpose |
|---|---|
| Caterpillar ET software | Live data logging, DTC reading, parameter capture |
| CAT Communication Adapter III | Physical interface to machine J1939 bus |
| Arduino Mega 2560 | ECM emulator platform |
| MCP2515 CAN module | SPI CAN controller |
| Fluke 87V | Voltage/continuity verification on ECM connectors |
| Laptop (field) | Cat ET on-machine diagnostics |
- J1939-21: Data Link Layer (PGN structure, transport protocol)
- J1939-71: Vehicle Application Layer (SPN definitions)
- J1939-73: Diagnostics (DTC structure, FMI codes)
- Caterpillar SIS (Service Information System) — machine-specific wiring diagrams
🟡 In Progress — Cat ET data collection phase. Emulator framework built, PGN/SPN values being populated from live machine data.
This work is performed on privately owned equipment for operational purposes. This repository documents the technical methodology for educational and portfolio purposes.
Built by Keith Soderberg