#nmea2000

[bitstream24]

Teensy 4.0 With NMEA 2000 Connector And 240 x 240 IPS LCD for Marine Applications

This board carries an Arduino-compatible Teensy 4.0 microprocessor system, a 240x240 pixels IPS LCD, and a Micro C NMEA 2000 connector. The board receives power through the 12 VDC NEMA 2000 connector that feeds an onboard 5 VDC regulator. There is also a 4-way 1mm (Qwiic) IC2 connector for external sensors. The example sketch reads data from an NMEA 2000 wind sensor and a temperature sensor and displays the reading on the LCD.

[iseedeadpackets]

Rebuilding CAN bus traffic from NMEA2000 logs

Summary

In this post I will cover how I identified and extracted CAN bus traffic from a NMEA2000 data log of a mixed technology network. This is an important step for untangling and reverse engineering CAN bus data, which I’ll go over in future posts.

The Challenge

HackTheMachine is a maritime cyber contest hosted by the United States Navy to raise awareness in the computer security industry about challenges and threats facing maritime networks. During the 2020 and 2021 HackTheMachine competitions, teams were given the output from a NMEA2000 logger of a network that included both NMEA2000 and CAN bus devices, and had to determine various aspects of the CAN bus devices.

Though NMEA2000 is compatible with CAN bus, these protocols have different addressing schemes and their frames need to be interpreted differently.

Separating Traffic

To rebuild CAN bus traffic from the NMEA2000 log we will need to understand the details of CAN bus and NMEA2000 frames and how they relate to each other in order to identify anomalous traffic and reconstruct them into CAN bus frames.

CAN Bus Frame Reconstruction

NMEA2000 is not directly related to CAN bus but instead is based on the SAE J1939 protocol used in commercial vehicles such as trucking and construction. The SAE J1939 protocol is based on the CAN bus protocol used in consumer vehicles most people drive. As they share the same physical standards, all three protocols can operate on the same network. What makes them different is the addressing mechanism of their MAC (media access control) layer. As the addressing mechanism is located in the first 32 bits of the CAN bus frame, we can focus on that and ignore the rest of the frame for this post.

CAN bus Identifiers

CAN bus has a single address field called an identifier. This field both identifies the sender, message format, and the message priority with the lower ID having higher priority. The CAN bus ID field can be either 11 bits (CAN bus 2.0a) or 29 bits (CAN bus 2.0b). SAE J1939 and NMEA2000 only use the CAN bus 2.0b frames. While CAN bus 2.0a frames can operate on a network with CAN bus 2.0b frames, it is unlikely that the NMEA2000 data logger would record any CAN bus 2.0a frames.

SAE J1939 PGN and Addresses

SAE J1939 splits up the CAN bus 2.0b’s 29 bit identifier field into the Message Priority, Parameter Group Number (PGN), Destination Address, and Source Address fields. The PGN number provides context on how to interpret the data field (typically 8 bytes) similar in how ICMP Data is based on the ICMP Type and Code. The PGN is formed by the Data Page, Extended Data Page, PDU Format, and PDU Specific fields.

While some messages need to be sent to a specific device, most do not require a destination address. A PDU Format value less than 240 (0xF0) indicates the message is intended for a specific device. When this occurs the PDU Specific field will contain the ID of that device, and the PGN is calculated with a PDU Specific value of 0 (0x00). PDU format values of 240 (0xF0) or more indicate a broadcast message, and the PGN is calculated with the PDU Specific value of the PDU Specific Field.

Note, a message can be sent to a specific identifier of 255 (0xFF) which is effectively a broadcast message, but the PGN would still be calculated with a PDU Specific value of 0 (0x00).

NMEA2000 PGN and Addresses

NMEA2000 inherits the PGN and address features of SAE J1939 except for the Data Page and Extended Data Page fields. Instead it enlarges the PGN field by extending into the Data Page field, and marks the Extended Data Page field as a reserved field. Besides this slight change in PGN format, what makes NMEA2000 different is mainly due to redefining the PGN values.

We can reconstitute the CAN bus identifier using the NMEA2000 Priority, PGN, Source Address, and optional Destination Address. However, as bit 4 is reserved in the NMEA2000 frame, the log doesn’t provide us its value and so our CAN bus ID will always be incomplete. In general this isn’t a great loss of information, but it is something to keep in mind.

For those interested, NMEA2000 device address assignment works similar to Automatic Private Internet Protocol Addressing (otherwise known as that annoying 169.154.0.0/16 address when your computer can’t reach the DHCP server). The NMEA2000 device selects an address value and asks the network if that address is already in use. If an address is already using that address, it’ll report “address claimed”. If the device doesn’t receive an “address claimed” message within a window of time, it will begin operating with that address. This form of self address procurement was also inherited from the SAE J1939 specification.

CAN bus Traffic Identification

Depending on how much log data is collected, you can also determine CAN Bus devices based on traffic analysis. PGN values such as 59392, 59904, 60928, and 126208 are often seen in messages between NMEA2000 devices as they pertain to network address and control function (as explained above). If a device doesn’t participate in this traffic, then it (and its associated PGN value) is likely a misinterpreted CAN bus identifier.

Additionally by determining what NMEA2000 devices exist on the network, through a visual recon, and checking for the PGN values they transmit can help you determine which PGN values you shouldn’t see and are likely misinterpreted CAN bus identifiers. For interoperability, the PGN values any NMEA2000 device transmits or accepts are well documented and can be found either in the product brochure, technical specifications, or user manual. This is true even for proprietary PGNs, the data format will of course be an industry secret, but the PGN will be documented.

Results

Examining the PGNs in the NMEA2000 log, I was able to identify three values (61184,65280,65281) via network analysis and confirmed by researching known device transmit PGN values. It appeared that there were seven devices based on the NMEA2000 source addresses. However, 14 CAN bus identifiers were revealed when these addresses and PGN values (along with the priority and destination fields) were converted.

Conclusion

Once the CAN bus frames are separated and reconstructed we are able to correctly organize the CAN bus data by the CAN bus identifier. This will help us while reverse engineering the data formats, which I will go over in a future post.

Source logs and code associated to this post can be found at https://github.com/VirusFriendly/HackTheMachine-Notes

Special thanks to Fathom5, Booz Allen Hamilton, and the United States Navy for providing the opportunity to gain hands-on experience with maritime networks, and to Ploppowaffles for review and feedback on this post.

[patern29]

Oceanis 381 Clipper

Oceanis 381 Clipper, Année 2000 Bel Oceanis 381 Clipper, bien entretenu, équipé pour la grande croisière (transat en novembre 2022), nouvelle électronique NMEA2000, nouvelle installation solaire, nouveau gréement dormant, ... Pont en teck, barre à roue pliable et Propulseur d'étrave. Disponible en Martinique ou Guadeloupe en avril 2023 3 cabines doubles 2 salles de bain Carré transformable Électronique NMEA2000 (2022) Pilote automatique B&G Nac-3 (2022) Vérin du pilote révisé en usine (2022) Triducer - sondeur + speedo (2022) Girouette-anémomètre B&G (2022) Antenne VHF neuve (2022) AIS réception-émission + splitter (2022) VHF Navicom RT750 (2021) Traceur Garmin GPSmap 7407xsv VHF portable Orange Marine (2022) 3 panneaux solaires Victron de 105W => 315W (2022) Régulateur MPPT Victron (2022) 2 batteries de servitude GEL Victron de 165Ah => 330Ah (2022) Chargeur de quai Mastervolt 35A Onduleur 600W - 12V => 220V (2022) Contrôleur de batteries Victron (2021) Prises USB (2022) Éclairage LED Combi feu de hune / feu de pont LED (2022) Nombreuses prises 220V Système radio Hi-fi avec enceintes dans la carré, la cabine avant et le cockpit Chauffe-eau - eau chauffée par le moteur ou via la prise de quai Propulseur d'étrave Barre à roue pliable Guindeau électrique Ancre Delta 16kg + 60m de chaîne diamètre 10 2 ancres Britany de 16kg Radeau de survie 6 personnes Read the full article

[teamnutz]

NMEA advanced certification completed. #nmea #nmea2000 #abyc #boatlife #marineelectronics #boatelectronics #pittsburgh #diycustoms (at Team Nutz) https://www.instagram.com/p/CMOAD7EheQS/?igshid=j4hisxqstyw4

[jgtec]

We have plenty of stock of this amazing device shipping now #nmea #nmea2000 #actisense #navico #raymarine #garminmarine #marineelectronics https://www.instagram.com/p/Bx4Iy_gAcEu/?igshid=1qefe6s19swn9

[nauticanews]

Convertidor de NMEA2000 a NMEA0183

Convertidor de NMEA2000 a NMEA0183

iKonvert, convertidor de NMEA2000 a NMEA0183 iKonvert es un convertidor bidireccional de NMEA2000 a NMEA0183 diseñado para facilitar la conexión de dispositivos nuevos y antiguos en el sistema electrónico de su embarcación.

  Está disponible en dos versiones: una versión ISO (con cables NMEA0183) y una versión USB para permitir la transmisión de datos NMEA2000 en PC, Mac o incluso en el software…

[boostpowermarine]

Programming a nmea2000 dash @boostpowermarine #nmea #nmea2000 #nmea2000backbone #programming #technology #canbus #boostpower #boostpowermarine #alexiz

[bitstream24]

NMEA 2000 Simulator for testing NMEA 2000 devices on the bench

The NMEA 2000 simulator uses the Teensy 4.0 module (included in the scope of delivery). It is useful for testing NMEA 2000 devices on the bench. Six PGNs are adjustable via potentiometers and two per onboard switches. We also provide open-source firmware, which allows adding and modifying NMEA 2000 PGNs.

[iseedeadpackets]

Identifying CAN bus Devices using Traffic Analysis

Summary

In this post I will cover how I use traffic analysis to determine the various functions of an unknown CAN bus protocol. I’ll use this analysis to map CAN bus addresses to physical devices, and ultimately allow me generate predictable effects by spoofing the protocol.

The Challenge

HACKtheMACHINE is a maritime cyber contest hosted by the United States Navy to raise awareness in the computer security industry about challenges and threats facing maritime networks. During the 2020 and 2021 HackTheMachine competitions, teams were given the output from a NMEA2000 logger of a network of devices using a proprietary CAN bus protocol and had to determine various aspects of the CAN bus devices.

Previous posts covered how I extracted CAN bus frames from a NMEA2000 log of a mixed network, and how I broke the CAN bus data field into smaller data types known in SAE J1939 as signals. This post is the payoff those posts were leading up to, where I analyze the protocols to determine their function and correlate them with the physical devices seen below.

The photo above is a frame of the video demonstrating the target system used in this competition. I’ve highlighted the devices of interest. The two green devices are control stations. The red box is a control unit. The yellow box to its right is a shift unit. The blue unit mounted to the wall is a mechanical actuator.

The mechanical actuator’s output is expressed through the propeller spinning, so I do not expect to see it transmitting to the network. In the previous posts, I determined there were 14 CAN bus devices using 9 different protocol formats. Now I need to figure out how they’re related to these three devices.

Traffic Analysis

In a previous post, I broke down the CAN bus data bytes into smaller fields that I’ll be referring to as signals, using SAE J1939 nomenclature. I’ve enumerated each signal, except for signals that are always constant (denoted as ZZ for constant zero, XX for constant 0xFF, and YY for any other constant value). In this post I’ll reference each signal using the CAN bus identifier hyphenated with a signal (ex: 216989712-1, 216989712-2).

The CAN bus device 216989761 only transmitted a constant value, and so I will not be able to determine any meaning from it. However, there is a neighboring device 216989760 that has a similar data format that may help determine the function of both.

I created a script to plot each signal over time to allow me to correlate each signal’s behavior with other signals to determine a relationship. Of course correlation does not imply causation normally, but as we have control stations feeding input into the control unit which then sends commands to the shift unit and actuator, I’m willing to assume causation here.

Time Span

While reviewing multiple signals, I didn’t notice any changes in values except for between the timestamps of 480000 and 560000. Limiting my analysis to this timespan will help me to narrow my analysis and magnify smaller changes in values, as seen below.

Throttle System

The following are three signals from different devices that have a strong correlation.

I believe that the first two (419365168-3, 419365169-3) are separate control stations and their input is accepted by the control unit which determines which control station is active, and sends their input (via 419365152-3) to the manual actuator.

Shift Control

Another signal (419365168-2) from the same control station (419365168), shows us that the second push in throttle was actually in reverse.

But this reversal isn’t reflected in any of the signals from the control unit (419365152), which makes sense as it is just telling the actuator how fast to go (a function of magnitude), while it is the purpose of the shift unit to communicate the direction.

The signal from 216989712-1 matches well with the vector data from the control stations (419365168-2, 419365169-2).

Control Enabling

This throttle system has two control stations that can provide throttle commands, but only one control station can be enabled at a time.

These signals change values during a pause in throttle data. Prior to these signal changes, one control station was sending throttle data, then after the signal changes the other control station began sending throttle data. These behaviors lead me to assume that these signal changes communicated the station selection.

The first two signals come from different device addresses (419364912 and 419364913) and the last two signals come from the same address (216989744). I assume the first two signals are the control stations stating their desire to be enabled, with the last two signals coming from the control unit declaring what the enable status for each station is.

Clock Signals

Notice how both control stations appear to send a clock signal when neither station is enabled. These control stations also transmit a complete clock signal in their data as follows.

Results

Now there are 24 non-constant signals, but I’ve only gone over 10 of them, as the others appear to have redundant functionality. The following is the CAN bus signal breakdown with the associated device.

Conclusion

Over three posts, I’ve shown how I identified the CAN bus traffic, dissected its data into signals, and then analyzed the signals to determine their function. Now I would be able to introduce fake signals into the system to cause the “boat” to run at full speed forward or reverse. Also, due a property of CAN bus communications which makes it easy to zero out data, I force the throttle to idle and leave the “boat” helpless in the water

This research was generated from a single log file with no interaction with the target systems. Given more time and hands-on interactions, I could refine my assumptions about each signal.

Source logs and code associated to this post can be found at https://github.com/VirusFriendly/HackTheMachine-Notes

Special thanks to Fathom5, Booz Allen Hamilton, and the United States Navy for providing the opportunity to gain hands-on experience with maritime networks, and to CaptainHaggis for review and feedback on this post.

[fishfinderbrand]

As you evolve in your fishing abilities, you expect more and more features from your fish finder. But as they run up to thousands of dollars, where do you stop? The Lowrance Elite 7 TI fish finder with TotalScan transducer kit might be your answer. CHIRP, StructureScan with both Side and Down Imaging, touchscreen operation, Navionics capability, Wi-Fi and Bluetooth combine together in a reasonably priced package here. What gives? Let’s find out best fish finder 2018.

The Lowrance Elite 7 TI fish finder is best served by their TotalScan transducer. This single transducer can handle all frequencies from regular Echo to StructureScan. With all these SONAR technologies, you have a near-photographic view of the underwater landscape. This is supported by basic networking features like the NMEA2000 and advanced sharing features like Wi-Fi and Bluetooth which helps if you fish as a team over a large vessel.

The closest competition with similar feature set is the Garmin 7sv but it doesn’t have a touchscreen or Pre-loaded maps and costs almost half of Elite 7 TI .  The HumminBird Helix 7 is as exhaustive in its features as the Elite 7 but it does not have the touchscreen.

The Elite 7 TI fish finder is better suited for professional anglers but it can fit into the budget of expert recreational anglers too.

Source: https://fishfinderbrand.com/lowrance-elite-7-ti-reviews/

[southwestmarineagency-blog]

• User selectable 2, 3 or 4 engines • Sunlight readable 1000 cd/m2 dimmable display using our BlackGlass™ technology • Direct J1939 and NMEA2000® interfaces • Remote panel with brightness up, brightness down and alarm mute buttons. • Supports inboard engine manufacturers including Caterpillar, Cummins, FPT, John Deere, MAN, MTU, Seatek, Volvo and Yanmar • Supports outboard engine manufacturers including Evinrude, Honda, Mercury, Suzuki, and Yamaha. • Switch settable imperial or metric displays units • Displays manufacturer standard engine warnings • Displays 1 to 4 fuel tank levels • Rugged IP66 front display seal • Internal and external alarm sounder @caterpillarinc @cummins @johndeereeurope @mantruckandbus @electronics_mtudiesel_service @sea.tek @volvopenta @yanmarmarine @evinrudebrp @evinrudeoutboards @hondamarineturkiye @honda_marine_croatia @hondamarine @mercurymarine @suzuki_italia_marine @suzukiturkiye @yamahaboating (at Plymouth) https://www.instagram.com/p/BtpEvd9BhNJ/?utm_source=ig_tumblr_share&igshid=1qmw7m7q2mqcs

[boostpowermarine]

View this post on Instagram

A post shared by ALEXIZ MOTORSPORTS INC. (@alexizmotorsportsinc)

NMEA2000 BOOSTPOWER BIG INCH ENGINE AT IDLE out streaming to a GARMIN dash! @boostpowermarine #nmea2000 #canbus #cangatewayupgrade #cangateway #dynoproven

[miamimarina]

Choosing A Service To Install Or Replace Quality Mercury Marine Parts In Miami

The first step in choosing a company that supplies and installs Mercury Marine Parts in Miami is to check their acceptability and reputation in the market. If there are reputable people and firms recommending the products, you can count on them. The user feedback is always helpful in this regard. Depending on the scope and scale of your operations, you can also consult NEMA or the National Marine Electronics Association for information and leads. Operating out of Miami and other leading metros of the country, the US-based, premier marine electronics corporation has published a range of standards pertaining to the correct use and maintenance of marine electronics.

About the services

The premier companies also offer great training courses for aspiring installers of Mercury Marine Parts in Miami. They have a throng of accredited and registered marine electronics installers. You can find the names on the company website. If you’ve just purchased a boat, the showroom may also refer to you proper professionals. You need to ensure that you look at the details. It includes pricing and imminent service signs. Another way is to reach out to the people and friends in the boating community and your circle. They can always refer you to prominent shops that install common and rare equipment.

Running background checks

It’s always prudent to buy marine audio equipment, marine GPS, or any marine electronics with proper reference. In addition to safety, you also have two common reasons to install electronic Mercury Marine Parts in Miami for enhances entertainment or advanced fishing. For anglers, you can install the marine technology as part of the boat’s construction latter phases. You can talk to your boat builder and designer regarding this thing. Experts recommend you check the previous crafts and tools of the installing firm. If they have a store or showroom of the goods, you can check them out.

The brands they offer

You need to search the company’s name and read their reviews online. Do remember that a company with decades of experience and expertise is a definite sign of great management. A company selling and supplying Mercury Marine Parts in Miami for more than 20 years means they have professional and consistent customer service. A happy customer means a reliable and premier company. If you’re living in Miami and need to service your waterway vehicle, you can count on the companies that have more than 25-30 years of experience in the industry. They can work with virtually every size and type of watercraft.

In a nutshell

There are some service providers that provide great options to choose amongst brands. Notwithstanding the analysis paralysis that you might face at the initial stages and delay the installation, it’s a very important process. Choosing between marine parts brands also necessitate considerable background searches or digging, whatever you want to call. If you don’t mind going for the replacement of components and parts every two to three years, you’re free to choose a company without extensive research. Experts recommend you choose a brand that’s compliant and compatible with the current NMEA2000 standards. Visit Here: Powerhouse Marina

[bitstream24]

espBerry - ESP32 Development Board with NMEA 2000 & NMEA 0183 HAT for Marine Applications

The espBerry DevBoard combines the ESP32-DevKitC development board with any Raspberry Pi HAT by connecting to the onboard RPi-compatible 40-pin GPIO header. The PICAN-M (M = Marine) is a Raspberry Pi HAT with NMEA 0183 and NMEA 2000 connection. The NMEA 0183 (RS422) port is accessible via a 5-way screw terminal. The NMEA 2000 port is accessible via a Micro-C connector.

[iseedeadpackets]

Reverse Engineering Unknown CAN bus Protocols

Summary

In this post I will cover how I determine data structures in unknown CAN bus protocols. I’ll then be able to contrast these data structures to identify separate protocols from each other and perform traffic analysis in a future post to determine meaning behind the data structures.

The Challenge

HackTheMachine is a maritime cyber contest hosted by the United States Navy to raise awareness in the computer security industry about challenges and threats facing maritime networks. During the 2020 and 2021 HackTheMachine competitions, teams were given the output from a NMEA2000 logger of a network of devices using a proprietary CAN bus protocol and had to determine various aspects of the CAN bus devices.

In a previous post, I demonstrated how I extracted CAN bus traffic from a NMEA2000 log of a mixed network. The next step is to analyze the CAN bus data field to determine the structure of the proprietary protocol or protocols. This will allow me to perform traffic analysis on the protocols to determine how they relate to each other.

Byte Entropy Analysis

CAN bus frames can have up to 8 bytes of data, and this proprietary protocol always uses all 8 bytes. I created a script to correlate traffic by CAN bus ID, and count the variety of values in each byte of data for us to analyze. Each byte should have a minimum of 1 value seen, and a maximum of 256. I have the script output these values in padded hex for easy viewing.

Using the following value counts as an example: 91 08 02 01 9b 08 75 71

Given enough samples, we can use Benford’s Law (the first digit law) to determine the size of a data field. Leading digits have less variety or entropy than the trailing digits in a value, with leading zeros having no entropy.

The first digit had 145 (0x91) different values and the values to the right of it have decreasing entropy until we reach the 4th byte which only had one value. This strongly indicates that the value is little endian, and 32bit. Using this technique we can see that the next field is likely a 16 bit value.

The last two bytes are more troubling, as there’s less than a 5% difference between them. These could be two 8 bit values, one 16 bit value, or a variety of other data formats. The technique I’m using here works well for identifying byte aligned integers but not bit fields, floating point values, or non-byte aligned values. It’s alright to assume byte aligned values for now, as I will analyze these values in a future post.

As the last two bytes each have a count greater than 16 (0x10), I continue to assume that they are an integer value, and assume that they are a 16bit value. If the counts for these bytes were less than 16, then I would suspect that they are bit flags. Additionally, I could have used Benford’s Law on a bit level to determine if these values had a sign bit that was always off, this would improve detecting smaller field sizes.

Similarities with SAE J1939

Proprietary protocols are a black box, which is often assumed that the vendor created their own protocol, but nothing prevents the vendor from taking inspiration from open standards. I know I’m making a big assumption here, but this protocol seems very similar to SAE J1939.

SAE J1939 data have multiple fields called signals. These signals are also little-endian, except for ascii data. Both of these protocol features match the proprietary one. However, I don’t think the protocol is entirely SAE J1939, as we don’t see the typical address reservation messages from our analysis of SAE J1939 in the previous post.

Analyzing Constants

In the example, the 4th byte only has one value which could be zero, but it could be a single byte non-zero constant. Additionally, SAE J1939 uses special values to indicate meaning. A signal containing all 0xFF bytes means that the device doesn’t support that signal. While a signal containing all 0xFE bytes indicates an error.

I need a way to indicate to slip into my byte counts that it’s a constant and the type of constant without making a mess of the output. To avoid any confusion I can’t use any symbol that could be a hexadecimal digit, so I’m left with G-Z.

ZZ indicating Zero byte

XX indicating Unsupported Signal

XE indicating Error

YY indicates any other constant values.

I can also use this method to indicate a byte that has had all 256 values without messing with the output format.

GG indicating 256 values

Results

The following is an output of my script, along with my manual demarcation of signals. Notice that five pairs of CAN bus IDs have the same signal arrangement (or SPN in SAE J1939 jargon). This is expected as the CAN bus devices in question have redundant controls.

Conclusion

Had I made the assumption that these CAN bus devices were using a single unified protocol, it would have been impossible to conclude any meaning from the data. By examining the data per device, I was able to make some educated guesses on each device’s signal formats. However, I still don’t know the meaning behind these signals, or what each device is yet, but knowing these signal formats will allow me to perform traffic analysis in a future post.

Source logs and code associated to this post can be found at https://github.com/VirusFriendly/HackTheMachine-Notes

Special thanks to Fathom5, Booz Allen Hamilton, and the United States Navy for providing the opportunity to gain hands-on experience with maritime networks, and to Ploppowaffles and Calc for review and feedback on this post.

Additionally, I would like to thank Calc who gave me my first view of a car’s CAN bus traffic as viewed through an entropy analysis tool he developed. While this work is not directly derived from his, I would often think back to that demonstration while working on this competition.

[angelinatoms]

Price: 399.99

Airmar DT820BV-235-N2 235 kHz Low Profile Tilted Element™ Smart™ Sensor 20° Tilt Bronze NMEA 2000 Airmar has taken its proven Tilted Element™ and broadband technologies and applied them to its leading line of Smart™ Sensors. The DT800 is a low-profile, retractable, thru-hull sensor that computes accurate depth and temperature data and sends it to any NMEA 0183 or NMEA 2000® display. The DT800 operates at a frequency of 235 kHz and can run simultaneously with other Airmar 50/200 kHz transducers on-board with no interference. The broadband ceramic delivers depth readings to 183M (600'), as well as accurate shallow-water readings in as little as 500 mm (1.6'). Airmar's Smart™ Sensors have embedded microelectronics – the transducer element and signal processor are only millimeters apart. The signal from the depth transducer is processed right inside the sensor itself. All that is needed to receive depth and temperature data is a single cable into a compatible device or display. Because the ceramic is tilted inside the housing, the transducer beam is oriented straight down, resulting in strong bottom echo returns and accurate depth readings. The retractable housing with a self-closing valve reduces water flow into the vessel when the transducer is removed for cleaning. Smart™ Sensor Features Enhanced depth performance Maximum Depth Range: 180M (594') Minimum range 0.5M (1.6') Urethane face provides better sensitivity Excellent high-speed performance Fixed 20° tilt for 16° to 24° deadrise Fixed 12° tilt for 8° to 15° deadrise Fixed 0° tilt for 0° to 8° deadrise NMEA 2000 output 100 W RMS power Frequency: 235 kHz Cone: 12° All models have depth and temperature 235 kHz eliminates interference with fishfinders Retractable insert provides ease of serviceability Usable Shaft Length: 57mm (2.25") .6M(19.8') NMEA 2000® devicenet cable and connector 51mm (2") housing Blanking plug included Accommodates maximum hull thicknesses 54mm (2-1/8") Accommodates minimum hull thicknesses 6.3mm (0.25") Product : AIRMAR DT800 20 DEGREE TILTED NMEA2000 DEPTH AND TEMP SMART Manufacturer : Airmar Manufacturer Part No : DT820BV-235-N2 UPC : 44200401 Product : AIRMAR DT800 20 DEGREE TILTED NMEA2000 DEPTH AND TEMP SMART

* CLICK HERE FOR MORE INFO

#boating #boatingtips #boatingsupplies #boatingnews #boatingshop #wolfcreek