Komunikace VAG-CAN přes ELM327

[ccr64k]

Příklad načtení VIN kódu z řídící jednotky motoru. Vysvětlení postupu (pro komunikaci bude nutno napsat

program, VW TP 2.0 vyžaduje udržování komunikace a ruční zadávání příkazů přes terminál je moc pomalé.

Vysvětlivky:
> zadává program řádek ukončen ENTER kód 0x0D
< odpověď ELM327 ENTER uváděn jako d, texty uváděny v uvozovkách
; poznámka v angličtině

1) setup communication protocol on ELM327
> atz ;reset all
< d,d,"ELM327 v1.5",d,d,">"
> atd ;set all to defaults
< "atd",d,d,"OK",d,d,">"
> ate0 ;echo off
< "ate0",d,"OK",d,d,">"
> atat0 ;adaptive timing control disabled
< "OK",d,d,">"
> ats0 ;printing of spaces off
< "OK",d,d,">"
> ath1 ;headers on
< "OK",d,d,">"
> atcaf0 ;CAN auto formatting off
< "OK",d,d,">"
> atcpbC001 ;set protocol B parameters
;0xC0 = 11000000
; 7 bit = transmit ID length 0 = 29 bit ID, 1 = 11 bit ID
; 6 bit = data length 0 = fixed 8 byte, 1 = variable DLC
; 5 bit = receive ID length 0 = as set by 7 bit , 1 = both 11
and 29 bit
; 4 bit = baud rate multiplier 0 = x1, 1 = x8/7
; 3 bit = reserved for future use always 0
; 2, 1, 0 bit -data formatting options 000 = none
;0x01 = baud rate divisor
; baud rate (in kbps) = 500 : baud rate divisor
; here baud rate (in kbps) = 500 : 1 = 500
< "OK",d,d,">"
> atspb ;set protocol to B = USER 1 CAN (here 11 bit ID, 500 kbps)
< "OK",d,d,">"
> atd0 ;display of DLC off (DLC = umber of data bytes)
< "OK",d,d,">"
> atbi ;bypass the initialization sequence
< "OK",d,d,">"

2) Using VW TP 2.0 to initiate channel setup with ECU module #1, request it use CAN ID 0x300
> atst10 ;set time out to 16x4 = 64msec
< "OK",d,d,">"
;VW TP 2.0: The channel setup request message should be sent from CAN ID 0x200 and the response will sent

with CAN ID 0x200 + the destination modules logical address e.g. for the engine control unit (0x01) the

response would be 0x201
> atsh200 ;set header to 0x200, CAN message sent will begin with 200
< "OK",d,d,">"
> atcra201 ;set the CAN Rx addr to 0x201
< "OK",d,d,">"
> 01C000100003011
; 01 = ECU module #1
; C0 = setup request
; 0010 = 1000 tells destination module which CAN ID to listen to
; 0003 = 0300 tells destination module which CAN ID to transmit from
; 01 = application type
;1 = ???
< "20100D00003400701",d,d,">"
; 201 = CAN ID = 200 + ECU module #1
; 00 = logical address of destination module = originator of communication
; D0 = positive response
; 0003 = 0300 tells destination module which CAN ID to listen to
; 4007 = 0740 tells destination module which CAN ID to transmit from
; 01 = application type

3) Using VW TP 2.0 to setup channel parameters
> atsh740 ;set header to 0x740
< "OK",d,d,">"
> atcra300 ;set the CAN Rx addr to 0x300
< "OK",d,d,">"
> A00194FF82FF2
; A0 = parameters request
; 01 = block size = number of packets to send before expecting an ACK response
; 94 = T1 (timing parameter 1), time to wait for ACK. T1 should be greater than 4*T3
; 0x94 = 10010100
; 7, 6 bit = units 0x0 = 0.1ms, 0x1 = 1ms, 0x2 = 10ms, 0x3 = 100 ms
; 5 - 0 bit = scale
; here units = 10 ms, scale = 0x14 = 20, i.e. 200 ms
; FF = T2 (timing parameter 2), always 0xFF
; 82 = T3 (timing parameter 3), interval between two packets
; 7, 6 bit = units 0x0 = 0.1ms, 0x1 = 1ms, 0x2 = 10ms, 0x3 = 100 ms
; 5 - 0 bit = scale
; here units = 10 ms, scale = 0x02 = 2, i.e. 20 ms
; FF = T4 (timing parameter 4), always 0xFF
;2 = ???
< "300A10F8AFF4AFF",d,d,">"
; 300 = CAN ID = 300
; A1 = parameters response
; 0F = block size = number of packets to send before expecting an ACK response
; 8A = T1 (timing parameter 1), time to wait for ACK.
; here units = 10 ms, scale = 0x0A = 10, i.e. 100 ms
; FF = T2 (timing parameter 2), always 0xFF
; 4A = T3 (timing parameter 3), interval between two packets
; here units = 1 ms, scale = 0x0A = 10, i.e. 10 ms
; FF = T4 (timing parameter 4), always 0xFF

4) Send VIN request 0x1A with 0x90 as a parameter
> atst80 ;set time out to 128x4 = 512msec
< "OK",d,d,">"
> 1000021A90
; 1 = last packet, waiting for ACK
; 0 = packet number, increments up to 0xF then back to 0x0
; 0002 = the first 2 bytes of the first packet sent contain the length of the message - here 2 bytes
; 1A90 = payload, here KWP2000 REI (ReadEcuIdentification service 0x1A) followed by parameter VIN (0X90)
< "300B1",d,d,">"
; 300 = CAN ID = 300
; B = ACK, ready for next packet
; 1 = sequence number, increments up to 0xF then back to 0x0
< "3000000135A90544D42",d,d,">"
; 300 = CAN ID = 300
; 0 = waiting for ACK, more packets to follow
; 0 = sequence number, increments up to 0xF then back to 0x0
; 0013 = the first 2 bytes of the first packet sent contain the length of the message - here 19 bytes (2

bytes for response + 17 bytes for VIN)
; 5A90 = payload, here: positive response on request 1A90
; 544D42 = start of VIN in ASCII, here "TMB"
> B11
; B = ACK, ready for next packet
; 1 = sequence number, increments up to 0xF then back to 0x0
; 1 = ???
< "30001474536315A3036",d,d,">"
; 300 = CAN ID = 300
; 0 = waiting for ACK, more packets to follow
; 1 = sequence number, increments up to 0xF then back to 0x0
; 474536315A3036 = next bytes of VIN in ASCII, here "GE61Z06"
> B21
; B = ACK, ready for next packet
; 2 = sequence number, increments up to 0xF then back to 0x0
; 1 = ???
< "3001231323334353637",d,d,">"
; 300 = CAN ID = 300
; 1 = waiting for ACK, this is last packet
; 2 = sequence number, increments up to 0xF then back to 0x0
; 31323334353637 = next bytes of VIN in ASCII, here "1234567"
> B30
; B = ACK, ready for next packet
; 3 = sequence number, increments up to 0xF then back to 0x0
; 0 = ???
< d,">"

5) Disconnect from channel
>A81
; A8 = Disconnect, channel is no longer open.
; 1 = ???
< "NO DATA",d,">"

[ccr64k]

Zdroje:
ELM327 AT commands: ELM327DS
VW TP 2.0: neoficiální stránky
KWP2000: ISO 14230-3 švédská implementace

[ccr64k]

Takže pokud někdo napíše program, který přes Bluetooth nebo po kabelu bude na zařízení s ELM327 posílat příkazy KWP2000 s využitím VW TP 2.0 podobně jak je uvedeno v prvním příspěvku, půjde přes zařízení za cca 400 Kč dělat totéž co přes HEX CAN kabel a mnohem víc.

Např. Carista takto umí kromě diagnostiky dlouhé i krátké kódování, ale v KWP2000 jsou např i příkazy na čtení a zápis EEPROM - tj. nastavování tachometru, chip tuning...

[pagotamd]

Zkusim se zeptat na apku na android pro koncern z osobni zkusenosti jestli je proste moznost
Pro nacteni jednotek, chyba obvodu airbagu, live data ze snimacu otacek kol atd. Bezny veci. Nechci kabel, nechci notebook. Modul bluethoot mam vychytany.
Nemam ted koncernove auto ale mit budu a chci byt pripraven.
Npr. Na renolt/dacia/ford s apkou v mobilu dostanu do VSECH jednotek a pohodlne v mobilu a zdarma..je potreba slusny modul ten mam. Tak jestli je moznost i na koncernu, rad se v tom vrtam sam ..nechodim do servisu a sere se furt neco
Diky

[passion]

Carista s BT v1.5 vie všetko to, čo píšeš v príspevku,