SwedeSpeed - Volvo Performance Forum banner

1 - 20 of 28 Posts

·
Super Moderator
Joined
·
9,305 Posts
Discussion Starter · #1 ·
There are a couple of other threads on this, but they are more about commercial stuff. Let's talk about the details of OBD-II and other Volvo data access...<p>As we know, all Volvos from 1996 in the US support some form of OBD-II communication. Most Volvos from 1999-2004 use an ISO9141 interface for this, while 2005- use CAN. To read the car's OBD-II you need a scan tool or other device which uses the right interface. But, the OBD-II protocol, and what you can read from the car with it, is pretty much the same.<p>Going "down a layer", you can in fact read the raw protocol that's travelling around the various car components, but once you go there you're in proprietary Volvo-land, and it's not at all obvious how to figure it out. Some folks here <A HREF="http://forums.swedespeed.com/zerothread?id=38911" TARGET="_blank">have been doing so</A>, but only a few. BSR seems to have cracked some or all of it, to make their PPC and diagnostic (<A HREF="http://www.ppc-diagnostic.com/" TARGET="_blank">http://www.ppc-diagnostic.com/</A>).<p>So, I'm a Palm developer in my spare time (<A HREF="http://mytreo.net/downloads/details-640.html?KeyguardTime+" TARGET="_blank">http://mytreo.net/downloads/details-640.html?KeyguardTime+</A>) and crazy enough to hack on the open source PalmOS client for this bluetooth OBD device (on my Treo 650):<p><IMG SRC="http://www.car-pal.net/car-pal/images/car-pal_small.jpg" BORDER="0"> <A HREF="http://www.car-pal.net" TARGET="_blank">http://www.car-pal.net</A><p>It's really useful as a data logger and general monitoring tool. There are lots of other devices like it (though this is the only one I know with Bluetooth). But OBDII devices are not at all a window into the inner workings of the car, they're limited by what the car chooses to reveal.<p>OBD-II is implemented by a kind of "gateway" device in the car, and it allows sampling of signals called "PIDs" (<A HREF="http://en.wikipedia.org/wiki/OBD-II_PIDs" TARGET="_blank">http://en.wikipedia.org/wiki/OBD-II_PIDs</A>). These are defined by the SAE J1979 spec, and they're rather generic. There is much more detailed information available when speaking the Volvo protocols, this is what dealers use of course.<p>My V50 has a 500Kbit/s CANbus (our XC90 is ISO9141), and the Car-Pal connects right up. The available OBD PIDs are as follows, most other Volvos seem to be pretty much identical:<p> 3 - fuel system<br> 4 - load<br> 5 - coolant temp<br> 6 - STFT<br> 7 - LTFT<br> A - fuel pressure<br> C - RPM<br> D - speed<br> E - ign adv<br> F - air temp<br>10 - MAF<br>11 - Throttle<br>13 - O2 sensor map<br>15 - O2 sensor<br>1C - OBD std type<br>1F - time since engine started<p>I have found that my Treo can sample all these available PIDs together at about 9.5/second. Interestingly, if I reduce the number of PIDs being scanned, the sample rate actually goes down, I suspect there's a software glitch in my Treo client. But, 9.5 is about all I have seen any OBDII device do, so I am assuming the max sample rate is basically being limited by the car. This makes sense, since OBD-II is really just a compliance thing. There isn't really a big effort to expose the inner workings of the car, or make it a general-purpose interface.<p>Anyway, the good thing is that the basic OBD-II data is more than good enough for basic monitoring for speed (acceleration), basic air/fuel (off the O2 sensor) which can also give mpg, engine rpm and load, plus some interesting engine parameters like coolant temp, IAT, fuel pressure, fuel trim etc which are useful when tuning. And, it reads engine codes, etc (but only engine and emission codes, not the many others). So, it's really good for data logging and basic diagnostics. These data are basically what the Auterra PDA Dyno, G-tech, and other devices are reading.<p>Unfortunately, it doesn't read boost (pid 0xb), which of course is what everyone would want to see. I suspect Volvo leaves this off intentionally. It's not required for compliance purposes, and it's a window into the car's algorithms. Maybe I'm just a cynic, but there it is.<p>Anyway, I'm really interested in knowing if anyone else here is interested in OBD or CAN programming for Volvos, and/or has started down this road. There are bunches of similar projects on other brands. Anyone want to share?<p>Tom.
 

·
Registered
Joined
·
2,545 Posts
Re: OBD-II / CAN / ISO9141 technical issues (tmtalpey)

Hi Tom,<p>This is exciting stuff! I've been holding off on getting a new OBD2 tool since I'm trying to figure out which one to buy based on which author is most likely to offer enhance Volvo support soon.<br>You've probably aready seen the thread I started on this but for other's sake here it is: <A HREF="http://forums.swedespeed.com/zerothread?id=59569" TARGET="_blank">http://forums.swedespeed.com/zerothread?id=59569</A><br>i<br>I'm seriousely considering spending $300 on ValueCan so I can us CanCracker from these guys <A HREF="http://www.intrepidcs.com/website/CANCracker.htm" TARGET="_blank">http://www.intrepidcs.com/website/CANCracker.htm</A><p>I'm a techie-DYI guy and know my way around cars and electronics but the problem I have with digging into this is time. I'm not sure how far I would <I>actually</I> get if I bought that tool.<p>I'd like to work on this with you.<p>Does CarPal use the ELM chipset? Are you able to send raw commands on the CAN bus with CarPal?<p>LTA<br>
 

·
Super Moderator
Joined
·
9,305 Posts
Discussion Starter · #3 ·
Re: OBD-II / CAN / ISO9141 technical issues (LTA)

Yeah, it is kind of fun, a little puzzle to try to figure out...<p>As to which author might support Volvo, from a pure OBDII perspective the answer is all of them. At a lower level, I'm not too optimistic. Volvo doesn't release any detail at all (unlike other mfrs), and the market volume just isn't there. But, we shall see.<p>I don't know much about ValueCan, but it looks interesting enough. I'll check it out more sometime soon.<p>CarPal doesn't use ELM, but it is very similar. Yes, certain raw commands can be sent with it, and other functions. But, like other OBD-capable units, it's not actually a CAN sniffer. If you want to go there, think differently.<p>I'll contact you offline. Anyone else?<p>Tom.
 

·
Registered
Joined
·
2,545 Posts
Re: OBD-II / CAN / ISO9141 technical issues (tmtalpey)

You think we can get the students that worked on this cool system to help us? <A HREF="http://www.youtube.com/watch?v=OtlAJlh9xHA" TARGET="_blank">http://www.youtube.com/watch?v=OtlAJlh9xHA</A><p>I bet they had to sign an NDA and won't spill the beans <IMG NAME="icon" SRC="http://www.vwvortex.com/vwbb/frown.gif" BORDER="0"><p>LTA<br>
 

·
Registered
Joined
·
85 Posts
Re: OBD-II / CAN / ISO9141 technical issues (tmtalpey)

I'd be interested in helping also, but I may not be of much help since I am just starting to learn how CAN works. I do have some limited software/db development background.<p>Pat
 

·
Registered
Joined
·
2,545 Posts
Re: OBD-II / CAN / ISO9141 technical issues (Pat S)

<TABLE WIDTH="90%" CELLSPACING=0 CELLPADDING=0 ALIGN=CENTER><TR><TD><i>Quote, originally posted by <b>Pat S</b> »</i></TD></TR><TR><TD CLASS="quote">I'd be interested in helping also, but I may not be of much help since I am just starting to learn how CAN works. I do have some limited software/db development background.<p>Pat</TD></TR></TABLE><p>Thanks Pat.<p>I got an e-mail from Alex C. Peper, he says he should have more advanced Volvo support in 1-2 months from now. As for getting into deep into the various Volvo controllers he says it may require hardware changes and no idea on how long that will take. <p>I offerd to help test and suggested that he'll win many customers should he be able to read special Volvo messaging especially BOOST.<p>I suspect standard OBD-2 messaging in current model Volvos happens on CAN H (high speed bus) but getting into other controllers may requir comms on the CAN L buss (low speed bus). That's just a hunch and I'm waiting for Alex to respond.<p>LTA<p>
 

·
Registered
Joined
·
200 Posts
Re: OBD-II / CAN / ISO9141 technical issues (tmtalpey)

<TABLE WIDTH="90%" CELLSPACING=0 CELLPADDING=0 ALIGN=CENTER><TR><TD><i>Quote, originally posted by <b>tmtalpey</b> »</i></TD></TR><TR><TD CLASS="quote">, and it's not at all obvious how to figure it out. Some folks here <A HREF="http://forums.swedespeed.com/zerothread?id=38911" TARGET="_blank">have been doing so</A>, but only a few. <br></TD></TR></TABLE><p>Wow that was an old thread...now know a lot more than I did back then! What you see in that screen shot are the periodic CAN messages that are sent out on the bus – they are actually not much use unless you have a copy of the appropriate signal config file and know how to decode it.<p>While the protocol is structured, Volvo uses "manufacturer specific" request types/identifiers/etc – so it's mostly guess work. For example a request type of A6 means READ CURRENT DATA BY IDENTIFIER. You then need to know what offset or identifier you’re looking for on the ECU.<p><br>I've actually broken down the process for writing to an ECU - it's reading the current programming I've yet to figure out (although I do have some suspicions). Some of the standard PBL commands include:<p>86 - shuts the ECUs up and prepares for programming<br>C0 - starts the specified ECUs primary boot loader<br>9C - specified base address where the action should take place <br>F8 - erase the memory block<br>B4 - commit up to the specified address<br>A0 - used to jump to another subroutine address<br>C8 - resets the ECUs to normal operating mode<p>I was hoping that someone with documentation would contact me or anonymously send some details my way. Unfortunately, I've not been so lucky.<p>I could probably figure more details out, but this is my daily driver. I can't afford to accidentally screw up one of the ECUs and have to get it flashed with VIDA. <br>
 

·
Registered
Joined
·
2,545 Posts
Re: OBD-II / CAN / ISO9141 technical issues (we R obsessed)

we R obsessed,<p>If your goal is to read and write the ECU fuel/air mapping (ie performance tuning) there could be an easy way to get much closer to cracking it:<p>Attach your CAN sniffer to the bus along with an ECU reader/writer that uses the CAN bus and 'watch' and record what goes on. For example, if one of those black-box ECU tuner things uses the CAN bus then in theory one could snoop on what commands and data and being sent and received during the ECU 'tune' process.<p>You'd still have lots of deciphering to do but atleast you'd be looking in the right haystack!<p>Ps. Please tell me what system you're using to sniff you CAN bus. ELM327 bases 'scanners' seem good and do offer CAN monitoring but with their small 256KB buffer and 34.8Kbps RS232 speed it might get choked up with CAN H. Intrepid systems' CanCracker is REALLY cool, but not cheap! Which one are you using?<p>LTA<br><BR><BR>
<i>Modified by LTA at 9:40 AM 7-6-2006</i>
 

·
Registered
Joined
·
2,545 Posts
Re: OBD-II / CAN / ISO9141 technical issues (we R obsessed)

we R obsessed: Check your IM.<p>LTA<br>
 

·
Registered
Joined
·
7 Posts
Re: OBD-II / CAN / ISO9141 technical issues (tmtalpey)

I know there must be serveral VADIS users out there. Does anyone have access to VCT2000? That might help figuring out what goes on high/low CANs. Using VADIS32\BIN\BugTrace.exe it is possible to capture all serial communication that goes on between VADIS and VCT2000.<p>If request/response messages do not show up, you may need to add following key to registry (this is registry export of it):<p>Windows Registry Editor Version 5.00<p>[HKEY_LOCAL_MACHINE\SOFTWARE\Volvo\VADIS\Bucket\VEH]<br>"DEFAULT_BAUD"="115200"<br>"VCTLIB_TRACE_MSGS"="1"<p>Here is sample of BugTrace run where connect to VCT2000 is simulated... If someone with VCT2000 could capture reading of the codes and other data and post it here. Thenmaybe CAN sniffing experts here could see if it maps directly to CAN requests/responses (besides VCT2000 frame info).<p>Time MOD D E S Trace Data<br>08:40:36.54 SWM 1 0 4 SWMGR.DLL Initializing<br>08:40:36.54 VDA 1 0 1 DllMain - Process Attach (0x6b0000)<br>08:40:36.54 VDA 1 0 4 Vadis version: 6.7a.2775<br>08:40:36.54 VCA 1 0 1 DllMain - Process Attach (0x6f0000)<br>08:40:36.54 VCA 1 0 4 Vadis version: 6.7a.2775<br>08:40:36.54 VHA 1 0 1 DllMain - Process Attach (0x710000)<br>08:40:36.54 VHA 1 0 4 Vadis version: 6.7a.2775<br>08:40:36.54 SWM 1 0 4 LoadLibrary(Safecl32.dll) failed, err = 126<br>08:40:55.92 SWM 1 0 4 LoadLibrary(Safecl32.dll) failed, err = 126<br>08:45:45.33 VHA 1 1 1 System Logging is OFF<br>08:45:45.37 VCL 1 1 1 VctOpen: Serial RW timeout set to: 30000<br>08:45:45.61 VCA 1 1 1 OpenCommPort: port COM1 opened, baudrate = 115200<br>08:45:45.61 VCA 1 1 1 Force RS232 baud to 115200<br>08:45:45.61 VCA 1 1 1 Set Download VCT RS232 baud rate = 115200.<br>08:45:45.61 VCL 1 1 1 Request Frame Size=23 Data=<br>08:45:45.61 VCL 1 1 1 80,00,0E,00,1F,01,00,00,01,F4,00,00,03,E8,00,01,C2,00,00,00,03,51,81,<br>08:45:45.95 VCL 1 1 1 Response Frame Size=22 Data=<br>08:45:45.95 VCL 1 1 1 80,00,0D,00,1F,06,00,00,00,00,1F,01,12,34,00,00,00,00,00,01,18,81,<br>08:45:45.95 VCA 1 1 1 InitVCT2000: Serial RW timeout set to: 30000<br>08:45:45.95 VCL 1 1 1 Request Frame Size=17 Data=<br>08:45:45.95 VCL 1 1 1 80,00,08,00,10,02,00,00,00,00,00,00,00,00,00,9A,81,<br>08:46:15.96 VCL 1 1 1 RecvLLPFrame returned = 0XFFFF7F18<br>08:46:15.96 VCA 1 1 1 VctListPackages returned (0XFFFF7F18)<br>08:46:15.96 VCA 1 1 1 SelectPackage() returned (-33000)<br>08:46:15.96 VCA 1 1 1 Connect: InitVct_HW() returned (-33000)<br>08:46:15.97 VCA 1 1 1 DisConnected from VCT<br>08:46:15.97 VHA 1 1 1 System Logging is OFF<br>08:46:16.00 VCL 1 1 1 VctOpen: Serial RW timeout set to: 30000<br>08:46:16.02 VCA 1 1 1 OpenCommPort: port COM1 opened, baudrate = 115200<br>08:46:16.02 VCA 1 1 1 Force RS232 baud to 115200<br>08:46:16.02 VCA 1 1 1 Set Download VCT RS232 baud rate = 115200.<br>08:46:16.02 VCL 1 1 1 Request Frame Size=23 Data=<br>08:46:16.02 VCL 1 1 1 80,00,0E,00,1F,01,00,00,01,F4,00,00,03,E8,00,01,C2,00,00,00,03,51,81,<br>08:46:16.15 VCL 1 1 1 Response Frame Size=22 Data=<br>08:46:16.15 VCL 1 1 1 80,00,0D,00,1F,06,00,00,00,00,1F,01,12,34,00,00,00,00,00,01,18,81,<br>08:46:16.15 VCA 1 1 1 InitVCT2000: Serial RW timeout set to: 30000<br>08:46:16.15 VCL 1 1 1 Request Frame Size=17 Data=<br>08:46:16.15 VCL 1 1 1 80,00,08,00,10,02,00,00,00,00,00,00,00,00,00,9A,81,<br>08:46:46.15 VCL 1 1 1 RecvLLPFrame returned = 0XFFFF7F18<br>08:46:46.15 VCA 1 1 1 VctListPackages returned (0XFFFF7F18)<br>08:46:46.15 VCA 1 1 1 SelectPackage() returned (-33000)<br>08:46:46.15 VCA 1 1 1 Connect: InitVct_HW() returned (-33000)<br>08:46:46.15 VCA 1 1 1 DisConnected from VCT<p>
 

·
Registered
Joined
·
200 Posts
Re: OBD-II / CAN / ISO9141 technical issues (sweedespeed)

Yes, those are the command sent to the VCT2000. Those commands setup the initial communication parameters (baud rate) and then query the VCT for it's packages (PFWDL/MONIT/VADIS), free memory, ect. I actually haven't examined these that closely as it's easier for me to just sniff the real CAN frames on the car.<p><br>80,00,0E,00,1F,01,00,00,01,F4,00,00,03,E8,00,01,C2,00,00,00,03,51,81,<br>|--|.................................................................................................................Start of frame<br>....|---------------------------|..............................................................................Frame header<br>....|??|---|.......................................................................................................Data size (14)<br>.......................................|-------------------------------------------------------|.......Frame data<br>.....................................................................|??|-----------|...........................Baud Rate (115200)<br>.............................................................................................................|--|....End of frame
 

·
Super Moderator
Joined
·
9,305 Posts
Discussion Starter · #12 ·
Re: OBD-II / CAN / ISO9141 technical issues (we R obsessed)

Slight elaboration:<p>80,00,0E,00,1F,01,00,00,01,F4,00,00,03,E8,00,01,C2,00,00,00,03,51,81,<br>|--|.................................................................................................................Start of frame<br>....|---------------------------|..............................................................................Frame header<br>....|------|........................................................................................................Send data size (14)<br>.......................................|-------------------------------------------------------|........Frame data<br>.....................................................................|??|-----------|............................Baud Rate (115200)<br>..........................................................................................|--------------|........Bytewise checksum<br>.............................................................................................................|--|....End of frame<p>There's a lot more going in here of course. I do find it odd that the software would send the baud rate to the VCT2000, over the serial line that's already set to that baud rate.<p>0x1F4 is 500 decimal, and isn't 0x3E8 a standard COM port i/o address?<p>Tom.
 

·
Registered
Joined
·
200 Posts
Re: OBD-II / CAN / ISO9141 technical issues (tmtalpey)

Hmmm must have hit edit by mistake instead of reply...over wrote my old post. Oh well, new info with the details is in a few posts anyway... Keep scrolling! <IMG NAME="icon" SRC="http://www.vwvortex.com/vwbb/biggrin.gif" BORDER="0"> <BR><BR>
<i>Modified by we R obsessed at 9:20 PM 1-30-2009</i>
 

·
Super Moderator
Joined
·
9,305 Posts
Discussion Starter · #14 ·
Re: OBD-II / CAN / ISO9141 technical issues (we R obsessed)

<TABLE WIDTH="90%" CELLSPACING=0 CELLPADDING=0 ALIGN=CENTER><TR><TD><i>Quote, originally posted by <b>we R obsessed</b> »</i></TD></TR><TR><TD CLASS="quote">the 0x1F4 - I've only seen it set to anything on this one frame. In all other cases I have it's 0x0.</TD></TR></TABLE><br>Probably a millisecond timeout, or something along those lines.<p>All this is just the control portion of the Vadis<->VCT comms, of course. Not the most interesting stuff on the planet.<p>Tom.
 

·
Registered
Joined
·
3 Posts
Hi. I plan to implement the steering wheel buttons in my Carputer and I have bought a CAN-interface <A HREF="http://www.machinebus.com/images/stories/products/mci100/mci100p_datasheet.pdf" TARGET="_blank">http://www.machinebus.com/imag...t.pdf</A> that I plan to use together w/ a Basic stamp. I have no idea how to filter out the buttons on the CAN. I can configure CAN ID filters in the interface but I don't know the ID for the buttons, do any of U know them? Could really need some help here. Best regards L. Kull from Sweden.
 

·
Registered
Joined
·
1 Posts
tmtalpey,<p>I have a 1999 Dodge caravan. It uses ISO9141 Protocol. I was able to use an ELM323 chip and a PIC microcontroller to communicate with the ECU. Now I am trying to write my own software to run on the PIC microcontroller but I am not getting anywhere. <p>Based on what you have accomplished as Palm developer, I believe that you might be in a position to help. I would like to know;<p>1/ what voltage level on the bus would the ECU and the Scan Tool interpret as a "1" and a "0"? and<p>2/ would this voltage level be the same during the very first part of the Bus Initiation (i.e when sending 33 hex), and during the remainder on the Bus Initiation process?<p>Thanks very much for your response.<br>
 

·
Registered
Joined
·
200 Posts
Re: OBD-II / CAN / ISO9141 technical issues (we R obsessed)

<p>hehehe I got my hands on some info. <IMG NAME="icon" SRC="http://www.vwvortex.com/vwbb/biggrin.gif" BORDER="0"> <p>Frame (Max size 0x200):<br>Frame beginning is always 0x80<br>16 bit unsigned intager indicating the payload size<br>1 byte pading of value 0<br>The Payload - variable size<br>1 byte pading of value 0<br>1 byte pading of value 0<br>3 byte checksum <br>Frame ending is always 0x81<p>Payload max size is 0x1f7 per frame.<p>That one we were looking at is an Init VCT2000 request:<br>16 bit unsigned at offset 0 command ID (0x1f01)<br>16 bit unsigned at offset 2 undefined<br>16 bit unsigned at offset 4 inter frame time (500)<br>16 bit unsigned at offset 8 complete frame time (1000)<br>32 bit unsigned at offset 10 baud rate (115200)<p>The VCT sent back a Acknowledgment response:<br>16 bit unsigned at offset 0 command ID (0x1f06)<br>16 bit unsigned at offset 2 application handle<br>16 bit unsigned at offset 4 message handle<br>16 bit unsigned at offset 6 ack message ID (aka request command ID)<br>32 bit unsigned at offset 8 is reserved<br>1 byte at offset 6 12 acknowledgment value ( 1 = info, 2 = nack, 0 = OK )<br>---note are ack was OK so it stops here--<br>16 bit unsigned at offset 13 error/info code (many to list)<br>16 bit unsigned at offset 15 cause (many to list)
 

·
Registered
Joined
·
4 Posts
Re: OBD-II / CAN / ISO9141 technical issues (we R obsessed)

There is one of my "trac1" files.Time MOD D E S Trace Data<br>19:01:45.12 SWM 1 0 4 SWMGR.DLL Initializing<br>19:01:45.13 VDA 1 0 1 DllMain - Process Attach (0x5d0000)<br>19:01:45.13 VDA 1 0 4 Vadis version: 6.7a.2775<br>19:01:45.13 VCA 1 0 1 DllMain - Process Attach (0x610000)<br>19:01:45.13 VCA 1 0 4 Vadis version: 6.7a.2775<br>19:01:45.13 VHA 1 0 1 DllMain - Process Attach (0x630000)<br>19:01:45.13 VHA 1 0 4 Vadis version: 6.7a.2775<br>19:03:33.35 VCC 1 0 4 DllMain - Process Attach (0X2550000)<br>19:03:33.35 VCC 1 0 4 Vadis version: 6.7a.2775<br>19:03:33.35 VCC 1 0 6 entry - InitRunTime<br>19:03:33.35 VCC 1 0 6 exit - InitRunTime<br>19:03:33.35 VCC 1 0 6 WM_CCM_CONNECT received<br>19:03:33.35 VCC 1 0 6 WM_CCM_CONNECT return<br>19:03:33.35 VCC 1 0 6 WM_CCM_CONNECT received<br>19:03:33.35 VCC 1 0 6 WM_CCM_CONNECT return<br>19:03:33.35 VCC 1 0 6 WM_CCM_CONNECT received<br>19:03:33.35 VCC 1 0 6 WM_CCM_CONNECT return<br>19:03:33.35 VCC 1 0 6 WM_CCM_POKE received (hwnd = 2490954)<br>19:03:33.35 VCC 1 1 1 Using Vehicle Profile settings from profile module<br>19:03:33.37 VHA 1 1 1 System Logging is OFF<br>19:03:33.47 VCL 1 1 1 VctOpen: Serial RW timeout set to: 30000<br>19:03:33.47 VCA 1 1 1 OpenCommPort: port COM1 opened, baudrate = 115200<br>19:03:33.47 VCA 1 1 1 Force RS232 baud to 115200<br>19:03:33.47 VCA 1 1 1 Set Download VCT RS232 baud rate = 115200.<br>19:03:33.47 VCL 1 1 1 Request Frame Size=23 Data=<br>19:03:33.48 VCL 1 1 1 80,00,0E,00,1F,01,00,00,01,F4,00,00,03,E8,00,01,C2,00,00,00,03,51,81,<br>19:03:34.63 VCL 1 1 1 Response Frame Size=22 Data=<br>19:03:34.63 VCL 1 1 1 80,00,0D,00,1F,06,00,00,00,00,1F,01,12,34,00,00,00,00,00,01,18,81,<br>19:03:34.63 VCA 1 1 1 InitVCT2000: Serial RW timeout set to: 30000<br>19:03:34.63 VCL 1 1 1 Request Frame Size=17 Data=<br>19:03:34.63 VCL 1 1 1 80,00,08,00,10,02,00,00,00,00,00,00,00,00,00,9A,81,<br>19:03:36.33 VCL 1 1 1 Response Frame Size=17 Data=<br>19:03:36.33 VCL 1 1 1 80,00,08,00,10,06,00,00,10,02,00,01,00,00,00,B1,81,<br>19:03:36.33 VCA 1 1 1 VctListPackages: #pkgs = 0, free mem = 0<br>19:03:36.33 VCA 1 1 1 VctSelectPackage(, 01:>0000001)<br>19:03:36.33 VCL 1 1 1 Request Frame Size=30 Data=<br>19:03:36.33 VCL 1 1 1 80,00,15,00,10,04,00,00,00,00,00,00,00,10,A8,76,A1,01,AE,00,00,00,31,00,39,00,00,03,91,81,<br>19:03:38.16 VCL 1 1 1 Response Frame Size=17 Data=<br>19:03:38.17 VCL 1 1 1 80,00,08,00,10,06,00,00,10,02,00,01,00,00,00,B1,81,<br>19:03:38.17 VCL 1 1 1 Request Frame Size=61 Data=<br>19:03:38.17 VCL 1 1 1 80,00,34,00,1F,00,00,00,00,01,E8,48,00,03,D0,90,00,00,00,00,00,00,28,A0,00,00,00,00,00,00,00,<br>19:03:38.17 VCL 1 1 1 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,04,2F,81,<br>19:03:39.91 VCL 1 1 1 Response Frame Size=17 Data=<br>19:03:39.91 VCL 1 1 1 80,00,08,00,10,06,00,00,10,02,00,01,00,00,00,B1,81,<br>19:03:39.91 VCA 1 1 1 InitVct_HW: Vct Hardware Initialized<br>19:03:39.91 VHA 1 1 1 Mk=1 Partner=INT Model=384 Year=2001 CG=2 Var=153 CG2=-1 Var2=-1<br>19:03:39.91 VHA 1 1 1 ECUDiagNum="08631773 A" ECUDiagID=4063 DiagSetupID=242<br>19:03:39.91 VHA 1 1 1 ECU Address = 0x11 FrameID = 0x000FFFFE BusType=1 TimingID=18<br>19:03:39.91 VCL 1 1 1 Request Frame Size=15 Data=<br>19:03:39.91 VCL 1 1 1 80,00,06,00,1D,01,00,00,00,00,00,00,00,A4,81,<br>19:03:41.38 VCL 1 1 1 Response Frame Size=17 Data=<br>19:03:41.38 VCL 1 1 1 80,00,08,00,10,06,00,00,10,02,00,01,00,00,00,B1,81,<br>19:03:41.38 VCA 1 1 1 InitVct_Diagnostic: Vct Diagnostic Application initialized<br>19:03:41.38 VCL 1 1 1 Request Frame Size=53 Data=<br>19:03:41.38 VCL 1 1 1 80,00,2C,00,1D,02,00,00,00,01,00,03,01,0A,13,40,11,00,00,00,00,00,00,0C,00,14,00,19,00,00,00,<br>19:03:41.38 VCL 1 1 1 1E,00,00,00,32,00,14,00,05,00,32,00,64,27,10,27,42,00,00,03,16,81,<br>19:03:42.95 VCL 1 1 1 Response Frame Size=17 Data=<br>19:03:42.95 VCL 1 1 1 80,00,08,00,10,06,00,00,10,02,00,01,00,00,00,B1,81,<br>19:03:42.95 VCA 1 1 1 InitVct_Diagnostic: Vct Diagnostic Protocol initialized<br>19:03:42.95 VCL 1 1 1 Request Frame Size=35 Data=<br>19:03:42.95 VCL 1 1 1 80,00,1A,00,1F,04,00,00,01,01,03,00,0F,FF,FE,00,40,00,13,FF,FF,00,00,00,00,00,03,B2,F0,03,00,<br>19:03:42.95 VCL 1 1 1 00,06,C7,81,<br>19:03:44.64 VCL 1 1 1 Response Frame Size=17 Data=<br>19:03:44.64 VCL 1 1 1 80,00,08,00,10,06,00,00,10,02,00,01,00,00,00,B1,81,<br>19:03:44.64 VCL 1 1 1 Request Frame Size=17 Data=<br>19:03:44.64 VCL 1 1 1 80,00,08,00,1B,0D,00,00,00,00,00,00,00,00,00,B0,81,<br>19:04:14.65 VCL 1 1 1 RecvLLPFrame returned = 0XFFFF7F18<br>19:04:14.65 VCA 1 1 1 VctSync returned (0XFFFF7F18)<br>19:04:14.65 VCA 1 1 1 InitVct_Diagnostic: Sync() returned (-33000)<br>19:04:14.65 VHA 1 1 1 InitVctForDiagnosticRequest: InitVct_Diagnostic returned (-33000)<br>19:04:14.65 VCC 1 0 6 VehDiagInit failed (-33000)<br>19:04:14.65 VCC 1 0 6 WM_CCM_POKE received (hwnd = 2490954)<br>19:04:14.66 VCA 1 1 1 DisConnected from VCT<br>19:04:14.66 VCC 1 0 6 WM_CCM_POKE return<br>19:04:14.66 VCC 1 0 6 WM_CCM_POKE return<br>19:04:14.66 VCC 1 0 6 entry - StartExec<br>19:04:14.66 VCC 1 0 6 exit - StartExec<br>19:04:14.70 VCC 1 0 6 WM_CCM_DISCONNECT received<br>19:04:14.70 VCC 1 0 6 WM_CCM_DISCONNECT return<br>19:04:14.70 VCC 1 0 6 WM_CCM_DISCONNECT received<br>19:04:14.70 VCC 1 0 6 WM_CCM_DISCONNECT return<br>19:04:14.70 VCC 1 0 6 WM_CCM_DISCONNECT received<br>19:04:14.70 VCC 1 0 6 WM_CCM_DISCONNECT return<br>19:04:14.70 VCC 1 0 6 WM_DESTROY<br>19:04:14.70 VCC 1 0 6 CcmDeleteWindow, hwnd = 0x26024a<br>19:04:14.70 VCC 1 0 4 DllMain - Process Detach (0X2550000)<br>
 

·
Registered
Joined
·
7 Posts
Re: OBD-II / CAN / ISO9141 technical issues (we R obsessed)

we R obsessed,<p>Can you provide more information how communicating with ECUs goes? Do you have a complete example of the message sent to an ECU and a response from there?<p>My understanding from VADIS is that ECU number for Driver Door Module (DDM) on my S80 should be 43, but I see headers 00 E0 30 A2 with ELM327 based monitoring when moving window up and down. I cannot see how 43 would be encoded in that or 40 (CEM).<p>Another example is sending power head restraints down. Communication should be from CCM (29) to REM (46), but complete message what I see is<br>01 70 04 00 00 00 00 00 00 00 00 02 and again I do not see how 29 or 46 would be encoded in it. If I send the same message, then head restraints do go down, but that does not help me really.<p>When VADIS is communicating with the vehicle it would first do a read block by offset (B9 F0) to read ECU config, but since I do not know to what address to send it, I have not been able to get pass that. Do you know how to send this read block by offset request?<p>Please note that I ordered my ELM327 based vehicle communication tool from China and it is version 1.5a and must be some knock off version since elmelectronics.com has 1.3 their latest version. Also all the documentet AT command do not work as expected on it. What are you using to communicate with the vehicle?<p>
 

·
Registered
Joined
·
7 Posts
Re: OBD-II / CAN / ISO9141 technical issues (sweedespeed)

Hi all,<p>Does anyone have any info on this? On my 2001 S80 CANBUS is behind relay and I have been able to brute force search for the request to open the CANBUS for OBD connector using ISO-9141 and what I have been able to reverse engineer from VADIS. Next step is to understand canbus format, but so far I have not been lucky enough to get any request to send a response. I know ECUs e.g 40 and tester is 13 and request to read ECU part number is B9 F0 from VADIS and also (http://www.google.com/patents?id=XmqoAAAAEBAJ&pg=PA4&lpg=PA4&dq=%22D2+protocol%22+Volvo&source=bl&ots=A0mT-drbI7&sig=tW7N_V8HzEhEM0edZOl3vHl0SxQ&hl=en&ei=h8aeSuOPEM-c8QbFsPSyAw&sa=X&oi=book_result&ct=result&resnum=5#v=onepage&q=%22D2%20protocol%22%20Volvo&f=false). Also do not know if FrameID FFFFE is part of it. How to format a request from that data is still a mystery to me. Is D2 protocol extension of ISO 15765? If it is then <A HREF="http://en.wikipedia.org/wiki/OBD-II_PIDs" TARGET="_blank">http://en.wikipedia.org/wiki/OBD-II_PIDs</A> CAN Bus format section might help.<p>Thanks,<br>Sweede<br>
 
1 - 20 of 28 Posts
Top