Print Page - Volvo D2 Transport Protocol

Title: Volvo D2 Transport Protocol
Post by: prj on March 17, 2023, 06:10:05 AM

Having a look at this abomination...
It seems like there is not much info available at the moment.
I looked briefly here: https://github.com/prometey1982/VolvoTools (https://github.com/prometey1982/VolvoTools) - but it is not implemented at all. Just a guesstimate is made based on the request as to what the length of the response should be.

While everything online is posted about the single frame mode, there is actually a full transport protocol here.
The first byte determines whether the transport protocol is used or not. If the MSB is set, then transport is used. This is also why ID's of all controllers are < 0x80.

Here's an exchange between ECU and tester with a multi-frame request/response, reading the ECU ID:

Code:

;   Message Number
;   |         Time Offset (ms)
;   |         |        Type
;   |         |        |        ID (hex)
;   |         |        |        |     Data Length
;   |         |        |        |     |   Data Bytes (hex) ...
;   |         |        |        |     |   |
;---+--   ----+----  --+--  ----+---  +  -+ -- -- -- -- -- -- --
     1)      4449.8  Rx     000FFFFE  8  CA 7A A1 00 00 00 00 00 
     2)      4469.3  Rx     00400021  8  CA 7A E1 00 00 00 00 00 
     3)      6923.8  Rx     000FFFFE  8  CB 7A B9 F2 00 00 00 00 
     4)      6944.9  Rx     00400021  8  8F 7A F9 F2 42 30 44 35 
     5)      6954.9  Rx     00400021  8  09 30 30 41 4D 41 43 20 
     6)      6965.0  Rx     00400021  8  0A 20 20 20 20 20 20 20 
     7)      6975.0  Rx     00400021  8  0B 20 20 20 20 20 20 20 
     8)      6985.0  Rx     00400021  8  4F 20 20 20 20 20 20 20

0xCx - Single frame
0x8x - First frame
0x4x - Last frame
In case of consecutive frames it seems there's some kind of serial numbering.

For FF, LF and SF there is a length encoded in the last three bits of the low nibble.
For CF the last three bits of the low nibble are the number of the frame.

Title: Re: Volvo D2 Transport Protocol
Post by: prj on March 17, 2023, 07:08:02 AM

As a side note, I am testing this on ME9 ECU.
Seems like it has to use transport here and without transport the ECU does not even reply.

Title: Re: Volvo D2 Transport Protocol
Post by: prj on March 17, 2023, 09:03:13 AM

Seems like this is a newer version of the protocol indeed.
The response ID is also on 0x400021 and not 0x21.

Title: Re: Volvo D2 Transport Protocol
Post by: daniel2345 on March 17, 2023, 09:22:30 AM

ECU has to be in boot mode to use Communication without Format Identifier (=your first byte).
In diagnostic mode it is always used.

Title: Re: Volvo D2 Transport Protocol
Post by: prj on March 17, 2023, 09:56:19 AM

Quote from: daniel2345 on March 17, 2023, 09:22:30 AM

ECU has to be in boot mode to use Communication without Format Identifier (=your first byte).
In diagnostic mode it is always used.

Aha okay. So in boot mode they did not use a transport protocol.

Since I am not trying to flash anything, then it's not interesting to me.
Wonder why this info was so hard to come across... but I guess it's quite easy to deduce.
Scanned the B9 service on my ECU (which i'd compare to 0x1A on KWP):

Code:

0003: [] 03 00 00
00A0: [] A0 00 00
00F0: [0eT  A0hFB  A] F0 00 30 65 04 54 20 20 41 30 68 46 42 20 20 41
00F2: [B0D500AMAC] F2 42 30 44 35 30 30 41 4D 41 43 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
00F4: [] F4 00 0A 00
00F5: [0xU3 AA0wIP ABZZZZ] F5 00 30 78 55 33 20 41 41 00 1E 00 00 00 30 77 49 50 20 41 42 5A 5A 5A 5A
00F8: [] F8 00 00 00 02 96 05

DHA gives some insights what everything is.

Next to try and request some ram addresses and see what it thinks about that...

Title: Re: Volvo D2 Transport Protocol
Post by: dikidera on April 30, 2023, 02:21:48 AM

It is odd that for Denso, on the bench I cannot make the ECU return data for B9 F0(or any command that should return data) via D2

000FFFFE 0xCB 7A B9 F0 00 00 00 00 <- no reply. On the car there are no issues, but on the bench...it simply refuses to.
000FFFFE 0xCB 7A B9 F2 00 00 00 00 <- no reply.
000FFFFE 0xCB 7A B9 F8 00 00 00 00 <- no reply.

I can see the ECU streaming data via CAN, I can make it enter programming mode vs FF 86 command, I can even upload and run my own kernel, so I know it is receiving my commands. But for the life of me, I cannot get it to reply to these commands on the bench.

I am only powering the ECU via one 12v pin, specifically pin 10 as it was the easiest, could this be the reason?

(https://i.imgur.com/jVotGnP.png)

Yes it was the other pin, 37(ignition). After connecting it, it now works. Perfect.

Title: Re: Volvo D2 Transport Protocol
Post by: dikidera on May 04, 2023, 02:08:53 PM

prj, thanks for the information, I believe then I can correlate what you wrote with the code over here

(https://imgur.com/RZibmcG.png)

Still I am a bit far from my goal. And that is to see what the streamed data is in boot mode, how the CAN IDs are calculated, and potentially discover, which module they are for.

NefMoto

Technical => Communication Protocols => Topic started by: prj on March 17, 2023, 06:10:05 AM