Pages: [1]
Author Topic: EDC15 CAN TP  (Read 10612 times)
nihalot
Full Member
***

Karma: +41/-3
Offline Offline

Posts: 117


« on: May 12, 2017, 10:04:28 PM »

EDC15 has a special TP which seems very similar to KWP2000 but there are some differences.

1. Send a 3 byte message to id 0x214(apperently is the ecu id in this protocol, had to disassemble the flash to find this, not listed in the FR) for channel setup
  --> 0x214 3 0x01 0xC0 0xA1
  <-- 0x201 3 0x01 0xD0 0xA1

0x01- engine
0xc0- channel setup command(TPCI1 byte, like in KWP2000)
0xA1- offset from 0x700 for channel(means 0x7A1 will be id for comms)


2. Send 6 byte message to id 0x7A1 for timing parameters. ECU replies on 0x7A1 with it's timing parameters
 
  -->7A1 6 0xA0 0x0F 0x8A 0xFF 0x32 0xFF
  <--7A1 6 0xA1 0x01 0x94 0x83 0x82 0xD4

3. now, when I send startDiagSession command, there is no response. no ACK or anything at all.

Am i missing something? Or could it be that this TP is not mant for diag? I'm still trying to trace the disassembly but its getting harder with so  many possible responses!

regards
Nihal
Logged

www.tangentmotorsport.com

multimap/LC/rolling antilag for MG1/MED17/EDC17/MED9/EDC15

contact for reverse engineering services of any ECU/TCU
nubcake
Sr. Member
****

Karma: +53/-4
Offline Offline

Posts: 400


« Reply #1 on: May 13, 2017, 06:03:57 AM »

Try sniffing one of the diag tools, might shed some light on what to look for in the code.
Logged
nihalot
Full Member
***

Karma: +41/-3
Offline Offline

Posts: 117


« Reply #2 on: May 13, 2017, 06:47:18 AM »

Try sniffing one of the diag tools, might shed some light on what to look for in the code.
I don't think there's any tool implementing this protocol...
Logged

www.tangentmotorsport.com

multimap/LC/rolling antilag for MG1/MED17/EDC17/MED9/EDC15

contact for reverse engineering services of any ECU/TCU
nubcake
Sr. Member
****

Karma: +53/-4
Offline Offline

Posts: 400


« Reply #3 on: May 13, 2017, 01:26:39 PM »

This doesn't really look like TP2.0 communication, but at the same time looks awfully similar.
I can only assume that this is VW TP1.6 (basically, previous generation).
However, that is only regarding the transport layer.

The actual communication you have tried (I assume) was KWP2000, right?
Could be that it's not actually supported over CAN? Maybe try KWP1281?
Logged
nihalot
Full Member
***

Karma: +41/-3
Offline Offline

Posts: 117


« Reply #4 on: May 13, 2017, 03:10:52 PM »

I did some more experiments
After the 214 id init, if i send-
7A1 0xA0

Without any timing paramters, the ecu still acks with-

7A1 0xA1 0x94 0x83 0x82 0xD4

I did read on another site that some of the parameters are fixed in TP1.6, so maybe you are correct in assuming this is TP1.6.
Do you have any info about this protocol? I couldnt find much, jazdw.net only mentions it as similar but fixed parameters...

Thanks
Logged

www.tangentmotorsport.com

multimap/LC/rolling antilag for MG1/MED17/EDC17/MED9/EDC15

contact for reverse engineering services of any ECU/TCU
nubcake
Sr. Member
****

Karma: +53/-4
Offline Offline

Posts: 400


« Reply #5 on: May 13, 2017, 03:38:28 PM »

Unfortunately, in the same boat as you. Only whatever's in the google.
Logged
Tatan974
Newbie
*

Karma: +0/-1
Offline Offline

Posts: 19


« Reply #6 on: March 29, 2018, 07:27:16 PM »

Hi
What interface can communicate with protocol canbus to edc15 ?
Logged
zxcv
Newbie
*

Karma: +2/-0
Offline Offline

Posts: 19


« Reply #7 on: March 31, 2018, 09:43:54 AM »

maybe you want to look at

http://www.emotive.de/documents/WebcastsProtected/Transport-Diagnoseprotokolle.pdf

its german but for UDS and OBD over can the doc has good info on structure...

also your spec looks very similar to VW TP2.0 (regarding the parameter/chan setup for A0/A1)
how did you try to start the diag session ?

like 10 89 10 ? or 10 00 02 89 10 ?

Greets
« Last Edit: March 31, 2018, 09:47:48 AM by zxcv » Logged
zxcv
Newbie
*

Karma: +2/-0
Offline Offline

Posts: 19


« Reply #8 on: April 01, 2018, 09:07:47 AM »

check this book here

https://books.google.de/books?id=iv1VDZLKkDIC&pg=PA100&lpg=PA100&dq=TP+1.6&source=bl&ots=0SwUenEd6B&sig=3KIdmqXyfh77VcV7LBnoYg4jvi0&hl=de&sa=X&ved=0ahUKEwjs15KUupnaAhWBLVAKHXL5DjQQ6AEILjAA#v=onepage&q=TP%201.6&f=false

seems its TP1.6
Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.018 seconds with 17 queries. (Pretty URLs adds 0s, 0q)