Pages: [1] 2 3
Author Topic: Developing a Arduino Based version of ME7Logger  (Read 24780 times)
Cadensdad14
Full Member
***

Karma: +8/-1
Offline Offline

Posts: 134


« on: February 11, 2021, 09:27:50 PM »

*Disclaimer* Im an amateur.  I dont know a lot about coding or C++.  This code is not optimized, complete, or functional. 

Working File:
https://github.com/randumbintelrally/ME7_Logger_Arduino
the configuration is too complicated right now and I have tested this enough on enough ECUs to know it will work on anything but mine.  Will continue working on it and updating

Theres a lot of discussion on here of people wanting to implement ME7logger onto Arduino or RPi.  Prj says its easy and the information is out there and it can be put together pretty quickly.  The thing thats lacking everywhere is code to do it, examples, and specifics.

Ive been wading through this mess longer than I care to admit and trying to wrap my head around it and make working sketches.  I figure there are other people who want this.  And if i fail at it and do nothing more than give someone the database to build something off of, maybe I save them sometime.

Application Layer Protocol for KWP2000 ISO 14230-3
https://forum.arduino.cc/index.php?action=dlattach;topic=334778.0;attach=174852

Init Sequence:
https://www.blafusel.de/obd/vag_kw2000.html

Wiring Diagram for KKL leads.:
https://www.drive2.ru/b/2368649/
Im using the LM339N wired as the diagram shows, but only using pins 3, and 8-14.  Im connecting to the corresponding serial pins on a Teensy-LC, RX = 0, TX=1.

Right now I know the sequences with ME7Logger goes:
KWP2000 Fast Init Attempt
KWP2000 5 Baud Init (address 0x11)
Read System Supplier ECU Software Number
Start Diagnostic Session

At this moment, this sketch will:
KWP2000 5 Baud Init, Read System Supplier ECU Software Number, and start a Diagnostic Development Session

I understand that its not a lot, but its proof of concept.




« Last Edit: February 25, 2021, 07:53:20 PM by Cadensdad14 » Logged
Wommesz
Newbie
*

Karma: +2/-0
Offline Offline

Posts: 12


« Reply #1 on: February 13, 2021, 08:01:29 AM »

What works for me is getting a communication log, and annotating that, like done here:
https://jazdw.net/tp20

Then make sure you either have some hardware on your desk to talk to, or write a simulator.
I've done the latter. It's extra work, but it makes sure I don't knock anything over and debugging is simpler than
with real hardware.

Logged
Cadensdad14
Full Member
***

Karma: +8/-1
Offline Offline

Posts: 134


« Reply #2 on: February 13, 2021, 10:04:55 AM »

i cant get the tp2.0 working on the me7.  I have an ECU on the bench.  right now the conversation goes

In:   55 EF 8F      Init Response
Out: 70               Inverse Response
In:    EE              Inverse Address
Out:  02 1A 94 B0     Read ECU Identification For System Supplier Software Number
In:    0C 5A 94 31 30 33 37 33 36 33 33 35 34 FD Positive Response
Out:  03 10 86 63 FC  StartDiagnosticSession DevelopmentSession
In:    03 50 86 63 3C  Positive Response

and then im not sure if its in or out:
21 F0 C4 E0 58 56 F7 84 F6 F0 0E 25 F2

Is it possible that the development session changes the baud rate?  im not sure what the 0x63  is
Logged
Cadensdad14
Full Member
***

Karma: +8/-1
Offline Offline

Posts: 134


« Reply #3 on: February 14, 2021, 01:56:13 PM »

The speed does change with staring the development session.  Ive put a new one up that implements the changed speed.  Were through the first part of what ME7logger does in getting access to the system.  After this there are 2 readMemoryBy Address commands.  I believe they relate to this:
Found bootrom version 05.12/05.32 via readmem

then we need to do this:
Read pointer ... done
Store handler ... done
Verify handler ... done
Redirect pointer ... done

but the format stops the KWP2000 format its used up to here.
Logged
Cadensdad14
Full Member
***

Karma: +8/-1
Offline Offline

Posts: 134


« Reply #4 on: February 15, 2021, 11:23:21 PM »

So another update:

The format change was due to the limitations of the Length in the header.  Once the message exceeds a certain length, the header becomes 0x00 and the the following byte is the transmission length.

Ive gotten through the configuration message.  The ECU is rejecting the tester present message.  Im working on the ECU on the bench, and just logging a single transmission. 

Ive written the following sketch to parse out the commands, addresses, and constant data blocks.

https://github.com/randumbintelrally/KWP2000_Sniffer

The idea is to be able to spy on ME7Logger and be able to duplicate its inputs.

I feel like im a few days away from having a working example of this.  Hopefully my optimism isnt short lived.
Logged
prj
Hero Member
*****

Karma: +902/-419
Offline Offline

Posts: 5779


« Reply #5 on: February 16, 2021, 04:14:31 AM »

ME7Logger uses a hack (stolen from APR)
It finds the DDLI buffer in RAM and then redirects the pointer to a different (empty) RAM area.
Then fills that with WriteMemoryByAddress.

Your ECU does not have TP2.0, that's for sure.
Most likely it's TP1.6. The init is 3 bytes. If it even has CAN diags.

It is described in SAE J3054.
I am not sure I want to post it here, because the forum might receive a DMCA notice. But you can find it in some torrent files. Or you can buy it.

But TP1.6 and TP2.0 are CAN transport protocols.
They have nothing to do with a K-Line connection, which is what you seem to be using. So WTF? Smiley
Your data link layer is described in 14230-2.
« Last Edit: February 16, 2021, 04:23:43 AM by prj » Logged

PM's will not be answered, so don't even try.
Log your car properly.
Cadensdad14
Full Member
***

Karma: +8/-1
Offline Offline

Posts: 134


« Reply #6 on: February 16, 2021, 09:12:29 AM »

prj,
I was originally trying to work through the CAN-BUS lines using an MCP2515.  My concerns were primarily speed.  I had trouble sniffing the ftdi232 lines originally, but ive managed to get it working on a second attempt.  Ive just about got the program cobbled together.

I just got frustrated with everywhere finding people wanting to do this, but there not being any code of anyones project.

Ill be posting more up soon

   
Logged
prj
Hero Member
*****

Karma: +902/-419
Offline Offline

Posts: 5779


« Reply #7 on: February 16, 2021, 12:10:53 PM »

Step 1 is to implement ISO14230-2.
Step 2 is to implement ISO14230-3.

You are trying to do both at once.
Logged

PM's will not be answered, so don't even try.
Log your car properly.
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12229


WWW
« Reply #8 on: February 16, 2021, 05:31:33 PM »

I hate to say this but a open source C or python version of ME7Logger (to talk to a FTDI/CHxx) would be of much more general use, and would get more exposure for your project, and may attract more help, and would be easily portable to arduino if you architect it properly. Some FTDI/CHxx drivers would have to be C, of course, for tricky timing. Windows/Linux/OSX portability would be ideal, though OSX might be tricky.

In fact, if you can cobble together the right docs (no, avoid CAN and TPxx as prj suggests, stick to straight kline for now), I will try to spend some time on it. I do not have access to any ISO or SAE (14230, J3054 respectively) docs, however, so somebody else has to do the research or throw money at ISO.

And yes, prj, do not post any SAE docs here, nobody needs the hassle. ISO is maybe a bit "safer" to leak, but not by much.

PM me, though, if you want to discuss alternatives, depending on how much you trust me.

I might also add some sort of open-source ME7Info tool would be extremely useful; there are one or two projects that might provide a good start.
« Last Edit: February 16, 2021, 05:36:31 PM by nyet » Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
prj
Hero Member
*****

Karma: +902/-419
Offline Offline

Posts: 5779


« Reply #9 on: February 17, 2021, 03:27:47 PM »

https://github.com/commaai/panda
Open source implementations and hardware of 14230 and 15765.

I use J2534 myself, so never needed to implement these.
I have implemented TP2.0 recently though, since it's non-standard. It was really 1-2 evenings of work.

Doing a "ME7Logger" implementation using J2534 is ridiculously easy. But I don't see any point.
The big work is in doing a "ME7Info". Well, I did it differently and I can find almost every variable in the bin if I have a similar A2L.
But I am not going to be implementing a parser for C167, there is no money in it for me. I have PPC VLE and TriCore, and I'm doing PPC ISA now, it takes a lot of time to adapt disassembling libraries to be able to do automatic variable matching.

The matching algo itself is the same though, it's architecture-agnostic. The big deal is disassembling and parsing the disassembly to generate the metadata. I've sunk months into this at this point.
« Last Edit: February 17, 2021, 03:33:49 PM by prj » Logged

PM's will not be answered, so don't even try.
Log your car properly.
Cadensdad14
Full Member
***

Karma: +8/-1
Offline Offline

Posts: 134


« Reply #10 on: February 17, 2021, 10:23:11 PM »

I dont have my head wrapped completely around everything and I havent tested this on a vehicle to make the correlations and work out the bugs.  But im getting mostly positive responses from an ECU on the bench and its doing everything ME7logger does, except the ECU responses are longer at the end.  Maybe I need the tester present message but ME7logger gets a negative response on that so I havent included it.

This is a long way from done and needs to be entirely rewritten

Step 1:  Load K_Line_Spy_Config.ino onto the Teensy
Step 2:  Use FTDI chip to LM339 chip to access ECU. Attach RX line from Teensy to RX line on FTDI chip
Step 3:  Run ME7Logger configured for your ECU with Serial Monitor Open.  Run to take single sample.
Step 4:  Serial monitor will produce the tables from ME7logger to configure the arrays in the config.h file
Step 5:  Load the Version_1.ino file onto the Teensy with the edited arrays in Config.h

You should get out the raw hex that ME7logger receives.  Not done.  But more improvement.  Im going to e able to start checking it for the 2.7t tomorrow and finding my references.  Then I can hopefully start polishing it up into something functional.

Im sure there are ways I could get more help or exposure, but right now I know what I know because of this site and the problems I have that Im trying to solve.

https://github.com/randumbintelrally/KWP2000_Access
https://github.com/randumbintelrally/KWP2000_Sniffer
Logged
Cadensdad14
Full Member
***

Karma: +8/-1
Offline Offline

Posts: 134


« Reply #11 on: February 25, 2021, 07:56:34 PM »

And it works.  Theres a lot of refinement left to do on the configuration side, but at least it can start communication, configure the memory, and then read it accurately.  Im getting a pcb made up and will be able to start testing it shortly.

https://github.com/randumbintelrally/ME7_Logger_Arduino
Logged
adam-
Hero Member
*****

Karma: +122/-33
Offline Offline

Posts: 2177


« Reply #12 on: March 02, 2021, 01:06:21 AM »

This is awesome! 

I'll be using this for the FIS control because the current method is IMO very clunky.  This seems more refined!  Well done!
Logged
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12229


WWW
« Reply #13 on: March 02, 2021, 02:39:03 PM »

Nice!
Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12229


WWW
« Reply #14 on: March 02, 2021, 02:40:33 PM »

I confess I dont know much about arduino dev, but .h files should not have code.
Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
Pages: [1] 2 3
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.023 seconds with 17 queries. (Pretty URLs adds 0s, 0q)