Volvo D2 Transport Protocol

Pages: [1]

« previous next »

Author

Topic: Volvo D2 Transport Protocol (Read 3622 times)

prj

Hero Member

Karma: +915/-426
Online

Online

Posts: 5836

	Volvo D2 Transport Protocol « on: March 17, 2023, 06:10:05 AM »

Having a look at this abomination...
It seems like there is not much info available at the moment.
I looked briefly here: https://github.com/prometey1982/VolvoTools - but it is not implemented at all. Just a guesstimate is made based on the request as to what the length of the response should be.

While everything online is posted about the single frame mode, there is actually a full transport protocol here.
The first byte determines whether the transport protocol is used or not. If the MSB is set, then transport is used. This is also why ID's of all controllers are < 0x80.

Here's an exchange between ECU and tester with a multi-frame request/response, reading the ECU ID:

Code:

;   Message Number
;   |         Time Offset (ms)
;   |         |        Type
;   |         |        |        ID (hex)
;   |         |        |        |     Data Length
;   |         |        |        |     |   Data Bytes (hex) ...
;   |         |        |        |     |   |
;---+--   ----+----  --+--  ----+---  +  -+ -- -- -- -- -- -- --
     1)      4449.8  Rx     000FFFFE  8  CA 7A A1 00 00 00 00 00 
     2)      4469.3  Rx     00400021  8  CA 7A E1 00 00 00 00 00 
     3)      6923.8  Rx     000FFFFE  8  CB 7A B9 F2 00 00 00 00 
     4)      6944.9  Rx     00400021  8  8F 7A F9 F2 42 30 44 35 
     5)      6954.9  Rx     00400021  8  09 30 30 41 4D 41 43 20 
     6)      6965.0  Rx     00400021  8  0A 20 20 20 20 20 20 20 
     7)      6975.0  Rx     00400021  8  0B 20 20 20 20 20 20 20 
     8)      6985.0  Rx     00400021  8  4F 20 20 20 20 20 20 20

0xCx - Single frame
0x8x - First frame
0x4x - Last frame
In case of consecutive frames it seems there's some kind of serial numbering.

For FF, LF and SF there is a length encoded in the last three bits of the low nibble.
For CF the last three bits of the low nibble are the number of the frame.


	Logged

PM's will not be answered, so don't even try.
Log your car properly.

prj

Hero Member

Karma: +915/-426
Online

Online

Posts: 5836

	Re: Volvo D2 Transport Protocol « Reply #1 on: March 17, 2023, 07:08:02 AM »

As a side note, I am testing this on ME9 ECU.
Seems like it has to use transport here and without transport the ECU does not even reply.


	Logged

PM's will not be answered, so don't even try.
Log your car properly.

prj

Hero Member

Karma: +915/-426
Online

Online

Posts: 5836

	Re: Volvo D2 Transport Protocol « Reply #2 on: March 17, 2023, 09:03:13 AM »

Seems like this is a newer version of the protocol indeed.
The response ID is also on 0x400021 and not 0x21.


	Logged

PM's will not be answered, so don't even try.
Log your car properly.

daniel2345

Full Member

Karma: +11/-7
Offline

Offline

Posts: 188

	Re: Volvo D2 Transport Protocol « Reply #3 on: March 17, 2023, 09:22:30 AM »

ECU has to be in boot mode to use Communication without Format Identifier (=your first byte).
In diagnostic mode it is always used.


	Logged

prj

Hero Member

Karma: +915/-426
Online

Online

Posts: 5836

	Re: Volvo D2 Transport Protocol « Reply #4 on: March 17, 2023, 09:56:19 AM »

Quote from: daniel2345 on March 17, 2023, 09:22:30 AM

ECU has to be in boot mode to use Communication without Format Identifier (=your first byte).
In diagnostic mode it is always used.

Aha okay. So in boot mode they did not use a transport protocol.

Since I am not trying to flash anything, then it's not interesting to me.
Wonder why this info was so hard to come across... but I guess it's quite easy to deduce.
Scanned the B9 service on my ECU (which i'd compare to 0x1A on KWP):

Code:

0003: [] 03 00 00
00A0: [] A0 00 00
00F0: [0eT  A0hFB  A] F0 00 30 65 04 54 20 20 41 30 68 46 42 20 20 41
00F2: [B0D500AMAC] F2 42 30 44 35 30 30 41 4D 41 43 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
00F4: [] F4 00 0A 00
00F5: [0xU3 AA0wIP ABZZZZ] F5 00 30 78 55 33 20 41 41 00 1E 00 00 00 30 77 49 50 20 41 42 5A 5A 5A 5A
00F8: [] F8 00 00 00 02 96 05

DHA gives some insights what everything is.

Next to try and request some ram addresses and see what it thinks about that...


	Logged

PM's will not be answered, so don't even try.
Log your car properly.

dikidera

Full Member

Karma: +7/-6
Offline

Offline

Posts: 130

	Re: Volvo D2 Transport Protocol « Reply #5 on: April 30, 2023, 02:21:48 AM »

It is odd that for Denso, on the bench I cannot make the ECU return data for B9 F0(or any command that should return data) via D2

000FFFFE 0xCB 7A B9 F0 00 00 00 00 <- no reply. On the car there are no issues, but on the bench...it simply refuses to.
000FFFFE 0xCB 7A B9 F2 00 00 00 00 <- no reply.
000FFFFE 0xCB 7A B9 F8 00 00 00 00 <- no reply.

I can see the ECU streaming data via CAN, I can make it enter programming mode vs FF 86 command, I can even upload and run my own kernel, so I know it is receiving my commands. But for the life of me, I cannot get it to reply to these commands on the bench.

I am only powering the ECU via one 12v pin, specifically pin 10 as it was the easiest, could this be the reason?

Yes it was the other pin, 37(ignition). After connecting it, it now works. Perfect.


« Last Edit: April 30, 2023, 02:54:33 AM by dikidera »	Logged

dikidera

Full Member

Karma: +7/-6
Offline

Offline

Posts: 130

	Re: Volvo D2 Transport Protocol « Reply #6 on: May 04, 2023, 02:08:53 PM »

prj, thanks for the information, I believe then I can correlate what you wrote with the code over here

Still I am a bit far from my goal. And that is to see what the streamed data is in boot mode, how the CAN IDs are calculated, and potentially discover, which module they are for.


« Last Edit: May 04, 2023, 02:23:58 PM by dikidera »	Logged

Pages: [1]

« previous next »

Jump to:

Navigation

Personal Tools

April 19, 2024, 11:59:42 AM

Welcome, Guest. Please login or register.
Did you miss your activation email?

Navigation

Personal Tools

Search