Pages: 1 2 3 [4] 5
Author Topic: Logging with KWP-2000 protocol  (Read 40407 times)
Basano
Full Member
***

Karma: +70/-2
Offline Offline

Posts: 176


« Reply #45 on: April 08, 2014, 03:14:45 AM »

 Cheesy no, nothing as fancy as that.

Arduino with Sparkfun CANBUS shield and the Arduino IDE language (very similar to C).

Cheap and cheerful!
Logged
dream3R
Hero Member
*****

Karma: +14/-6
Offline Offline

Posts: 1202


« Reply #46 on: April 08, 2014, 10:41:59 AM »

Nice, I started in Arduino, the Uno has limited RAM but worked fine.

Chipkit is nice if you want more power Wink
Logged



How to work out values from an A2L Smiley

http://nefariousmotorsports.com/forum/index.php?topic=5525.msg52371#msg52371


Starting Rev's http://nefariousmotorsports.com/forum/index.php?topic=5397.msg51169#msg51169

noobs read this before asking http://nefariousmotorsports.com/forum/index.php?topic=9014.0title=


ORGORIGINAL 05 5120 creator for Volvo
ORIGINAL Datalogger (Freeware) Author
ORGINAL finder of the 'extra' torque' limits
I don't have ME7.01 A2L I just use ID
MIL_on
Full Member
***

Karma: +10/-1
Offline Offline

Posts: 118


« Reply #47 on: April 08, 2014, 10:41:13 PM »

did anyone else start implementing ME7Logger on Arduino?  Thats what i am just in...
the great thing about it would be that you are able to display every var you want on a display, log them via SD-Card without Laptop (maybe not so important) and connect external sensors and view everything in ECUxPlot!
Logged
Basano
Full Member
***

Karma: +70/-2
Offline Offline

Posts: 176


« Reply #48 on: April 16, 2014, 01:37:02 PM »

Hi all,

I’ve managed to modify the MED9.1 assembly code to allow me to specify ram locations larger than one byte for logging.

(The below explanation makes a lot more sense if you read the last couple of pages of this thread first)

Earlier in this thread I described a problem that I encountered when specifying DDLI’s (DefineDynamicLocalIdentifier) for logging. If I specified a block of memory locations, only the last location could have a size larger than one byte. All the other memory locations had to be one byte in size otherwise the command would fail. I tried a few combinations of the command, but never found a way around it. I don’t know if it’s my ecu or a general MED9.1 issue. If I wanted to log a 16 bit variable (two bytes) I specified the memory location (size one byte) and then the next consecutive memory location (again size one byte) and put them together to get the full 16 bits. Also, if your variables lay close together in memory, you could read a chunk of memory and parse it for what you want. Hmmm.

However I thought it would be neater when defining the DDLI to simply specify a memory location and size thereof. This is similar to how ME7Logger works and I don’t see why it couldn’t work here.  You’ve got twenty locations in the first DDLI and I didn’t want to waste them.

The mechanism of ME7Logger is really well described at the start of this thread. I began by defining a few random DDLI and then dumping the contents of the RAM (since the DDLI’s should live in RAM like ME7). Dumping the RAM was surprisingly simple – exactly the same as reading the flash, use the same KWP commands you’d use to retrieve the flash, but just specify the start location to be 0x800000 instead of 0x000000. After that I had a snapshot of the RAM. Search through that for the random DDLI’s previously defined and you can see the locations where they are written to. Then disassemble with IDA and look at the cross references that refer to those RAM locations. That gave me an entry point into the code that handles the DDLI definition.

After many dead-ends and puzzlement, I reached a section in the assembler that I’m reasonably sure checks the size of the DDLI’s. Basically it compares the size to another variable. I simply replaced the CMP operation with a NOP. Now when I specify a block of memory locations in a DDLI, I can specify the size of each location (no longer restricted to one byte for the prior locations) and the command is accepted. Once the command is accepted, the ecu happily works with the size parameter and outputs the expected data.

Attached are the before and after bins so you can see the change I’m talking about if you are curious. It’s a very small change (replace CMP with NOP).

I’d love to hear from anyone logging on MED9.1 to see if you faced a similar issue and how you’ve worked with it.
Logged
prj
Hero Member
*****

Karma: +289/-29
Offline Offline

Posts: 3516


« Reply #49 on: April 16, 2014, 01:48:29 PM »

Most people use VCDS for MED9.
The patch I don't like. This involves modifying the binary instead of just logging the car.

You should check where that variable comes from and see if it is possible to modify it.
Another approach is, since you know the variable address, then if it is not populated often, maybe it is possible to WriteMemoryByAddress on that variable before starting to log.

Or, just do what ME7Logger does and fill the DDLI structure directly via WriteMemoryByAddress?
« Last Edit: April 16, 2014, 01:50:14 PM by prj » Logged
Basano
Full Member
***

Karma: +70/-2
Offline Offline

Posts: 176


« Reply #50 on: April 17, 2014, 01:02:09 AM »

Most people use VCDS for MED9.

I use VCDS as well. I have the genuine article and it’s helped me more times than I can count. I worked on the ram logging because a) it was interesting b) I was looking at variables that aren’t present in the measuring blocks that VCDS reads (like rl_w and the PID variables)  c) the sample rate was a bit faster.

The patch I don't like. This involves modifying the binary instead of just logging the car.

Yes. If you are a pro and working on many vehicles, patching binaries is a bit impractical. I’ve got the one car which I tinker with day in and day out. I think you can choose how to log as circumstances allow and what is appropriate . Ram logging via DDLI works very nicely without any patches at all. The patch allows me to make the most of the DDLI’s in my scenario. ymmv.

You should check where that variable comes from and see if it is possible to modify it.
Another approach is, since you know the variable address, then if it is not populated often, maybe it is possible to WriteMemoryByAddress on that variable before starting to log.

Or, just do what ME7Logger does and fill the DDLI structure directly via WriteMemoryByAddress?

Read and WriteMemoryByAddress doesn’t work on my MED9.1. I’ve tried all sorts of variations, diagnostic levels and security access. I even tried defining a DDLI and then using WriteDataByLocalIdentifier to indirectly write the memory. No joy. Attached is an extract from the FR showing what services are described. I’d loved to be proved wrong, but even in the Funktionsrahmen, WriteMemoryByAddress isn’t mentioned (having said that, #34 RequestDownload isn’t described either, but that definitely works!)

Logged
prj
Hero Member
*****

Karma: +289/-29
Offline Offline

Posts: 3516


« Reply #51 on: April 22, 2014, 01:24:35 PM »

No easy way then besides making an automatic patcher to patch binaries.
That's pretty easy to do though.
I have so many ideas what to do, but I just do not have time when I have a carpark outside the shop needing tuning.

To make this accessible, one would need to implement this with a easy to get cable as opposed to standalone MCU setup.
For example ELM327, BMW K+DCAN or ask Ross-tech for specs and implement it with the VCDS cable.

The more interesting part is to parse the variable structure found in the ECU, so that the variable config can be auto generated, like ME7Logger does.
Logged
Basano
Full Member
***

Karma: +70/-2
Offline Offline

Posts: 176


« Reply #52 on: April 28, 2014, 02:18:25 AM »

Thanks,

I've got some ideas I will post up soon :-)
Logged
melodic
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 23


« Reply #53 on: August 12, 2014, 09:08:55 PM »

I have an interesting idea.
Take the arduino due (it has 2 canbus). Read needed groups by OBD can bus and transfer they to the dashboard instead song name. Also write logs to SD card. Maybe log G-sensor and GPS or anyone else. To control we can use cruise buttons.
Logged
dream3R
Hero Member
*****

Karma: +14/-6
Offline Offline

Posts: 1202


« Reply #54 on: January 01, 2016, 09:39:19 PM »

I'd like to reignite this if interest just as a hobby.
Logged



How to work out values from an A2L Smiley

http://nefariousmotorsports.com/forum/index.php?topic=5525.msg52371#msg52371


Starting Rev's http://nefariousmotorsports.com/forum/index.php?topic=5397.msg51169#msg51169

noobs read this before asking http://nefariousmotorsports.com/forum/index.php?topic=9014.0title=


ORGORIGINAL 05 5120 creator for Volvo
ORIGINAL Datalogger (Freeware) Author
ORGINAL finder of the 'extra' torque' limits
I don't have ME7.01 A2L I just use ID
dream3R
Hero Member
*****

Karma: +14/-6
Offline Offline

Posts: 1202


« Reply #55 on: January 01, 2016, 09:41:36 PM »

I use VCDS as well. I have the genuine article and it’s helped me more times than I can count. I worked on the ram logging because a) it was interesting b) I was looking at variables that aren’t present in the measuring blocks that VCDS reads (like rl_w and the PID variables)  c) the sample rate was a bit faster.

Yes. If you are a pro and working on many vehicles, patching binaries is a bit impractical. I’ve got the one car which I tinker with day in and day out. I think you can choose how to log as circumstances allow and what is appropriate . Ram logging via DDLI works very nicely without any patches at all. The patch allows me to make the most of the DDLI’s in my scenario. ymmv.

Read and WriteMemoryByAddress doesn’t work on my MED9.1. I’ve tried all sorts of variations, diagnostic levels and security access. I even tried defining a DDLI and then using WriteDataByLocalIdentifier to indirectly write the memory. No joy. Attached is an extract from the FR showing what services are described. I’d loved to be proved wrong, but even in the Funktionsrahmen, WriteMemoryByAddress isn’t mentioned (having said that, #34 RequestDownload isn’t described either, but that definitely works!)



With the Simos FR and comparing the Audi Diag DB there is $cmds missing from the FR for sure, here not so sure.
Logged



How to work out values from an A2L Smiley

http://nefariousmotorsports.com/forum/index.php?topic=5525.msg52371#msg52371


Starting Rev's http://nefariousmotorsports.com/forum/index.php?topic=5397.msg51169#msg51169

noobs read this before asking http://nefariousmotorsports.com/forum/index.php?topic=9014.0title=


ORGORIGINAL 05 5120 creator for Volvo
ORIGINAL Datalogger (Freeware) Author
ORGINAL finder of the 'extra' torque' limits
I don't have ME7.01 A2L I just use ID
kuebk
Jr. Member
**

Karma: +0/-0
Offline Offline

Posts: 30



« Reply #56 on: September 01, 2016, 01:39:47 PM »

Does anyone have experience with EDC17 logging over KWP2000?
ReadMemoryByAddress is not supported by this ECU, dynamicallyDefineLocalIdentifier (reading by memory address) should be supported (as FR says) but actually its not.

> 23 40 73 50 02 01 01
< 7F 23 11
> 2C F0 03 01 02 40 73 50
< 7F 2C 11

I had success with requestUpload/transferData but are there more efficient ways to read RAM?


Logged
ozzy_rp
Jr. Member
**

Karma: +13/-1
Offline Offline

Posts: 46


« Reply #57 on: September 02, 2016, 03:30:57 AM »

Does anyone have experience with EDC17 logging over KWP2000?
ReadMemoryByAddress is not supported by this ECU, dynamicallyDefineLocalIdentifier (reading by memory address) should be supported (as FR says) but actually its not.

> 23 40 73 50 02 01 01
< 7F 23 11
> 2C F0 03 01 02 40 73 50
< 7F 2C 11

I had success with requestUpload/transferData but are there more efficient ways to read RAM?

Try to use 0x35 command

Here line from Diagnostic Service Config with supported command:
DiagCom_ServiceTable_t <0x35, 0xFF, 0xFFFB, 8, sub_8007E8B2, sub_8007E880, off_8002ED18> ; requestUpload
Logged

MED17/EDC17 Reverse engineering
dream3R
Hero Member
*****

Karma: +14/-6
Offline Offline

Posts: 1202


« Reply #58 on: September 02, 2016, 12:27:29 PM »

Sounds like uds that?
Logged



How to work out values from an A2L Smiley

http://nefariousmotorsports.com/forum/index.php?topic=5525.msg52371#msg52371


Starting Rev's http://nefariousmotorsports.com/forum/index.php?topic=5397.msg51169#msg51169

noobs read this before asking http://nefariousmotorsports.com/forum/index.php?topic=9014.0title=


ORGORIGINAL 05 5120 creator for Volvo
ORIGINAL Datalogger (Freeware) Author
ORGINAL finder of the 'extra' torque' limits
I don't have ME7.01 A2L I just use ID
kuebk
Jr. Member
**

Karma: +0/-0
Offline Offline

Posts: 30



« Reply #59 on: September 02, 2016, 01:04:50 PM »

Try to use 0x35 command

Here line from Diagnostic Service Config with supported command:
DiagCom_ServiceTable_t <0x35, 0xFF, 0xFFFB, 8, sub_8007E8B2, sub_8007E880, off_8002ED18> ; requestUpload


I'm already using 0x35/0x36, but is there any other way?

Sounds like uds that?

It's KWP.
Logged
Pages: 1 2 3 [4] 5
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.04 seconds with 18 queries. (Pretty URLs adds 0s, 0q)