Hacking CANBUS/kline/kwire

[winmutt]

Looking for any additional resources y'all might have squirreled away before I embark on this adventure. Canbus id mapping, any info on how kwire works for mercedes.

My car was running poorly and I forked over the $45 for hfmscanner, which I still think is worth it, but I want to explore more and do something open source. The ECU license seems to be tied to the specific serial or part numer and I had to replace my ECU and hfmscanner is not showing the additional parameters anymore.

 

[gsxr]

Looking for any additional resources y'all might have squirreled away before I embark on this adventure. Canbus id mapping, any info on how kwire works for mercedes.

I'd like to know more about this as well. There's no direct link to the CAN bus, you'll have to get creative to tap into CAN. The factory diagnostic tools (HHT, or HHT-Win on SDS) use a direct K-line through a multiplexer to each individual computer.

My car was running poorly and I forked over the $45 for hfmscanner, which I still think is worth it, but I want to explore more and do something open source. The ECU license seems to be tied to the specific serial or part numer and I had to replace my ECU and hfmscanner is not showing the additional parameters anymore.

Huh? This is on a 400E, right? Can you swap in the old / bad ECU and see if the additional parameters reappear in HFM Scan?


To get live data for diagnostics, the easiest solution is to shell out for a full SDS (Star Diagnostic System) with HHT-Win support. Based on recent reports, it seems you may want the new "M6" version instead of the C4. This isn't going to get you direct CAN bus access though.

 

[winmutt]

I'm getting places with this. I believe I will be able to get to logging by the end of the weekend. I'm writing a basic logger in golang so I can build precompiled binaries for any OS using the FTDI based VAGCOM KKL ODBII cable with the ODBii to 38pin plug adapter. The semantics of KWP2000/ISO1914 aren't terribly difficult to understand.

However, I am constantly surprised around every corner. The K Line pin on the OBDII is pin 7, I assumed it would map to the On Off ratio plugs but according to this, it maps to everything. I will have to ohm this out later.

Once I get the basics worked out, I am going to find some local kind soul with SDS that will let me sniff with an oscilloscope to see what the commands are to get error codes, reset, issue the LMM burn off, etc. I am mostly interest in the EZL, since that is what HFM didnt support.

Big dreams, lets see what I can deliver.
Resources:

GitHub - iwanders/OBD9141: A class to read an ISO 9141-2 port found in OBD-II ports.

A class to read an ISO 9141-2 port found in OBD-II ports. - iwanders/OBD9141

github.com

GitHub - aster94/Keyword-Protocol-2000: The KWP2000 is a communications protocol used for on-board vehicle diagnostics systems (OBD) by Suzuki (SDS), Kawasaki (KDS), Yamaha (YDS), Honda (HDS) and possibly more. It is standardized by ISO 14230

The KWP2000 is a communications protocol used for on-board vehicle diagnostics systems (OBD) by Suzuki (SDS), Kawasaki (KDS), Yamaha (YDS), Honda (HDS) and possibly more. It is standardized by ISO ...

github.com

https://emmd.ro/vagcom-usb

FTDI FT232x

Fast USB multi-protocol connectivity

periph.io

ecu_diagnostics::kwp2000 - Rust

Module for KWP2000 (Keyword protocol 2000 - ISO142330)

docs.rs

GitHub - bri3d/kwp2000: KWP2000 library for Java

KWP2000 library for Java. Contribute to bri3d/kwp2000 development by creating an account on GitHub.

github.com

GitHub - derpston/me7: Python interface to Bosch ME7 ECUs via KWP2000

Python interface to Bosch ME7 ECUs via KWP2000. Contribute to derpston/me7 development by creating an account on GitHub.

github.com

GitHub - trichard3000/mmll: the Most Minimal Linux Logger

the Most Minimal Linux Logger. Contribute to trichard3000/mmll development by creating an account on GitHub.

github.com

Pinout of the diagnostic connector Mercedes.

Mercedes diagnostic connector. The Pinout of the diagnostic connectors. The Pinout of the diagnostic connector Mercedes 38 pin: (-) ground contact. (+)

stardiag.net

1. (-) ground contact.
2. (+) power pin 15 or circuit 87.
3. (+) output power, circuit 30
4. contact K-line of the electronic control unit ECU(ECU) engine ( HFM-SFI, DFI, LH-SFI,IFI; ME-SFI — part right)
5. contact K-line scanning, the control UNIT (ECU) (ECU) engine (LH-SFI, ME-SFI — part left)
6. contact K-line scanning, the control UNIT (ECU) anti-lock braking system ABS, ASR traction control system, ESP stabilization system trajectory, ETS system, traction control.
7. contact K-line scanning, the control UNIT (ECU) ISC idle speed control UNIT (ECU) EFP EA throttle actuator accelerator electronic control UNIT (ECU) CC, thermostat, cruise control the cruise control.
8. contact K-line scanning, the control UNIT (ECU) BAS brake assist and BM of the main module
9. contact K-line scanning, the control UNIT (ECU) ASD automatic locking differential.
10. contact K-line scanning, the control UNIT (ECU) transmission(EATC, ETC)
11. contact K-line scanning, the control UNIT (ECU) active suspension (ADS)
12. contact K-line scanning block power steering (SPS, PML)
13. contact the engine speed signal (TD, TNA, TN)
14. contact enable, disable the oxygen sensor LH-SFI (right)
15. contact K-line scanning, the control UNIT (ECU) instrument cluster (IC, KI)
16. contact enable, disable lambda sensor LH-SFI (left)
17. contact K-line scanning, the control UNIT (ECU) of the air conditioner and heater (HEAT,Tempmatic, Automatic)
18. contact K-line scanning, the control UNIT (ECU) ignition (right side) (DI)
19. contact K-line scanning, the control UNIT (ECU) ignition (left side) (DI)
20. contact K-line scanning, the control UNIT (ECU) (DM)
21. contact K-line scanning, the control UNIT (ECU) (PSE) pneumatic suspension, W210 — multi-function control UNIT(ECU) DBE sunroof control, etc.
22. contact K-line scan module of comfort (CF) and ECU (ECU) roof (car RST)
23. contact K-line scanning, the control UNIT (ECU) RB circular security (W129)
24. contact K-line scanning ATA ()antitheft unit)
25. contact K-line scan TELE-AID — block
26. contact K-line scanning RDK control unit tyre pressure
27. Data are not available.
28. contact K-line scanning, the control UNIT (ECU) ASD automatic locking differential (W202)
29. contact K-line scanning sensors, the ECU PTS
30. contact K-line scanning the ECU, SRS, AB passive safety — airbags, belt tensioners safety
31. contact K-line scanning, the control UNIT (ECU) IRCL Central locking
32. contact — reset service intervals.
33. contact K-line scanning radio module (RD) and the navigation block
34. contact K-line scanning of the blocks in ICS, CNS communications, navigatsionnoi information
35. contact K-line scanning, the control UNIT (ECU) LWR headlamp adjust
36. contact K-line scanning, the control UNIT (ECU) STH HB — heaters of the main and additional
37. data not available.
38. data not available.

 

[gsxr]

On the 400E/500E, there's no direct link to the CAN bus, you'll have to get creative to tap into CAN wires. Yes, there is direct K-line to each individual computer, but that is not the CAN bus. These are two different things.

Your list above is a generic list, not 400E/500E specific. Poke around in this directory for 034/036 documents. Note that most of the 38-pin diagnostic connector is empty (no wire connections). The generic list in your previous post is for other Mercedes chassis which have additional systems.

 

[Alphasud40]

I’m curious as to what you are trying to gain from tapping into the data bus. Especially with an early version of CAN. I would imagine it’s just simple data sharing with very little diagnostic information. Reading codes on the individual modules would be more helpful and lead you to the can bus if there are communication issues. It either works or it doesn’t.

 

[gsxr]

I’m curious as to what you are trying to gain from tapping into the data bus. Especially with an early version of CAN. I would imagine it’s just simple data sharing with very little diagnostic information. Reading codes on the individual modules would be more helpful and lead you to the can bus if there are communication issues. It either works or it doesn’t.

I would like to be able to extract live data for purposes of datalogging, at the fastest update rate available. It would be awesome to graph (for example) a full throttle run through the gears, and view RPM / ignition angle / knock angle of each cylinder / injector duration / MAF airflow / etc. Even better if this was available in 0.1-second intervals or better. There's no way to do this with HHT-Win.

You are 100% correct that for most diagnostic purposes, datalogging at this resolution isn't necessary.

 

[Alphasud40]

Okay now I’m picking up what you are putting down. That’s a tough one. I think you would have to develop your own monitor from raw inputs rather than the can bus. Personally I’m surprised you can get the data at all from this early module that was cutting edge in the early 90’s. I don’t think the processor has the speed to walk and chew gum at the same time. And since timing information and knock retard isn’t something shared with LH real time that data is generated specifically for the HHT tester. I remember in 96 when we went to OBD2 for all US models baud rates were pretty slow. I think SAE set the minimum of 15Kbits. When Hyundai developed the OBD2 for their cars they took the minimum specs and set the ECU to that minimum. You could only look at one PID at the time to get a useable data PID. Select a few and it was like looking at a static display. We are definitely spoiled with current technology.

 

[winmutt]

Well for now I'm interested in kline. Baby steps. My interest is that Mostly because the cost of SDS is absolutely ludicrous for these cars today. This is right up my alley. KWP2000 is 10400 baud, but KWP2000 over canbus is in the mbit range.

 

[Alphasud40]

Well for now I'm interested in kline. Baby steps. My interest is that Mostly because the cost of SDS is absolutely ludicrous for these cars today. This is right up my alley. KWP2000 is 10400 baud, but KWP2000 over canbus is in the mbit range.

I will be interested to see if you can interpret the bus communication. I’m assuming the scan tool is providing data at a rate the control units are exporting the data and that is your bottle neck if you are looking for a faster rate of data transfer in Dave’s case. In your case if you are trying to create an economical scan tool for yourself you might have something others would pay for. Might make for a cool dashboard display.

 

[Jlaa]

Well for now I'm interested in kline. Baby steps. My interest is that Mostly because the cost of SDS is absolutely ludicrous for these cars today. This is right up my alley. KWP2000 is 10400 baud, but KWP2000 over canbus is in the mbit range.

SDS isn't that much right? I mean, you could go to carobdtool.com and get a complete package of a laptop, multiplexer, cables, and software for something like $650 no? For the amount of time / aggravation an SDS can save, $650 feels inexpensive? I mean, its like 1/8 the price of a set of headlights!

That said, trying to get to the CANBUS directly without relying on SDS is a really cool project.

 

[R129 UK]

@winmutt any update on this?

Thanks