Data exchange with Mercedes R172

Hello everyone,

I hope I'm in the right place, because I want to read out various standard parameters such as engine speed, speed, etc. from some Mercedes models, specifically the R172 SLK models from 2011 onwards, and the GLK models, which are approximately 7 years old.

I've now managed to access the CAN bus through the OBD2 port and have already started exchanging data with the R172.

My hardware consists of an ESP32 with a CAN adapter. I am sending the "raw data" to a PC via TCP/IP for my test setup.

If I send something now, the device responds with a large number of telegrams, approximately one minute's worth, sent one by one. Based on the IDs in the responses, I can't find any meaningful connection to the explanations, such as the PID 0x0D being used for speed, as explained in various forums.
I am sending, for example, 0x00 0x00 0x07 0xDF 0x02 0x01 0x0D 0x55 0x55 0x55 0x55 0x55 to query the speed.

Therefore, here are my questions.
Can I query a simple address, and if so, what string do I need to send on the CAN bus?

Is it even possible to query data points so easily, or is it encrypted from a certain model year onwards? I once read something about "CAN Secure" being used in cars at some point.

I appreciate your support.
Thank you, Frank.

First, the good news: your two vehicles are too old to be compatible with SecOC (Secure Onboard Communication). They're not doing that yet.

If you want to retrieve diagnostic data via CAN, you first need to address the corresponding control unit. Each control unit has its own unique ID in the vehicle. A generic OBD reader first initiates a functional inquiry to all control units (functional addressing) and then checks which ones respond. Based on the responses received on the CAN bus, you obtain the physical addressing, and you can then directly address the desired control unit and send corresponding PID requests (i.e., inquiries). Normally, you would check beforehand to see if PID support is available.

The numerous messages you receive in response to your request might contain answers to a functional query, along with physical addresses.

I just tested it on my vehicle, because I think the data you're sending is implausible. If I send the following request:
0x02 0x01 0x0D .... (Speed in mode 1)
I will receive the following response:
0x03 0x41 0x0d 0x00 (Response is 4 bytes long, 3 bytes payload, speed is 0 km/h)

Thank you for the quick response.

To which ID did you send it?

Okay, I'm going to try this now. I've just purchased a Y OBD2 cable and a current diagnostic tool. I'll connect it in parallel to my CAN interface and see what kind of data is being transmitted.

I will report .

Best regards, Frank.

The Y-cable trick is a clever move; it allows you to log bus traffic and directly identify diagnostic commands. For example, in my case, it was ID 0x700h, but there is no specification for the distribution of CAN IDs; that is up to the manufacturer.