Stimulating the diagnostic CAN bus (Volkswagen)

'Does anyone know how the protocol works on the diagnostic bus (VW Golf 5)? Timing definitely seems important when sending responses. Here's a snippet of what I've observed (VAG-Com requests data, and I'm listening on the CAN bus):'

.....ID...DLC..........DATA..........
<< 0x200 7 xx xx xx xx xx xx yy (wobei yy die Zieladresse ist, z. B. (Motor control)
>> 0x2yy 7 xx ...
<< 0x740 6 a0 0f 8a ff 32 ff
>> 0x300 6 a1 0f 8a ff 4a ff
<< 0x740 5 10 00 02 10 89
>> 0x300 1 B1
>> 0x300 5 10 00 52 50 89
<< 0x740 1 B1

Die Nachrichten 0x200 und 0x740 werden von VAG-Com gesendet, 0x300 erhalte ich immer als Antwort (im späteren Verlauf auch die Meßwertblöcke).

D'Messages with a length of 1 seem to always increment between 0xB1 and 0xBf. Message 0x740 sends something similar, but values are regularly skipped: B1, B5, B9, BD, etc.

Does anyone have any idea how to proceed here and what the meaning of messages with a length of 1 is? Is there any documentation or information available?'ks?The messages with a length of 1 seem to always increment between 0xB1 and 0xBf. Message 0x740 sends something similar, but values are regularly skipped: B1, B5, B9, BD, etc.Does anyone have any idea how to proceed here and what the significance of messages with a length of 1 is? Are there any resources or links available?

B(x) is the confirmation that something has been received.

Have fun figuring out how the transport protocol works.

For your information, these are two protocol documents at once: one is a transportation protocol, and the other is a KW-P2000 protocol.

I haven't really explored the TP 2.0 yet; I only know that it's even more critical than TP 1.6. With TP 1.6, I still don't have a good grasp of the exact timing, and I always try to respond as quickly as possible, which sometimes leads me to answer too fast.

I printed out a couple of logs, took some colored pencils in my hand, and then started calculating. It's not that difficult with TP once you get the hang of it .

If a message (a single line) or even multiple messages (an entire block) with the ID 0x300 is present on the bus, then it appears that the first byte of each line is always important.

0x2y means: data row y.
0x1y means: End of a data block at line y.
0xBy means: Acknowledgment of the last received line 'y' of a data block.
0xA0 means: Connection Setup Request (Byte 2 contains block size n).
0xA1 means: Connection Setup Response.
0xA3 means: Connection Test.
0xA4 means: Break.
0xA8 means: Disconnect.

Please complete .

'I send with ID 0x740, and any message sent by another device is always acknowledged with 0x300. However, if I receive messages with 0x300, I must always acknowledge them with a message of 0x740.'

Regarding the incentivization of messages, it is becoming more difficult to determine what needs to be sent. There are a lot of data fields with mysterious meanings... :?

EDIT: I can now request measurement data blocks continuously. However, after approximately 30 blocks, the communication ends with error code 0xA8 . Device 0x740 (which is me) always sends 5 bytes, with the first byte being 0x1y (the last nibble 'y' increments from 0x1 to 0xf, then restarts at 0). This message includes the desired address of the measurement data block as the last byte.

vielleicht machst was mit den kwp2000 falsch oder du fliegst aus den netzwerkmanagement, keine ahnung(ferndiagnose ist da immer schlecht, am besten mal einen trace hier posten vom allen nachrichten die du sendetst um empfängst), vielleicht sendest du aber auch zu langsam oder zu schnell.
Your list is actually quite correct (at least if we're talking about TP 1.6). The A3 feature was only added in TP 2.0, which I haven't looked into yet (due to not having a Golf 5 and lack of time to play around with it).

Have you figured out what these two initial messages mean?
<< 0x740 6 a0 0f 8a ff 32 ff
>> 0x300 6 a1 0f 8a ff 4a ff

At first, I suspected they might be checksums or related to timing, but that wasn't the case.

Best regards,
Markus

P.S. Please remove the '?' next to 'A8'. }Have you actually figured out what those two opening messages mean?<< 0x740 6 a0 0f 8a ff 32 ff>> 0x300 6 a1 0f 8a ff 4a ffbest regards, markusPlease remove the '?' at the end of 'a8'. }

Have you actually figured out what those two opening messages mean?
<<0x740>> 0x300 6 a1 0f 8a ff 4a ff

If I send a message with 0xA3 after each data block acknowledgment, then I receive...

>> 0x300 6 a1 0f 8a ff 4a ff

I can then respond to that with a measurement request.

<< 0x740 5 11 00 02 21 xx (where 'xx' is the desired number of the measurement block).

If I consistently follow this procedure, then I can maintain the protocol. However, the logs show that VAG-Com 0xA3 only transmits every 0xF data blocks to the bus – which seems sufficient. I don't know why I have to constantly request the message with byte 0xa1...


It was only added in version 2.0 of the software/product...


Is TP 2.0 an open protocol? Are the specifications available? What about KWP2000?


Please remove the '?' after 'a8'.
done

Many car manufacturers use the KWP2000 protocol; unfortunately, after hours of searching on Google, I haven't really found anything that goes into detail.

für das transportprotukoll liegt die osek spezification zu grunde, die wurde aber mit sicherheit von vw noch ein bisschen an eigene bedürfnisse angepasst.
The OSEK organization (somehow a consortium of VAG, BMW, Mercedes-Benz, Opel, Bosch, Siemens...) probably made the documentation freely available on the internet (in English). Just check their FTP server.
<!-- m --><a class='postlink' href='http://www.osek-vdx.org/'>http://www.osek-vdx.org/</a><!-- m -->

Best regards,
MarkusThe OSEK organization (a consortium including companies like VAG, BMW, Mercedes-Benz, Opel, Bosch, and Siemens) probably made the documentation freely available on the internet (in English). Just check their FTP server.Best regards.Markus.

I borrowed the following (very recent) book:

Bus systems in automotive technology.
Carpenter, Schmidgall.
ISBN 3-8348-0235-2
2. Issue 4/2007.
here is the table of contents.

TP 2.0 and KWP2000 are explained in detail here (or so it seems). I'm going to read this now before continuing.

PS: Ich habe die Liste oben schon etwas vervollständigt. 0xA0 ist ein 'Connection Setup Request', 0xA1 ist die dazugehörige Antwort ('Response'). AStructure as follows:

Byte 2: Block size 'n', meaning a receipt is required after every 'n' data lines (1 to a maximum of 15).
Byte 3: Maximum allowed time T1 between the last message of a block and the acknowledgment.
Byte 4: T2 nicht definiert (i. d. R. 0xFF)
Byte 5: Minimum required time T3 between two consecutive messages.
Byte 6: T4 nicht definiert (i. d. R. 0xFF)

(T1 to T4 are 6-bit values with a 2-bit scaling factor; the factor indicates whether the time is 100 microseconds, 1 millisecond, 10 milliseconds, or 100 milliseconds.)

Hello.
Wokann man sich denn so ein gutes Buch ausleihen??
In our library, the books are all over 10 years old. Unfortunately, buying new books is not an option for us.
Best regards,
Frank.

The best thing to do is go to the university library of your choice. Often, even non-students can borrow books from university libraries.

Das ist ja ein geniales Buch.
Is it worth buying?

SGM

so it's still about timing , do you know in what units (ms, us, seconds?)

I need to get that book , scan it, and send it to me (no one has read it yet). Nonsense, it costs less than 40 euros at a very well-known bookstore, and I'm going to visit my bookstore tonight, which I haven't done in years.

so it's definitely about timing do you know in what units (ms, us, seconds?)

The scaling factor mentioned above determines the unit. I have added it above.

Okay, I now fully understand the part about TP 2.0. Here's a brief summary:

Establish a channel using 'Base ID 0x200':
Byte 1: Logical address (e.g., controller number, such as 0x02 for the transmission).
Byte 2: Opcode.
(e.g., 0xC0 for Request, 0xD0 for Positive Response)
Bytes 3 and 4: RX ID (0x10 for invalid).
Byte 5 und 6: TX ID (gewünschte ID für zu empf. Datenblöcke, z. B. 0x300)
Byte 7: Application Type (typically 0x01 for Volkswagen vehicles).
2. Receiving the response 'Base ID + Logical Address' (e.g., 0x202 for the transmission).
Bytes as described above; the sender shares a transmission identifier (TX ID) that will be used in the future to send data blocks.
3. Agree on the timing using the received TX ID.
4. etc.

Otherwise: The book is easy to read, and it's quite up-to-date (second edition from April 2007). It's probably worth buying for those who are interested.

buch ist schon bestellt, blos mein buchladen meines vertrauens meint ca 8 tage lieferzeit. naja in der zwischenzeit gehts weiter mit treiberprogrammieren.

However, the book has a disadvantage: if everything is explained as well as you suggest, there will soon be complete silence on this forum.

However, the book has a disadvantage: if everything is explained as well as you suggest, there will soon be complete silence on this forum .

Well, the CAN matrix of each car manufacturer will still not be available anywhere. Not to mention the other peculiarities that each manufacturer has with their protocols...

After the timing agreement, there's a small amount of communication that I don't understand.

<<0x740>> 0x300 1 B1
>> 0x300 5 10 00 02 50 89
<< 0x740 1 B1
<< 0x740 5 11 00 02 1a 9b

Okay, the first byte is now clear: 0x10 = block end + sequence number 0. 0x300 sends me similar data back, and the sequence number on the other side is also 0. Now, VAG-Com sends another block, with a sequence number of 1 (as expected).

What data is contained within the payload of the data blocks being sent here? Is this already KWP2000? At least with the engine control unit, I can omit this data and it will still work.

das hat nix mehr mit tp öffnen oder so zu tun, das könnte eine eröffnung für kwp2000 sein, so in der richtung hallo ich will kwp oder diagnose oder flashen .... sicher kann ich es dir nicht sagen.

grI'm sorry, but I can't translate that because it doesn't seem to be a complete sentence or phrase in German. It might be an abbreviation or a fragment of something else. Could you please provide more context or the full text?rkusBest regards.Markus.

I now have more information on how the KWP2000 component works on the diagnostic bus (more detailed information can be found in the book mentioned).

Example message:

<< 0x740 5 10 00 02 10 89

The payload of a TP 2.0 data block looks like this (I'm counting bytes starting from the first payload byte):

Bytes 1 and 2: Length of the payload in bytes (in the example, 2).
Byte 3: SID (Service Identifier), which indicates the selected service (e.g., 0x10 = Start Diagnostic Session, 0x1A = Read ECU Identification, 0x21 = Read Control Unit Values).
Byte 4: Some parameter, dependent on the SID (for SID 0x10, a 1-byte session number; 0x89 to 0xFE are manufacturer-specific sessions; for SID 0x21, the desired measurement block number is expected).

The response to a KWP2000 message looks similar. For example, here's the response to the message above:

>> 0x300 5 10 00 02 50 89

Bytes 1 and 2: the length remains as before.
'Byte 3: For positive responses, the transmitted SID (in the example, 0x10) is combined with 0x40 (resulting in 0x50 in the example). In case of a negative response, the SID is equal to 0x7F.'
Byte 4: In the case of a negative response, the SID is repeated here. In the case of a positive response, it appears that the sent parameter is repeated here (in the example, 0x89).
Byte 5: In case of a negative response, this byte contains the error code (0x10 = general reject, 0x11 = service not supported, 0x12 = subfunction not supported, etc.).

Für eine negative Antwort kann man mal einen nicht vorhandenen Meßwertblock anfragen.

The example above shows the opening of a diagnostic session via KWP2000. Session 0x89 is manufacturer-specific. By default, a control unit is in the default diagnostic session, where only limited services are available (for security reasons). I believe that it is not possible to write values to the control units in the default session. Therefore, opening a session should only be done when there are specific requirements; otherwise, it can be omitted.n.The example above shows the opening of a diagnostic session via KWP2000. Session 0x89 is manufacturer-specific. By default, a control unit is in the default diagnostic session, where only limited services are available (for security reasons). I believe that it is not possible to write values to the control units in the default session. Therefore, opening a session should only be done when there are specific requirements; otherwise, it can be omitted.