Scanning the K line of a Mercedes Sprinter - KWP2000 detected - Doubts about PIDs
11-28-2011, 12:14 AM
#1
Newbie
Thread Starter
Join Date: Nov 2011
Posts: 1
Likes: 0
Received 0 Likes
on
0 Posts
Sprinter
Scanning the K line of a Mercedes Sprinter - KWP2000 detected - Doubts about PIDs
Hello all.
This is my first message at this forum.
My father has a Mercedes-Benz Sprinter who has a 14 pin round diagnostic connector for to connect a diagnostic tool (We are currently using a genuine tool from Mercedes).
I find out the functionality of each pin present at the diagnostic connector using an oscilloscope (explained at my PDF log).
We have a genuine scanner tool of Mercedes-Benz (proprietary hardware and software of Mercedes) where we can see live data parameter like, RPM, coolant temperature, speed and many other parameters.* We also can read trouble codes using this tool.
What I need is to read live data from this diagnostic connector using my own hardware and a microcontroller (I am using a Microchip dsPIC30F MCU for now, but I can change to a Freescale or ST with ARM core later, if necessary). I want to read RPM, speed, coolant temperature and others, just by using my hardware and a MCU.
I did my own hardware suitable to read all data packets which flows trough the K-line at 10.400 bps, so I was able to read all request packets sent by the diagnostic tool and also the response packets from Sprinter. I find out that it uses the ISO14230 protocolo (also know as Keyword protocol 2000).
The hardware design was very simples:
K-line <-> ISO9141 hardware <-> UART2 @ 10.400bps <->* dsPIC30F4013 <-> UART1 @ 115200bps <-> MAX232 <-> PC with a serial port monitor software
Below is a link to a PDF file containing a report of my Logs where is shown the received packets and a study of each packet byte.
DOWNLOAD LINKS -* LOG WITH EXPLANATIONS
After this logs, I noticed that Mercedes scan tool is using the Diagnostic Service named readDataByCommonIdentifier Request Service Id (0x22) to request data from K-line. When this kind of Service ID is used, the PID value is described by two bytes (a high and a low byte). This PIDs, in this case, are named as recordCommonIdentifier (2 bytes).
These are some recordCommonIdentifier PIDs used by the Mercedes tool to read live data, like RPM and coolant temperature: This can be viewed in the PDF log I did.
and many other starting with a high byte (containing 1Dh value)
In all packets received by the PC, we can notice that the checksum byte (last byte) was always correct, so I have sure these packets are valid packets, to be "interpreted"
My questions are :
1) Is there any document where I can check the meaning of each PID and how to interpret the data bytes (To read the RPM correctly for example)?
2) Would it be a proprietary data encoding made by Mercedes-Benz? It is a way to make the user dependent on their scan tools to read data parameters from K-line?
3) I noticed that there is third-party tools who are able to read the same data that the genuine diagnostic tool from Mercedes is able to. Anyone have idea on how they did to build their own scanners for Mercedes Spritner and trucks/bus?
4) Do I need to make a reverse engineering to get the data with my own hardware?
This is my first message at this forum.
My father has a Mercedes-Benz Sprinter who has a 14 pin round diagnostic connector for to connect a diagnostic tool (We are currently using a genuine tool from Mercedes).
I find out the functionality of each pin present at the diagnostic connector using an oscilloscope (explained at my PDF log).
We have a genuine scanner tool of Mercedes-Benz (proprietary hardware and software of Mercedes) where we can see live data parameter like, RPM, coolant temperature, speed and many other parameters.* We also can read trouble codes using this tool.
What I need is to read live data from this diagnostic connector using my own hardware and a microcontroller (I am using a Microchip dsPIC30F MCU for now, but I can change to a Freescale or ST with ARM core later, if necessary). I want to read RPM, speed, coolant temperature and others, just by using my hardware and a MCU.
I did my own hardware suitable to read all data packets which flows trough the K-line at 10.400 bps, so I was able to read all request packets sent by the diagnostic tool and also the response packets from Sprinter. I find out that it uses the ISO14230 protocolo (also know as Keyword protocol 2000).
The hardware design was very simples:
K-line <-> ISO9141 hardware <-> UART2 @ 10.400bps <->* dsPIC30F4013 <-> UART1 @ 115200bps <-> MAX232 <-> PC with a serial port monitor software
Below is a link to a PDF file containing a report of my Logs where is shown the received packets and a study of each packet byte.
DOWNLOAD LINKS -* LOG WITH EXPLANATIONS
Code:
http://www20.zippyshare.com/v/61430902/file.html http://turboupload.com/1fne4j5ei946 http://speedy.sh/KB4E4/Mercedes-Sprinter-LOG.pdf
These are some recordCommonIdentifier PIDs used by the Mercedes tool to read live data, like RPM and coolant temperature: This can be viewed in the PDF log I did.
Code:
1D02h 1D0Eh 1D05h 1D08h 1D0Ah 1D07h 1D09h
In all packets received by the PC, we can notice that the checksum byte (last byte) was always correct, so I have sure these packets are valid packets, to be "interpreted"
My questions are :
1) Is there any document where I can check the meaning of each PID and how to interpret the data bytes (To read the RPM correctly for example)?
2) Would it be a proprietary data encoding made by Mercedes-Benz? It is a way to make the user dependent on their scan tools to read data parameters from K-line?
3) I noticed that there is third-party tools who are able to read the same data that the genuine diagnostic tool from Mercedes is able to. Anyone have idea on how they did to build their own scanners for Mercedes Spritner and trucks/bus?
4) Do I need to make a reverse engineering to get the data with my own hardware?
