Wednesday 18 January 2017

i.MX6SX - Prototype VW (VAG) vehicle diagnostic adapter for KWP2000 services (UDOO NEO)


An interesting use case for the i.mx6sx is as vehicle diagnostic (or interface) adapter. In this blog I will demonstrate how we can re-purpose a UDOO NEO as a prototype diagnostic adapter.



The adapter targets VW vehicles supporting KWP2000 services. Typically an adapter requires a real time interface to the vehicle in order to keep the diagnostic session alive after establishing communications with an ECU.  The real time needs can easily be met on the M4 and we can exploit the A9 side to offer data transformation and API services, for example to make the data available a Mobile application. The end goal is demonstrated in the video where a custom developed Android Application retrieves diagnostic information from the vehicle in real time. The application communicates over Wifi with the NEO which in turn is connected to the vehicles OBD-II port.

The application is first used to query the vehicle for a list of available ECUs (modern vehicles can contain tens of ECUs). For each ECU the physical address and overall status is displayed (OK or has DTC errors).

Subsequently after selecting an individual ECU the application retrieves information about the ECU including the short/long coding value (if applicable).



Although the video demonstrate a few KWP2000 services being invoked, its actually possible to invoke most if not all of the services available. Furthermore it could be enhanced to support UDS services.


At a hardware level VW KWP2000 is supported through CAN (some older vehicles use K-Line) and is accessible through the vehicles on board 16-pin OBD-II connector. For the prototype (in the photo to right) the NEO is simply connected to a SN65HVD230 which in turn is connected to the CAN pins of the OBD-II connector.


Typically VW KWP2000 services are supported over VW's proprietary TP2.0 protocol. TP2.0 is used to establish a session and pass datagrams between 2 ECUs, one of which is our case is the NEO and normally referred to as the 'tester'. Implementing TP2.0 is a challenge as accurate timings are required to correctly deal with time out and error scenarios in addition to implementing logic to cater for varying ECU behaviours depending on their age.  Above TP2.0 is the KWP2000 protocol which implements a simpler request response model. As shown the diagram below a complete TP2.0 and KWP2000 stack was developed to run on the M4.



On the A9 side KWP2000 services are exposed through a custom API interface that when invoked communicate with the M4 over a bidirectional link. The A9 allows the data to be enriched and transformed eg XML/JSON before being exposed via a number of network interfaces such as bluetooth, wifi or even ethernet. For the demo its done by enabling a  Wifi Access Point on the NEO. For those sharp eyed readers you will notice the prototype uses a NEO Basic which has no on board wifi support, instead a wifi dongle was plugged into the USB port to create the Access Point.

7 comments:

  1. Hi, what pins do you use for CAN in ODB Connector? Do you use pin 5 or pin 4 for ground or both? Do you use optocopplers on your CAN transceiver board?

    Best Regards,
    Konstantin

    Best Regards,
    Konstantin

    ReplyDelete
    Replies
    1. Hi,

      Pin 6 - CAN H
      Pin 14 - CAN L
      Pin 5 - GND

      No opto-isolator.

      Delete
    2. Hi, thanks, I got it working at 500kBps. Do I understand correctly, that I now have to open communication channel using VW TP 2.0 before I see anything? For now I only see one strange message repeated indefinitely:
      0x17F00010 with data bytes 20 10 00 00 00 00 00 10

      Thanks for your answer,
      Konstantin

      Delete
    3. The VW CAN gateway should be silent unless you establish a TP session with it, in fact it won't even respond to invalid requests. Therefore the repeating message your seeing doesn't look right unless its a CAN frame your are sending echoed back to you.

      Delete
  2. I am trying to read DTCs from my VW Polo ABS and Airbag modules (which run on TP 2.0) using an elm 327 device and PuTTY (similar to Hyperterminal). But I am not able to get past the initialization command.
    Command: AT SH 200
    Reply: OK
    Command: 01 C0 00 10 00 03 01
    Reply: NO DATA
    Can you please help me get the list of all AT commands I should hit to start reading DTCs in a VW car?

    ReplyDelete
    Replies
    1. Using an ELM 327 + Putty isn't the best option for VW TP 2.0 given the dynamic nature of the request/response protocl. If you want to find the initialisation commands for the ELM 326 refer to the code here https://github.com/jazdw/vag-blocks/blob/master/tp20.cpp .

      Delete
    2. I wrote a Python script to send commands to the ECU (based on the GitHub code), but that doesn't help either.
      Can you list the 'AT' commands (and other commands) I need to hit to get it initialized?

      Delete