arduino-psa-diag

Arduino sketch to send diagnostic frames to PSA cars

How to use

The serial console is used to send raw diagnostic frames, start it using 115200 baud rate. The sketch is meant to be used with line feed (LF) - new line - and without carriage return (CR) for each command.

Choose ECU

You have to choose the ECU you want to communicate with by inputing its diagnostic frame IDs in hexadecimal:

>CAN_EMIT_ID:CAN_RECV_ID

Examples

Telematic unit (UDS) access example:

>764:664

To access LIN ECUs (LIN over UDS) you must input diagnostic frame IDs in hexadecimal as well as ECU code

DGT7CFF LVDS Screen (LIN) access example:

>736:716
L47

Check out ECU_LIST.md inside the repo for other ECUs IDs pair

Easy Unlock

Once you are on the chosen ECU you can unlock it easily using this shortcut:

:UNLOCK_KEY:UNLOCK_SERVICE:DIAG_SESSION_ID

Explanation

Examples

NAC Telematic unit (UDS) unlock for coding example:

:D91C:03:03

AMPLI_AUDIO Amplifier unit (KWP) unlock for coding example:

:A7D8:83:C0

Check out ECU_KEYS.md for other ECUs keys

UDS Commands

KWP2000 (HAB - 125Kbits) Commands

KWP2000 (IS - 500Kbits) Commands

UDS Answers

UDS Errors

KWP2000 (HAB - 125Kbits) Answers

KWP2000 (IS - 500Kbits) Answers

Sketch Errors

Secured Traceability

UDS

After each configuration writing you must write 2901 zone for the so called "Secured Traceability" to avoid B1003 DTC error in the ECU

Quick & dirty command that works everytime:

2E2901FD000000010101

Writing counter

Each time you write the traceability zone a counter in increased inside C000 zone, this zone can't be rewrited

22C000

KWP

After each configuration writing you must write A0 zone for the so called "Secured Traceability" to avoid F303 DTC error in the ECU

Number of secured writings "should" be increased after each writing

Quick & dirty command that works everytime:

3BA0FFFD0000000101010000

PSA Seed/Key algorithm

Algorithm can be found here with some example source code

Diagnostic frames explanation / What the Sketch is doing

CAN-BUS is limited to 8 bytes per frame, to send larger data ~~PSA~~ automotive industry via ISO 15765-2 chose a simple algorythm to truncate the data into multiple parts

To send data smaller or equal to 7 bytes:

[SEND] Frame:

To send data larger than 7 bytes:

[SEND] First Frame:

[RECEIVE] Write Acknowledgement Frame:

[SEND] Second Frame:

ID starting at 0x21 and increasing by 1 for every extra frame needed, after 0x2F reverting back to 0x20

[SEND] Third Frame:

To receive data smaller or equal to 7 bytes:

[RECEIVE] Frame:

To receive data larger than 7 bytes:

[RECEIVE] First Frame:

[SEND] Read Acknowledgement Frame:

[SEND] Second Frame:

ID starting at 0x21 and increasing by 1 for every extra frame needed, after 0x2F reverting back to 0x20

[SEND] Third Frame:

Received frames could be out-of-order, ID must be used to append parts at the correct position into the final data whose size is known

Calibration file (.cal / .ulp) explanation

Type of file : Motorola S-record - https://en.wikipedia.org/wiki/SREC_(file_format)

1h = 1 HEX Byte or 2 characters in the .cal/.ulp file

Content Size (S2 frames - Zones data block)

Content Size (S3 frames - Binary data block)

Special frames

S0 (Hardware info)

S1 (Identification Zone - ZI)

S5 (Optional control frame - Number of frames in previous data block)

S7 (End of S3 frames data block)

S8 (End of S2 frames data block)

S9 (End of S1 frame data block)

Content Data

Checksums have to be computed by converting HEXADECIMAL to BINARY

Dump Mode

This sketch also provides a way to dump Diagbox frames (read & write) very easily, it is merging split CAN-BUS frames together to have a clean and "human readable" output. Just enable it this way in the source code:

bool Dump = true;

You can also use the serial console typing:

X

To revert into normal mode:

N

Example

You can build yourself that kind of cable using an OBD2 Extender cable to use both the Arduino and PSA Interface:

PINOUT

AEE2004 / AEE2010

⚠️ NEA2020

Original PINOUT is used for DoIP (Diagnostic over IP)

Reminder: In Dump mode the termination resistor should not be activated