How to do it?You haven't send new value to address 2901 to repair B1003
How to do it?You haven't send new value to address 2901 to repair B1003
I have a Wave 2 NAC. I don't know how can I help youGreetings ygorigor, thank you for the insight.
When 23AB is set to 01, the chimes change to an older variant (Peugeot 2012);
However, when I set 23B4 to 01 and set 23AB to 00, I still cannot access/find the submenu which lets you change the chimes.
I have a NAC Wave 4, BSI 2010_EV equipped on an 2022 C5 Aircross
I also attached my original NAC parameters in this post.
Hi,Hello, @marcins, @VLud I already have CVM2 installed and working perfectly. I recently bought the radar so I could have the ACC. However, to make it work I need to write to esp90, but I couldn't write with the key found in the Vlud files. Would there be another key, or are the keys individual? Follow the readings from my esp90 below. My car is a 3008 P84
Readings my ESP90
F080 >> 62F080982554978000039812786180FFFFFFFF1101FFFFFF01
F0FE >> 62F0FE0000000003920F0111030A1403FFFFFF0002000001926615
2100 >> 62210006A29212BDFB310000000060FF000000A420300B8CE3FFFAE01004FF03
2101 >> 62210106FFBFFFFFFFFFFEFFFFFFFFFFEFFFFFFF7FFF7FFFEFFFFFEFF8FFFF
2102 >> 62210206000000A400
2103 >> 62210306EFFFFFFF
Is it possible for you to attach your Wave2 .nac file which includes your zone info? I would like to cross-reference it to my Wave4. I think I miss something essential about it.I have a Wave 2 NAC. I don't know how can I help you
Yes, :60A5:03:03,Hi,
what key did you use to unlock the ESP90 - UNLOCK_KEY - :60A5: ?
IF YOU ENTER WRONG KEY, ESP90 WILL BLOCK!!!Yes, :60A5:03:03,
I tried others like 83:03 etc, but none unlocked esp for recording.
What are you trying to activate? In the C5ACIs it possible for you to attach your Wave2 .nac file which includes your zone info? I would like to cross-reference it to my Wave4. I think I miss something essential about it.
Also, the menu can be entirely missing because of a different calibration.
Merci Albatros pour cette réponse rapide, mais alors pourquoi ne pas avoir simplement une commande 34A0CC, à quel endroit la nomenclature suivante est telle détaillée ?@zzzzzz
>6B5:695
81
:2305:83:C0
34A00000000605CCFD000000F8A7
21A0
82
OUI, c'est uniquement l'écrirure de CC en A0.
I am trying to activate the menu in NAC which lets you change the warning, turn signal, seatbelt chimes etc..What are you trying to activate? In the C5AC
Hi,Merci Albatros pour cette réponse rapide, mais alors pourquoi ne pas avoir simplement une commande 34A0CC, à quel endroit la nomenclature suivante est telle détaillée ?
00 -mem address high
00 -mem address medium
00 -mem address low
06 -mem size
05 -Id Tlc Dae
Car je ne l'ai vu nulle part ailleurs et la seule info que j'ai c'est dans les commandes KWP :
34XXYYYYYYYYYYYY = > Write Zone XX with data YYYYYYYYYYYY (Unit must be unlocked first)
il n'est pas précisé le contenu de YYYYYYYYYYYY
d'ailleurs cela semble contradictoire avec une autre commande KWP q:
348100000D07 => Prepare flash writing for .cal upload (Unit must be unlocked first)
puisque je ne vois pas comment le calculo ne comprends pas ici d'écrire à la zone 81 mais avec un contenu incomplet (on a 8 digits sur les 12 attendus)
Enfin j'ai aussi cette commande d'écriture :
3BXXYYYYYYYYYYYY => Write Zone XX with data YYYYYYYYYYYY (Unit must be unlocked first)
Quelle est la différence avec la commande 34XXYYYYYYYYYYYY ? vitesse de communication (500 KBits vs 115 Bits) uniquement ? on peut donc utiliser l'une ou l'autre comme on le souhaite ?
Enfin en protocole UDS la commande pour écrire est la suivante :
2EXXXXYYYYYYYYYYYY
pourtant j'ai vu des exemples de commandes ne contenir que 2 digits sur les 12 attendus :
2E230033
sauf pour la gestion du "secure traceability" qui semble nécessiter d'écrire dans la zone 2901, là on a 14 digits au lieu des 12
2E2901FD000000010101
et une description associé :
*Write* | *Traceability* | *Aftersales* | *Factory* | *01* | *January* | *2001* |
Je ne comprends pas pourquoi la commande d'écriture accepte une longueur variable, la seule raison serait selon moi qu'on peut choisir d'écrire plusieurs octets et non un seul mais d'après ce que tu dis ce n'est pas le cas
Dernière chose, tu indiques aussi qu'en retour si tu lis la zone tu obtiens :
21A0 -> 61 A0 05C0CC0002000001
CC n'apparaît qu'en 3ème position après 05 (Id Tlc Dae ?) et C0 ??
Don on a écrit plusieurs octets, pas seulement CC ?
Thank you for your reply.Hi,
I activated Park Assist in my 5008 II GT-Line 2019 4 days ago.
The activation condition is to have 12PDC = 6 PDC front + 6 PDC rear
My old values before coding:
1. AAS_UDS_G5:
>75D:65D
1003
222101
answer from arduino: 62 2101 A5
1001 (closes sessions)
2.BSI:
>752:652
1003
222300
answer from arduino: 62 2300 13
1001 (closes sessions)
3.DAE_BVH2:
>6B5:695
81
21A0
answer from arduino:: 61 A0 05C0 CD 0002000001
82 (closes sessions)
You can check your values via Arduino in the terminal.
If you want, I can write step by step how I activated it.
Secured Traceability
2E2901FD000000010101
You enter it in BSI right after the first coding change, I just entered it there. Not in DAE_BVH2 and AAS.
Be careful, with my AAS_G5 I had to telecode it again with the secured traceability. Without it, the module turned itself off; parking sensors and blind spot detection stopped working.Thank you for your reply.
I do had 12 PDC with 180 degrees View and « keep in line » feature so I think what is pack is just software activation.
I thought secure traveability need to be entered for each zone write but you say it is not usefull for DAE and AAS ? It seems DAE read and write commands (KWP protocol) doesn’t work the same as for BSI and AAS since read give severals bytes values.
I will try to read values from my car (DS7 from 2018) to see if there are the same as yours. By the way how did you know your AAS is G5 and not G6 (I believe open command is not the same) ?
Ok, so I will add the command to write secured traceability for each ecu I wrote on it.Be careful, with my AAS_G5 I had to telecode it again with the secured traceability. Without it, the module turned itself off; parking sensors and blind spot detection stopped working.
I wrote secured traceability for BSI and AAS. With NAC it's not necessary with Vlud's app and DAE uses KWP protocol.Ok, so I will and the command to write secured traceability for each ecu I wrote on it.
kwp protocol has his own secured traceability as far as I know, but it seems it could be included in single write operation since the value to change and the secured traceability use the same zone (A0). Maybe I am wrong with this assertion ?I wrote secured traceability for BSI and AAS. With NAC it's not necessary with Vlud's app and DAE uses KWP protocol.
You're right. I guess it's like this:Be careful, with my AAS_G5 I had to telecode it again with the secured traceability. Without it, the module turned itself off; parking sensors and blind spot detection stopped working.
When I telecoded AAS again but with secured traceability, it started working again so my guess is you don't have to worry about your AAS module becoming unusable or blocked.You're right. I guess it's like this:
AAS_UDS_G5 - BOSCH (I think in cars 3008 II, 5008 II)
AAS_UDS_G6 - VALEO (I think in car DS7)
Be careful because I read how you will enter the wrong one:
IF YOU ENTER IN ECU WRONG UNLOCK KEY, ECU WILL BLOCK!!!
Once locked, no further encoding can be performed.
This certainly applies to ESP and AIRBAG. I read on the forum that AAS is also possible (but this information needs to be checked. Maybe someone from the forum knows the answer?)
34A0 000000 06 05 CC FD 000000 F8A7kwp protocol has his own secured traceability as far as I know, but it seems it could be included in single write operation since the value to change and the secured traceability use the same zone (A0). Maybe I am wrong with this assertion ?
Maybe I didn't explain exactly what it was about.When I telecoded AAS again but with secured traceability, it started working again so my guess is you don't have to worry about your AAS module becoming unusable or blocked.
34A0 000000 06 05 CC FD 000000 F8A7
34A0 > Request download to zone A0
00 00 00 > Memory address high, medium and low
06 > Memory size
05 > ID TLC DAE (I have no idea about the purpose of this)
CC > Options (for City Park, Lane Keeping Assist, Dynamic Control etc.) (This can be different between makes and models of cars)
FD > Site for Secured Traceability (FD for Aftersales, 00 for Factory)
000000 > Signature for Secured Traceability (000000 for Factory)
F8A7 > Checksum
Thank you onzar, but there is no way to check on which ecu we are trying to connect (since the command is the same for all AAS ECU, it is easy to send the bad unlock shortcut) ?Maybe I didn't explain exactly what it was about.
These are the UNLOCK KEYS to ASS provided by VLud
Voir la pièce jointe 35256
If you use the UNLOCK KEY not CODING in AAS_UDS_G6 from AAS_UDS_G5, the AAS will be blocked for encoding.
(but this information needs to be checked. Maybe someone from the forum knows the answer?)
The answer lies in your question.wdsmk > I already had this description about 34 command from previous Albatros post, but I don't know where it comes from and what this need. I just don't want to do something without understanding what I am doing... as far as I know it is just a writing command, but I wonder why the syntax seem so "strange" and different from the UDS protocol write command.
If I look at the readme file from arduino psa diag on git repo :
UDS Commands :
| 22XXXX | Read Zone XXXX (2 bytes) |
| 2EXXXXYYYYYYYYYYYY | Write Zone XXXX with data YYYYYYYYYYYY (Unit must be unlocked first) |
KWP HAB Commands :
| 21XX | Read Zone XX (1 byte) |
| 3BXXYYYYYYYYYYYY | Write Zone XX with data YYYYYYYYYYYY (Unit must be unlocked first) |
KWP IS Commands :
| 21XX | Read Zone XX (1 byte) |
| 34XXYYYYYYYYYYYY | Write Zone XX with data YYYYYYYYYYYY (Unit must be unlocked first) |
You are not. KWP HAB uses 10C0 and KWP IS uses 81 for opening diagnostic session.It isn't clear : why read zone command is the same between KWP IS and KWP HAB ? since we use same command to open KWP session I don't understand how ECU can do the difference between them.
UDS commands have a different layout and different measures to ensure secured traceability as you need to utilize a seperate zone write to 2901 for Secured Traceability for BSI. (check out Vlud's zone 2901 explanation for more info).Futhermore UDS Write zone command seem to be the same as for KWP (except the zone is coded on two bytes and not one), but when I look at examples I saw "2E230033" to write 33 byte value, but we need to use "34A0 000000 06 05 CC FD 000000 F8A7" to write only CC on zone A0 with KWP write zone command. Why ?
The layout that you gave the example with does NOT apply in KWP IS nor KWP HAB.There is not explanations about that in readme file, I juste don't understand why I can't use "34A033" command, is it specific to AED ACU ?
Thank you very much for taking the time to explain me wdsmk.You are not. KWP HAB uses 10C0 and KWP IS uses 81 for opening diagnostic session.
This is the backup file I get before I made changes in the NAC. Sory but I didn't get backup after I made changes.Is it possible for you to attach your Wave2 .nac file which includes your zone info? I would like to cross-reference it to my Wave4. I think I miss something essential about it.
Also, the menu can be entirely missing because of a different calibration.
inThank you very much for taking the time to explain me wdsmk.
I didn't notice this difference since I only looked at the syntax of "easy unlock" commands :
:UNLOCK_KEY:UNLOCK_SERVICEIAG_SESSION_ID
### Explanation
| UNLOCK_SERVICE (HEX) | Protocol | Detail | *Equivalent command* |
| - | - | - | - |
| 01 | UDS | Download | *2701* |
| 03 | UDS | Coding | *2703* |
| 83 | KWP | Download/Coding | *2783* |
| DIAG_SESSION_ID (HEX) | Protocol | Detail | *Equivalent command* |
| - | - | - | - |
| 02 | UDS | Download | *1002* |
| 03 | UDS | Coding | *1003* |
| C0 | KWP | Download/Coding | *10C0* |
This command does not precise which KWP protocol you use, but actually I suppose this is HAB since the last "10C0" in last line (and CO shortcut value) apply to HAB one.
For the second point, the readme file explain this about KWP protocol (HAB) :
After each configuration writing you must write **A0** zone for the so called "Secured Traceability" to avoid *F303 DTC error* in the ECU
| Command | Zone | | [Site](https://github.com/ludwig-v/arduino-psa-diag/blob/master/SITES.md) | [Signature](https://github.com/ludwig-v/arduino-psa-diag/blob/master/SIGNATURES.md) | Day | Month | Year | Number of secured writings | Number of non-secured writings |
| - | - | - | - | - | - | - | - | - | - |
| 3B | A0 | FF | FD | 000000 | 01 | 01 | 01 | 2A | 00 |
| *Write* | *Traceability* | | *Aftersales* | *Factory* | *01* | *January* | *2001* | *42* | *0* |
*Number of secured writings "should" be increased after each writing*
Quick & dirty command that works everytime:
3BA0FFFD0000000101010000
So It seems that you can also have differents writes in KWP protocol (= not combined) as in UDS protocol since "standalone" command 3BA0FFFD0000000101010000 is designed only for that (for UDS it is 2E2901FD000000010101).
This is why, for me, the command seems to work the same way : if you put 2E230033 : you write 33 (one byte) value at zone 2300 in UDS protocol. If you put 2E2901FD000000010101 you write FD000000010101 (7 bytes) values at zone 2901 in UDS protocol, right ?
So now if I use 3BA0FFFD0000000101010000, what this shouldn't mean you write FFFD0000000101010000 (10 bytes) values at zone A0 in KWP HAB Protocol ? As 34A0 000000 06 05 CC FD 000000 F8A7 should mean I write 000000 06 05 CC FD 000000 F8A7 (12 bytes) values at zone AO in KWP IS Protocol.
Readme file doesn't tell anything about the decomposition you make :
00 00 00 > Memory address high, medium and low
06 > Memory size
05 > ID TLC DAE (I have no idea about the purpose of this)
CC > Options (for City Park, Lane Keeping Assist, Dynamic Control etc.) (This can be different between makes and models of cars)
FD > Site for Secured Traceability (FD for Aftersales, 00 for Factory)
000000 > Signature for Secured Traceability (000000 for Factory)
F8A7 > Checksum
=> all 34 commands shoud follow theses rules ? Or only 34A0 (since it is the same writing zone as the one used for "secured traceability") ? This apply for 3B too (KWP HAB) ?
Thanks again
Thank you marcins (I am not sure I understand the difference between writing data and download command but I don't want to bother you more).in
KWP_HAB
3B= WDBLID -write data by local identifier
and here subcomand A0 means write secured traceability
34= REQDWN download command to download (load .cal(81) etc)
since
KWP_IS
3B=WDBLID -NOT EXIST
config ecu is realised by
34=REQDWN with subcommand
A0 =where here means Configuration ecu not secured traceability like in 3B=WDBLID
to check what AAS you have just sendThank you marcins (I am not sure I understand the difference between writing data and download command but I don't want to bother you more).
I finally tried to code my car, I met problem when trying to code AAS ecu, I got error 7F3E03 and 7F2783 error (Don't know what does it means) when I input :B6F0:03:03 shortcut command...
however I was pretty sure I have AAS_UDS_G6 ecu (I checked models with 12 channels on Internet, there are all from Valeo), and this is what onzar said about it : AAS_UDS_G5 - BOSCH (I think in cars 3008 II, 5008 II)
AAS_UDS_G6 - VALEO (I think in car DS7)
I tried severals time and got also "7F2724" error ("Unlocking - Request Sequence Error")
So I tried "1F5:03:03" despite onzar warning "If you use the UNLOCK KEY not CODING in AAS_UDS_G6 from AAS_UDS_G5, the AAS will be blocked for encoding. (but this information needs to be checked. Maybe someone from the forum knows the answer?)"
This time I got 7F2735 error, no idea what does mean (7F2736 mean "Unlocking - Exceeded number of attempts")
I hope I didn't lock my AAS ecu to telecode