[TUTO] Télécodage et calibration d'un NAC / RCC / CIROCCO / CMB_NUM SANS Diagbox via Arduino
- Démarrée par VLud
- Date de début
Hey all.
I did a lot of reading, searching but I'm not entirely sure how to change BSI settings using this arduino. I was able to change two things in my RCC, change from single AC to dual AC and add G-force display. The issue is that AC is dual now, but I can't control second zone, it's always LO. I saw multiple posts about it, but no answer. I guess it has to be changed in BSI as well? And same for the second item. I added g-force display, but it's showing that the data are unavailable. I read about certain ECU type which supports that, but I have Peugeot 208 2020 Allure with iCockpit, full LED headlights and a lot of other crap. I was trying to figure out what to send through Arduino into BSI but I'm completely lost. Anyone able to help me with this? Thanks.
I did a lot of reading, searching but I'm not entirely sure how to change BSI settings using this arduino. I was able to change two things in my RCC, change from single AC to dual AC and add G-force display. The issue is that AC is dual now, but I can't control second zone, it's always LO. I saw multiple posts about it, but no answer. I guess it has to be changed in BSI as well? And same for the second item. I added g-force display, but it's showing that the data are unavailable. I read about certain ECU type which supports that, but I have Peugeot 208 2020 Allure with iCockpit, full LED headlights and a lot of other crap. I was trying to figure out what to send through Arduino into BSI but I'm completely lost. Anyone able to help me with this? Thanks.
Hello everyone.
I finally managed to turn on Park Assist in my 5008 II 2019 and it works
. A week of reading the entire Arduino forum. It helped and I would like to thank everyone on the forum for their help and useful information. Many thanks to @VLud for providing the program to NAC / RCC / CIROCCO.
And I read about Secured Traceability code 2E2901FD000000010101 but I forgot it somewhere, thank you @1 6 D for your reminder
I finally managed to turn on Park Assist in my 5008 II 2019 and it works
. A week of reading the entire Arduino forum. It helped and I would like to thank everyone on the forum for their help and useful information. Many thanks to @VLud for providing the program to NAC / RCC / CIROCCO.And I read about Secured Traceability code 2E2901FD000000010101 but I forgot it somewhere, thank you @1 6 D for your reminder
Hello, @marcins, @VLud I already have CVM2 installed and working perfectly. I recently bought the radar so I could have the ACC. However, to make it work I need to write to esp90, but I couldn't write with the key found in the Vlud files. Would there be another key, or are the keys individual? Follow the readings from my esp90 below. My car is a 3008 P84
Readings my ESP90
F080 >> 62F080982554978000039812786180FFFFFFFF1101FFFFFF01
F0FE >> 62F0FE0000000003920F0111030A1403FFFFFF0002000001926615
2100 >> 62210006A29212BDFB310000000060FF000000A420300B8CE3FFFAE01004FF03
2101 >> 62210106FFBFFFFFFFFFFEFFFFFFFFFFEFFFFFFF7FFF7FFFEFFFFFEFF8FFFF
2102 >> 62210206000000A400
2103 >> 62210306EFFFFFFF
Readings my ESP90
F080 >> 62F080982554978000039812786180FFFFFFFF1101FFFFFF01
F0FE >> 62F0FE0000000003920F0111030A1403FFFFFF0002000001926615
2100 >> 62210006A29212BDFB310000000060FF000000A420300B8CE3FFFAE01004FF03
2101 >> 62210106FFBFFFFFFFFFFEFFFFFFFFFFEFFFFFFF7FFF7FFFEFFFFFEFF8FFFF
2102 >> 62210206000000A400
2103 >> 62210306EFFFFFFF
Is it possible for you to attach your Wave2 .nac file which includes your zone info? I would like to cross-reference it to my Wave4. I think I miss something essential about it.
Also, the menu can be entirely missing because of a different calibration.
IF YOU ENTER WRONG KEY, ESP90 WILL BLOCK!!!
Once locked, no further encoding can be performed.
The ESP90 controller will function normally, but coding will no longer be possible. The same thing happens in AIRBAG if you enter the wrong KEY
Bonjour à tous,
je possède une DS7 et j'aimerai activer le park assist dessus mais avant de me lancer je prends un peu de temps pour comprendre comment s'y prendre afin de ne pas faire n'importe quoi.
J'ai compris que je devais mettre à jour des valeurs au niveau de plusieurs calculos et notamment le DAE via un arduino et en mode console (sauf pour le NAC grâce à la superbe appli de VLud)
Première question :
J'ai l'impression qu'il existe plusieurs protocoles : KWP2000 et UDS. J'ai remarqué qu'avec le DAE les seules exemples de commandes sont toujours du KWP2000, tandis qu'avec les autres c'est parfois en UDS, parfois en KWP.
J'ai compris qu'il fallait déverrouiller le calculo et établir la session et que des raccourcis existaient pour cela au niveau des commandes de Arduino (ce qui évite d'avoir à faire la réponse dans les 5s, etc.) mais y-a-t-il une raison particulière à choisir un KWP 2000 plutôt que UDS ?
si je pose la question c'est parce-que en KWP la commande d'écriture "34" ne prend qu'un octet pour la zone (par exemple A0) tandis qu'en UDS la commande d'écriture "2E" en prend deux octets (par exemple zone "2300" pour le BSI).
Est-ce que le protocole à utiliser dépend des zones du calculateur : zones en 2 octets (genre BSI ou AAS) ==> UDS, zones en 1 octet (DAE) ==> KWP ?
Si NON : cela signifie-t-il que la commande "2E00A0" est équivalente à la commande "34A0" ?
Si OUI : je ne suis pas certain d'avoir compris toutes les subtilités de la commande d'écriture KWP "34".
Ce que j'ai compris c'est que chaque écriture dans un calculo nécessite une écriture finale dans une zone spéciale (2901 en UDS et A0 en KWP, ce qui semble indiquer que les zones ne sont pas les mêmes selon le protocole...)
UDS : commande 2E2901FD000000010101, KWP commande 3BA0FFFD0000000101010000 (et non 34A0..., pourquoi une seconde commande d'écriture ? on dirait que c'est la vitesse de communication qui diffèrent entre les deux donc devrait fonctionner aussi avec 34 ?)
Ce que je comprends moins c'est un des messages de Albatros qui donne un exemple sur le calculo DAE (en KWP):
DAE_BVH2 : Modifier Zone A0 : Remplacer DD par CC
========
>6B5:695
81
21A0 => écrire la même chose mais mettre à jour le checksum je suppose selon technique vue plus bas ?
:2305:83:C0
34A00000000605CCFD000000F8A7
21A0
82
=> explication écriture A0:
34 -request download
00 -mem address high
00 -mem address medium
00 -mem address low
06 -mem size
05 -Id Tlc Dae
XX -coding option (AVEC STTA OU SANS STT,AVEC CITY PARK,AVEC LKA,AVECCONTROLE DYNAMIQUE,SANS AVA)
FD -site for Secured Traceability (https://github.com/ludwig-v/arduino-psa-diag/blob/master/SITES.md)
000000 -signature tool (https://github.com/ludwig-v/arduino-psa-diag/blob/master/SIGNATURES.md)
ZZZZ -checksum (voir plus bas)
Je ne comprends pas ici on dirait qu'en une seule écriture on a à la fois la valeur à réellement écrire "CC" ainsi que la gestion du "secure traceability" FD000000 sauf qu'on ne renseigne pas la date et qu'on a un checksum à ajouter et des adresse "haute/moyenne/basse" donc j'ignore complètement la signification. Est ce que 34A00000000605CCFD000000F8A7 permet d'écrire dans la zone A0 une seul octet "CC" ou cela fait davantage ?
Merci d'avance pour vos éclaircissements, soyez sûr qu'en retour je vous donnerai de mes nouvelles sur mes réalisations (ou non réalisations)
je possède une DS7 et j'aimerai activer le park assist dessus mais avant de me lancer je prends un peu de temps pour comprendre comment s'y prendre afin de ne pas faire n'importe quoi.
J'ai compris que je devais mettre à jour des valeurs au niveau de plusieurs calculos et notamment le DAE via un arduino et en mode console (sauf pour le NAC grâce à la superbe appli de VLud)
Première question :
J'ai l'impression qu'il existe plusieurs protocoles : KWP2000 et UDS. J'ai remarqué qu'avec le DAE les seules exemples de commandes sont toujours du KWP2000, tandis qu'avec les autres c'est parfois en UDS, parfois en KWP.
J'ai compris qu'il fallait déverrouiller le calculo et établir la session et que des raccourcis existaient pour cela au niveau des commandes de Arduino (ce qui évite d'avoir à faire la réponse dans les 5s, etc.) mais y-a-t-il une raison particulière à choisir un KWP 2000 plutôt que UDS ?
si je pose la question c'est parce-que en KWP la commande d'écriture "34" ne prend qu'un octet pour la zone (par exemple A0) tandis qu'en UDS la commande d'écriture "2E" en prend deux octets (par exemple zone "2300" pour le BSI).
Est-ce que le protocole à utiliser dépend des zones du calculateur : zones en 2 octets (genre BSI ou AAS) ==> UDS, zones en 1 octet (DAE) ==> KWP ?
Si NON : cela signifie-t-il que la commande "2E00A0" est équivalente à la commande "34A0" ?
Si OUI : je ne suis pas certain d'avoir compris toutes les subtilités de la commande d'écriture KWP "34".
Ce que j'ai compris c'est que chaque écriture dans un calculo nécessite une écriture finale dans une zone spéciale (2901 en UDS et A0 en KWP, ce qui semble indiquer que les zones ne sont pas les mêmes selon le protocole...)
UDS : commande 2E2901FD000000010101, KWP commande 3BA0FFFD0000000101010000 (et non 34A0..., pourquoi une seconde commande d'écriture ? on dirait que c'est la vitesse de communication qui diffèrent entre les deux donc devrait fonctionner aussi avec 34 ?)
Ce que je comprends moins c'est un des messages de Albatros qui donne un exemple sur le calculo DAE (en KWP):
DAE_BVH2 : Modifier Zone A0 : Remplacer DD par CC
========
>6B5:695
81
21A0 => écrire la même chose mais mettre à jour le checksum je suppose selon technique vue plus bas ?
:2305:83:C0
34A00000000605CCFD000000F8A7
21A0
82
=> explication écriture A0:
34 -request download
00 -mem address high
00 -mem address medium
00 -mem address low
06 -mem size
05 -Id Tlc Dae
XX -coding option (AVEC STTA OU SANS STT,AVEC CITY PARK,AVEC LKA,AVECCONTROLE DYNAMIQUE,SANS AVA)
FD -site for Secured Traceability (https://github.com/ludwig-v/arduino-psa-diag/blob/master/SITES.md)
000000 -signature tool (https://github.com/ludwig-v/arduino-psa-diag/blob/master/SIGNATURES.md)
ZZZZ -checksum (voir plus bas)
Je ne comprends pas ici on dirait qu'en une seule écriture on a à la fois la valeur à réellement écrire "CC" ainsi que la gestion du "secure traceability" FD000000 sauf qu'on ne renseigne pas la date et qu'on a un checksum à ajouter et des adresse "haute/moyenne/basse" donc j'ignore complètement la signification. Est ce que 34A00000000605CCFD000000F8A7 permet d'écrire dans la zone A0 une seul octet "CC" ou cela fait davantage ?
Merci d'avance pour vos éclaircissements, soyez sûr qu'en retour je vous donnerai de mes nouvelles sur mes réalisations (ou non réalisations)
Merci Albatros pour cette réponse rapide, mais alors pourquoi ne pas avoir simplement une commande 34A0CC, à quel endroit la nomenclature suivante est telle détaillée ?
00 -mem address high
00 -mem address medium
00 -mem address low
06 -mem size
05 -Id Tlc Dae
Car je ne l'ai vu nulle part ailleurs et la seule info que j'ai c'est dans les commandes KWP :
34XXYYYYYYYYYYYY = > Write Zone XX with data YYYYYYYYYYYY (Unit must be unlocked first)
il n'est pas précisé le contenu de YYYYYYYYYYYY
d'ailleurs cela semble contradictoire avec une autre commande KWP q:
348100000D07 => Prepare flash writing for .cal upload (Unit must be unlocked first)
puisque je ne vois pas comment le calculo ne comprends pas ici d'écrire à la zone 81 mais avec un contenu incomplet (on a 8 digits sur les 12 attendus)
Enfin j'ai aussi cette commande d'écriture :
3BXXYYYYYYYYYYYY => Write Zone XX with data YYYYYYYYYYYY (Unit must be unlocked first)
Quelle est la différence avec la commande 34XXYYYYYYYYYYYY ? vitesse de communication (500 KBits vs 115 Bits) uniquement ? on peut donc utiliser l'une ou l'autre comme on le souhaite ?
Enfin en protocole UDS la commande pour écrire est la suivante :
2EXXXXYYYYYYYYYYYY
pourtant j'ai vu des exemples de commandes ne contenir que 2 digits sur les 12 attendus :
2E230033
sauf pour la gestion du "secure traceability" qui semble nécessiter d'écrire dans la zone 2901, là on a 14 digits au lieu des 12
2E2901FD000000010101
et une description associé :
*Write* | *Traceability* | *Aftersales* | *Factory* | *01* | *January* | *2001* |
Je ne comprends pas pourquoi la commande d'écriture accepte une longueur variable, la seule raison serait selon moi qu'on peut choisir d'écrire plusieurs octets et non un seul mais d'après ce que tu dis ce n'est pas le cas
Dernière chose, tu indiques aussi qu'en retour si tu lis la zone tu obtiens :
21A0 -> 61 A0 05C0CC0002000001
CC n'apparaît qu'en 3ème position après 05 (Id Tlc Dae ?) et C0 ??
Don on a écrit plusieurs octets, pas seulement CC ?
I am trying to activate the menu in NAC which lets you change the warning, turn signal, seatbelt chimes etc..
Zone 23AB (COM2008 Sound Presence), if set to 01, changes these chimes with an older Peugeot variant.
Someone recommended zone 23B4 and I enabled it. I still don't have the sound menu in NAC.
I have enabled Harmony Sound tab in NAC using Vlud's app and I shared my zone configs in previous posts..
My car is a Citroen C5 Aircross with BSI 2010_EV and NAC Wave 4 (manufactured 11/2021)
Hi,
I activated Park Assist in my 5008 II GT-Line 2019 4 days ago.
The activation condition is to have 12PDC = 6 PDC front + 6 PDC rear
My old values before coding:
1. AAS_UDS_G5:
>75D:65D
1003
222101
answer from arduino: 62 2101 A5
1001 (closes sessions)
2.BSI:
>752:652
1003
222300
answer from arduino: 62 2300 13
1001 (closes sessions)
3.DAE_BVH2:
>6B5:695
81
21A0
answer from arduino:: 61 A0 05C0 CD 0002000001
82 (closes sessions)
You can check your values via Arduino in the terminal.
If you want, I can write step by step how I activated it.
Secured Traceability
2E2901FD000000010101
You enter it in BSI right after the first coding change, I just entered it there. Not in DAE_BVH2 and AAS.
Thank you for your reply.
I do have 12 PDC with 180 degrees View and « keep in line » feature so I think what lacks is just software activation.
I thought secure traceability need to be entered for each zone write but you say it is not usefull for DAE and AAS ?
However it seems DAE read and write commands (KWP protocol) doesn’t work the same as for BSI and AAS since read give severals bytes values. And write command (34) seems to include secure traceability.
I will try to read values from my car (DS7 from 2018) to see if there are the same as yours. By the way how did you know your AAS is G5 and not G6 (I believe open command is not the same) ?
Be careful, with my AAS_G5 I had to telecode it again with the secured traceability. Without it, the module turned itself off; parking sensors and blind spot detection stopped working.
Ok, so I will add the command to write secured traceability for each ecu I wrote on it.
Dernière édition:
I wrote secured traceability for BSI and AAS. With NAC it's not necessary with Vlud's app and DAE uses KWP protocol.
kwp protocol has his own secured traceability as far as I know, but it seems it could be included in single write operation since the value to change and the secured traceability use the same zone (A0). Maybe I am wrong with this assertion ?
You're right. I guess it's like this:
AAS_UDS_G5 - BOSCH (I think in cars 3008 II, 5008 II)
AAS_UDS_G6 - VALEO (I think in car DS7)
Be careful because I read how you will enter the wrong one:
IF YOU ENTER IN ECU WRONG UNLOCK KEY, ECU WILL BLOCK!!!
Once locked, no further encoding can be performed.
This certainly applies to ESP and AIRBAG. I read on the forum that AAS is also possible (but this information needs to be checked. Maybe someone from the forum knows the answer?)
When I telecoded AAS again but with secured traceability, it started working again so my guess is you don't have to worry about your AAS module becoming unusable or blocked.
34A0 000000 06 05 CC FD 000000 F8A7
34A0 > Request download to zone A0
00 00 00 > Memory address high, medium and low
06 > Memory size
05 > ID TLC DAE (I have no idea about the purpose of this)
CC > Options (for City Park, Lane Keeping Assist, Dynamic Control etc.) (This can be different between makes and models of cars)
FD > Site for Secured Traceability (FD for Aftersales, 00 for Factory)
000000 > Signature for Secured Traceability (000000 for Factory)
F8A7 > Checksum
Maybe I didn't explain exactly what it was about.
These are the UNLOCK KEYS to ASS provided by VLud
If you use the UNLOCK KEY not CODING in AAS_UDS_G6 from AAS_UDS_G5, the AAS will be blocked for encoding.
(but this information needs to be checked. Maybe someone from the forum knows the answer?)
Thank you onzar, but there is no way to check on which ecu we are trying to connect (since the command is the same for all AAS ECU, it is easy to send the bad unlock shortcut) ?
wdsmk > I already had this description about 34 command from previous Albatros post, but I don't know where it comes from and what this need. I just don't want to do something without understanding what I am doing... as far as I know it is just a writing command, but I wonder why the syntax seem so "strange" and different from the UDS protocol write command.
If I look at the readme file from arduino psa diag on git repo :
UDS Commands :
| 22XXXX | Read Zone XXXX (2 bytes) |
| 2EXXXXYYYYYYYYYYYY | Write Zone XXXX with data YYYYYYYYYYYY (Unit must be unlocked first) |KWP HAB Commands :
| 21XX | Read Zone XX (1 byte) || 3BXXYYYYYYYYYYYY | Write Zone XX with data YYYYYYYYYYYY (Unit must be unlocked first) |
KWP IS Commands :
| 21XX | Read Zone XX (1 byte) || 34XXYYYYYYYYYYYY | Write Zone XX with data YYYYYYYYYYYY (Unit must be unlocked first) |
It isn't clear : why read zone command is the same between KWP IS and KWP HAB ? since we use same command to open KWP session I don't understand how ECU can do the difference between them. Futhermore UDS Write zone command seem to be the same as for KWP (except the zone is coded on two bytes and not one), but when I look at examples I saw "2E230033" to write 33 byte value, but we need to use "34A0 000000 06 05 CC FD 000000 F8A7" to write only CC on zone A0 with KWP write zone command. Why ? There is not explanations about that in readme file, I juste don't understand why I can't use "34A033" command, is it specific to AED ACU ?
I'd really appreciate if someone could explain me or give me details about that.
The answer lies in your question.
UDS (ISO 14229-1) and KWP (ISO 14230) are two different automotive electronics communication protocols.
You are not. KWP HAB uses 10C0 and KWP IS uses 81 for opening diagnostic session.
UDS commands have a different layout and different measures to ensure secured traceability as you need to utilize a seperate zone write to 2901 for Secured Traceability for BSI. (check out Vlud's zone 2901 explanation for more info).
KWP's zone writing command combines Zone info and Secured Traceability into one.
The layout that you gave the example with does NOT apply in KWP IS nor KWP HAB.
Each communication protocol has its own differences in processing the telecoding.
Given that the communication commands are already reverse engineered and well available to use; my advice to you is to study the README file again and again, because that's exactly how I learned about the differences between these commands.
Thank you very much for taking the time to explain me wdsmk.
I didn't notice this difference since I only looked at the syntax of "easy unlock" commands :
:UNLOCK_KEY:UNLOCK_SERVICE
IAG_SESSION_ID### Explanation
| UNLOCK_SERVICE (HEX) | Protocol | Detail | *Equivalent command* |
| - | - | - | - |
| 01 | UDS | Download | *2701* |
| 03 | UDS | Coding | *2703* |
| 83 | KWP | Download/Coding | *2783* |
| DIAG_SESSION_ID (HEX) | Protocol | Detail | *Equivalent command* |
| - | - | - | - |
| 02 | UDS | Download | *1002* |
| 03 | UDS | Coding | *1003* |
| C0 | KWP | Download/Coding | *10C0* |
This command does not precise which KWP protocol you use, but actually I suppose this is HAB since the last "10C0" in last line (and CO shortcut value) apply to HAB one.
For the second point, the readme file explain this about KWP protocol (HAB) :
After each configuration writing you must write **A0** zone for the so called "Secured Traceability" to avoid *F303 DTC error* in the ECU
| Command | Zone | | [Site](https://github.com/ludwig-v/arduino-psa-diag/blob/master/SITES.md) | [Signature](https://github.com/ludwig-v/arduino-psa-diag/blob/master/SIGNATURES.md) | Day | Month | Year | Number of secured writings | Number of non-secured writings |
| - | - | - | - | - | - | - | - | - | - |
| 3B | A0 | FF | FD | 000000 | 01 | 01 | 01 | 2A | 00 |
| *Write* | *Traceability* | | *Aftersales* | *Factory* | *01* | *January* | *2001* | *42* | *0* |
*Number of secured writings "should" be increased after each writing*
Quick & dirty command that works everytime:
3BA0FFFD0000000101010000
So It seems that you can also have differents writes in KWP protocol (= not combined) as in UDS protocol since "standalone" command 3BA0FFFD0000000101010000 is designed only for that (for UDS it is 2E2901FD000000010101).
This is why, for me, the command seems to work the same way : if you put 2E230033 : you write 33 (one byte) value at zone 2300 in UDS protocol. If you put 2E2901FD000000010101 you write FD000000010101 (7 bytes) values at zone 2901 in UDS protocol, right ?
So now if I use 3BA0FFFD0000000101010000, what this shouldn't mean you write FFFD0000000101010000 (10 bytes) values at zone A0 in KWP HAB Protocol ? As 34A0 000000 06 05 CC FD 000000 F8A7 should mean I write 000000 06 05 CC FD 000000 F8A7 (12 bytes) values at zone AO in KWP IS Protocol.
Readme file doesn't tell anything about the decomposition you make :
00 00 00 > Memory address high, medium and low
06 > Memory size
05 > ID TLC DAE (I have no idea about the purpose of this)
CC > Options (for City Park, Lane Keeping Assist, Dynamic Control etc.) (This can be different between makes and models of cars)
FD > Site for Secured Traceability (FD for Aftersales, 00 for Factory)
000000 > Signature for Secured Traceability (000000 for Factory)
F8A7 > Checksum
=> all 34 commands shoud follow theses rules ? Or only 34A0 (since it is the same writing zone as the one used for "secured traceability") ? This apply for 3B too (KWP HAB) ?
Thanks again
inThank you very much for taking the time to explain me wdsmk.
I didn't notice this difference since I only looked at the syntax of "easy unlock" commands :
:UNLOCK_KEY:UNLOCK_SERVICE
### Explanation
| UNLOCK_SERVICE (HEX) | Protocol | Detail | *Equivalent command* |
| - | - | - | - |
| 01 | UDS | Download | *2701* |
| 03 | UDS | Coding | *2703* |
| 83 | KWP | Download/Coding | *2783* |
| DIAG_SESSION_ID (HEX) | Protocol | Detail | *Equivalent command* |
| - | - | - | - |
| 02 | UDS | Download | *1002* |
| 03 | UDS | Coding | *1003* |
| C0 | KWP | Download/Coding | *10C0* |
This command does not precise which KWP protocol you use, but actually I suppose this is HAB since the last "10C0" in last line (and CO shortcut value) apply to HAB one.
For the second point, the readme file explain this about KWP protocol (HAB) :
After each configuration writing you must write **A0** zone for the so called "Secured Traceability" to avoid *F303 DTC error* in the ECU
| Command | Zone | | [Site](https://github.com/ludwig-v/arduino-psa-diag/blob/master/SITES.md) | [Signature](https://github.com/ludwig-v/arduino-psa-diag/blob/master/SIGNATURES.md) | Day | Month | Year | Number of secured writings | Number of non-secured writings |
| - | - | - | - | - | - | - | - | - | - |
| 3B | A0 | FF | FD | 000000 | 01 | 01 | 01 | 2A | 00 |
| *Write* | *Traceability* | | *Aftersales* | *Factory* | *01* | *January* | *2001* | *42* | *0* |
*Number of secured writings "should" be increased after each writing*
Quick & dirty command that works everytime:
3BA0FFFD0000000101010000
So It seems that you can also have differents writes in KWP protocol (= not combined) as in UDS protocol since "standalone" command 3BA0FFFD0000000101010000 is designed only for that (for UDS it is 2E2901FD000000010101).
This is why, for me, the command seems to work the same way : if you put 2E230033 : you write 33 (one byte) value at zone 2300 in UDS protocol. If you put 2E2901FD000000010101 you write FD000000010101 (7 bytes) values at zone 2901 in UDS protocol, right ?
So now if I use 3BA0FFFD0000000101010000, what this shouldn't mean you write FFFD0000000101010000 (10 bytes) values at zone A0 in KWP HAB Protocol ? As 34A0 000000 06 05 CC FD 000000 F8A7 should mean I write 000000 06 05 CC FD 000000 F8A7 (12 bytes) values at zone AO in KWP IS Protocol.
Readme file doesn't tell anything about the decomposition you make :
00 00 00 > Memory address high, medium and low
06 > Memory size
05 > ID TLC DAE (I have no idea about the purpose of this)
CC > Options (for City Park, Lane Keeping Assist, Dynamic Control etc.) (This can be different between makes and models of cars)
FD > Site for Secured Traceability (FD for Aftersales, 00 for Factory)
000000 > Signature for Secured Traceability (000000 for Factory)
F8A7 > Checksum
=> all 34 commands shoud follow theses rules ? Or only 34A0 (since it is the same writing zone as the one used for "secured traceability") ? This apply for 3B too (KWP HAB) ?
Thanks again
KWP_HAB
3B= WDBLID -write data by local identifier
and here subcomand A0 means write secured traceability
34= REQDWN download command to download (load .cal(81) etc)
since
KWP_IS
3B=WDBLID -NOT EXIST
config ecu is realised by
34=REQDWN with subcommand
A0 =where here means Configuration ecu not secured traceability like in 3B=WDBLID
Thank you marcins (I am not sure I understand the difference between writing data and download command but I don't want to bother you more).
I finally tried to code my car, I met problem when trying to code AAS ecu, I got error 7F3E03 and 7F2783 error (Don't know what does it means) when I input :B6F0:03:03 shortcut command...
however I was pretty sure I have AAS_UDS_G6 ecu (I checked models with 12 channels on Internet, there are all from Valeo), and this is what onzar said about it : AAS_UDS_G5 - BOSCH (I think in cars 3008 II, 5008 II)
AAS_UDS_G6 - VALEO (I think in car DS7)
I tried severals time and got also "7F2724" error ("Unlocking - Request Sequence Error")
So I tried "
1F5:03:03" despite onzar warning "If you use the UNLOCK KEY not CODING in AAS_UDS_G6 from AAS_UDS_G5, the AAS will be blocked for encoding. (but this information needs to be checked. Maybe someone from the forum knows the answer?)" This time I got 7F2735 error, no idea what does mean (7F2736 mean "Unlocking - Exceeded number of attempts")
I hope I didn't lock my AAS ecu to telecode
to check what AAS you have just sendThank you marcins (I am not sure I understand the difference between writing data and download command but I don't want to bother you more).
I finally tried to code my car, I met problem when trying to code AAS ecu, I got error 7F3E03 and 7F2783 error (Don't know what does it means) when I input :B6F0:03:03 shortcut command...
however I was pretty sure I have AAS_UDS_G6 ecu (I checked models with 12 channels on Internet, there are all from Valeo), and this is what onzar said about it : AAS_UDS_G5 - BOSCH (I think in cars 3008 II, 5008 II)
AAS_UDS_G6 - VALEO (I think in car DS7)
I tried severals time and got also "7F2724" error ("Unlocking - Request Sequence Error")
So I tried "
This time I got 7F2735 error, no idea what does mean (7F2736 mean "Unlocking - Exceeded number of attempts")
I hope I didn't lock my AAS ecu to telecode
>75D:65D
1003
22F0FE and post reply
you get 62 F0 FE FF FF 00 00 YY ZZ 11 04 22 03 35 15 00 FF FF FF 00 02 00 00 02 xx xx xx (xx calibration ref)
06=Valeo
03=Bosch
33=Metasystem
E0=AAS Valeo
E1=AAS Bosch
E2=AAS Metasystem
Dernière édition:
Discussions similaires
