诊断仪器DIY--大众轿车诊断协议分析.doc

第一行为来自网络的原始文字第二行为翻译的文字The Baud rates are generally between 1k and 10,4k bit/s. 通讯波特率通常为 1200 BPS 到 10400 BPS 之间。Common today are 4800, 9600 and 10400 (for most OBD-II equipped ECUs).比较常用的波特率是 4800，9600以及10400 BPS（用于 OBD II 兼容的ECU）。however they could be any non-standard baudrate.虽然如此，也不排除使用其他任意的不寻常的波特率。with an interbyte time of approximately 10ms.字节与字节之间的时间差异大概为 10 ms 左右。Some definitions first:首先声明几个术语：The smallest repeatable transmission unit is a BLOCK. 通常最小的交换单位称之为“数据包”。The sum of all blocks transmitted within the framework of communication with a control unit is a TELEGRAM.所有在控制单元和诊断设备之间交换的数据包都包含一个“包计数器”。The unit (ECU or tester), which is authorized to output a block, is termed MASTER. Correspondingly, the receiverof a block is called a SLAVE. 在控制单元和诊断设备之间，数据包的发送者称之为“主设备”，反之，数据包的接受者称之为“从设备”。BLOCK Transfer:数据包交换： The bytes of a block that are transmitted by the master are returned by the slave complemented in bytes 主设备发送的数据包中的每一个字节，从设备都返回一个字节作为响应。返回的字节为接收字节的反码。原码 Xor FF = 反码Xor ：按位加法，不进位10110110+11111111=-01001001B6+FF=-49 i.e. the 1st byte of the master leads to the complemented 1st byte of the slave, 例如：主设备发送的第一个字节，紧跟从设备的响应的字节反码。 upon which the master transmits the second byte to the slave, and so on. 主设备接着发送第二字节，从设备紧跟着响应。如此反复 。 With this form of transmission the master will always know after every byte whether the transmitted byte has been correctly received. 通过这种格式，主设备可以确定发送的字节是否被从设备正确的接受。 The last byte of the block is not returned by the slave, it answers by transmitting the Block end $03 (if you like pascal) or 0x03 (if your more C inclined) ;-) 数据包的最后一个字节，没有响应。它只是作为一个数据包的结束标志。在Pascal语言中表示为：$03；在C语言中为：0x03。Blocks are built up of five parts. ( Please note: For the protocol, I will always be using hexadecimal values ! )数据包有五部分组成（注意：在这个协议当中，我将使用十六进制表示数据）。TypeAcronymdescription1.Block length 包长度number of bytes in block - excluding the Block end byte 数据包的字节数目，不包括包结束标志字节 0x032.Block counter 包计数器inc by 1 with every block - wraps from FF to 00 每传递一个数据包其值增加一。如果等于FF，回到00。3.Block title 包类型this is the command-type 命令包的命令类型，数据包的数据类型4.data 包数据a block could have NO data, i.e. the ACK block 包的具体数据，可能不包含数据，例如 ACK 包。5.Block end 包结束标志value of 03 hex 标志一个数据包的结束。十六进制 0x03example: An Acknowledge block would look like this:举一个例子说明：一个响应包看起来像这样：Note: the Block title (command) for the Acknowledge block is 09注意：ACK 包的包类型为 09valuecomment03Block length 包长度ZZBlock counter 包计数器09Block title (Acknowledge) 包类型（ACK 包）03Block end 包结束标志Now that weve covered the basics, you should easily understand the following communication. 在我们掌握了这些基本协议之后，我们比较容易理解下面描述的通讯协议！ This is an example of a log Ive taken from entering the Engine Controller (address 01) of a VW Polo Classic. 这个例子的数据来自VW Polo 的发动机控制单元。地址码为 01。The only deviation from what I have described above, is the 5 bps initialization. 当控制单元被初始化的时候，不采用正常的通讯波特率。首先使用 5 BPS 进行初始化。It works as follows: 初始化流程如下： the tester issues the 5 baud address of the controller it would like to initiate communication with. 诊断设备在5 BPS 的通讯速度发送控制单元的地址码。所以这时候速度比较慢。 数据格式：1/7/ODD/1 一个开始数据位，7位地址码，一个奇校验位，一个停止位。 所以地址只能在 00 - 7F 之间。其中 00 用于所有系统的故障查询。 should the ECU recognize its address, it will reply with a sync byte (55) 如果与地址码对应的 ECU 查询到地址码，它将返回字节 55。 which is used by the tester to determine the baudrate that the ECU would like to communicate at. 字节 55 用于告诉诊断设备 ECU 使用的波特率。55 看是来像这样：（稍后，我们会插入一个图片说明） following a short delay, the ECU will send a Key word (consisting of 2 Key bytes, first the Least Significat Byte, followed by the MSB) 大于10ms之后，ECU 将会发送 Key Word 关键字（有两个字节组成，首先是低字节，然后是高字节，两个字节组成一个字）。关键字协议：Key Word Protocol 以前大众公司使用 KWP1281，例如大部分发动机/变速器控制单元现在开始使用 KWP2000，例如 MK-60 ABS已经有CAN 诊断协议开始使用，比如 Golf V， Audi A8 。如何计算一个关键字 ？例如：01 8A 其中 01 为低字节 8A 为高字节。去掉最高为的校验位之后得到0A 01 =10 * 128 + 1 =1281。 所以称之为 KWP1281。KWP2000 与此类似。其中高字节固定为 8F。低字节随着使用的协议细节不同而不同。例如：6B 8F =2027 =KWP 2027。其中 8F -F = 15， 15 * 128 = 1920。然后与 6B 相加即可。 the tester replies with the complement of the Key MSB byte. 诊断设备发送关键字的高字节的反码作为响应。 This hands master mode to the ECU, and it starts outputting the ECU info. 现在开始，初始化成功。ECU 将向 诊断设备发送它的信息，例如 零件号码 。from PCfrom ECUcomments015 bps address of the Engine Controller 1start, 7data, odd parity, 1stop 5 BPS 发送控制单元地址码，1/7/ODD/155this is the sync byte to determine the baudrate (01010101) 1start, 8data, 1stop 同步字节，用于检测波特率，1/8/N/101Key word LSB 1start, 7data, odd parity, 1stop 关键字字节 1 1/7/ODD/18AKey word MSB 1start, 7data, odd parity, 1stop 关键字字节 2 1/7/ODD/175Complement of Key word MSB 关键字字节 2的反码 诊断设备发送原码 Xor FF = 反码Xor ：按位加法，不进位10001010+11111111=-011101018A+FF=-75Here follows the first ECU info Block. The first one is the Controller ID #: RSU906258? ECU 开始发送第一个数据包，一般来说是它的零件号码。from PCfrom ECUcomments0FBlock length - ECU is master 长度 15 字节，不包含 03 结束标志F0诊断设备发送的反码01Block counter 包计数器FEF6Block title - ASCII text follows 包类型：数据类型：ASCII 文本流0952RAD53SAC55UAA399C6300CF366C9322CD355CA388C73F?C020 DF20 DF03Block end 包结束了Now master mode is handed to the Tester (PC in our case) and it replies with the Ack Block.接着，诊断设备发送一个响应数据包到控制单元。from PCfrom ECUcomments03Block length - PC is master 包长度FC控制单元发送的反码02Block counter 包计数器FD09Block title - ACK command 包类型：命令包：响应F603Block end 包结束了Now the ECU replies with the Component #: 2.0 MP9.0 控制单元接着发送他的组件描述信息，一般需要两个包才能发送完成。 from PCfrom ECUcomments0FBlock length - ECU is masterF003Block counterFCF6Block title - ASCII text follows0920 DF322CD2E.D1300CF20 DF4DMB250PAF399C62E.D1300CF20 DF20 DF03Block endNow master mode is handed to the Tester and it replies with the Ack Block.诊断设备再次响应。from PCfrom ECUcomments03Block length - PC is masterFC04Block counterFB09Block title - ACK commandF603Block endNow the ECU replies with the Software Coding: 2PZARSU3 接着的数据包一般是组件描述的继续。from PCfrom ECUcomments0FBlock length - ECU is masterF005Block counterFAF6Block title - ASCII text follows09322CD50PAF5AZA541ABE52RAD53SAC55UAA333CC20 DF20 DF20 DF00Cut-off signal (NULL) - when NOT Coding FF03Block endNow master mode is handed to the Tester and it replies with the Ack Block.诊断设备再次响应。from PCfrom ECUcomments03Block length - PC is masterFC06Block counterF909Block title - ACK commandF603Block endNow the ECU replies with the Dealer Part #: 0261204?一般说来，这个数据包包括控制单元编码和服务站代码信息。from PCfrom ECUcomments0DBlock length - ECU is masterF207Block counterF8F6Block title - ASCII text follows09300CF322CD366C9311CE322CD300CF344CB3F?C03F?C03F?C003Block endNow master mode is handed to the Tester and it replies with the Ack Block.诊断设备再次响应。from PCfrom ECUcomments03Block length - PC is masterFC08Block counterF709Block title - ACK commandF603Block endNow the ECU replies with the Additional Info1: 2227355?一般说来，这是附加信息，例如 底盘号/防盗器ID 等等。from PCfrom ECUcomments0DBlock length - ECU is masterF209Block counterF6F6Block title - ASCII text follows09322CD322CD322CD377C8333CC355CA355CA3F?C03F?C03F?C003Block endNow master mode is handed to the Tester and it replies with the Ack Block.诊断设备再次响应。from PCfrom ECUcomments03Block length - PC is masterFC0ABlock counterF509Block title - ACK commandF603Block endThis implies that the ECU info Telegram is now complete.ECU 的信息发送完成了。The ECU and Tester will exchange Ack Blocks until comms is lost, ended or another command is issued from the tester.诊断设备和EC