openecu.org

Hey guys... I'm trying to figure out what the KWP2000 addresses would be if using either functional or physical request modes.

I see that in the ecuExplorer source code
IE_SSM_HEADER = 0x80
IE_SSM_SSM = 0x10
IE_SSM_ECU = 0xF0

Which means that it uses the physical request mode and the
target(ecu) address is 0xF0 and source(tester) address is 0x10. Are those addresses specific to Subaru? If not, how does one know 0x10 is the tester address... are they defined somewhere?

I'm trying to build a logger that does KWP2000, not SSM because I'd like the logger to be used with ISO cars other than Subaru.

Thanks in advance.

Also I did find that in functional mode, 0x33 is the target address. The ecu(s) responsible for the request on the bus will return a response. What would one use as the source address in this instance?

Futher google results/reading I see that a scan tool is normally address 0xF1

So with that, I can send Functional addresses

[functional]0xC0 [target]0x33 [source]0xF1 [length]0xnn
[data]....[chksum]0xnn

That should do the trick I'm assuming.

still getting crap back when sending packets out...

Does Tactrix always have to be 4800 baud or is that just SSM? I'm attempting 10400 baud as is called for by the ISO standard.

anyone...is this thing on?

Heh, on air
4800 baud is SSM specific I guess..
What happens if you try 10400 baud ?

Has anyone disassembled the SSM and ODBII parts of the ECU?
Are there two UARTS?

Sorry, no answers just more questions

well the packet structure is the same. The addressing methods are different.

According to specs, If I use functional adressing 0xC0 as my packet type, all ecu's on the bus that support the command I send should return an answer if supported. This is useful if you don't know a target address (which I assume one would not if they're building a generic-make ISO logger)

All the logging source code found on this site uses physical addressing 0x80 with specific source/target addresses 0x10 for the target (ecu), 0xf1 for the source (laptop)

Questions would be is 0x10 specific to subaru, or is that a general starting address for the target, like 0xF0 is the general starting address for the source?

I've sent the quick init packet, still no luck.

I've got the basics down, just not seeing results and need to know if anyone knows why.

re-reading crap I can find on the 'net...


functional addressing..

for OBD2 emissions information, target address 0x33 is required for KWP2000. Which is what I'm using.


The J2178 spec documents is what I need.

well I'm doing it right, perhaps it's a comm settings issue... going to start trying different baud rates other than 10400 i guess...

my packets are Cn 0x33 0xF1 [serviceID] [databyte]...[checksum]

Will double check to ensure my checksum value is correct...

if all else fails I'll say fork it and do a SSM scanner.

apparently one needs to use Xon/Xoff with the tactrix cable?

tried every handshake method, set DTR etc... still getting same results back... still think it's a comm settings issue.

MDTURBO wrote:apparently one needs to use Xon/Xoff with the tactrix cable?

no. definitely not. nor do you use hardware handshaking. none of that is applicable to K-line communications. you just 'take turns talking'...

MDTURBO wrote:
All the logging source code found on this site uses physical addressing 0x80 with specific source/target addresses 0x10 for the target (ecu), 0xf1 for the source (laptop)

Questions would be is 0x10 specific to subaru, or is that a general starting address for the target, like 0xF0 is the general starting address for the source?

0x10-0x17 is the range reserved for ECM's (motor control ECU's) , 0xF0-0xFD for testers.
Most manufacturers use 0x10 but I have seen one using 0x10 for gasoline and 0x11 for diesel engines. Testers usually have the 0xF1 address but can have any address in the the tester range - the ECU should use the source address in the request package as destination address in it's reply.

OBDII emission testers are an exception, they must have the 0xF1 address and the ECM must be functionally addressed as 0x33.
Keep in mind also that there are only 9 (0x01 - 0x09) ServiceID's defined for OBDII emission tests - they give emission related info but not much more.

^^ Thank you for finally shedding some light!

I guess I'll try the physical format and see what happens... as of right now everything I send out is getting echo'ed back to me. :/

Have you seen this thread?:
http://forums.openecu.org/viewtopic.php?t=115&highlight=odb+ssm
se the posts by fastchip and cboles..