Scanning the K line of a Mercedes Sprinter - KWP2000 detecte

Developer topics relating to hardware that interfaces PCs to ECUs

Moderator: Freon

Scanning the K line of a Mercedes Sprinter - KWP2000 detecte

Postby seccoxiru » Sun Nov 27, 2011 8:52 pm

Hello all.
This is my first message at this forum.
My father has a Mercedes-Benz Sprinter who has a 14 pin round diagnostic connector for to connect a diagnostic tool (We are currently using a genuine tool from Mercedes).

I find out the functionality of each pin present at the diagnostic connector using an oscilloscope (explained at my PDF log).

We have a genuine scanner tool of Mercedes-Benz (proprietary hardware and software of Mercedes) where we can see live data parameter like, RPM, coolant temperature, speed and many other parameters.  We also can read trouble codes using this tool.
What I need is to read live data from this diagnostic connector using my own hardware and a microcontroller (I am using a Microchip dsPIC30F MCU for now, but I can change to a Freescale or ST with ARM core later, if necessary). I want to read RPM, speed, coolant temperature and others, just by using my hardware and a MCU.

I did my own hardware suitable to read all data packets which flows trough the K-line at 10.400 bps, so I was able to read all request packets sent by the diagnostic tool and also the response packets from Sprinter. I find out that it uses the ISO14230 protocolo (also know as Keyword protocol 2000).

The hardware design was very simples:

K-line <-> ISO9141 hardware <-> UART2 @ 10.400bps <->  dsPIC30F4013 <-> UART1 @ 115200bps <-> MAX232 <-> PC with a serial port monitor software

Below is a link to a PDF file containing a report of my Logs where is shown the received packets and a study of each packet byte.

Code: Select all

After this logs, I noticed that Mercedes scan tool is using the Diagnostic Service named readDataByCommonIdentifier Request Service Id (0x22) to request data from K-line. When this kind of Service ID is used, the PID value is described by two bytes (a high and a low byte). This PIDs, in this case, are named as recordCommonIdentifier (2 bytes).

These are some recordCommonIdentifier PIDs used by the Mercedes tool to read live data, like RPM and coolant temperature: This can be viewed in the PDF log I did.
Code: Select all

and many other starting with a high byte (containing 1Dh value)

In all packets received by the PC, we can notice that the checksum byte (last byte) was always correct, so I have sure these packets are valid packets, to be "interpreted"

My questions are :
1) Is there any document where I can check the meaning of each PID and how to interpret the data bytes (To read the RPM correctly for example)?

2) Would it be a proprietary data encoding made by Mercedes-Benz? It is a way to make the user dependent on their scan tools to read data parameters from K-line?

3) I noticed that there is third-party tools who are able to read the same data that the genuine diagnostic tool from Mercedes is able to. Anyone have idea on how they did to build their own scanners for Mercedes Spritner and trucks/bus?

4) Do I need to make a reverse engineering to get the data with my own hardware?
Posts: 1
Joined: Sun Nov 27, 2011 8:50 pm

Re: Scanning the K line of a Mercedes Sprinter - KWP2000 det

Postby Sasha_A80 » Tue Nov 29, 2011 11:24 am

1 - It is not a rocket science to reverse engineer data log protocol provided you have a running scantool. Just a bias and a factor for each parameter is required moreover they often correspond to OBD II values.
2 - If you are too lazy to write your own datalogging PC software ( so am I ) I would recommend to implement any ready Logger and to write PIC code for protocol conversion ( I am routinely use SSM2 protocol under RomRaider\ecuExplorer and USB enabled PIC24 as a solution ). Or just write data log onto SDcard.

Have fun.
Posts: 102
Joined: Sun Aug 31, 2008 3:04 am
Location: Saratov, Russia

Return to Interface Hardware

Who is online

Users browsing this forum: No registered users and 1 guest