-
Notifications
You must be signed in to change notification settings - Fork 56
K LINE Library
The K-LINE library supports KW1281 and KWP2000 protocols. It has functions for security login, standard and extended diagnostics, as well as some advanced diagnostic functions for messing with internal memory.
It comes with a few examples for EDC15P, EDC15C2 and ME7. The ECU-Tool library is required to properly run this examples.
For a full understanding of the way it works, just browse the library files (kline.h and kline.cpp).
As a quick overview, the functions provided by the library are the following:
void begin(byte adr, byte tst)**
Used for ECU and tester address pointer setup
boolean securityAccess(long Key, byte accmod)
long key: It is the key to be used to process the algorithm, and it is unique to each EDC15/EDC16 variant.
accmod: Access mode (Security level to be accessed)
boolean securityAccess(long Key, long Key2, byte accmod, byte accparam)
long key/key2: It is the key to be used to process the algorithm, and it is unique to each EDC15/EDC16 variant.
accmod: Access mode (Security level to be accessed)
accparam: Access parameter (Used only on EDC15)
byte readECUID(byte opt, byte buffer[])
Retrieves ECU info in fast mode, returns the size of the reply
You need to start a Standard diag session before using it!
The following options are available: EDC15/EDC16-17
0x80 - All data
0x86 - VIN and Hardware no.
0x8A - Boot version
0x90 - VIN
0x91 - Manufacturer Drawing number / Main Firmware version
0x92 - ECU hardware no.
0x93 - ECU hardware version no.
0x94 - ECU software no.
0x95 - ECU software version no.
0x96 - Homologation code
0x97 - ISO code
0x98 - Tester code
0x99 - Reprogramming/production date [Y-Y-M-D]
0x9B - NA/Configuration software version
byte read(byte buffer[])
Reads a string, writes only the payload on the buffer, and returns the length of the payload.
boolean write(byte data[], byte len)
write in slow speed mode (with delay between bytes) or in fast mode if a diag session has been established
boolean write(byte data[], byte len1, byte data2[], byte len2)
write two arrays, useful for functions with header
boolean startComms(byte buffer[])
Start communications packet. stores the reply in buffer (for debugging)
boolean stopComms()
Stop communications packet
long getPIDSupport(byte PID)
Get Supported PIDs
byte getPID(byte PID, byte buffer[])
Get PID data and put it in a buffer
boolean getEmissionsDTCs(byte buffer[])
Get Emissions DTC data and put it in a buffer
byte getDTCs(byte buffer[])
Get DTC data and put it in a buffer
boolean accessTiming(byte buffer[],byte cmd,byte p2min, byte p2max, byte p3min, byte p3max, byte p4min)
byte cmd options:
-00: read possible limits
-01:reset to default values
-02:read current values
-03:set values
P2 config: 15<=P2<=50 ms (number is in ms) - time between ECU reply and tester next request
P3 config: 0.5<=P3<=5000 ms (number is in ms) -time between tester request and ecu reply
P4 config: 0<=P4<=20 ms (number is in ms) - time between ECU bytes
pXmin= minimum
pXmax= maximum
boolean startDiagSession(byte sub)
sub must be 0x85 to write (download) and 0x86 to read (upload) the flash
Possible Modes are:
0x81 - Standard Diagnostics
0x84 - End of Line supplier mode
0x85 - Download mode
0x86 - Upload mode
0x89 - Yet another Standard Diag session
boolean stopDiagSession()
Obvious
boolean stopFlashSession()
EDC15, terminate session after read/write flash
boolean fastInit()
Init the ECU in fast mode (25ms pull down)
byte requestDownload(byte memaddrh, byte memaddrm, byte memaddrl, byte dataformID, byte ucmsh, byte ucmsm, byte ucmsl)
Requests download to the ECU (write ECU flash), returns the data length accepted by ECU
Memory address to start writing at
memaddrh: Memory address high byte
memaddrm: Memory address middle byte
memaddrl: Memory address low byte
dataformID: Data format identifier (00 for no encryption and uncompressed used on EDC15, 0x02 for EDC16 with Encryption)
This indicates the size of the file to be downloaded:
ucmsh: Uncompressed memory size high byte
ucmsm: Uncompressed memory size middle byte
ucmsl: Uncompressed memory size lower byte
boolean requestUpload(byte memaddrh, byte memaddrm, byte memaddrl, byte dataformID, byte ucmsh, byte ucmsm, byte ucmsl)
Requests upload from the ECU (read ECU flash)
Memory address to start reading at
memaddrh: Memory address high byte
memaddrm: Memory address middle byte
memaddrl: Memory address low byte
dataformID: Data format identifier
First digit indicates compression, second digit indicates encryption.
0x00 means no encryption and uncompressed
This indicates the size of the file to be uploaded:
ucmsh: Uncompressed memory size high byte
ucmsm: Uncompressed memory size middle byte
ucmsl: Uncompressed memory size lower byte
boolean transferData(long addr, byte buffer[], byte len)
Sends a packet to ECU while in Download service, EDC15
boolean transferData24(long addr, byte buffer[], byte len)
Transfer data packet, EDC15C version for 24bit address
boolean requestTransferData(byte buffer[])
Requests a data packet from ECU while in Upload service, and returns the read data, use on EDC16
boolean testerPresent()
Tester present packet, returns if response is valid.
boolean clearEmissionsDTCs()
This will wipe the following data:
-
MIL and number of diagnostic trouble codes
-
Clear the I/M (Inspection/Maintenance) readiness bits
-
Confirmed Emissions diagnostic trouble codes
-
Pending diagnostic trouble codes
-
Diagnostic trouble code for freeze frame data
-
Freeze frame data
-
Oxygen sensor test data (Be careful if you are going to inspection soon!. It takes about one week to get this again!)
-
Status of system monitoring tests
-
On-board monitoring test results
-
Distance travelled while MIL is activated
-
Number of warm-ups since DTCs cleared
-
Distance travelled since DTCs cleared
-
Time run by the engine while MIL is activated
-
Time since diagnostic trouble codes cleared
boolean clearGeneralDTCs()
Clear DTCs packet in fast mode
boolean reset(byte type, byte buffer[])
ECU reset packet, NOT supported by EDC15. Returns reply in buffer (for debugging)
Types:
0x01: Hard Reset
0x02: Key Off On Reset
0x03: Soft Reset
boolean startRoutine(byte buffer[], byte len)
Start Routine by Local ID packet
To use this function, we must pass an array with all setings.
The first byte of the array indicates the routine to start, and all the others indicate the parameters for this routine
boolean requestRoutineResults(byte ID, byte buffer[])
Requests the results for a routine previously started with StartRoutine.
byte ID is the routine.
buffer is where the reply is stored.
boolean requestTransferExit()
Requests end of file transfer after reading or writing a memory block
boolean sendDownloadData(byte data[], byte len)
Sends the data after download session is accepted
Note that len cannot be more than 0xFE
byte getUploadData(byte data[])
Gets the data after upload session is accepted
Note that len wont be more than 0xFE
byte slowInit(byte skip)
Makes a slow init to the target address and then switches to the selected baudrate
skip can be 0 (dont skip) or 1. It is used to skip comms after we get the response from ecu to the 5 baud init
boolean dynDefDataID(byte buffer[], byte len)
Dynamically define data ID packet
byte readDataByLocalID(byte ID, byte buffer[])
Reads a local ID block and returns the length of the reply
boolean writeDataByLocalID(byte ID, byte buffer[], byte len)
Writes a local ID block
byte readMemByAddr(byte hiMem, byte midMem, byte lowMem, byte length, byte buffer[])
Reads a data string from a memory address
-byte hiMem: Higher byte of mem address
-byte midMem: Middle byte of mem address
-byte lowMem: lower byte of mem address
-byte length: total length of the data (just data)
-byte buffer[]: destination of read data, must be at least same size as the value specified in "length"
boolean writeMemByAddr(byte hiMem, byte midMem, byte lowMem, byte length, byte buffer[])
Writes a data string to a memory address
-byte hiMem: Higher byte of mem address
-byte midMem: Middle byte of mem address
-byte lowMem: lower byte of mem address
-byte length: total length of the data (just data)
-byte buffer[]: the data to be written
byte readKW1281(byte cnt, byte buf[])
Read data with KW1281 protocol.
cnt is used to provide the block counter (for debugging)
byte readKW1281(byte buf[])
Read data with KW1281.
void writeKW1281(byte buf[], byte len)
Write data in KW1281 format
void closeKW1281Session()
Obvious