K-Line: Difference between revisions

From OpenGK
No edit summary
No edit summary
Line 1: Line 1:
{{Stub}}
{{Stub}}
{{Warning|'''Only on 1.6/2.0 without immo the K-line from ECU is connected directly to the K-line pin on [[Data link connector (OBD2)|OBD2]] or [[Multipurpose Check Connector]]!!''' See below for some details.}}


K-Line on SIMK43 runs at 10400 baud and uses the KWP2000 protocol for diagnostic communication.  
K-Line on SIMK43 runs at 10400 baud and uses the KWP2000 protocol for diagnostic communication.  
Line 17: Line 15:
==== '''- If you have 2.7 with or without immobilizer installed:''' ====
==== '''- If you have 2.7 with or without immobilizer installed:''' ====
Your K-Line pins (OBD2/MCC) are connected to BCM's "Diagnosis" pin (BCM-IM, pin 19). Your K/Immo-Line pin at the ECU (C133-1, pin 3) is connected to BCM's "Immo W-line" (BCM-IM, pin 20). 2.7 ECUs don't have a separate K and W line - it's all integrated in one pin, you don't have nothing to worry about.
Your K-Line pins (OBD2/MCC) are connected to BCM's "Diagnosis" pin (BCM-IM, pin 19). Your K/Immo-Line pin at the ECU (C133-1, pin 3) is connected to BCM's "Immo W-line" (BCM-IM, pin 20). 2.7 ECUs don't have a separate K and W line - it's all integrated in one pin, you don't have nothing to worry about.
=== OBD2 (Data Link Connector) ===
==== Vehicles with immo: ====
K-Line pin (2) is connected to "DIAG" (BCM-IM 19) pin on the BCM which acts as a gateway. We don't know yet how to bypass that, so direct connection to ECU (or other modules) K-line is not possible through OBD-2 on vehicles with immobiliser. You could use the joint connector located under the gear shifter to bypass that<sup>[todo: include connector's name and pinout]</sup>.
==== Vehicles without immo: ====
K-Line pin (2) has direct connection to ECU and other modules


== KWP2000 ==
== KWP2000 ==
To start communication, you need to use Fast Init - so bring the K-line down for exactly 25ms, then up for 25ms followed by StartCommunication request. Python example of that using a FTDI cable [https://github.com/Dante383/gkbus/blob/a3ff894e8352ef2faab36e22553da7ddf5688cb8/gkbus/interface/kline/KLineSerial.py#L48 can be found in GKBus] code.
To start communication, you need to use Fast Init - so bring the K-line down for exactly 25ms, then up for 25ms followed by StartCommunication request. Python example of that using a FTDI cable [https://github.com/Dante383/gkbus/blob/a3ff894e8352ef2faab36e22553da7ddf5688cb8/gkbus/interface/kline/KLineSerial.py#L48 can be found in GKBus] code.


ID of the ECU is 0xF1, and as a diagnostic device you should be using ID 0x11. So an example command and response would look like this:
ID of the ECU is 0x11, and as a diagnostic device you should be using ID 0xF1. So an example command and response would look like this:


Diagnostic device: <code>82 11 F1 27 01 AC</code> (security access request)
Diagnostic device: <code>82 11 F1 27 01 AC</code> (security access request)

Revision as of 03:25, 8 January 2024

This article is a stub. You can help by contributing your knowledge of the Tiburon platform

K-Line on SIMK43 runs at 10400 baud and uses the KWP2000 protocol for diagnostic communication.

Connection points

ECU

- If you have 1.6 or 2.0 without immobilizer installed:

Good news! Your K-Line pins (OBD2/MCC) are connected directly to the K-line pin on the ECU (2.0 - 77)

- If you have 1.6 or 2.0 with immobilizer installed:

Your K-Line pins (OBD2/MCC) are connected to BCM's "Diagnosis" pin (BCM-IM, pin 19). THERE IS NOTHING CONNECTED TO K-LINE PIN AT THE ECU!! (2.0 77). Instead, all K-line stuff is connected to the ECU's W-Line (2.0 - 47)

- If you have 2.7 with or without immobilizer installed:

Your K-Line pins (OBD2/MCC) are connected to BCM's "Diagnosis" pin (BCM-IM, pin 19). Your K/Immo-Line pin at the ECU (C133-1, pin 3) is connected to BCM's "Immo W-line" (BCM-IM, pin 20). 2.7 ECUs don't have a separate K and W line - it's all integrated in one pin, you don't have nothing to worry about.

KWP2000

To start communication, you need to use Fast Init - so bring the K-line down for exactly 25ms, then up for 25ms followed by StartCommunication request. Python example of that using a FTDI cable can be found in GKBus code.

ID of the ECU is 0x11, and as a diagnostic device you should be using ID 0xF1. So an example command and response would look like this:

Diagnostic device: 82 11 F1 27 01 AC (security access request)

ECU response: 83 F1 11 67 02 34 22

Challenge-response calculation

SIMK43/41 uses a 2 byte seed and 2 byte key for security access. Until a write-up about the algorithm is prepared, you can take a look at it's Python implementation in GKFlasher: https://github.com/Dante383/GKFlasher/blob/15a715b18f2119d697a5ceed00f6383f690c4a23/ecu.py#L42