Professional Documents
Culture Documents
KWP2000
Version 1.2
Table of contents
1 History ..................................................................................................................1
1.1 List of changes in version 1.1........................................................................1
1.2 List of changes in version 1.2........................................................................1
2 Introduction..........................................................................................................2
3 Description...........................................................................................................3
3.1 Configuration.................................................................................................3
3.2 Basic operation .............................................................................................3
3.3 Available services..........................................................................................3
3.4 TP Configuration ...........................................................................................4
1 History
2 Introduction
Diagnostics is used configure, maintain, support, control and extend an ECU before
or after it is installed in a system, e.g. a vehicle.
Diagnostics is usually performed in a request – response scheme: a tester (client)
sends a request to an ECU (or even more than one ECU) and the ECU(s) (server)
respond(s) by sending a “positive response message” containing the requested in-
formation, or a “negative response”.
The most widely used protocol is the ITU Keyword Protocol 2000 (KWP2000; cf. ISO
15765-3, ISO 14230-3), although many OEMs define their own extensions. For this
development, ISO 14230-3 version 1.5 (1997-10-1) was used.
This DLL provides support for the basic KWP services, allowing nodes simulated in
CANoe to interact with real testers or ECUs. It helps the user by providing direct ac-
cess to the (standard) service parameters.
This document describes the usage of the DLL in CANoe. Knowledge of the underly-
ing transport protocol (ISO/OSEK TP) and CAPL is expected; for the configuration of
the TP please refer to the document OSEK_TP_e.pdf (distributed with CANoe) and
section 3.4 “TP Configuration”.
3 Description
3.1 Configuration
The KWP2000 add-on for CANoe consists of the files KWP2000.DLL and
KWP2000.INI. The former works as a node layer module for CANoe simulation
nodes. Please refer to the online help documentation, section “Search Sequence for
Nodelayer-DLLs”, for details of the placement of the DLLs. It is recommended to
place the DLL in a directory called “exec32” in the same folder as the configuration
file.
The INI file should be put in the same folder as the DLL file. It has the same format
as the OSEK_TP.INI file for the OSEK TP DLL, so please refer to the documentation
there for details.
According to the standard, an answer is called „response“. But since the term „request“ also starts with the
1
WriteMemoryByAddress
3.4 TP Configuration
The KWP services rely on the transport protocol to transfer data between client and
server. The address information has to be entered in the database or set dynamically
in CAPL via function calls. The document OSEK_TP_e.pdf contains a detailed de-
scription of the TP setup.
Caveat Instead of „OSEKTL_“, the prefix of all functions is „KWP_“, e.g. instead of
„OSEKTL_SetTgtAdr“, the function is called „KWP_SetTgtAdr“. This allows
the usage of TP and KWP in parallel.
The names of the database attributes remain unchanged.
4 Function description
4.2.1 StartDiagnosticSession
Type Function/Callback Parameters Description
Long StartSessionR long DiagnosticMode, Request the start of a diagnostic
long BaudRate session, choosing a mode and
transmission rate (use –1 if rate
should not be sent)
Long StartSessionRI long DiagnosticMode, Requested mode and baud rate
long BaudRate (-1 if not transmitted)
Long StartSessionA long code, Return the mode and baud rate
long DiagnosticMode, actually used. If rate = -1, it is not
long BaudRate sent on the bus.
Void StartSessionAI long state, Incoming request or request
long DiagnosticMode state. Also returns the parameter
long BaudRate sent.
Note: The parameter “BaudRate” is normally only used on serial line interfaces,
i.e. not in conjunction with CAN. Most users will set this value to –1.
4.2.2 StopDiagnosticSession
Type Function/Callback Parameters Description
Long StopSessionR Void …
Long StopSessionRI (none)
Long StopSessionA Long code …
Void StopSessionAI Long state …
4.2.3 SecurityAccess
Type Function/Callback Parameters Description
Long SecurityAccessR Long AccessMode, byte Request switch to a protected
data[], dword datalen mode. Server should send key or
seed
Long SecurityAccessRI long AccessMode, byte da- mode and key/seed data, datalen
ta[], dword datalen may be 0
Long SecurityAccessA Long code, long Access- Return key or seed.
Mode, byte data[], dword
datalen
Void SecurityAccessAI long state, long Access- Status and key/seed data.
Mode, byte data[], dword
datalen
4.2.4 TesterPresent
Type Function/Callback Parameters Description
Long TesterPresentR dword ResponseRequired Periodically sent by the tester
(client) to make the ECU (server)
stay in diagnostic mode. The pa-
rameter indicates whether the
tester expects a response (OEM
specific).
Long TesterPresentRI (none) Standard not clear here!
Long TesterPresentA Long code, dword Respon- Respond if necessary.
seRequired
Void TesterPresentAI Long state …
4.2.5 EcuReset
Type Function/Callback Parameters Description
Long EcuResetR Dword ResetMode
Long EcuResetRI Dword ResetMode
Long EcuResetA Long code, byte data[], Return the reset status. Datalen
dword datalen may be 0.
Void EcuResetAI Long state, byte data[], …
dword datalen
4.2.6 ReadEcuIdentification
Type Function/Callback Parameters Description
Long ReadEcuIdentR Dword option Which data?
Long ReadEcuIdentRI Dword option Requested information
Long ReadEcuIdentA Long code, Byte data[], Return the requested information.
dword datalen
Void ReadEcuIdentAI Long state, byte data[], Status and requested data, if suc-
dword datalen cessful.
4.2.7 ReadDTCByStatus
(Note the name change from „status“ to „state“.)
Type Function/Callback Parameters Description/remarks
Long ReadDTCByStateR dword statusOfDTC, Only 8, resp. 16 bit of the input
dword groupOfDTC parameters are used
Long ReadDTCByStateRI Dword statusOfDTC, Only 8, resp. 16 bit of the input
dword groupOfDTC parameters are used
Long ReadDTCByStateA Long code, Return the requested DTC(s)
byte data[], dword datalen
Void ReadDTCByStateAI Long state, byte data[],
dword datalen
4.2.8 ClearDiagnosticInformation
Type Function/Callback Parameters Description/remarks
Long ClearDiagInfoR dword groupOfDTC Only 16 bit are used
Long ClearDiagInfoRI dword groupOfDTC Only 16 bit are used
Long ClearDiagInfoA Long code, dword grou- Only 16 bit are used for
pOfDTC groupOfDTC
Void ClearDiagInfoAI Long code, dword grou- Only 16 bit are used for
pOfDTC groupOfDTC
4.2.9 InputOutputCtrlByLocalId
Type Function/Callback Parameters Description/remarks
Long IOCtrlLocalIdR Dword localId, dword con- Datalen may be 0
trol, byte data[], dword
datalen
Long IOCtrlLocalIdRI Dword localId, dword con-
trol, byte data[], dword
datalen
Long IOCtrlLocalIdA Long code, dword localId, Datalen may be 0
dword control, byte data[],
dword datalen
Void IOCtrlLocalIdAI Long code, dword localId,
dword control, byte data[],
dword datalen
4.2.10 ReadMemoryByAddress
Type Function/Callback Parameters Description/remarks
Long ReadMemByAddrR Dword address, dword size 24 bit address
Long ReadMemByAddrRI Dword address, dword size
Long ReadMemByAddrA Long code, byte data[],
dword datalen
Void ReadMemByAddrAI Long code, byte data[],
dword datalen
4.2.11 WriteMemoryByAddress
Type Function/Callback Parameters Description/remarks
Long WriteMemByAddrR Dword address, byte data[], 24 bit address
dword datalen
Long WriteMemByAddrRI Dword address, byte data[],
dword datalen
Long WriteMemByAddrA Long code, dword address
Void WriteMemByAddrAI Long code, dword address
4.4 Troubleshooting
This section lists some of the most common problems encountered when using the
DLL and tries to offer solutions.
Please note that a client may send data directly using the “KWP_DataReq” function
(cf. “OSEKTL_DataReq”), which will lead to call of the “KWP_DataInd” callback func-
tion (cf. “OSEKTL_DataInd”) in the server.
In this example, a non-standard service is implemented (without timeout check etc.):
// Tester side ------
MyKWPServiceR( DWORD parameter) {
byte data[5];
data[0] = 0x99; // non-standard ID
data[1] = 0x10; // argument
data[2] = parameter >> 16;
data[3] = parameter >> 8;
data[4] = parameter;
KWP_DataReq( data, 5); // transfer data to ECU
}
5 Example programs
A KWP demo is provided in the folder Demo_CAN_CN\KWP2000, please refer to the
documentation there.
The following small example demonstrates the usage of the KWP2000 DLL. A data-
base containing the nodes “Client” and “Server” and the following node attribute defi-
nitions and values is necessary:
Usage: initiate the session by pressing the space bar and end the session by press-
ing ‘x’. You can set the server state by pressing the keys ‘0’ to ‘4’. Then after pressing
the space bar, different server behaviour can be observed: immediate or delayed re-
sponse/ negative response, and ignoring of the request to provoke a timeout.
Please note that this example does not implement realistic ECU or tester behaviour!
/* ----------------------------------------------------------------------
* File: client.can
* This file implements a simple tester that sends request to an ECU.
*/
variables {
char name[7] = "Tester";
int gServerOpen = 0;
BYTE gKey[20];
msTimer presentTimer;
int gIdent = 0;
}
on key 'x' {
KWP_StopSessionR();
}
lastId = KWP_LastServiceId();
KWP_ServiceIdMne( lastId, serviceMne, 10);
on timer presentTimer {
KWP_TesterPresentR( 1); // Answer expected.
}
on key 'r' {
KWP_EcuResetR( 27);
}
if( code) {
ReportFailure( "ReadEcuIdent", code);
return;
}
dest[len] = 0;
while( len-- > 0)
dest[len] = source[len];
}
on key 'i' {
KWP_ReadEcuIdentR( gIdent++);
gIdent &= 0x3; // 4 values, 0 is unknown!
}
on key 'd' {
KWP_ReadDTCByStateR( 1, 99);
}
on key 'c' {
KWP_ClearDiagInfoR( 99);
}
on key 'l' {
BYTE buff[5];
KWP_IOCtrlLocalIdR(27, 1, buff, 5);
}
KWP_IOCtrlLocalIdAI (long state, DWORD localId, DWORD control, byte data[], DWORD
datalen) {
if( state) {
ReportFailure( "IOCtrlLocalIdAI", state);
return;
}
write( "%s: IOCtrlLocalIdAI returned Id %d, control %d and %d byte", name,
localId, control, datalen);
}
/* ----------------------------------------------------------------------
* File: server.can
* This file implements a simple ECU that responds to tester requests.
*/
variables {
char name[7] = "Server";
mstimer mytimer;
int state = 0; // answer, delay, deny, delay+deny or ignore request.
int gLocked = -1; // -1: locked, 0: open
long gMode = -1;
}
gMode = mode;
write( "%s: received StartSession request, mode %d ", name, mode);
switch( state) {
case 0:
write( "%s: answering immediately.", name);
return 0; // Let DLL handle response, returning same values.
case 1:
case 3:
on timer mytimer {
long code;
char desc[20];
if( state == 1) {
write( "%s: sending delayed positive answer to StartSession.", name);
KWP_StartSessionA( 0, gMode, -1);
} else {
code = KWP_MnemonicResCode( "b-RR");
KWP_ResponseCode( code, desc, 20);
write( "%s: sending delayed negative 0x%x answer (%s) to StartSes-
sion.",
name, code, desc);
KWP_StartSessionA( code, -1, -1); // arguments are ignored.
}
}
on key '0' {
// switch server in state "answer immediately to request"
state = 0;
}
on key '1' {
// switch server in state "answer after delay to request"
state = 1;
}
on key '2' {
// switch server in state "answer with negative response"
state = 2;
}
on key '3' {
// switch server in state "delay then deny request"
state = 3;
}
on key '4' {
// sendKey
MakeSeed( mode, buff);
MakeKey( buff);
if( datalen >= 8 && 0 == bytencmp( buff, data, 8)) {
state = 0; // answer immediately, if possible
gLocked = 0; // key valid, open server
buff[0] = 0x34;
KWP_SecurityAccessA( 0, mode, buff, 1);
return -1;
} else {
state = 2; // deny requests
gLocked = -1;// lock server
return KWP_MnemonicResCode("IK"); // Invalid Key
}
long KWP_TesterPresentRI () {
long KWP_StopSessionRI () {
write( "%s: Stopping diagnostics mode.", name);
gLocked = 1;
return -1; // Do not answer ...
}
return 0;
}
long KWP_IOCtrlLocalIdRI (DWORD localId, DWORD control, byte data[], DWORD datalen)
{
write( "%s: IOCtrlLocalIdRI( %d, %d, ..., %d)",
name, localId, control, datalen);
return 0;
}/* --------------------------------------------------------------------*/