arduino-psa-telematic-diag
Arduino sketch to send diagnostic frames to telematic units
The serial console is used to send raw diagnostic frames, start it using 115200 baud rate
Commands (NAC/RCC_CN/RCC)
| Command |
Description |
| 3E00 |
Keep-Alive session |
| 190209 |
List of current faults |
| 14FFFFFF |
Clear faults |
| 37 |
Flash autocontrol (Unit must be unlocked first) |
| 1001 |
End of communication |
| 1002 |
Open Download session |
| 1003 |
Open Diagnostic session |
| 1103 |
Reboot |
| 2701 |
Unlocking service for download (Diagnostic session must be enabled first) - SEED |
| 2703 |
Unlocking service for configuration (Diagnostic session must be enabled first) - SEED |
| 2702XXXXXXXX |
Unlocking response for download - XXXXXXXX = KEY - Must be given within 5 seconds after seed generation |
| 2704XXXXXXXX |
Unlocking response for configuration - XXXXXXXX = KEY - Must be given within 5 seconds after seed generation |
| 22XXXX |
Read Zone XXXX (2 bytes) |
| 2EXXXXYYYYYYYYYYYY |
Write Zone XXXX with data YYYYYYYYYYYY (Unit must be unlocked first) |
| 3101FF0081F05A |
Empty flash memory (Unit must be unlocked first) |
| 3103FF00 |
Empty flash memory (Unit must be unlocked first) |
| 3481110000 |
Prepare flash writing (Unit must be unlocked first) |
| 3101FF04 |
Empty ZI Zone (Unit must be unlocked first) |
| 3103FF04 |
Empty ZI Zone (Unit must be unlocked first) |
| 3483110000 |
Prepare ZI zone writing (Unit must be unlocked first) |
| Command |
Description |
| 3E |
Keep-Alive session |
| 17FF00 |
List of current faults |
| 14FF00 |
Clear faults |
| 1081 |
End of communication |
| 10C0 |
Open Diagnostic session |
| 31A800 |
Reboot |
| 31A801 |
Reboot 2 |
| 2781 |
Unlocking service for download (Diagnostic session must be enabled first) - SEED |
| 2783 |
Unlocking service for configuration (Diagnostic session must be enabled first) - SEED |
| 2782XXXXXXXX |
Unlocking response for download - XXXXXXXX = KEY - Must be given within 5 seconds after seed generation |
| 2784XXXXXXXX |
Unlocking response for configuration - XXXXXXXX = KEY - Must be given within 5 seconds after seed generation |
| 21XX |
Read Zone XX (1 byte) |
| 3BXXYYYYYYYYYYYY |
Write Zone XX with data YYYYYYYYYYYY (Unit must be unlocked first) |
| 318181F05A |
Empty flash memory (Unit must be unlocked first) |
| 318101 |
Empty flash memory (Unit must be unlocked first) |
| 348100000D07 |
Prepare flash writing (Unit must be unlocked first) |
Test Commands (NAC/RCC_CN/RCC)
| Command |
Description |
| 22D4XX |
Measures |
| 22D405 |
Visible satellites |
| 3101DF07 |
Tactile Test Screen |
| 2FD6000300 |
Black screen |
| 2FD60000 |
Restore the screen |
| 2FD66000 |
Stop Camera display control |
| 2FD66003 |
Camera display control |
| 2FD6700330 |
180° Camera display control - Standard view |
| 2FD6700340 |
180° Camera display control - Zoom view |
| 2FD6700350 |
180° Camera display control - Lateral view |
| 2FD62000 |
Stop Sound Test |
| 082FD620030108 |
Sound test Front Right |
| 082FD62003010A |
Sound test Front Right |
| 082FD620030208 |
Sound test Front Left |
| 082FD62003020A |
Sound test Front Left |
| 082FD620030308 |
Sound test Back Right |
| 082FD62003030A |
Sound test Back Right |
| 082FD620030308 |
Sound test Back Left |
| 082FD62003030A |
Sound test Back Left |
Test Commands (SMEG/AIO/MRN)
| Command |
Description |
| 308300 |
Black screen |
| 308301 |
Black screen Keep-Alive |
| 308302 |
Stop Black screen |
| 308311 |
Abort Black screen |
| 308200 |
Blank screen |
| 308301 |
Blank screen Keep-Alive |
| 308202 |
Stop Blank screen |
| 308211 |
Abort Blank screen |
| 308700 |
Camera display |
| 308701 |
Camera display Keep-Alive |
| 308702 |
Stop Camera display |
| 308711 |
Abort Camera display |
| 30850001006419 |
Sound testing Front Right |
| 30850002006419 |
Sound testing Front Left |
| 30850003006419 |
Sound testing Rear Right |
| 30850004006419 |
Sound testing Rear Left |
| 308501 |
Sound testing Keep-Alive |
| 308502 |
Stop Sound testing |
| 308511 |
Abort Sound testing |
| Answer |
Description |
| 7E00 |
Keep-Alive reply |
| 54 |
Faults cleared |
| 7101FF0001 |
Flash erased successfully |
| 7103FF0002 |
Flash erased successfully |
| 7101FF0401 |
ZI erased successfully |
| 7103FF0402 |
ZI erased successfully |
| 77 |
Flash autocontrol OK |
| 5001XXXXXXXX |
Communication closed |
| 5002XXXXXXXX |
Download session opened |
| 5003XXXXXXXX |
Diagnostic session opened |
| 5103 |
Reboot OK |
| 62XXXXYYYYYYYYYYYY |
Successfull read of Zone XXXX - YYYYYYYYYYYY = DATA |
| 6701XXXXXXXX |
Seed generated for download - XXXXXXXX = SEED |
| 6703XXXXXXXX |
Seed generated for configuration - XXXXXXXX = SEED |
| 6702 |
Unlocked successfully for download - Unit will be locked again if no command is issued within 5 seconds |
| 6704 |
Unlocked successfully for configuration - Unit will be locked again if no command is issued within 5 seconds |
| 6EXXXX |
Successfull Configuration Write of Zone XXXX |
| 741000 |
Download Writing ready |
| 76XX02 |
Download frame XX injected with success |
| 76XX0A |
Invalid checksum on download frame XX |
| 7F3478 |
Download Writing in progress |
| 7F3778 |
Flash autocontrol in progress |
| 7F2724 |
Anti-Bruteforce active |
| 7F2713 |
Invalid SEED Answer (KEY) |
| 7F2E78 |
Configuration Write in progress |
| 7F2E13 |
Failed Configuration Write - Invalid Zone data |
| 7F2E7E |
Failed Configuration Write - Unit is locked |
| 7F2E31 |
Failed Configuration Write - Not allowed operation |
| 7F2EXX |
Failed Configuration Write |
| 7F2E31 |
Failed Configuration Read - Not allowed operation |
| 7F22XX |
Failed Configuration Read |
| 7FXXYY |
Error - XX = Service / YY = Error Number |
| Answer |
Description |
| 7E |
Keep-Alive reply |
| 5081 |
Communication closed |
| 50C0 |
Diagnostic session opened |
| 71A801 |
Reboot |
| 71A802 |
Reboot 2 |
| 61XXYYYYYYYYYYYY |
Successfull read of Zone XX - YYYYYYYYYYYY = DATA |
| 6781XXXXXXXX |
Seed generated for download - XXXXXXXX = SEED |
| 6783XXXXXXXX |
Seed generated for configuration - XXXXXXXX = SEED |
| 6782 |
Unlocked successfully for download - Unit will be locked again if no command is issued within 5 seconds |
| 6784 |
Unlocked successfully for configuration - Unit will be locked again if no command is issued within 5 seconds |
| Zone ID |
Description |
| F0FE |
ZI Zone (Last 6 characters: current calibration) |
| F080 |
ZA Zone |
| F190 |
VIN |
| F18C |
Serial number |
| 2100 |
Telecoding_Fct_AAS |
| 2101 |
Telecoding_Fct_AFIL |
| 1234 |
HU_CODING_ADDONS |
| 2103 |
Telecoding_Fct_ARTIV |
| 2104 |
Telecoding_Fct_AUDIO |
| 2106 |
Telecoding_Fct_AVR |
| 2107 |
Telecoding_Fct_BT |
| 2108 |
Telecoding_Fct_BTEL |
| 2109 |
Telecoding_Fct_CAFR |
| 210A |
Telecoding_Fct_CHANGER_CD |
| 210B |
Telecoding_Fct_CHECK |
| 210C |
Telecoding_Fct_CITYPARK |
| 210D |
Telecoding_Fct_CLIM |
| 210E |
Telecoding_Fct_DSG |
| 210F |
Telecoding_Fct_ECRAN_PRINCIPALE |
| 2110 |
Telecoding_Fct_ECRAN_SECONDAIRE |
| 2112 |
Telecoding_Fct_HDC |
| 2113 |
Telecoding_Fct_HY |
| 2114 |
Telecoding_Fct_INTERNET |
| 2115 |
Telecoding_Fct_MPD |
| 2117 |
Telecoding_Fct_RADIO |
| 2118 |
Telecoding_Fct_RADIO_NUM |
| 2119 |
Telecoding_Fct_SAM |
| 211A |
Telecoding_Fct_STT |
| 211B |
Telecoding_Fct_XVV |
| 211C |
Telecoding_Fct_WIFI |
| 211D |
Telecoding_Fct_ASR |
| 211E |
Telecoding_Fct_ADML |
| 211F |
Telecoding_Fct_LANG |
| 2120 |
Telecoding_Fct_LKA |
| 2121 |
Telecoding_Fct_ACV |
| 2124 |
Telecoding_Fct_LUM |
| 2125 |
Telecoding_Fct_OBC |
| 2126 |
Telecoding_Fct_CPUSH |
| 2128 |
Telecoding_Fct_SPY |
| 2127 |
Telecoding_Fct_IHM |
| 2116 |
Telecoding_Fct_NAV |
| 0100 |
Calibration_Fct_AAS |
| 0105 |
Calibration_Fct_AVR |
| 0106 |
Calibration_Fct_BT |
| 0107 |
Calibration_Fct_BTEL |
| 010A |
Calibration_Fct_CITYPARK |
| 010C |
Calibration_Fct_ENTREE_VIDEO |
| 010D |
Calibration_Fct_FAN |
| 010E |
Calibration_Fct_FMUX |
| 010F |
Calibration_Fct_HY |
| 0110 |
Calibration_Fct_INTERNET |
| 0112 |
Calibration_Fct_NAV |
| 0115 |
Calibration_Fct_STT |
| 0116 |
Calibration_Fct_XVV |
| 0117 |
Calibration_Fct_LUM |
| 011A |
Calibration_Fct_WIFI |
| 0119 |
Calibration_Fct_LANG |
| 0118 |
Calibration_Fct_OBC |
| 011B |
Calibration_Fct_VIDEOTIMING |
| 011E |
Calibration_Fct_SVR |
| 2123 |
Telecoding_Fct_Alarm_2 |
| 0103 |
Calibration_Fct_AUDIO |
| 2129 |
Telecoding_Fct_LVDS |
| 2105 |
Telecoding_Fct_AVP |
| 212A |
Telecoding_Fct_VISIOPARK |
| 0120 |
Calibration_Fct_VISIOPARK |
| FFF1 |
Calibration_Fct_COLOR_CORRECTION |
| 011D |
Calibration_Fct_HDC |
| 011F |
Calibration_Fct_LVDS |
| 212C |
Telecoding_Fct_ION |
| 212D |
Telecoding_Fct_PPS |
| 212E |
Telecoding_Fct_IDVR |
| 212F |
Telecoding_Fct_AUDIO2 |
| 2130 |
Telecoding_Fct_BTA |
| 0104 |
Calibration_Fct_AVP |
| 011C |
Calibration_Fct_CLIM |
| 0121 |
Calibration_Fct_ION |
| 0122 |
Calibration_Fct_PPS |
| 2131 |
Telecoding_Fct_ANDROID |
| 2132 |
Telecoding_Fct_IDVR_HMI |
| 0123 |
Calibration_Fct_VIDEOTIMING_2 |
| 2133 |
Telecoding_Fct_WAVE3 |
| 0124 |
Calibration_Fct_LVDS_EXPORT |
| 0125 |
Calibration_Fct_HW_VERSION |
| 0126 |
Calibration_Fct_BEIDOU |
| 0127 |
Calibration_Fct_DGT |
| 0128 |
Calibration_Fct_MASS |
| 0129 |
Calibration_Fct_PPS2 |
| 012A |
Calibration_Fct_VP1_HW |
| 012B |
Calibration_Fct_USB |
| 00DE |
Calibration_Fct_PUSH_LUM |
| 00DD |
Calibration_Fct_AEE_SEL |
| 2145 |
Telecoding_Fct_AIO |
| Zone ID |
Description |
| FE |
ZI Zone (Last 6 characters: current calibration) |
| 80 |
ZA Zone |
| B0 |
VIN |
| 82 |
Serial number |
| A0 |
? (SMEG) |
| B1 |
? (AIO) |
| B2 |
? (SMEG, AIO) |
| B3 |
Personalization menus (SMEG) |
| B5 |
? (SMEG) |
| B9 |
? (SMEG) |
| C0 |
? (SMEG) |
| D0 |
Display details - Part number, Software (SMEG) |
| BC |
GPS Measures (SMEG) |
Diagnostic frames explanation / What the Sketch is doing
CAN-BUS is limited to 8 bytes per frame, to send larger data PSA chose a simple algorythm to truncate the data into multiple parts
To send data smaller or equal to 7 bytes:
| Byte 1 |
Byte 2 |
Byte 3 |
Byte 4 |
Byte 5 |
Byte 6 |
Byte 7 |
Byte 8 |
| Full Data Length |
Data[0] |
Data[1] |
Data[2] |
Data[3] |
Data[4] |
Data[5] |
Data[6] |
To send data larger than 7 bytes:
| Byte 1 |
Byte 2 |
Byte 3 |
Byte 4 |
Byte 5 |
Byte 6 |
Byte 7 |
Byte 8 |
| 0x10 |
Full Data Length |
Data[0] |
Data[1] |
Data[2] |
Data[3] |
Data[4] |
Data[5] |
[RECEIVE] Write Acknowledgement Frame:
| Byte 1 |
Byte 2 |
Byte 3 |
| 0x30 |
0x00 |
0x0A |
ID starting at 0x21 and increasing by 1 for every extra frame needed, after 0x2F reverting back to 0x20
| Byte 1 |
Byte 2 |
Byte 3 |
Byte 4 |
Byte 5 |
Byte 6 |
Byte 7 |
Byte 8 |
| 0x21 |
Data[6] |
Data[7] |
Data[8] |
Data[9] |
Data[10] |
Data[11] |
Data[12] |
| Byte 1 |
Byte 2 |
Byte 3 |
Byte 4 |
Byte 5 |
Byte 6 |
Byte 7 |
Byte 8 |
| 0x22 |
Data[13] |
Data[14] |
Data[15] |
Data[16] |
Data[17] |
Data[18] |
Data[19] |
To receive data smaller or equal to 7 bytes:
| Byte 1 |
Byte 2 |
Byte 3 |
Byte 4 |
Byte 5 |
Byte 6 |
Byte 7 |
Byte 8 |
| Full Data Length |
Data[0] |
Data[1] |
Data[2] |
Data[3] |
Data[4] |
Data[5] |
Data[6] |
To receive data larger than 7 bytes:
| Byte 1 |
Byte 2 |
Byte 3 |
Byte 4 |
Byte 5 |
Byte 6 |
Byte 7 |
Byte 8 |
| 0x10 |
Full Data Length |
Data[0] |
Data[1] |
Data[2] |
Data[3] |
Data[4] |
Data[5] |
[SEND] Read Acknowledgement Frame:
| Byte 1 |
Byte 2 |
Byte 3 |
| 0x30 |
0x00 |
0x05 |
ID starting at 0x21 and increasing by 1 for every extra frame needed, after 0x2F reverting back to 0x20
| Byte 1 |
Byte 2 |
Byte 3 |
Byte 4 |
Byte 5 |
Byte 6 |
Byte 7 |
Byte 8 |
| 0x21 |
Data[6] |
Data[7] |
Data[8] |
Data[9] |
Data[10] |
Data[11] |
Data[12] |
| Byte 1 |
Byte 2 |
Byte 3 |
Byte 4 |
Byte 5 |
Byte 6 |
Byte 7 |
Byte 8 |
| 0x22 |
Data[13] |
Data[14] |
Data[15] |
Data[16] |
Data[17] |
Data[18] |
Data[19] |
Received frames could be out-of-order, ID must be used to append parts at the correct position into the final data whose size is known
Calibration file (.cal) explanation
Every line of calibration files has this form:
| TYPE |
LENGTH |
ADDRESS |
LENGTH2 |
ZONE |
DATA |
CHECKSUM |
CHECKSUM2 |
| 1h |
1h |
Variable Length |
1h |
2h |
Variable Length |
2h |
1h |
1h = 1 HEX Byte or 2 characters in the .cal file
| Line Part |
Line Detail |
| TYPE |
S1 = ZI Zone / S2 / S8 |
| LENGTH |
Hex Length of ADDRESS+ZONE+DATA+CHECKSUM+CHECKSUM2 |
| ADDRESS |
|
| LENGTH2 |
Hex Length of ZONE+DATA+CHECKSUM |
| ZONE |
|
| DATA |
|
| CHECKSUM |
CRC-16/X-25(DATA) with this order CRC[1] CRC[0] |
| CHECKSUM2 |
CRC-8/2s_complement(ADDRESS+ZONE+DATA+CHECKSUM) - 1 |