Automotive diagnostic protocols
Published: 2024-02-23
In the history of automotive ECUs, there have been a number of different approaches to the design of their diagnostic protocols. One of these, Keyword Protocol 71 (also known as KWP-71 or KW71), seems to have provided the original model for a family of protocols that I'll refer to as the "block exchange" type. These protocols all have some sort of initialization sequence, followed by a continuous exchange of messages between the ECU and tester hardware. This message exchange must be maintained for the connection to remain active.
KWP-71 was developed by Bosch in the mid-1980s, and its origin is explained briefly in Bosch Automotive Electrics and Automotive Electronics, 5th Ed., Robert Bosch GmbH, 2007:
This protocol was developed in collaboration with Bosch as the first standardized serial interface and is based on a 5-baud initialization and byte handshake. For addressing, the protocol provides for the use of a unidirectional line (L line). The line for data exchange (K line) is bidirectional. Alternatively, if the L line is not used at all in the system architecture, the K line can also be used for addressing because addressing and data exchange are two chronologically sequential states. The way in which communication is established is predefined, the services are standardized.
... and expanded on in Bussysteme in der Fahrzeugtechnik: Protokolle und Standards (Werner Zimmermann and Ralf Schmidgall, 2009):
Before the KWP 2000 protocol was published, other K-Line protocols were used, all of which were based on ISO 9141 and 5 baud initialization in terms of bit transmission and connection establishment, but then switched to a proprietary protocol via a specific keyword. The "Keyword KW 71" protocol from Bosch was very widespread and was usually implemented for bit rates of 1200 bit/s or 9600 bit/s. It defined different messages and services depending on the respective vehicle manufacturer. During communication, ongoing handshaking took place between the diagnostic tester and the control unit received characters were sent back as an echo in inverted form. The protocol is now just as outdated as other keyword variants.
The block-exchange family of protocols grew with the introduction of KW-82, KW-1281, FIAT-9141, and Marelli 1AF. One common element between these protocols is the notion of a "slow init" sequence in which the tester sends an address byte at 5 baud to wake up the ECU, and the ECU then responds with a "keyword sequence" of bytes that identify the protocol and/or ECU type.
There is also at least one protocol -- Marelli P8 -- that sends an ISO keyword sequence unsolicited when its ECU powers on, but is entirely query/response based after that (i.e. no block exchange.)
All of the protocols discussed above are what you'd call K-Line protocols, which are characterized by their use of one signal line (the "K-Line") at half duplex for both sending and receiving. The K-Line uses 0V and 12V for its logic levels. In contrast, there are some protocols that do not have an init sequence, do not do block exchange, and do not even use K-Line signalling. Examples include MEMS ROSCO and Lucas 14CUX, both of which have dedicated Rx/Tx lines that operate at TTL levels (0V/5V).
K-Line protocol comparison
| KWP-71 | FIAT-9141 | Marelli 1AF | |
|---|---|---|---|
| Nominal baudrate | 9600 | 4800 | 4800 |
| Slow init data bits | 8 | 7 | 7 |
| Slow init parity | None | Odd | Odd |
| Number of keyword bytes | 3 (55 00 81) |
6 | 6 |
| Keyword byte index to echo | 2 | 2 | n/a: Tester instead sends SELECT block (see "Process after initialization") |
| Keyword echo is inverted | Yes | Yes | n/a |
| Time before reconnect (ms) | 250 | 2000 | 500 |
| Time between blocks (ms) | 5 to 250 | 2 to 500 | 2 to 200 |
| Time between bytes within block (ms) | ~2 to 250 | 2 to 40 | 1 to 10 |
| Max payload bytes per block | 252 | 29 | 16 |
| Block sequence numbers | Yes | No | No |
| Echo during block receipt | Yes (inverse) | No | No |
| Block trailer | 0x03 | Checksum (8-bit) | Checksum (16-bit) |
| Process after initialization | ECU sends one or more ASCII string packets (0xF6) with ID information | - Tester sends SELECT.- ECU responds with SELECT ACK within 1200 ms.- Tester waits 200 ms and sends SET HOST.- ECU responds with OUT STATUS within 200 ms. |
Notes
- Although the slow init address byte is sent with 7 data bits and a parity bit for some protocol versions, the normal communication that follows always seems to be always be 8N1.
- The block titles used for FIAT-9141 almost perfectly overlap with those used for KWP-71 (on which it appears to be based.) The block titles for the Marelli 1AF protocol, however, are quite different.
- Some of the official FIAT PDFs that describe these protocols are very old, and use nonstandard character encodings/mappings for their fonts. This makes the PDFs non-searchable and prevents text from being copied out of them directly. The problem is discussed here.