This guide provides a comprehensive overview of Psa-diag, an Arduino sketch designed to send diagnostic frames to Peugeot and Citroën vehicles (PSA). We will cover its functionality, usage instructions, and detailed command explanations for various communication protocols.
Getting Started with psa-diag
The psa-diag sketch utilizes the Arduino serial console for sending raw diagnostic frames. Ensure your serial console is configured to 115200 baud rate and uses line feed (LF) without carriage return (CR) for each command.
Selecting the Target ECU
Communication with a specific Electronic Control Unit (ECU) requires inputting its diagnostic frame IDs in hexadecimal format:
>CAN_EMIT_ID:CAN_RECV_IDFor instance, to access the Telematic unit (UDS), use:
>764:664Accessing LIN ECUs (LIN over UDS) requires both hexadecimal frame IDs and the ECU code. To access the DGT7CFF LVDS Screen (LIN), use:
>736:716 L47A comprehensive list of ECU ID pairs is available in the ECU_LIST.md file within the repository.
ECU Unlocking with psa-diag
psa-diag simplifies the ECU unlocking process with the following shortcut:
:UNLOCK_KEY:UNLOCK_SERVICE:DIAG_SESSION_IDThe table below explains the UNLOCK_SERVICE parameter:
| UNLOCK_SERVICE (HEX) | Protocol | Detail | Equivalent command |
|---|---|---|---|
| 01 | UDS | Download | 2701 |
| 03 | UDS | Coding | 2703 |
| 83 | KWP | Download/Coding | 2783 |
The DIAG_SESSION_ID parameter is detailed below:
| DIAG_SESSION_ID (HEX) | Protocol | Detail | Equivalent command |
|---|---|---|---|
| 02 | UDS | Download | 1002 |
| 03 | UDS | Coding | 1003 |
| C0 | KWP | Download/Coding | 10C0 |
For example, to unlock the NAC Telematic unit (UDS) for coding:
:D91C:03:03To unlock the AMPLI_AUDIO Amplifier unit (KWP) for coding:
:A7D8:83:C0Refer to ECU_KEYS.md for a comprehensive list of ECU keys.
Diagnostic Commands: UDS, KWP2000 (HAB & IS)
psa-diag supports various diagnostic commands for UDS and KWP2000 protocols. Detailed command lists for each protocol, including descriptions and usage, are provided in the original documentation. These commands cover functions such as keep-alive, fault listing, clearing faults, flashing, rebooting, and memory management.
Understanding Diagnostic Responses and Errors
The documentation provides a comprehensive list of UDS and KWP2000 responses and error codes, enabling users to interpret the feedback received from the ECU. This includes acknowledgements, error messages, progress indicators, and security access denials.
Secured Traceability in psa-diag
After configuration writing, specific zones must be written to ensure Secured Traceability and prevent DTC errors. Detailed instructions for UDS (zone 2901) and KWP (zone A0), including command structures and example values, are provided in the original documentation. A writing counter in zone C000 tracks secured and non-secured writing operations.
PSA Seed/Key Algorithm
The psa-diag utilizes the PSA Seed/Key algorithm for security purposes. The algorithm details and example source code are available at https://github.com/ludwig-v/psa-seedkey-algorithm.
Diagnostic Frame Structure and Explanation
PSA utilizes a specific algorithm based on ISO 15765-2 to handle data larger than the CAN-BUS frame limit of 8 bytes. The documentation details the frame structure for sending and receiving data, including single-frame and multi-frame scenarios. It explains how larger data is truncated and reassembled using specific identifiers and acknowledgement frames.
Calibration File (.cal/.ulp) Format
Calibration files (.cal/.ulp) use the Motorola S-record format. The documentation outlines the structure of these files, including content size for different frame types (S2, S3), special frames (S0, S1, S5, S7, S8, S9), and detailed explanations of each field within the frames. Checksum calculation methods are also provided.
Dump Mode in psa-diag
psa-diag offers a Dump Mode to capture and analyze Diagbox frames. Enabling this mode merges split CAN-BUS frames for easier interpretation. Instructions for activating and deactivating Dump Mode, along with an example cable setup and pinout diagrams for various PSA interfaces, are detailed in the original documentation. Remember to deactivate the termination resistor in Dump Mode.
