J2534 hardware/software interface

[icecubetray]

Has anyone played around with J2534?

Its a standard interface for programming Automobile ECUs, mandated by the EPA.

It utilizes the OBD port on the Automobile to allow independant Garages the ability to program the ECU.

Does anyone have or know where I might be able to find the SAE document "PassThru (SAE J2534-1) v0404"?

one thing I have come across is openecu.org......

Cheers!

[crahak]

Has anyone played around with J2534?

On a daily basis, yes. It's a suite of protocols, not a single protocol. Individual ECUs use different protocols for communication/updating, depending on the vehicle make/model/year and such.

[icecubetray]

Yes, OBD/j2534 refers to many protocols.

In my case I am really only particularly interested in CAN......but

I am trying to find the SAE standard so I can have a read.

J2534 defines the SAE standard.  Which explains the programming process, the Software API and the hardware functionality.

I know what OBD and J2534 is and what they are.......but I was hoping to find the documentation that defines specifically how this process works.

Without the doc I can't build any hardware or write any software.

You don't happen to have the doc do you? or know the specifics of the hardware?

There is a programming pin to set a programming voltage?.....do you know what pin this is and what voltage it needs to be set to?
Do you know what the required CAN commands are for reading and writing to the ECU?
As I understand some ECUs are encrypted.......so there is some handshaking that happens before you can read and write.

http://www.drewtech.com/support/j2534/index.html

the above defines a little bit of the highlevel API......for their product.

Any help you can provide would be greatly appreciated.....

[crahak]

I don't think the docs would really get you anywhere (even J1939 or CAN related). Our own products update over such protocols (most are using CAN actually). However, each company's modules update in their own specific ways (using their own commands, using their own bootloaders, passwords required, etc) and that isn't documented anywhere. And no, there aren't programming voltages, CAN just uses a differential pair to communicate.

And to really get anywhere with other companies' products, as no one actually seems to publish any infos (it's more like they try to keep it all secret), you usually have to spy on the bus using specialized equipment (pretty much guessing what is what), and that's a fair amount of work. To see how the programming happens (and find out the specific commands required and such), you'd probably have to spy on the bus while you're programming the module in the first place...

It's not as easy as it may seem.

[icecubetray]

hmmm, I was  afraid of that.....

Now I wonder what bus they are using to program, as my obd port has a high speed and meduim speed can bus.  though the OBD standard is using the medium speed bus it doesn't mean they aren't using the high speed bus for programming at the dealership.

So J2534 just defines the standard software API and hardware interface.....so they are indeed using their own software layer on top of all that....well I guess no real surprise there

I'm not saying any of this would be easy, but sniffing the bus wouldn't be that difficult.  A little custom hardware and software to log the bus data.  Each packet is identified with the source and destination, so it should be easy enough to sort each individual transmission.....then with a ECU on the bench later it should be possible to determine the read and write commands....etc etc....

The other question would then be is the data going across the bus encrpyted....I guess that should be easy enough to visualize with a hex editor

Thanks for the info Crahak.....