Messing around with OBD.

[freddyokel]

So, I've been doing some quite in depth messing around with OBD on my 2008 207cc 1.6Hdi.
The diagrams in ServiceBox indicate that the 'CAN IS' is attached to a 250kbps CAN bus on the J1962 standard pins 6 & 14.
Also... it indicates an ISO14230 'K Line' directly connected to the engine ECU on J1962 pin 7 and a non-standard 'DIAG CAN' at 500kbps connected to the 'manufacturers use' pins 3 & 8.
Using the ubiquitous ELM327 interface and a terminal emulator I have discovered that the CAN bus (6/14) is actually at 500kbps and is quite 'chatty', with a total of 26 IDs chucking out data.
The only one I've identified so far is '0x30D' which is an encoded form of the 4 wheel speeds.
Connecting an Actia/Lexia with a Y adapter indicates that Diagbox exclusively uses the alternative CAN bus on pins 3 & 8.
My only useful bit of this so far is that by using the K-Line direct to the ECU you can erase engine fault codes without the BSI trying to log them in it's memory.
Apart from this guy:
https://github.com/ludwig-v/arduino-psa-diag
And this guy:
https://autowp.github.io/

Has anyone else messed around with this?
I've definitely found that the BSI (connected to the 6/14 and 3/8 interfaces) is the gatekeeper/filter to the rest of the ECUs.

Edit: I've also just noticed there's another 'K Line' direct to the ABS ECU on Pin 12

[mickthemaverick]

Excellent digging there I'd say but beyond my desire to learn nowadays. Hopefully someone else will have a useful comment to make!!

[freddyokel]

Sadly I think I've reached the limits of what I can do via the OBD port at the moment.
Next step would be to wire the ELM327's CAN bus to the DIAG CAN on 3/8 and monitor what Diagbox does.
The CAN IS on the J1962 pins appears to be for information only as none of the ECUs that Servicebox lists as being connected to it respond to UDS messages on their main addresses, implying that the BSI is acting as a kind of firewall.
I originally started this to see if I could upgrade the firmware on an EMF_C as I have several on the v53 firmware and only one on the v71 firmware required for the RD45 stereo upgrade.
I'll probably try and 'bench' an EMF_C direct onto it's CAN pins next.