Multiecuscan

KWP1281 info:

Protocol:
All bytes sent from the master are returned by the slave in complemented form, except the Block End byte.
Block counter is increment with each block sent, from slave or master.
Acknowledgement blocks are sent by the receiver after each block is completed.
When there is nothing to send, acknowledgement blocks get acknowledged repeatedly.

Connection:
7 data bits, no parity, 1 stop bit
The tester issues the 5 baud address of the controller it would like to initiate communication with.
8 data bits, no parity, 1 stop bit
Should the ECU recognize its address, it will reply with a sync byte (0x55), which is used by the tester to determine the baudrate that the ECU would like to communicate at.
Following a short delay, the ECU will send a Key word (consisting of 2 Key bytes, first the Least Significat Byte, followed by the MSB)
The tester replies with the complement of the Key MSB byte. This hands master mode to the ECU, and it starts outputting the ECU info.
Check the received data to match 0x55, 0x01, 0x8A, if it doesn't match, try another baud rate.
If the tester does not reply, the ECU will transmit again.
Communication speed is usually 4800, 9600, or 10400 Baud

ECU transmits these blocks in order upon connection:
-Controller ID Number Block
-Component Number Block
-Software Coding Block
-Dealer Part Number Block
-Additional Info 1 Block

Controller Addresses:
0x01 - ECU
0x03 - ABS
0x15 - Airbags

Block Titles:
0x00 - confirmed - Identification code request/ECU info
0x01 - confirmed - Read RAM, 8 bit byte count, 16 bit address
0x02 - confirmed - Write RAM, 16 bit address, 8 bytes data to write
0x03 - unsupported - Read eeprom, 8 bit byte count, 16 bit address
0x04 - unknown - Actuator Activation/Output Test
0x05 - unknown - clear errors
0x06 - unknown - end output
0x07 - unknown - get errors request, all errors sent
0x08 - unsupported - Request ADC channel reading/Single Reading
0x09 - confirmed - Acknowlege
0x0A - confirmed - No Acknowledge
0x0B - unsupported - Unknown Title
0x0C - unknown -
0x0D - unsupported - abort init sequence?
0x0E - unsupported -
0x0F - unsupported -
0x10 - confirmed - Recoding
0x11 - unknown - Basic Settng at Channel 0
0x12 - unknown - Snapshot request/Request group reading at channel 0
0x13 - unsupported -
0x14 - unsupported -
0x15 - unsupported -
0x16 - unsupported -
0x17 - unsupported - Actuactor Activation with Feedback
0x18 - unsupported - Login
0x19 - confirmed - Read eeprom, 8 bit byte count, 16 bit address
0x1A - unsupported - Write eeprom, 8 bit byte count, 16 bit address, data, data, data.....
0x1B - unknown -
0x1C - unsupported -
0x1D - unsupported -
0x1E - unsupported - Download Request
0x1F - unsupported - Download Transfer
0x20 - unsupported - Safety Code Transmission
0x21 - unknown - ??Coding??
0x22 - unknown - ??Coding/Adaptation??
0x23 - unsupported -
0x24 - unsupported -
0x25 - unsupported -
0x26 - unsupported -
0x27 - unsupported -
0x28 - unknown - Basic Setting
0x29 - unknown - Request group reading
0x2A - unknown - ??Adaptation??
0x2B - confirmed- Login

NO MORE SUPPORTED UNTIL RESPONSE CODES

0xE6 - checking -
0xE7 - Response to group reading
0xE8 - Response Actuator Activation Feedback
0xED - Response to write RAM
0xEF - Response to read eeprom 0x19
0xF0 - Response to Login
0xF4 - Response to snapshot request
0xF6 - ASCII Data/ID code response
0xF7 - Response to download request
0xF9 - Response to write eeprom
0xFB - Response to read ADC channel request
0xFC - Response to get errors request
0xFD - Response to read eeprom 0x03
0xFE - Response to read RAM

Block Contents:
Block Length - byte - the number of bytes following the block length byte, max of 31?, except for writing to the ecu which is 68 to allow reading of 64 byte blocks?
Block Counter - byte - increments by 1 with every block, wraps from FF to 00
Block Title - byte - the command type
Data - N bytes - some blocks have no data
Block End - byte - 0x03

Acknowledge Block Example:
Block Length - 0x03
Block Counter - ??
Block Title - 0x09
Block End - 0x03

Request Group Reading Example:
Block Length - 0x04
Block Counter - ??
Block Title - 0x29
Block Data - byte - group number
Block End - 0x03

Response to Group Reading Example:
Block Length - 0x0F
Block Counter - ??
Block Title - 0xE7
Block Data - byte - data type
Block Data - byte - value a
Block Data - byte - value b
Block Data - byte - data type
Block Data - byte - value a
Block Data - byte - value b
Block Data - byte - data type
Block Data - byte - value a
Block Data - byte - value b
Block Data - byte - data type
Block Data - byte - value a
Block Data - byte - value b
Block End - 0x03

Response to Get Error Codes Request Example with Four or More Errors:
Block Length - 0x15 - assuming atleast four error codes
Block Counter - ??
Block Title - 0xFC
Block Data - byte - error 1 code high byte
Block Data - byte - error 1 code low byte
Block Data - byte - error 1 status byte
Block Data - byte - error 2 code high byte
Block Data - byte - error 2 code low byte
Block Data - byte - error 2 status byte
Block Data - byte - error 3 code high byte
Block Data - byte - error 3 code low byte
Block Data - byte - error 3 status byte
Block Data - byte - error 4 code high byte
Block Data - byte - error 4 code low byte
Block Data - byte - error 4 status byte
Block End - 0x03

Response to Get Error Codes Request Example with Zero Errors:
Block Length - 0x06 - assuming atleast four error codes
Block Counter - ??
Block Title - 0xFC
Block Data - byte - 0xFF
Block Data - byte - 0xFF
Block Data - byte - 0x88
Block End - 0x03

-You can only recode when the engine speed is zero
-you can only write to RAM when the engine speed is zero