Communication Protocols

KWP2000
Following Modules Communicate via KWP2000; ECU - Destination Address
 * ECU - 0x10
 * TCM - 0x18
 * ABS - 0x28
 * SRS - 0x58

ECU Supported SID List

 * $02 -
 * $04 -
 * $06 -
 * $09 - Request VIN
 * $11 - Reset ECU
 * $12 - Read Freeze Frame Data
 * $14 - Clear DTC Information
 * $1A - Request ECU ID
 * $20 - Stop Diagnostic Session
 * $21 - Read Data by Local Identifier
 * $22 - Read Data by Common Identifier (Data Identifiers (DID) Range From 0 - 65535)
 * $27 - Security Access
 * $30 - I/O Control by Local ID
 * $31 - Start Routine by Local ID
 * $32 - Stop Routing by Local ID
 * $33 - Request Routine Results by Local ID
 * $34 - Request Download
 * $35 - (Special)
 * $36 - Transfer Data
 * $37 - Request Transfer Exit
 * $3B - Write Data by Local Identifier
 * $3E - Tester is Present
 * $80 - (Special)
 * $81 - Start Communication
 * $82 - Stop Communication
 * $83 - Access Timing Parameters
 * $A0 -
 * $A1 - (Special)
 * $A3 - Read DTC's
 * $A4 -
 * $AC - Request Simply Dynamically Defined Local ID
 * $BF - RAM Jump

SID Analysis
$11 - Reset ECU Functionality: Can potentially be used to clear self learn data. ARB ID's: 80 - Backup RAM Reset

$14 - Clear DTC's Functionality: Will clear all permanent and temporary DTC's.

$1A - Request ECU ID 80 - Returns ECU Distinction Flags : These are ROM flags, not sure on functionality. 81 - Request ECU ID : Ex. Returns "Z1CF48D" 82 - Returns ECU ID and "A Hard Distinction Number" 83 - Sets the RAM flag that allows you to request the CVN. : After sending 83, you can then send just $1A and it will return the CVN (Engine has to be off)

$27 01 - RequestSeed : ECU returns 32bit seed 02 - SendKey : host sends back key calculated with algorithm 01

$34 80 - RequestDownload : prepare stuff 81 - Only available inside BL kernels ? Or just some ECUIDs ? 82 - Only available inside BL kernels ? Or just some ECUIDs ? 83 - ?

$36 BLOCKNO_H BLOCKNO_L 20 ... - TransferData

$37 CKS_H CKS_L - RequestTransferExit. Returns "7F 37 91" if the checksum is bad.

A0 ????

$A3 - Read DTC's Functionality: Will return a specified amount/group of temporary/permanent DTC's. By sending just $A3, it will return all temporary and permanent DTC's.

ARB ID's:

A4

AC mem addresses or possibly LID / CID values

BF RAMjump 00 - RAMjumpcheck 01 - RAMjump

TCM Supported SID List
Note: Didn't test past 0x7F or between 0x30-0x3D
 * $10 - Diagnostic Session Control
 * $11 - Reset ECU
 * $12 - Read Freeze Frame Data
 * $14 - Clear DTC Information
 * $17 - Read DTC's Errr, why wouldn't this be a positive response? Further testing required.
 * $1A - Read ECU ID
 * $20 - Stop Diagnostic Session
 * $21 - Read Data by Local Identifier
 * $22 - Read Data by Common Identifier (Data Identifiers (DID) Range From 0 - 65535)
 * $23 - Read Memory By Address
 * $27 - Security Access
 * $2C - Dynamically Define Data
 * $3E - Tester is Present
 * $AC - Request Simply Dynamically Defined Local ID

Extensions to standard SIDs
$11 01 - Power On Reset

ABS Module Supported SID List

 * $14 - Clear DTC Information
 * $17 - Read DTC's Errr, why wouldn't this be a positive response? Further testing required.
 * $1A - Read ECU ID
 * $21 - Read Data by Local Identifier
 * $22 - Read Data by Common Identifier (Data Identifiers (DID) Range From 0 - 65535)
 * $30 - I/O Control by Local ID
 * $35 - Request Upload
 * $3E - Tester is Present
 * $A3 - Read Time of DTC's
 * $A4 - ?
 * $AC - Request Simply Dynamically Defined Local ID

Note: Didn't test past 0x7F or between 0x30-0x3D

SRS Supported SID List
Note: Nisprog can't maintain a connection yet. Not sure why, when NDS2 has no issues. But going off NDS2, this is what's probably supported.


 * $14 - Clear DTC Information
 * $17 - Read DTC's

UDS on CAN
Following modules communicate via UDS on CAN (Presumably); ECU - CAN ID - Tester
 * BCM - 0x745 - 0x765
 * IPDM - 0x74D - 0x76D
 * ? - 0x71E - ?
 * ? - 0x75B - ?