Addressing ECUs directly using an ELM327 dongle and ISO 9141

Question

I have a VW Golf Mk4, which is quite old and talks KWP 2000 (ISO 9141) on its CAN bus. I use a dongle powered by ELM327, connected to the OBD-II port of the car.

I am trying to send messages individually to each ECU. I tried to change the header of the messages:

AT SH 48 XX F1 (I hoped XX would be the ECU ID; 48 is the flag for "use physical addressing"). Any command I issue (e.g., I tried 3E for "tester present") returns NO DATA (I disabled automatic timeouts and set the timeout to maximum value).

Is there a way to send messages directly to the ECU? I am not interested in the set of data provided via OBD-II, neither do I want to reflash the ECUs. At the moment, I just try to find out which ECUs are available on the bus.

Answer 1

VW works on Transport Protocol TP 2.0, hence you need to initialize the device with a 0x200 header.

See VW Transport Protocol 2.0 (TP 2.0) for CAN bus for more information.