List of ECUs - colinbourassa/torinoscan GitHub Wiki

ECU list

SD1 name SD2 name ECU Cars Protocol Baud Address ISO sequence
BABS0002 n/a Bosch ABS 512TR 55 09 81
n/a BABS0055 Bosch ABS/ASR 5.3 360 KWP-71 9600 55 10 07 01 98 85
n/a BABS0077 Bosch ABS/ASR 575 KWP-71 9600 55 10 07 01 19 85
BABS0028 BABS0096 Bosch ABS/ASR 550 KWP-71 9600 0x20 55 54 83 01 15 C2
BABS0039 BABS0118 Bosch ABS 456M KWP-71 9600 0x20 55 54 83 01 15 C2
n/a BABS0136 Bosch ABS Enzo KWP-71 9600 55 10 07 01 19 86
BABS0036 BABS0142 Bosch ABS F355 KWP-71 9600 55 10 07 01 15 02
n/a BALI0140 Valeo clutch Enzo CAN 55 98 07 01 01 76
n/a BANT0062 Bosch security 360 (n/a)
n/a BANT0078 Bosch security 575 (n/a)
BANT0026 BANT0086 Bosch security 355
456
550		 Bosch Alarm protocol 9600 55 0E 07 01 15 80
BANT0026 BANT0120 Bosch security 456M Bosch Alarm protocol 9600 0x94 55 0E 07 01 15 80
n/a BIMM0131 Bosch immobilizer Enzo FIAT9141 4800 55 7F 86 01 97 F2
n/a BMOT0057 Bosch Motronic 7.3 360 KWP2000 10400 55 EF 8F
n/a BMOT0081 Bosch Motronic 575 KWP2000 10400 55 EF 8F
BMOT0034 BMOT0090 Bosch Motronic 550 KWP-71 9600 0x10 (right bank)
0x14 (left bank)		 55 00 81
n/a BMOT0098 Bosch Motronic 360 (2003) KWP2000 10400 55 EF 8F
BMOT0030
BMOT0046		 BMOT0100 Bosch Motronic 5.2 456M KWP-71 9600 0x10 (right bank)
0x14 (left bank)		 55 00 81
n/a BMOT0119 Bosch Motronic 5.2 456GT KWP-71 9600 55 4C 83 04 13 3B (Same as TRW airbag ECU -- why?)
BMOT0010 BMOT0121 Bosch Motronic 2.7 456GT KWP-71 4800 55 46 83 02 92 32 (EUR)
55 46 83 01 92 B3 (USA)
n/a BMOT0133 Bosch Motronic Enzo KWP2000 55 EF 8F
BMOT0024 BMOT0145 Bosch Motronic 5.2 F355 KWP-71 9600 0x10 55 00 81
BMOT0020 BMOT0146 Bosch Motronic 2.7 F50 KWP-71 4800 0x10 (right and left) 55 46 83 01 96 B5
55 46 83 02 94 B4 (EUR)
55 46 83 01 94 B3 (USA)
BMOT0015 BMOT0147 Bosch Motronic 2.7 F355 KWP-71 4800 55 46 83 04 92 34 (EUR)
55 46 83 85 92 B5 (USA)
BMOT0011 BMOT0162 Bosch Motronic 348
Mondial		 KWP-71 9600 55 46 83 01 13 32
BMOT0004 BMOT0163 Bosch Motronic 2.7 348
Mondial		 KWP-71 4800 55 46 83 01 89 A8 (Mondial noncat.)
55 46 83 83 89 2A (Mondial cat.)
55 46 83 04 89 AB (348 noncat.)
55 46 83 85 89 2C (348 cat.)
BMOT0001 BMOT0164 Bosch Motronic 512TR KWP-71 4800 0x10 55 46 83 02 10 B0 (EUR)
55 46 83 02 10 2F (USA)
55 46 83 01 10 2F (USA?)
n/a BPRE0069 Beru TPMS 575 KWP2000? 200 / 10400 0xF0 55 4F 83 01 15 3D
55 4F 83 02 15 3E
n/a BPRE0138 Beru TPMS Enzo KWP2000? 200 / 10400 0xF0 55 4F 83 01 15 3D
BSED0038 n/a Seats 456M 55 91 07
55 91 07 03 16 86
n/a BSED0071 Bitron seat control 575 9600 55 91 07 01 19 07
n/a BSED0114 Bitron seat control 456M 9600 55 91 07 D8 EE 00
n/a BSOS0052 Boge suspension 360 9600 55 97 07 01 98 8C
n/a BSOS0066 Skyhook suspension 575 55 92 07 01 19 08
BSOS0031 BSOS0088 Bilstein suspension 550 (same as BSOS0144) 9600 55 49 83 01 15 37
BSOS0007 BSOS0108 Bilstein suspension 456GT (same as BSOS0144) 9600 55 49 83 01 92 34
BSOS0045 BSOS0109 Bilstein suspension 456M (same as BSOS0144) 9600 55 92 07 02 16 86 (GTA)
55 92 07 01 16 85 (GT)
n/a BSOS0135 Skyhook suspension Enzo KWP2000 10400 55 92 07 01 01 70
BSOS0017 BSOS0143 Bilstein suspension F50 (same as BSOS0144) 9600 55 49 83 8A 13 3E
BSOS0014 BSOS0144 Bilstein suspension F355 5-byte messages, e.g. 0A 00 00 00 0A 9600 55 49 83 83 13 37
n/a BSOS0191 Skyhook suspension 575 (2004) 55 92 07 02 83 73
n/a CCAP0068 Convertible top 360 E9 89
n/a DCAP0231 Convertible top 575 SA 55 D0 83 02 04 AE
n/a DCON0054 Diavia climate control 360 55 4A 83 01 98 3B
n/a DCON0076 Diavia climate control 575 55 4A 83 01 19 BC
DCON0025 DCON0085 Diavia climate control 550 (same as DCON0161) Ack/empty msg seems to be the single byte 0x6D 9600 0x08 55 4A 83 01 15 38
DCON0042 DCON0106 Diavia climate control 456M (same as DCON0161) 9600 55 4A 83 02 16 3A
DCON0008
DCON0023		 DCON0110 Diavia climate control 456GT (same as DCON0161) 9600 55 4A 83 86 92 BA
n/a DCON0116 Diavia climate control 550 (1999) (same as DCON0161) 9600 55 4A 83 02 98 BC
n/a DCON0117 Diavia climate control 456 (2000) (same as DCON0161) 9600 55 4A 83 83 98 3D
n/a DCON0132 Diavia climate control Enzo 55 4A 83 01 01 A4
DCON0013 DCON0161 Diavia climate control F355 (same as DCON0008) 9600 0x08 55 4A 83 04 13 B9
n/a DCRU0050 Marelli dashboard 360 55 CD 83 01 98 3E
n/a DCRU0074 Marelli dashboard 575 55 CD 83 01 98 3E
DCRU0018 DCRU0154 Digitek dashboard F50 (same as DMUL0097) 9600 0x85 55 CD 83 08 13 40
n/a DCRU0188 Dashboard 360CS 55 CD 83 04 83 2C
n/a DCRU0215 Marelli dashboard 575 Evo 2 55 CD 83 01 98 3E
55 CD 83 02 04 AB
n/a DCRU0227 Dashboard 575SA 9600 55 CD 83 02 04 AB
DMOS0033 DMOS0103 Digitek security 456GT (same as DMUL0097) 9600 55 8F 07 01 15 01
DMOS0047 DMOS0105 Digitek security 456M (same as DRUN0102) 55 15 07 01 16 08
DMUL0035 DMUL0091 Digitek MFD 550 (same as DMUL0097) 55 58 83 01 15 46
DMUL0049
DMUL0069		 DMUL0092 Digitek MFD 550 (1999/2000)
DMUL0040 DMUL0097 Multifunction display 456M (same as DMUL0113) 4-byte messages, e.g. 02 FD 02 FD 55 58 83 02 16 C8
DMUL0067 DMUL0113 Multifunction display 456 (2000) (same as DMUL0097) 55 58 83 02 98 4A
n/a DNQS0141 Digitek instruments Enzo 55 CD 83 01 02 A8
DRUN0060 DRUN0093 Digitek running loss 550 (same as DMUL0097) 55 4F 83 01 15 3D
DRUN0065 DRUN0102 Digitek running loss 456
550		 (same as DMOS0105) 55 4F 83 01 98 40
n/a DSOL0137 Digitek nose lift Enzo 9600 55 CE 83 89 13 C2
DSOL0021 DSOL0157 Digitek nose lift F50 9600 0x98 55 CE 83 89 13 C2
FCAM0043 FCAM0111 Ricardo-FFD gearbox 456M (same as FCAM0115) 5-byte messages, e.g. 03 00 00 00 03 9600 55 D3 83 01 15 C1
FCAM0027 FCAM0115 Ricardo-FFD gearbox 456 (same as FCAM0111) 9600 55 D3 83 01 15 C1
n/a MCAM0058 Marelli gearbox 360 55 52 83 01 15 40
55 86 7C 01 98 31
55 13 07 02 01 F2
n/a MCAM0080 Marelli gearbox 575 55 13 07 01 80 70
55 13 07 01 83 73
n/a MCAM0134 Marelli gearbox Enzo KWP2000 55 13 07 01 80 70
MCAM0037 MCAM0151 Marelli gearbox F355 FIAT 1AF 9600 0x02 55 52 83 01 15 40
n/a MCAM0158 Marelli gearbox 360 55 52 83 01 15 40
55 86 7C 01 98 31
55 13 07 02 01 F2
n/a MCAM0168 Marelli gearbox 360CS 55 13 07 01 80 70
n/a MCAM0228 Gearbox 575SA KWP2000 10400 55 13 07 01 80 70
55 13 07 01 83 73
PCAP0019 PCAP0095 Power-Packer DUC1314-11-99 convertible top F355 9600 (No init sequence) 55 D0 83 01 94 3D
n/a SALZ0053 Window lift 360 FIAT 1AF 4800 55 D6 83 01 15 C4
n/a SALZ0079 Window lift 575 FIAT 1AF 4800 55 D6 83 01 15 C4
SALZ0022 SALZ0084 Window lift 550 FIAT 1AF 4800 55 D6 83 01 15 C4 (EUR)
55 D6 83 02 15 C5 (USA)
SALZ0044 SALZ0107 Window lift 456M FIAT 1AF 4800 55 D6 83 01 15 C4 (EUR)
55 D6 83 02 15 C5 (USA)
n/a SECR0232 Electrochromic glass 575SA KWP2000 10400 55 D0 83 14 AD
n/a TAIR0051 TRW airbag 360 55 16 07 01 98 0B
n/a TAIR0072 TRW airbag 575 55 AB 86 01 01 08
55 AB 86 02 01 89
TAIR0083 Becker airbag F355
456		 FIAT-9141 1200 55 4C 83 04 13 3B
55 4C 83 85 13 BC
TAIR0012 TAIR0089 TRW airbag F355
456
550		 FIAT-9141 1200 55 4C 83 04 13 3B (456/550 EUR)
55 57 83 02 16 C7 (456M)
55 4C 83 85 13 BC (F355)
55 57 83 01 15 45 (456/550 USA)
n/a TAIR0130 TRW airbag Enzo FIAT-9141 4800 55 AB 86 83 01 8A
n/a VNRI0139 Valeo NRI Enzo 55 97 07 01 01 75

Notes about specific ECUs/protocols

Note that any references to commands 0x11, 0x12, and 0x13 in this section are actually referring to the serial protocol used between the win32 software (WSDC32) and the VxWorks-based Tester.

  • Some ECUs use the L-line for init. These seem to include:
    • Some (all?) 2.7 Motronic
    • DCON0161 (Diavia air-con)
    • MCAM0151
  • BSOS0088, BSOS0108, BSOS0109, BSOS0143, and BSOS0144 seem to use the L-line for all communication.
  • Except in the cases of protocols that need a constant block exchange to stay alive (KWP-71, FIAT-9141), the .ecu modules don't do much beyond forwarding messages from the PC to the ECU and vice versa, removing or adding the win32 SW protocol packet header info as appropriate.
  • According to this FChat thread, the processor for the Motronic 5.2 (355/456/550) ECUs is an Intel MCS-96 (87C196KN). However, there is probably no publicly available copy of the code that resides in the processor's internal ROM.

BABS0096, BABS0118, BABS0142 (Bosch ABS)

  • Slow init and receipt of keyword bytes using L-line. Acknowledgement of keyword bytes and all other communication using K-line.
  • Cmd 0x13 seems to work like the KWP71 ECUs for the most part, with the exception that the PC can send a message with the embedded command 0x02 (write RAM?) and just an index number as opposed to the data to write. The actual data is contained in one of seven hardcoded buffers in the .ecu module on the Tester.
  • Responses from the ECU can apparently include 0xE8 as the block type. Purpose unknown.
    • This might be a FIAT9141 block title that is used in place of the normal 09 ACK when an actuator is active.

BANT0086 (Bosch security)

  • No slow init. 9600bps communication immediately available w/ K-line.
  • PC commands 0x11 and 0x12 just zero the payload portion of the buffer used to communicate back to the PC -- this means the expected ISO keyword bytes are just: 00 00 00 00 00 00. Only command 0x13 does anything interesting; it behaves the same as 0x13 for other ECUs, where the payload is used as a message to the ECU.

BPRE0069, BPRE0138

  • Appears to be using KWP2000 messages (e.g. 81 A2 F1 81 95 or 81 A2 F1 10 24)

BSOS0088

  • Five-byte messages with the command byte in position 0. The last byte is an XOR of the preceding four bytes.
  • 0A 00 00 00 0A seems to be an ACK/NOP.
  • Command 01 seems to be a memory read request.
  • Command 11 seems to request stored fault codes.
  • Command 06 is sent just after initialization, possibly to request ECU HW/SW identification.

PCAP0095 (Power-Packer convertible top ECU for F355)

  • No slow init. Bytes returned in the response to cmd 0x12 will be from uninitialized memory.
  • Cmd 0x13 includes (at position 07 in the message buffer) the number of bytes expected in the response from the ECU. The actual request to the ECU then follows at position 08. Example request: 81 00 00 00 81, with 0x11 bytes expected in response.

TAIR0089 (TRW airbag)

  • The .ecu module re-does the slow init sequence every time it receives a cmd 0x13 from the PC. This is probably just the result of a very simple protocol implementation that does not actually maintain the block exchange to keep the connection alive; instead, the command received from the PC will be sent to the ECU immediately after the slow init sequence is complete.

Specific examples (part numbers and pinouts)

This section is intended to be a list of ECUs that speak the same protocols as some of those listed above, but that are not for Ferrari applications and therefore might be more economical to procure for testing.

KWP-71

  • Bosch Motronic 1.2 (p/n 0 261 200 156) from 1988-90 BMW 750iL (E32). This ECU responds to slow init address 0x10 with 8 data bits, and then begins communication at 4800 baud.

  • Bosch Motronic 5.2 / Ferrari F355

    Row Pin Color Assignment
    1 6 black GND (chassis)
    1 26 red 12V (fused)
    1 27 yellow/red Main relay controlling 12V to ignition
    1 28 black GND (shield)
    2 34 black GND (chassis)
    2 46 blue/black GND (analog)
    2 54 green 12V power from relay
    2 55 green/black GND (chassis)
    3 56 yellow/black "Ignition lock" (signal from immobilizer module?)
    3 71 black/white GND (chassis)
    3 74 gray/black Water temp sensor
    3 80 brown/black Diagnostic port input
    3 87 red/gray Diagnostic port output
    3 88 brown/gray Diagnostic port control

FIAT 9141

Bosch immobilizer

The Bosch VIM### series of security/immobilizer systems was supplied to Ferrari, Porsche, Ford, and some other manufacturers. It was used on the Porsche 993 as well as the Ford Explorer in certain markets. A partial pinout is available here with the following information for the leftmost connector on the 993 variant of this module:

Pin Assignment
1 LED
2
3 Lock
4 Ground
5 Warning lamp
6 Ignition terminal 15
7 Buzzer contact
8 +12V (terminal 30)
9 W data line
10
11 K data line
12
13
14 Unlock
15
16 Starter relay

Ford Explorer variant (for MY1996) has part number F6RF-14B207-AA.

Diavia climate control (F355)

This may have also been used on VW products around the same time, e.g. SEAT Cordoba

⚠️ **GitHub.com Fallback** ⚠️