this file regards protocol kw1281. This was replaced by kw2089 around 2001. Some cars around this date implement both.

Communication on KW1281 occurs on the same lines as ISO 9141-2 with the same voltages etc but may use a different baud rate. message structure is completely different. priority and checksum are not used. bytes are sent one by one and must be acknowledged. I don't think this protocol can be implemented over elm327 unless headers and checksums can be disabled in some way. Elm372 does support various baud rates (AT IB commands) and initiation addresses (AT IIA).

initiation is by sending the desired address at 5 baud, as with ISO 9141-2.

slow (5 baud) init. addresses (in hex):
ECU 01
trans. 02
ABS 03
climate 08
electrics 09
stereo 0E
airbags 15
steering wheel 16
dash 17
Can gate 19
driver door 42
ccm 46
sound system 47
pass. door 52

the ECU should reply hex 55. This is binary 01010101, it is used to set baud rate for communications. baud rate will probably be 4800, 9600 or 10400.

the hex 55 will be followed by 01 8A (this identifies kw1281). The initiator must reply 75. The link will time-out if the reply is too late, but it must not be too soon either. One website suggests between 5ms and 500ms delay is OK.

communication then commences. At all times one end must be master. initially the car is master. After each byte the slave must reply with the byte's complement, before the next byte will be sent. If the complement is not received the link will drop. if it is wrong an error will be logged.

the first byte of each message is the length of the message, in bytes.

the next is a counter. each message increments the counter by 1 and it rolls over from ff to 00.

the next is message type: 06 = kill link, 09 = keep link active (ack), 29 = request 'group' of data, E7 = reply to 29, f6 = ASCI data.

next comes the data, as many bytes as are needed.

finally, 03 ends the block. the slave need not reply to this last byte.

The slave becomes master. The master becomes slave. If the new master has nothing to say it sends an ack, 03 ?? 09 03. (length, counter, ack, end).

The slave becomes master. The master becomes slave. repeat ad infinitum

The communication must be kept up. 09 is sent repeatedly to stop it ending. 06 may be sent to end the link, failing to reply will also cause it to drop.

If one end wants to make a communication it must wait until it is master. The ack is then replaced with a message encapsulated as described above.

this protocol supports writing alterations to the controllers, so be careful what you write.

you may request a data group. This is simply by sending 29 followed by the hex number of the one you want. There may be groups from 00 to ff with gaps depending on ECU.

A group will usually contain four blocks. Which blocks are in which group varies from car to car. some groups may contain 10 blocks. lists of which blocks are in each group are available in Ross-tech's VAG-COM label files. These used to be on their website but now appear to be hidden. Newer versions may be encrypted.

The reply will contain one byte E7 telling you it is a reply to a request 29, then one telling you the index of the first block, then two bytes containing that block's data (a,b). then the next block's index and it's data etc.

It seems that the index is a code telling you the equation and units for a block. It does not tell you what the block actually is, e.g. 05 is used for air temperature and for oil temperature. It may be possible to interpret this in some cases as some indices may only be used for one block. Indices translate as follows:

(!index and equations given in decimal!)
1	a*0.2*b			rpm
2	a*0.002*b		%
3	a*0.002*b		Deg
4	abs(b-127)*0.01*a	ATDC if Value >127, else "BTDC"
5	a*(b-100)*0.1		°C
6	0.001*a*b		V
7	0.01*a*b		km/h
8	0.1*a*b			-
9	(b-127)*0.02*a		Deg
10	b			if b==0 then "COLD", else "WARM"
11	0.0001*a*(b-128)+1	-
12	0.001*a*b		Ohm
13	(b-127)*0.001*a		mm
14	0.005*a*b		bar	
15	0.01*a*b		ms	
16				bitvalues	
17	chr(a)	chr(b)		-
18	0.04*a*b		Mbar	
19	a*b*0.01		L	
20	a*(b-128)/128		%	
21	0.001*a*b		V	
22	0.001*a*b		ms	
23	b/256*a			%	
24	0.001*a*b		A	
25	(b*1.421)+(a/182)	g/s	
26	b-a			C	
27	abs(b-128)*0.01*a	ATDC if Value less than 128, else "BTDC"	
28	b-a				
29	Kennfeld		if b128 : b-256 else b	
33	100*b/a(ifa=0then100*b)	%
34	(b-128)*0.01*a		kW			
35	0.01*a*b		l/h			
36	b*10+a*2560		km			
37	???			-			
38	(b-128)*0.001*a	Deg	k/w		
39	b/256*a			mg/h			
40	b*0.1+(25.5*a)-400	A			
41	b+a*255			Ah			
42	b*0.1+(25.5*a)-400	Kw			
43	b*0.1+(25.5*a)		V			
44	chr(a)	:	chr(b)	h	
45	0.1*a*b	/100			
46	(a*b-3200)*0.0027	Deg k/w		
47	(b-128)*a		ms			
48	b+a*255			-			
49	(b/4)*a			mg/h			
50	(b-128)/(0.01*a),	mBar	(if a==0 (b-128)/0.01	mBar)
51	((b-128)/255)*a		mg/h			
52	b*0.02*a-a		Nm			
53	(b-128)*1.4222+0.006*a	g/s			
54	a*256+b			Count			
55	a*b/200			s			
56	a*256+b			WSC			
57	a*256+b+65536		WSC			
58	1.0225*b, 			[if b>128 then	1.0225*(256-b)]
59	(a*256+b)/32768		-			
60	(a*256+b)*0.01		sec			
61	(b-128)/a,ifa==0(b-128)	-
62	0.256*a*b		S		
63	chr(a) + chr(b) + "?"	-		
64	a+b			Ohm		
65	0.01*a*(b-127)		mm		
66	(a*b)/511.12		V		
67	(640*a)+b*2.5		Deg		
68	(256*a+b)/7.365		deg/s		
69	(256*a+b)*0.3254	Bar
70	(256*a+b)*0.192		m/s^2

KWP2089 is based on KWP2000
KWP2098 is also called KWP2031
SSF 14230 is freely available on the internet and explains how KWP2000 works.

The physical layer is the same as ISO 9141 and kw2000. Initialisation is the same as also, keywords are 6F0F (the first message after initialisation is the keyword and identifies the protocol: in this case it indicates both types of header and both types of length byte are accepted, and that normal timing is in use)

The messages are sent uninterrupted (there is no need to acknowledge each individual byte as with kw1281)

The message format is Header, receiver, transmitter, message, CRC, exactly the same as KWP2000.
The header is the number of bytes in the message +hex80. This +80 implies physical addressing is in use. ECU address seems to be at hex 10

I am unsure how to request groups or blocks. I think I should request a diagnostic session code hex 81 with parameter 89 but I'm not sure what next.