CCP is another diagnostic protocol on CAN. It's used during debugging and final tuning or calibration of an ECU. Therefore, it mostly contains commands to read and write memory on the ECU. Even though it's not supposed to be used post-production, it's sometimes left enabled on production cars, or can be enabled using UDS. CCP is therefore a very useful protocol to know about.
The CCP protocol defines two types of messages, one for each direction between the tester and the ECU. Messages from tester to ECU are called CRO (Command Receive Object). Messages from ECU to tester are called DTO (Data Transfer Object).
The CRO is used to send commands from the Tester to the ECU. It's an 8-byte message. The first byte is the command. The command is followed by a one-byte counter. The counter increases by one after each command and wraps after reaching 255. The counter is used to match the CRO with the DTO. The rest of the message is command-specific data.
TesterECUCRO frame layout
commandcounter6 bytes, command-specific
Field
Mnemonic
Value
Description
Command Code
CMD
command
Identifies the requested command (e.g. 0x01 CONNECT, 0x03 DNLOAD).
Command Counter
CTR
counter
Increments per command, wraps at 0xFF → 0x00. The DTO echoes this value.
Parameters & data
DATA
6 bytes, command-specific
Layout depends on the command. Unused bytes are "don't care".
There are three different options for the DTO. All types of DTO start with a PID indicating the type of DTO.
Command Return Message (PID = 0xFF) — Response to a CRO from the tester. The second byte of the message is the Command Return Code, which is 0x0 for a successful command, or non-zero in case of an error. The rest of the message is command-specific data. The DTO is always 8 bytes in size, padded if needed.
Event Message (PID = 0xFE) — Sent based on a status change in the ECU. The second byte is the event code, and the rest of the message is event-specific data. Since the DTO is not sent as a response to a CRO, the CTR value is not defined. Always 8 bytes, padded if needed.
Data Acquisition Message (0x0 ≤ PID ≤ 0xFD) — Frame containing data as a response to a (periodic) Data Acquisition Request. The PID is used to identify the data and matches the entry in the ODT. The message can have a variable length and should not be padded.
ECUTesterDTO — Command Return / Event Message
0xFF / 0xFEcodecounter5 bytes, command-specific
Field
Mnemonic
Value
Description
Packet ID
PID
0xFF / 0xFE
0xFF = Command Return. 0xFE = Event Message.
Return / Event code
ERR
code
0x00 = acknowledge for Command Returns. Non-zero values are error or event codes.
Command Counter
CTR
counter
For Command Returns, echoes the CTR from the matching CRO. Don't-care for Event Messages.
Parameters & data
DATA
5 bytes, command-specific
Layout depends on the command or event. Always padded to 8 bytes total.
ECUTesterDTO — Data Acquisition Message
0x00 – 0xFDup to 7 bytes
Field
Mnemonic
Value
Description
Packet ID
PID
0x00 – 0xFD
Identifies the Object Descriptor Table (ODT) within the DAQ list.
DAQ data
DATA
up to 7 bytes
Periodic data from the ECU. Variable length, not padded.
The CONNECT command is the first step in establishing a connection with the ECU. The CONNECT command has a single two-byte parameter (little-endian), the Station Address. By adding a Station Address to the connect step, it's possible to have multiple ECUs listen for CCP on the same Arbitration ID. The Station Address parameter might also be ignored by the ECU, in which case it will respond to any Station Address.
Example of connecting to an ECU with Station Address 0x0040. The command counter is 0x00:
The SET_MTA command sets the Memory Transfer Address (MTA) pointer to a user-specified address. This data pointer is then used in subsequent commands. There are two data pointers, MTA0 and MTA1. The MTA number is specified in the CRO. MTA0 is used for DNLOAD, UPLOAD, DNLOAD_6, SELECT_CAL_PAGE, CLEAR_MEMORY, PROGRAM, and PROGRAM_6 commands. MTA1 is used as the destination pointer for the MOVE command.
SET_MTA — point MTA0 at 0x34002000 (extension 0x02)
The DNLOAD command is used to write data to the ECU. The data is written to the address specified by the MTA0 pointer. The length of the data is specified in the CRO. The CRO can contain up to 5 bytes of data. The MTA0 pointer is automatically increased by the amount of data written, so multiple DNLOAD commands can be issued in a row to write a large amount of data. The acknowledgment response from the ECU contains the value of the new MTA0 pointer.
DNLOAD — write 5 bytes at MTA0
TesterECU
0323051011121314
Field
Mnemonic
Value
Description
Command Code
CMD
03
0x03 = DNLOAD.
Command Counter
CTR
23
Per-command counter.
Size
SIZE
05
Number of data bytes that follow (1–5).
Data
DATA
10 11 12 13 14
Up to 5 bytes to write at MTA0. MTA0 is post-incremented by `size`.
ECUTester
FF00230234002005
Field
Mnemonic
Value
Description
Packet ID
PID
FF
0xFF = Command Return Message.
Return Code
ERR
00
0x00 = acknowledge.
Command Counter
CTR
23
Echoed CTR.
New MTA0 ext.
EXT
02
MTA0 address extension after post-increment.
New MTA0 address
ADDR
34 00 20 05
MTA0 after post-increment by `size` (0x34002000 + 5).
Using the DNLOAD command, one byte of payload is lost to the length byte. If large batches of data need to be written, the DNLOAD_6 command can be used to download data in fixed chunks of 6 bytes.
DNLOAD_6 — write a fixed 6-byte block
TesterECU
2325101112131415
Field
Mnemonic
Value
Description
Command Code
CMD
23
0x23 = DNLOAD_6.
Command Counter
CTR
25
Per-command counter.
Data
DATA
10 11 12 13 14 15
Always exactly 6 bytes. MTA0 is post-incremented by 6.
The UPLOAD command can be used to read data from the ECU. This can be useful to dump the flash or RAM contents of the ECU for reverse engineering. The ECU will reply with the requested size of data. The MTA0 pointer is incremented automatically.
UPLOAD — read 4 bytes from MTA0
TesterECU
0423040000000000
Field
Mnemonic
Value
Description
Command Code
CMD
04
0x04 = UPLOAD.
Command Counter
CTR
23
Per-command counter.
Size
SIZE
04
Number of bytes to read (1–5). MTA0 is post-incremented by `size`.
While the UPLOAD command can be used to read data from the ECU, it first requires setting the MTA0 pointer using the SET_MTA command. If you only want to read data from the ECU and want to keep track of the current pointer on the tester side, the SHORT_UP command can be used. This command requests up to 5 bytes from an address specified in the CRO. The MTA0 pointer is not changed by this command.
The CONNECT command is a great way to scan for ECUs that accept CCP connections. You have to iterate over all possible Arbitration IDs and Station Addresses, which is quite a large space to search. However, most of the time the Arbitration ID will be between 0x600 and 0x7FF, and the Station Address will be between 0x0 and 0x40. Sometimes the Station Address is ignored by the ECU.