In automotive diagnostics over the CAN network, especially in Toyota/Scion vehicles such as the FR-S, reading Diagnostic Trouble Codes (DTCs) is not limited to a single request from the scanner, but rather involves a sequence of communication steps using proprietary services. When the scanner sends a request like 0x13 0x81 to retrieve current DTCs, the ECU responds with 0x53 followed by the fault code data, allowing the scanner to display the DTC. However, immediately after this, the scanner continues requesting additional information using service 0x12, which corresponds to reading extended data or “freeze frame” information. These requests appear as 0x12 00, 0x12 01, and 0x12 02, where each one represents different data blocks associated with the detected fault. To maintain proper communication and avoid errors or scanner timeouts, it is essential to respond to each of these requests with the correct positive response (0x52), ensuring that the index matches and providing data, even if it is simulated. Finally, the scanner may send another request such as 0x13 0x82 to query additional categories of DTCs, such as pending or stored codes. This behavior highlights that proper ECU emulation must not only handle the initial DTC request, but also fully support subsequent data queries to ensure a stable and realistic diagnostic session between the scanner and the vehicle.
