General SAE OBD-II diagnostics
Modes 01–0A for any OBD-II compliant vehicle — live data, freeze frames,
fuel-trim, O₂ sensor data, on-board test results, calibration IDs, and pending / permanent DTCs.
SAE J1979 · ISO 15031-5
Full UDS (ISO 14229-1)
Every service that matters — sessions, security access, DataIdentifiers, routines,
ECU-reset, transfer, communication control, response-on-event, link control. Custom routine
builder plus an NRC decoder for every refusal.
0x10 / 0x14 / 0x19 / 0x22 / 0x27 / 0x28 / 0x2E / 0x2F / 0x31 / 0x34–0x37 / 0x3D / 0x3E / 0x85 / 0x87
Full VIN readout & decoder
Mode 09 InfoType 02 and UDS $22 F1 90 readout, with full WMI / VDS / VIS
breakdown — OEM identification, ISO 3779 model-year decode, plant code, sequential
number, and check-digit validation. Decode auto re-themes the OEM workspace.
8 corrected WMI-overlap conflicts (SAL, 5UX, WDB, 9BH, 5NM, 4S3, 4M2, 3LN)
Global & OBD-II fault codes
Full DTC management — Mode 03 / 07 / 0A for OBD-II, UDS 0x19 sub-functions 0x02 /
0x04 / 0x06 for OEM-specific codes. Reads freeze-frame data, snapshot records,
and extended data records, with audit-logged clears.
Per-VIN integrity chain on every operation
CAN & K-Line bus topographer
Active bus discovery — sweeps the entire 11-bit and 29-bit CAN ID space and the
K-Line address range, identifies every responsive ECU, then renders the network topology
so you can see exactly what's on the bus.
HS-CAN, MS-CAN, SW-CAN, K-Line all supported
Multi-bus CAN sniffer
HS-CAN (500 k), MS-CAN (125 k), SW-CAN (33.3 k) on auto-detect or manual
select, with replay, filtering, and a full CAN Bit-Timing Analyser for
diagnosing flaky buses down to the segment-quantum level.
ISO 11898 / GMLAN / SAE J2284
Emissions testing & monitors
SAE J1979 readiness monitor tracking with a full state-machine view of the
11 monitors (continuous + non-continuous), MIL status, distance since codes cleared, and
emissions-compliance PDF reports.
ADR 79 / 80 / 81 / 84 compliant report output
DoIP & CAN-FD ready
Modern transport layers alongside classic CAN — DoIP (ISO 13400)
over Ethernet with automatic vehicle announcement and routing activation, plus
CAN-FD flexible-data-rate framing. The transport is auto-detected on
connect, so the same UDS workflow runs over CAN, CAN-FD, or DoIP with no reconfiguration.
ISO 13400 DoIP · ISO 11898-1 CAN-FD · auto-detect transport
1000+ OEM PID definitions
Pre-decoded Mode 22 databases for Ford, GM, Honda, Nissan, Mazda, Subaru, PSA / Citroën,
and Daimler — plus a custom PID builder for definitions not yet catalogued,
with a full formula and scaling editor.
20,592 scaling formulas underpin the library
Live datalogger & signal analyser
Simultaneous multi-PID capture at the highest rate the ECU supports. Real-time waveform
plotting with cursor-pair measurement, frequency-domain analysis, statistical overlay, and
CSV export for post-session work.
Bench-grade sampling · cursor & statistical tools
USB oscilloscope integration
Turn the laptop into a lab scope — PicoScope automotive units (4225A / 4425A),
generic SCPI bench scopes over USB or LXI, and budget Hantek 6022
hardware, all behind one scope screen: per-channel V/div, AC/DC coupling, 10:1 probe factors,
edge trigger with pre-trigger, roll streaming, cursors, automated measurements, and CSV / PNG
export. And because it lives inside TES, you get simultaneous J2534 datalogging with
oscilloscope logging — PIDs, CAN traffic, and analog waveforms captured side-by-side
on one machine, every capture timestamped for post-session alignment of the physical layer
against protocol traffic.
PicoScope · SCPI/LXI · Hantek · scope + J2534 logged together
Dashboard, playback & histogram
Live gauge dashboards with configurable layouts, full session playback with seek and
variable-speed scrubbing, and histogram analysis for any logged PID — ideal for
finding intermittent faults.
Configurable layouts · saved per-vehicle
Relative compression & misfire
RPM-ripple-based compression analysis via PID 0x0C while cranking — finds weak
cylinders without pulling plugs. Plus full Mode 06 per-cylinder misfire counters with
TID stride auto-detection.
660 Mode-06 test IDs pre-labelled
ECU flash reprogramming
Read, erase, write firmware a large array of ECU familys including Ford, Volkswagen, Honda, Nissan,
Volvo, GM, Mazda
Validated profiles — not generic UDS speculation
100+ seed-key algorithms
Ford CAN-Generic v2003, Ford PATS, and coverage of UDS $27 across Ford, JLR,
VW, GM, Honda, Nissan, Mazda, Subaru, Daimler, PSA / Stellantis, and Renault families —
including VW/VAG SA2 run straight from the bytecode in the vehicle’s ODX
— plus a Seed-Key Sandbox for live experimentation against captured seeds.
400+ Ford named-key dictionary
Ford Routine Runner
One-click execution of OEM service routines for Ford modules — throttle / SAS / EPB
resets, learn procedures, calibration commits, oil-life resets, immobiliser sync, and more.
Routine library is extensible per-platform.
Routines audit-logged on every execution
Ford As-Built data editor
Read and edit Ford As-Built records — the configuration blocks
programmed into modules at the factory. Use for option-coding, retrofits, region changes,
immobiliser configuration, and module swaps that need data carried across.
Per-module diff · restore from snapshot
PATS programming - Most Ford Models
Passive Anti-Theft System programming for Fords — key learning, PCM ↔ ICC synchronisation,
transponder enrolment, emergency unlock workflows, and full audit logging of every operation.
Original cryptographic workflows, validated on hardware
ODX → routine creator
Import any ODX-D diagnostic description file and the suite generates an
executable J2534 routine on the fly — map services, sub-functions, and parameters
straight to a runnable workflow. The fastest path from OEM spec to bench-tested procedure.
ISO 22901-1 compatible · ODX-LINK output supported
17,974 OEM-specific DTCs
Canonical DTC library covering 15 OEM families plus an SAE J2012 generic fallback.
Bucketed lookup with auto-fallback to Generic. Includes manufacturer-specific freeze-frame
snapshot records, extended data records, and audit-logged clears.
Continuously expanded release over release
20,592 PID scaling formulas
Per-OEM expressions in canonical X(N) syntax that turn the raw bytes of a UDS
$22 ReadDID response into scaled values with units — e.g.
(X(0)*196)/16 = coolant temp in 0.0625 °C. Any custom PID inherits
the same library.
Drives every scaled gauge, log, and report
660 Mode-06 test definitions
Per-OEM SAE J1979 / J1979-DA on-board diagnostic test IDs — so an Emissions tab
shows “EVAP System Leak — gross” next to a raw Mode-06 result, instead
of just “Slot 01 / TID 41 / 0x0234”.
Generic fallback for any TID the active OEM does not override
Per-OEM branded workspaces
Every OEM family gets its own gradient banner, accent colour, and brand glyph. VIN
decoded → workspace re-themes automatically so the technician's UI matches the vehicle
in front of them.
14 distinct OEM workspace themes
Workshop procedures & PATS library
Catalogue of step-by-step workshop procedures, immobiliser sequences, key-fob
programming flows, and SCN-coding instructions — indexed per-OEM for in-app
search and surfaced alongside the relevant DTC, routine, or coding screen.
Context-aware procedure surfacing
IM240 / RG240 transient emissions lane
The full 240-second EPA IM240 transient drive cycle on a chassis dyno — the hash-pinned
official speed trace, a five-channel gas bench and the dyno driven together over serial,
and second-by-second grams-per-kilometre mass with dry-to-wet, HC carbon-number and NOx
humidity corrections, judged against ADR limit tables. Per-channel analyser time-alignment,
coast-down road-load verification, a live driver's aid, and fail-closed validity gating on
every run — finished as a tamper-evident, QR-verifiable signed PDF certificate.
EPA420-R-00-007 §85.2221(e) · 40 CFR 1065 / 1066 corrections · ADR 37 / 79 limits · Ed25519-signed reports
File utilities & binary tools
VBF firmware container unpack / repack with LZSS, hex viewer with structural overlays,
checksum calculators (CRC-16 / 32, Fletcher, custom polynomials), and a binary diff tool
for comparing calibration revisions.
Format-aware overlays for VBF / S19 / HEX / BIN
Bluetooth audio & phone test suite
Infotainment Bluetooth diagnostics — pairing handshake validation, A2DP audio-quality
measurement, HFP call-audio testing, codec negotiation (SBC / AAC / aptX), and contacts /
PBAP sync verification.
Reproduces real-world phone-pairing failure modes
Hidden BLE tracker sweep
Answers a question a worried owner can't answer alone: is there a tracker in this
vehicle? Passively scans for Apple Find My / AirTag, Tile, Samsung Galaxy SmartTag
and Google Find My Device tags. A differential drive survey — baseline the workshop,
log a short drive out and back, then compare — isolates the one device actually travelling
inside the car from the surrounding Bluetooth noise, with a live signal-strength aid to walk it
down and find it. Exports a signed PDF evidence report for police.
Passive receive only · signed evidence report · personal-safety checks
Remote master / slave agent
Drive a J2534 device on the other side of the world — encrypted WebSocket relay,
full feature parity with local mode. Flash, diagnose, sniff — anything that works at
the bench works over the internet.
Audit-logged sessions, signed envelopes
Ctrl+Shift+A — advanced diagnostics
One hotkey opens the suite's library of 30+ bench-grade engineering tools
— relative compression, ground-loop detector, CAN bit-timing analyser, ELM327
comparator, DTC timeline, live combustion map, module topology animation, monitor
state-machine, misfire counter, seed-key sandbox, and more.
Tool library extends with every release
PDF reporting throughout
Every meaningful diagnostic function exports a professional multi-page PDF —
customer reports, audit trails, evidence bundles with MANIFEST.json + per-file hashes,
Certificates of Authenticity, ECU Birth Certificates. Drop-in for insurance, warranty,
and legal use.
Branded export · tamper-evident manifest
ELM327 compatibility (limited)
Support for ELM327 V1.x / V2.x adapters over serial / USB / Bluetooth for basic OBD-II
read operations. Not suitable for flash or security access, but useful for field-side
quick scans and customer pre-checks.
Includes ELM327 firmware-quality comparator
A2L / XDF calibration editor
Load a firmware image plus an ASAM MCD-2 MC (.a2l) or
TunerPro (.xdf) definition and every named map, curve, and scalar becomes
an editable, colour-coded table. A two-pass A2L reader resolves conversions, record layouts, and
axes; the XDF reader honours embedded-data signedness, endianness, and the raw→physical math
— each surfaced as an editable property so an ambiguous definition is fixed in one click.
ASAM MCD-2 MC · TunerPro XDF 1.6 · definition-driven
Live heatmap, 3-D surface & map math
Edit 2-D and 3-D tables in a spreadsheet grid with a live colour heatmap and a rotatable
3-D surface alongside. Set / add / multiply / percent, horizontal·vertical·block
interpolation, smoothing, copy-paste between images, and a full undo stack. Side-by-side image
compare highlights every changed cell.
Emissions & safety tables flagged · risky edits double-confirmed
Checksum correction & safe write-back
Bench editing is never blocked, but writing a calibration back to an ECU is gated on a
valid checksum. One-click checksum correction, base-address resolution from the
A2L memory segments, out-of-bounds guarding, and XDF export keep a repaired image consistent
and flashable.
CRC / Fletcher / custom-polynomial checksum profiles
EEPROM bench editor & cluster tooling
Read and write physical serial EEPROMs through a bench programmer over a COM
port, with a built-in instrument-cluster database spanning 2,400+ vehicles,
odometer read & recalculation for cluster repair / replacement, and a structural hex editor.
Strictly offline — this workspace never touches the vehicle bus.
Serial EEPROM R/W · cluster database · mileage maps · hex editor
Blackbox Data Extraction
Tooling for the recovery of Crash Data from Restraints Control Modules and Airbag Modules.
Full reporting and data visualisation capability. SHA256 Integrity Chained and cryptographically
signed PDF for authentication and integrity of documentation produced.
Tester Present CDR Toolset
SAE J1939 fault diagnostics
Full J1939 network stack for on-highway trucks, buses and mobile plant — 29-bit PGN
decomposition, transport-protocol reassembly (BAM & RTS/CTS), J1939-81 address claim, and
active / previously-active / stored diagnostics via DM1–DM19 with SPN + FMI
decode against a 21,000-entry SPN catalogue and SAE SLOT scaling.
DM1 / DM2 / DM3 / DM4 / DM11 / DM19 · SPN·FMI · lamp status · honest-degradation on unresolved SPNs
TMC RP1210 adapter support
Every installed RP1210 adapter enumerates alongside J2534 devices in one unified
connection flow — pick the interface, pick the protocol, connect. Nexiq USB-Link,
Dearborn DPA, DrewLinQ, Jaltest and Caterpillar Comm Adapters all supported through their
vendor drivers. No second picker, no separate app.
RP121032.INI enumeration · J1939 / J1708 / CAN / CAT per-device protocol select
Caterpillar Data Link (CDL)
Listen-only Cat Data Link monitoring over RP1210 for Caterpillar iron — node discovery,
PID decode and frame capture. Rides a
Caterpillar-family adapter declaring the "CAT" protocol string.
CDL over RP1210 · node map · PID decode · export capture record · listen-only
J1587 / J1708 legacy datalink
Pre-2007 heavy-duty diagnostics over the SAE J1708 physical layer with J1587 message
decode — MID / PID / SID / FMI fault reporting for older engines, transmissions and brake
systems still working every day in the field.
SAE J1708 · J1587 MID / PID / SID / FMI
Offline-first for the pit & paddock
Heavy-duty fitters work in quarries, mine sites and remote workshops with no signal.
Tester Engineering Heavy is fully functional with zero internet, indefinitely —
USB-licence only, no phone-home, no cloud seed/key, all definition data on-disk. A
NIC-disabled machine is an acceptance test, not a degraded mode.
Zero phone-home · USB hardware licence · local-only data
UDS-on-J1939 & heavy OEM reach
Where a heavy ECU speaks UDS over a J1939 transport, the full inherited UDS service layer
rides on top — unlocking Isuzu, Hino, Fuso and Paccar diagnostics through the same routines,
security access and DID library the light-vehicle side uses.
UDS over J1939 · shared ISO 14229 service layer · per-OEM address inference
