Toyota Prius INF sub-code read over plain ELM327
================================================

Covers Toyota Prius (and other Toyota/Lexus hybrids) using a plain ELM327 adapter.

Toyota hybrids append a 3-digit INF (detail) code to some DTCs, e.g. P0AA6-611,
P0AA6-612, P3000-123, P3000-125. Each INF pinpoints a distinct trouble area (for
P0AA6 the INF distinguishes a battery fault from an inverter/cable/harness fault).

This document gives the wire-level read to obtain the active INF detail codes using a
plain, cheap ELM327 adapter -- no dealer tool, no dongle-specific app.


The read
--------

Set the ELM327 to talk to the HV battery ECU and issue a mode-22 DID read:

  ATSH7E2
  22 05 CA

Response:

  62 05 CA <57 data bytes>    (bytes 0..56)

DID 0x05CA is the INF detail-code DID on the HV ECU. The 57-byte payload packs all
INF codes for the HV/hybrid system. A code is active iff its extracted value is
nonzero; the value itself is the raw reported byte/bitfield, not a transformed code.

The full session init is the usual ELM327 sequence (ATZ, ATE0, ATL0, ATH1,
auto-protocol detect). Any ELM327 (Bluetooth SPP, Wi-Fi TCP, USB) that can set a CAN
header will do.


Payload layout
--------------

Each row: INF code, byte offset into the 62 05 CA payload, bit range (MSB-first).
Whole-byte fields are raw byte values; single-bit fields are 0/1 flags.

  INF 602   byte[0]      bits 0-7
  INF 603   byte[1]      bits 0-7
  INF 605   byte[2]      bits 0-7
  INF 606   byte[3]      bits 0-7
  INF 614   byte[4]      bits 0-7
  INF 615   byte[5]      bits 0-7
  INF 616   byte[6]      bits 0-7
  INF 617   byte[7]      bits 0-7
  INF 618   byte[8]      bits 0-7
  INF 619   byte[9]      bits 0-7
  INF 620   byte[10]     bits 0-7
  INF 608   byte[11]     bits 0-7
  INF 609   byte[12]     bits 0-7
  INF 611   byte[13]     bits 0-7
  INF 612   byte[14]     bits 0-7
  INF 621   byte[15]     bits 0-7
  INF 622   byte[16]     bits 0-7
  INF 623   byte[17]     bits 0-7
  INF 624   byte[18]     bits 0-7
  INF 632   byte[19]     bit 0
  INF 633   byte[19]     bit 1
  INF 634   byte[19]     bit 2
  INF 635   byte[19]     bit 3
  INF 636   byte[19]     bit 4
  INF 637   byte[19]     bit 5
  INF 638   byte[19]     bit 6
  INF 639   byte[19]     bit 7
  INF 625   byte[20]     bits 0-7
  INF 640   byte[21]     bits 0-7
  INF 641   byte[22]     bits 0-7
  INF 642   byte[23]     bits 0-7
  INF 643   byte[24]     bits 0-7
  INF 644   byte[25]     bits 0-7
  INF 645   byte[26]     bits 0-7
  INF 646   byte[27]     bits 0-7
  INF 647   byte[28]     bits 0-7
  INF 601   byte[29-30]  bits 0-7    (16-bit big-endian: (byte29 << 8) | byte30)
  INF 604   byte[31]     bits 0-7
  INF 607   byte[32]     bits 0-7
  INF 610   byte[33]     bits 0-7
  INF 613   byte[34]     bits 0-7
  INF 626   byte[35]     bits 0-7
  INF 627   byte[36]     bits 0-7
  INF 628   byte[37]     bits 0-7
  INF 629   byte[38]     bits 0-7
  INF 648   byte[39]     bits 0-7
  INF 649   byte[40]     bits 0-7
  INF 650   byte[41]     bits 0-7
  INF 651   byte[42]     bits 0-7
  INF 652   byte[43]     bits 0-7
  INF 653   byte[44]     bits 0-7
  INF 654   byte[45]     bits 0-7
  INF 655   byte[46]     bits 0-7
  INF 656   byte[47]     bits 0-7
  INF 657   byte[48]     bits 0-7
  INF 658   byte[49]     bits 0-7
  INF 659   byte[50]     bits 0-7
  INF 660   byte[51]     bits 0-7
  INF 661   byte[52]     bits 0-7
  INF 662   byte[53]     bits 0-7
  INF 630   byte[54]     bits 0-7
  INF 631   byte[55]     bits 0-7
  INF 663   byte[56]     bits 0-7


Decoding example
----------------

  INF 611 = byte 13 unmasked: present iff payload[13] != 0.
  INF 632 = bit 0 of byte 19: present iff payload[19] & 0x01.
  INF 601 = 16-bit: (payload[29] << 8) | payload[30], present iff nonzero.

The isolated-fault family for P0AA6 lives here (611/612/613/614, 603, 601, 604) --
this is the layer that distinguishes "battery" from "inverter/cable" in warranty
scenarios.


Important caveat
----------------

The INF number (e.g. the 611 in P0AA6-611) is carried by the DTC record itself, read
via the enhanced DTC services (mode 13/0A on this ECU). The 22 05 CA read reports which
INF details are active/present. To show a full P0AA6-611, do both: read the DTC (which
gives the code + its INF number), then read 22 05 CA (which confirms the detail's
active flags). The two together are the complete picture.


Scope
-----

Layout resolved for the Gen2 Toyota Prius hybrid HV ECU (2004-2009). Other generations
and Toyota/Lexus hybrids (Gen3, Gen4, Prius C/V/Prime, Aqua, Auris, Camry Hybrid,
CT200h, etc.) may use the same DID with generation-specific payloads; behavior is
unverified on-car for those. If you validate on another model/generation, a capture of
the 22 05 CA response is the contribution that extends this.