Software On ELM Street - OBD2 Software Development

Programs / Tools / Scripts
User avatar
Tazzi
Posts: 3550
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

antus wrote:Good work. Well done! :thumbup:
Yeah getting there. Almost through the first EngineData 1 tab in the tech2. Will post up soon.

Hopefully this will all be benifical to you as well Jayme for your avt adx :thumbup:
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Charlescrown
Posts: 1957
Joined: Sat Aug 06, 2011 7:58 am
cars: V8 VR Commodore BT1
LB Lancer 2L turbo & Delco
Starion TBI with Delco
Mitsubishi Lancer EVO4 track car
NA MX5
3 vintage motor bikes
Location: Padstow NSW

Re: ELM327 Software Development

Post by Charlescrown »

WOW Tazzi this has come a long way since I tried it a year ago. Where did you get the knowledge to get this far?
User avatar
Tazzi
Posts: 3550
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

Charlescrown wrote:WOW Tazzi this has come a long way since I tried it a year ago. Where did you get the knowledge to get this far?
Trial and error mate. And a little common sense haha :thumbup:
I didnt have anything to use when I first started, no elm or ECUs to test with hence progress was slow and tedious. But now with some equipment, I can start reverse engineering stuff real quick!
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3550
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

Code: Select all

5E8 FE 00 00 6E 00 00 00 00 

0000 = Engine Speed where  0004 = 1rpm, 0100 = 64rpm
6E = Desired Engine Idle Speed where 01 = 10rpm, 10=160rpm
00 = Coolant Temperature = -40degC where  01 = -39degc, 10 = -24degC
00 = Intake AirTemperature = -40degC where 10=-24degC
 0000 = Mass Air Flow = 0.00g/s where 0001 = 0.01g/s, 0100 = 2.56g/s


5E8 FD FF 00 FF 10 AB 0D 00 

FF = Engine Load = 100% where 03 = 1%,  20 = 12%, A0 = 62%
00 = Calculated Pedal Position = 0% where 03 = 1%, 10=6%, 20=13%, A0 = 63%
FF=Barometric Pressure =104Kpa (5.00v) where 0 = 10Kpa(0.00v), 10=16Kpa(0.31v), 20=22kpa(0.63v), 40=33kpa(1.25v), 41=34kpa(1.27v), 42=34kpa(1.29v),43=35kpa(1.31v)
10AB = Volumetric Efficiency = 99% where 0030=1%, 0060=2%,0100=5%, 0200=11%
0D= Desired Throttle Position = 5% where 2=1%, 10=6%, 20=13%, FF=100%
00=NOTHING ALLOCATED

5E8 FC 60 E0 01 05 00 00 00 

60=Malfunction Indicator(MI) (turns on at 40) where 20=.. Not sure what this is
E0=Extended Travel Break Pedal ACTIVE at 20.
01 = Loop Status B1S1 OPEN at 00, CLOSED at 10 
Loop Status B2S1 OPEN at 00, CLOSED at 08
05=UNSURE
00=UNSURE
00=UNSRUE
00=UNSURE


5E8 FB 00 00 00 0A 00 00 00 
00=Vechilce Speed = 0km/h where FF = 255km/h
0000 = Engine Runtime = 00:00:00 h:m:s where 0001 = 00:00:01, 003C = 00:01:00,0100=00:04:16
0A=DTC Set this ignition = DTC SET  where 0 no dtc, 1=dtc, 2=no dtc, 3=dtc   ect ect
00 = Calculated throttle position = 0% where 2=1%,4=2%,10=6%, FF=100%
00 = UNSURE
00=UNSURE



5E8 FA 00 0C 82 86 00 00 00 
00 = Knock Retard Cylinder 6 = 0degCA where 6 = 1, c=2,12=3
0C = Ignition On Signial (On at 08), Fuel Pump Relay On at 01
82= Engine Control Ignition (On at 02), Reduced Engine Power (Active at 10), Brake Lamp Switch (Active at 80)
86=Engine Control Ignition = 13.4V where 01=0.1v,06=0.6v ect
00 = Actual Gear = INVALID, 1=gear1, 6=gear6,7=invalid
00=UNSURE
00=UNSURE

5E8 F9 00 00 00 00 00 00 B8 
00 = Knock Retard Cylinder 1 =0degCA where 6=1,c=2,12=3
00 = Knock Retard Cylinder 2 = 0degCA
00= Knock Retard Cylinder 3 = 0degCA
00 = Knock Retard Cylinder 4 = 0degCA
00 = Knock Retard Cylinder 5 = 0degCA
00B8 = B2 Knock Sensor Signal =3.6V where 0003= 0.1v,0008=0.2v,00FF=5v, 0100= 5v


5E8 F8 80 00 00 00 00 B8 B8 
80 = Spark Advance = 0degCA where 00=-64degCA, 2=-63,4=-62
00 = Knock Retard = 0degCA where 6=1,c=2,12=3
0000 = Fuel Level = 0L where 0100= 4L,0200=8L,0300=12L,0400=16L
0040 = 1L, 0080=2L ect
00B8= B1 Knock Sensor Signal = 3.6v where 0003=0.1v,0.0008=0.2v,00FF=5v
B8 = UNSURE



5E8 F7 00 80 80 80 00 80 C0 
00=EVAP Purge Solenoid = 0% where 03=1,6=2,c=4 ect
80 =B1 LTFT Cruise/Acceleration = 0%, where 0 = -100%
80=B2 Short Term Fuel Trim = 0% where 00 =-100%, 02=-99% ect.
8000=B2LTFT Idle/Dece;eration = 0%, where 0000 = -1534%, 0100=-1522%,0200=1510% 
0010= -1533%, 0020=-1532%

80=B2 LTFT Cruise/Acceleration = 0% where 0=-100%
C0=UNSURE




5E8 F6 80 00 00 00 80 00 C0 
80= B1 Short Term Fuel Trim = 0% where 00=-100%
00= UNSURE
00=UNSURE
00=UNSURE
8000=B1 LTFT Idle/Deceleration = 0% where 0 = -1534%
C0=UNSURE
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3550
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

Its strange, the places where I have "Unsure", seem to be PIDs that are not actually used in that menu weirdly enough. Its easy enough to match up the PIDs with their respective name and calculation using the above table. Im fairly confident I caught all the parameters in there. Could possibly be missing one or two which eg Accessories ON/OFF. But all the main parameters with changing values have been found.

Table 1/12 completed..
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3550
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

From what I could work out,the PIDS are:
Im a little unsure about the bottom onces, since when comparing with the VPW list (All known match up), the pid 1149 and 1146 are meant to be 02 readings (not in that menu), but from what I can tell, there are three unknown bytes (all 00's) that did not change anything in the tech2, but the next two bytes after that were the ltft. From what I can see by the PIDs in DPID F6, pid 1149 is long term fuel trim otherwise it doesnt add up.

Code: Select all

000C= ENGINE SPEED
11C9=DESIRED ENGINE IDLE
0005=COOLANT TEMPERATURE
000F=INTAKE AIRTEMPERATURE
0010=MASS AIR FLOW


0004 =ENGINE LOAD
131F=CALCULATED PEDAL POSITION
13B0=VOLUMETRIC EFFICIENCY
131E=DESIRED THROTTLE POSITION
1493=


1106=MALFUNCTION INDICATOR
1105=EXTENDED TRABEL BRAKE PEDAL
1102=LOOP STATUS B1S1 AND B2S1
1101= UNKNOWN (NOTHING CHANGED)


000D=VEHICLE SPEED
11A1=ENGINE RUNTIME (Part1 maybe?)
11A2= DTC SET THIS IGNITION 
12B1= CALCULATED THROTTLE POSITION
1664=UNKNOWN
1661=UNKNOWN

13C3=KNOCK RETARD CYLINDER 6
1107=IGNITION ON SIGNAL,FUEL PUMP RELAY ON
1100=ENGINE CONTROL IGNITION ON, REDUCED ENGINE POWER, BRAKE LAMP SWITCH
148D=ENGINE CONTROL IGNITION VOLTAGE
199A=ACTUAL GEAR
1669=UNKNOWN
165F=UNKNOWN


12B8=KNOCK RETARD CYLINDER 1
13B9= KNOCK RETARD CYLINDER 2
13C0= KNOCK RETARD CYLINDER 3
13C1= KNOCK RETARD CYLINDER 4
13C2= KNOCK RETARD CYLINDER 5
137A= B2 KNOCK SENSOR SIGNAL


000E=SPARK ADVANCE
12D9=KNOCK RETARD
132A=FUEL LEVEL
1379=B1 KNOCK SENSOR SIGNAL


1170=EVAP PURGE SOLENOID
0007=B1 LTFT CRUISE/ACCELERATION
0008=B2 SHORT TERM FUEL TRIM
1378=B2 LTFT IDLE/DECELERATION
0009=B2 LTFT CRUISE/ACCELERATION
1104=UNKNOW


0006=B1 SHORT TERM FUEL TRIM
1146=UNKNOWN
1494=UNKNOWN
1149=B1 LTFT IDLE/DECELERATION
1377=UNKNOWN
Last edited by Tazzi on Wed Oct 01, 2014 5:54 pm, edited 1 time in total.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3550
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

Engine Data 2:

Code: Select all

7E0 10 0E 2C F7 00 0C 11 C9    PIDs: 000C   11C9
7E8 30 20 02 2C 7F 7F 7F 7F 
7E0 21 00 05 00 0F 15 35 15    PIDs: 0005    000F   1535   1536
7E0 22 36 00 00 00 00 00 00 
7E8 02 6C F7 00 00 00 00 00 

7E0 10 0C 2C F8 11 6F 00 10    PIDs: 116F   0010
7E8 30 20 02 54 7F 7F 7F 7F 
7E0 21 00 04 16 0A 14 2B 00    PIDs  0004   160A    142B
7E8 02 6C F8 00 00 00 00 00 

7E0 10 0E 2C F9 11 02 13 1F    PIDs   1102    131F
7E0 21 11 9D 13 B0 13 1E 12    PIDs    119D   13B0    131E    12B1
7E0 22 B1 00 00 00 00 00 00 
7E8 02 6C F9 00 00 00 00 00 

7E0 10 0C 2C FA 00 06 00 08    PIDs:  0006    0008
7E8 30 20 02 CA 00 00 00 06  
7E0 21 13 77 00 07 13 78 00     PIDs    1377    0007     1378
7E8 02 6C FA 00 00 00 00 00 

7E0 10 0A 2C FC 00 0E 11 96    PIDs:   000E     1196
7E8 30 20 02 00 00 00 00 05    
7E0 21 11 97 11 98 00 00 00      PIDs:  1197    1198
7E8 02 6C FC 00 00 00 00 00 

7E0 10 0E 2C FD 11 07 16 40     PIDs:1107    1640
7E8 30 20 02 7F 7F 7F 7F 7F 
7E0 21 11 03 11 00 11 05 19     PIDs:   1103    1100   1105   199A
7E0 22 9A 00 00 00 00 00 00 
7E8 02 6C FD 00 00 00 00 00 

7E0 10 0A 2C FE 00 0D 11 A1   PIDs:  000D   11A1 
7E0 21 11 08 12 34 00 00 00   PIDs:  1108    1234
7E8 02 6C FE 00 00 00 00 00 

7E0 10 0A 2C FB 00 09 11 93     PIDs:   0009   1193
7E8 30 20 02 44 00 70 70 80 
7E0 21 11 94 11 95 00 00 00     PIDs:   1194     1195
7E8 02 6C FB 00 00 00 00 00 

7E0 10 0A AA 04 F7 F8 F9 FA 
7E8 30 20 02 67 00 00 00 18
7E0 21 FC FD FE FB 00 00 00

5E8 F7 00 00 6E 00 00 00 0B 
5E8 F8 00 00 00 FF FB 38 00 
5E8 F9 01 00 FF 10 AB 0D 00 
5E8 FA 80 80 80 00 80 80 00 
5E8 FC 80 00 00 00 00 00 00  
5E8 FD 0C 00 22 82 E0 00 00 
5E8 FE 00 00 00 C0 00 00 00 
5E8 FB 80 00 00 00 00 00 00 
And Breaking down each byte:

Code: Select all

5E8 F7 00 00 6E 00 00 00 0B 
0000 = Engine RPM = 0rpm where 0004 = 1rpm
6E= Desired Engine Idle Speed = 1100rpm where 1=10rpm
00=Coolant Temperature = -48degC where 4=-44degC
00=Intake Air Temperature = -40DegC where 1=-39degC
00=Calculated ECT – Closed = -48degC where 1=-47degC
0B = Calculated ECT – Thermo = -40degC where 1=-47degC


5E8 F8 00 00 00 FF FB 38 00 
00=Startup ECT = -40degC where 1= -39degC
0000=Mass Air Flow = 0.00g/s where 0001= 0.01g/s
FF= Engine Load = 100%, where 10 = 6%
FB38 = Start Up IAT = -48dec where 0020= 1degC, 0040=2degc, 0100=10deg, 7000=1124degC, 8000=-1285degC, 9000=-1124DEGc
0=UNKNOWN


5E8 F9 01 00 FF 10 AB 0D 00 
01=Decel Fuel Cutoff  ACTIVE at 20, Power Enrichment  YES at 40, Loop Status B2S1 CLOSED at 08, Loop Status B1S1 CLOSED at 10, 
00= Calculated Pedal Position = 0%, where FF = 100%
FF=Barometric Pressue = 104KPA(5.00v), where 10 = 16kPa(0.31v)
10AB= Volumetric Efficiency = 99%, where 0100 = 6%, 0030=1%
0D=Desired Throttle Position = 5%, where FF = 100%
00=Calculated Throttle Position=0% where FF=100% 


5E8 FA 80 80 80 00 80 80 00 
80=B1 Short Term Fuel Trim = 0% where 00= -100%
80=B2 Short Term Fuel Trim= 0% where 00=-100%
8000=B1 LTFT Idle/Deceleration =0% where 0000=-1534%, 0010=-1533%,0100=-1522%
80=B1 LTFT Cruise/Acceleration = 0%, where 00=-100%, FF=99%
8000=B2LTFT Idle/Deceleration = -1534%, where 0010 = -1533%

5E8 FC 80 00 00 00 00 00 00  
80=Spark Advance = 0degCA, where 00=-64, 02=-63,04=-62
0000=Injector Time Cyilinder 4 = 0.0ms  where 0100= 3.9ms,0200=7.8ms,0010=0.2ms
0000=Injector Time Cylinder 5 = 0.0ms
0000=Injector Time Cylinder 6 = 0.0ms


5E8 FD 0C 00 22 82 E0 00 00 
0C= Fuel Pump Relay ON at 01, Ignition On Signal  ON at 08, Ignition accessory Sign  ON at 10, Fan Relay 2 and 3  ON at 40, Fan Relay 1 ON at 80
00=UNKNOWN
22=A/C Relay  ON at 80
82=Reduced Engine Power at 10
E0=Transmission Gear   P-N at 10,and 30, and 50 ect
00= Actual Gear = Invalid,  01=1,02=2 … 06=6
00=UNKNOWN



5E8 FE 00 00 00 C0 00 00 00 
00=Vehicle speed = 0km/h where 01=1km/h
0000=Engine Runtime = 00:00:00 h:m:s  where 0001 = 00:00:01
C0= Transmission Gear Selected (INVALID at 80, valid ar all other values)
0000=Distance since DTC Clear =0km where 0001 = 5kms, 0100=1280km
00=UNKNOWN


5E8 FB 80 00 00 00 00 00 00 
80=B2 LTFT Cruise/Acceleration = 0% where 00=-100%
0000=Injection Time Cylinder 1 = 0.0ms where 0100=3.9, 0010=0.2
0000=Injection Time Cylinder 2 = 0.0ms
0000=Injection Time Cylinder 3 = 0.0ms
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3550
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

All PIDs found:

Code: Select all

F7
000C =ENGINE RPM
11C9 = DESIRED ENGINE IDLE SPEED
0005 =COOLEANT TEMPERATURE
000F =INTAKE AIR TEMPERATURE
1535=CALCULATED ECT - CLOSED
1536= CALCULATED ECT - THERMO

F8
116F= STARTUP ECT
0010= MASSAIR FLOW
0004= ENGINE LOAD
160A= STARTUP IAT
142B= UNKNOWN


F9
1102= DECEL FUEL CUTOFF, POWER ENRICHMENT, LOOP STATUS B2S1 CLOSED, LOOP STATUS B1S1 CLOSED
131F=CALCULATED PEDAL POSITION
119D=BAROMETRIC PRESSURE
13B0=VOLUMETRIC EFFICIENCY
131E=DESIRED THROTTLE POSITION
12B1=CALCULATED THROTTLE POSITION


FA
0006=B1 SHORT TERM FUE TRIM
0008=B2 SHORT TERM FUEL TRIM
1377=B1 LTFT IDLE/DECELERATION
0007=B1 LTFT CRUISE/ACCELERATION
1378=B2 LTFT IDLE/DECELERATION

FC
000E=SPARK ADVANCE
1196=INJECTOR TIME CYLINDER 4
1197=INJECTOR TIME CYLINDER 5
1198=INJECTOR TIME CYLINDER 6

FD
1107=FUEL PUMP RELAY,IGNITION ON SIGNAL,IGNITION ACCESSORY SIGN, FAN RELAY 2 AND 3, FAN RELAY 1
1640=UNKNOWN
1103=A/C RELAY
1100=REDUCED ENGINE POWER
1105=TRANSMISSION GEAR
199A=ACTUAL GEAR

FE
000D=VEHICLE SPEED
11A1=ENGINE RUNTIME
1108=TRANSMISSION GEAR SELECTED
1234=DISTANCE SINCE DTC CLEAR

FB
0009=B2 LTFT CRUISE/ACCELERATION
1193=INJECTOR TIME CYLINDER 1
1194=INJECTOR TIME CYLINDER 2
1195=INJECTOR TIME CYLINDER 3
Table 2/12 :thumbup:
Had a quick skim through the other available tables, and theres alot of doubling up on parameters, so really, majority of the found PIDs above are reused. Will carry on anyways and grab any unknown PIDs.
I notice I can also choose transmission in the main screen... anyone have a VZ v6 commy that they dont mind sending a found frames? Just need to get past the first screen.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Holden202T
Posts: 10394
Joined: Sat Feb 28, 2009 9:05 pm
Location: Tenambit, NSW
Contact:

Re: ELM327 Software Development

Post by Holden202T »

I have hp tuners logs from a vz sv6 if they are of any use, no longer own the car though.
User avatar
Tazzi
Posts: 3550
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

Holden202T wrote:I have hp tuners logs from a vz sv6 if they are of any use, no longer own the car though.
Any log is a good log! Would be greatly appreciated :thumbup:
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Post Reply