Software On ELM Street - OBD2 Software Development

Programs / Tools / Scripts
User avatar
Tazzi
Posts: 3552
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

Alright, so with only a little bit of frustration and elm kicking.. Iv got it spitting out the correct data to the tech2. It is the first and last frame that is sent that indicates the fault code.. looks like PID2 is actually the fault code stored for that freeze data.

Example:
6C F1 10 52 00 00 02 12 22 C7
Would be freeze data for fault P1222

And when entering into the menu, there are 26 parameters to read... shouldnt be too painfull to get through all of them. I imagine most of these pids have already been found, its just simply changing the values a couple times to determine the PID calc. :thumbup:
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3552
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

Some more goodies.. Not sure if I posted these way back or not. Be good to test these out after being tuned with hptuners or efilive to quickly identify what they have been tuned with

Code: Select all

Checks ECU is there.. also return to normal message
6C 10 F1 20 64 
6C F1 10 60 72 

E9 3A F1 3C EC 
C8 3B 10 3C 80 1A 

PartNumber = 92171232
6C 10 F1 3C 08 F0 
6C F1 10 7C 08 05 7E 6B E0 29 

Operating S/W Level = BF
6C 10 F1 3C 93 D4 
6C F1 10 7C 93 42 46 36 

Operating S/W Calibration = 12225074   (Also known as OSID)
6C 10 F1 3C 0A CA 
6C F1 10 7C 0A 00 BA 8A 32 50 

Engine Calibration = 92171239
6C 10 F1 3C 0B D7 
6C F1 10 7C 0B 05 7E 6B E7 C4 

Transmission Calibration = 92171253
6C 10 F1 3C 0D 99 
6C F1 10 7C 0D 05 7E 6B F5 52 

Engine Diagnostic Calibration = 92171246
6C 10 F1 3C 0C 84 
6C F1 10 7C 0C 05 7E 6B EE 3A 

Transmission Diagnostic Calibration = 92171260
6C 10 F1 3C 0E BE 
6C F1 10 7C 0E 05 7E 6B FC 19 

Fuel Calibration = 92171267
6C 10 F1 3C 0F A3 
6C F1 10 7C 0F 05 7E 6C 03 4E 

Speed Calibration = 92171281
6C 10 F1 3C 11 C8 
6C F1 10 7C 11 05 7E 6C 11 41 

System Calibration = 92171274
6C 10 F1 3C 10 D5 
6C F1 10 7C 10 05 7E 6C 0A 29
 
Transmission Coding = Manual Transmission
E9 3A F1 3C EC 
C8 3B 10 3C 80 1A 
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3552
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

So.. only 26 parameters pop up in the tech2 although theres over 30 PIDs that the ECU spits out.. sooo many are not used! Iv identified all 26 that display in the freeze menu.

Code: Select all

[16:31:04:901]   Received: 6C F1 10 52 00 00 03 00 00 48 
Fuel System Status, 00 00 = open loop,  02 00 = closed loop

[16:31:04:916]   Received: 6C F1 10 52 00 00 04 00 53 
Engine load, 0 = 0%, FF=99%

[16:31:04:942]   Received: 6C F1 10 52 00 00 05 00 1F 
Engine Coolant Temp, 00 = -40degC, 1= -39degC

[16:31:04:959]   Received: 6C F1 10 52 00 00 06 00 CB
Left Short Term Fuel Trim, 00=-100%  01=-99%, 80=0%, FF=99%

[16:31:04:977]   Received: 6C F1 10 52 00 00 07 00 87 
Left Long Term Fuel Trim, 00=-100%, 80=0%

[16:31:04:995]   Received: 6C F1 10 52 00 00 08 00 24 
Right Short Term Fuel Trim, 00 = -100%, 80=0%

[16:31:05:010]   Received: 6C F1 10 52 00 00 09 00 68
Right Long Term Fuel Trim, 00=-100%, 80=0%
 
[16:31:05:025]   Received: 6C F1 10 52 00 00 0B 00 F0 
Manifold Absolute Pressure, 00=0Kpa or -0.55V, 01= 1Kpa or -0.50V, 2=2Kpa or -0.46V, FF=255Kpa or 12.99V

[16:31:05:041]   Received: 6C F1 10 52 00 00 0C 00 00 CE 
Engine RPM, 00 = 0rpm, 04 = 1rpm

[16:31:05:057]   Received: 6C F1 10 52 00 00 0D 00 45 
Speed (KM/H), 00 = 0km/h, 01=1km/h

[16:31:05:087]   Received: 6C F1 10 52 00 00 10 00 00 DC 
Mass Air Flow, 0 = 0.00g/s, 01=0.01g/s, 01 00=2.56g/s

[16:31:05:103]   Received: 6C F1 10 52 00 00 11 00 86 
Throttle Position Sensor, 3 = 1%, FF=99%

[16:31:05:138]   Received: 6C F1 10 52 00 11 02 00 71 
PID 1102 UNKNOWN

[16:31:05:167]   Received: 6C F1 10 52 00 11 4B 00 8D 
PID 114B UNKNOWN

[16:31:05:196]   Received: 6C F1 10 52 00 11 4E 00 EC 
PID 114E UNKNOWN

[16:31:05:227]   Received: 6C F1 10 52 00 11 52 00 2F 
PID 1152 UNKNOWN

[16:31:05:257]   Received: 6C F1 10 52 00 11 6F 00 D5 
Start Up ECT, 0=-40degC, FF=215degC, 01=-39degC

[16:31:05:286]   Received: 6C F1 10 52 00 11 92 00 0C 
Desired Idle Speed, 0 = 0RPM, FF=3187RPM, 01=12RPM

[16:31:05:316]   Received: 6C F1 10 52 00 11 9B 00 1A
PID 119B UNKNOWN
 
[16:31:05:347]   Received: 6C F1 10 52 00 11 9D 00 AF 
Barometric Pressure, 0=10KPA or 0.0V, 2=11KPA or 0.0V, FF=104KPA or 5.0V

[16:31:05:377]   Received: 6C F1 10 52 00 11 9E 00 7B 
Air Fuel Ratio, 0= 0.0 : 1, 01= 0.1:1, 02= 0.2:1

[16:31:05:406]   Received: 6C F1 10 52 00 11 A1 00 00 03 
Engine Runtime, 0000 = 00:00:00, 0005=00:00:05

[16:31:05:435]   Received: 6C F1 10 52 00 11 E9 00 A9 
PID 11E9 UNKNOWN
[16:31:05:465]   Received: 6C F1 10 52 00 12 35 00 00 67 
First Odometer, 0000=0km, 0100= 5km, 0200=10km, FF00=1275km
00FF= 0kms (weird?)

[16:31:05:495]   Received: 6C F1 10 52 00 12 36 00 00 EB 
Last Odometer, 0000=0km, FF00=1275km

[16:31:05:526]   Received: 6C F1 10 52 00 12 37 00 5D 
Fail Counter, 00 = 0, FF=255

[16:31:05:556]   Received: 6C F1 10 52 00 12 38 00 FE 
Pass Counter, 00=0, FF=255

[16:31:05:585]   Received: 6C F1 10 52 00 12 39 00 B2 
Not Ran Counter, 00=0, FF=255

[16:31:05:616]   Received: 6C F1 10 52 00 12 5A 00 00 B1 
Injector Pulse Bank 1, 0=0.0ms, 0100=3.91ms, 0200=7.82ms, 0001=0.02ms, 0002=0.03ms, 0010=0.24ms

[16:31:05:646]   Received: 6C F1 10 52 00 12 5B 00 00 3E 
Injector Pulse Bank 2, 0=0.0ms, 0100=3.91ms

[16:31:05:679]   Received: 6C F1 10 52 00 12 B0 00 6D 
PID 12B0 UNKNOWN

[16:31:05:712]   Received: 6C F1 10 52 00 12 B1 00 00 A1 
PID 13B1 UNKNOWN

[16:31:05:747]   Received: 6C F1 10 52 00 13 1E 00 00 4A 
PID 131E UNKNOWN

[16:31:05:779]   Received: 6C F1 10 52 00 13 1F 00 00 C5 
PID 131F UNKNOWN

[16:31:05:812]   Received: 6C F1 10 52 00 19 21 00 DC 
PID 1921 UNKNOWN

[16:31:05:844]   Received: 6C F1 10 52 00 19 42 00 00 83 
PID 1942 UNKNOWN

[16:31:05:874]   Received: 6C F1 10 52 00 19 9A 00 5A 
PID 199A UNKNOWN
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Munchies
Posts: 8
Joined: Thu Jan 23, 2014 10:55 am
cars: 6 Ford Diesels
1 Jeep Diesel
Hellcat redeye _Stolen
Couple bulldozers

Re: ELM327 Software Development

Post by Munchies »

You guys need http://www.intrepidcs.com/VehicleSpy/index.html
Tazz, if I send you an AVT, would you consider porting or dual development?
User avatar
Tazzi
Posts: 3552
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

Munchies wrote:You guys need http://www.intrepidcs.com/VehicleSpy/index.html
Tazz, if I send you an AVT, would you consider porting or dual development?
Yeah Iv read alllll about vehicle spy. At 5K+, youd have to be pretty dedicated for that!

I appreciate the offer mate, but I dont want to put anyone out of pocket since the AVT cables are a couple hundred.
My main focus at the moment, is gettting the application working 100% with the ELM on VZ v6 and LS1 ecus. This covers the protocols 11bit 500K and VPW, which seems to be the only protocols that GM tend to use for ECU communication so once its complete, it should be easy to add in other car types eg VE V6/V8 ect.

Once there is a working application for ELM devices, dual development for AVT is a possibility. :thumbup:
I cant be working on both devices at once otherwise itll do my head in!


Sooooo back on topic..
I had a mate testing out the Freeze frame on a VZ V6 ecu.. and seems hes getting back alot of '?' from the ELM device. I think this is occur as Im attempting to swap from "monitor all mode" to send a frame very quickly.. which isnt giving enough time for the ELM to change modes (I think). Ill have to try putting in a small delay to see if this rectifies the issue
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Munchies
Posts: 8
Joined: Thu Jan 23, 2014 10:55 am
cars: 6 Ford Diesels
1 Jeep Diesel
Hellcat redeye _Stolen
Couple bulldozers

Re: ELM327 Software Development

Post by Munchies »

Totally understand. I was thinking maybe the AVT could help your elm development, catching dropped frames or help monitoring something else.
I would consider it an extended tool loan. I have a few extra here now
User avatar
Tazzi
Posts: 3552
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

Munchies wrote:Totally understand. I was thinking maybe the AVT could help your elm development, catching dropped frames or help monitoring something else.
I would consider it an extended tool loan. I have a few extra here now
The ELM surprising does well with the correct filter set like Iv been doing so far, but when trying to display everything.. it just doesnt keep up. But, nothings beats the huge buffer and speed of the AVT.
Might have to get back to you on that one.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3552
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

Pretty sure these freeze frames could be used as proof for insurance companies looking at the parameters, shows the engine load, speed, rpm ect when the error occurs.. and Im sure alot of faults would occur from a collision!
Makes you wonder what other sort of info is being constantly logged in cars
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
monaro308
Posts: 343
Joined: Sat Mar 21, 2009 2:02 pm
cars: VT S1 LS1 C/dore track car
HJ GTS Monaro Coupe
CV8 V2 S3
VE SSV

Re: ELM327 Software Development

Post by monaro308 »

When doing adr's for crash testing at work a couple of years ago,i know a lot of data is captured in the SDM that can be accessed in a fatality with the correct legal procedures
ie brake pedal position vs throttle pedal position vs yaw rate vs steering angle position vs RPM vs 4 x wheel speeds vs vehicle speed....and the list goes on.
Tazzi I went through my stuff looking for a TCM that I thought I did have,but had no luck.
User avatar
VL400
Posts: 4991
Joined: Sun Mar 01, 2009 2:54 pm
cars: VL Calais and Toyota Landcruiser. Plus some toys :)
Location: Perth, WA
Contact:

Re: ELM327 Software Development

Post by VL400 »

Tazzi wrote:Makes you wonder what other sort of info is being constantly logged in cars
And the freeze frame data has been around since the VR $11 and $12 code.
Post Reply