Software On ELM Street - OBD2 Software Development

Programs / Tools / Scripts
User avatar
Tazzi
Posts: 3458
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

Holden202T wrote:yeah when you think about it the high priority stuff gets more and more, like maf or map, tps, knock, spark etc they all move very rapidly

on a side note, i got elm back from a mate so i should be able to do some testing for you ?

i have a vz alloytec and a holden cruze i can try it on.
Ah true, I Guess is would be quite quick. Wasnt sure if messing with the priority byte at the beginning makes much difference.
Yeah VZ or a cruze would be fine. You might need to run that serial port monitor again to see whats happening in the background, Hopefully we dont get any "No Data" messages again. And that the elm actually fires up properly!

In saying that, if you cant connect to the elm when in car, try other baud rates, Seems a few better programs actually run through all baud rates till it finds one that the elm responds to.

*Edit
My PCM emulator app is coming along. It works in theory.. although I have no idea how long it will take the elm device to swap from monitoring mode to sending a request and then back to monitoring. This is important as Im unsure how quick the Tech2/scantool will request data.. and how long it waits before timeout ect.
Anyone with a y-cable and scantool to test will be of great use right now! Should be able to reverse anything that use obd2 in tech2.
Will also need to have try out the "monitor all" function with a scantool connected in car to see what requests the scantool makes and what the car responds with so that these messages can be mimiced back onto the bench setup.

Im hoping that the tech2 doesnt search for an aldl heartbeat to detect car presence before requesting OBD2 data, as that will be a royal pain! But I think from memory it didnt care if the bcm was connected or not from the OBD2 engine stuff and went on attempting to request info (So I thought).
Last edited by Tazzi on Thu Oct 03, 2013 1:28 pm, edited 1 time in total.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Jayme
Posts: 2585
Joined: Sun Mar 01, 2009 8:59 am
Location: North Coast, NSW

Re: ELM327 Software Development

Post by Jayme »

im not so sure itll work the same on an alloytec or cruze. they are CAN, the ls1 is VPW. the header is different for CAN cars. so if it works on ls1 it might not nessesarily work on alloytec
User avatar
Tazzi
Posts: 3458
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

Jayme wrote:im not so sure itll work the same on an alloytec or cruze. they are CAN, the ls1 is VPW. the header is different for CAN cars. so if it works on ls1 it might not nessesarily work on alloytec
ummmm... damn? :thumbdown:

I thought all GM cars used VPW for all generic info/requests.
I thought CAN wasnt implemented till VE's? I havent got a whole lot of knowledge on this stuff, just info Im picking up all about the place!.

Ill have to have a look at whats needed for CAN, no idea if the messaging layout is different/header requirements ect.

Will need to have a car choice selection if this is the case to determine the required protocol for different cars
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
antus
Site Admin
Posts: 8292
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: ELM327 Software Development

Post by antus »

yeah the alloytec is the bosch pcm and its can. the 6L 2007 vz v8s are the early E38 pcms and are also can. There is a lot more can info and software out there than there is vpw. probably partly because vpw is GM, and can is used by other manufacturers also.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
Tazzi
Posts: 3458
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

antus wrote:yeah the alloytec is the bosch pcm and its can. the 6L 2007 vz v8s are the early E38 pcms and are also can. There is a lot more can info and software out there than there is vpw. probably partly because vpw is GM, and can is used by other manufacturers also.
Ah any particular protocol used for the alloytec, and the E38 pcms?
Iv got a choice of (from elm datasheet):
0-Automatic (let the device figure it out)
6-ISO 15765-4 CAN (11 bit ID, 500kbaud)
7-ISO 15765-4 CAN (29 bit ID, 500kbaud)
8-ISO 15765-4 CAN (11 bit ID, 250kbaud)
9-ISO 15765-4 CAN (29 bit ID, 250kbaud)
A-SAE J1939 CAN (29 bit ID, 250kbaud)

Didnt find any specs on the communication for vz's or anything alike.

*Just a note so I dont forget, Mode 22's are usually proprietary to each manufacture. This is the mode we would expect to see for Holden specific physical addressing.
**May found the answer.. " VT-VY are J1850 and the newer ones VZ-VE are ISO 15765-4 (CAN)"
Im guessing that 11bit and 29 bit are both supported possibly? But used for different things.
Last edited by Tazzi on Thu Oct 03, 2013 8:26 pm, edited 1 time in total.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3458
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

CAN protocol doesnt seem too bad.
The elm does majority of the work.. Simply set tothe required protocol eg7. Then send off commands as normal 010C. Does say to use DB for functional addressing and DA for physical addressing.
The General 29bit format is:
Header bytes (11/29 bit) - Data Bytes (8 total) - Checksum

The header for 29bit: VV XX YY ZZ where the last 3 are normal header and VV is CAN priority byte.

And header for 11bit: XX YY ZZ, although it only uses the last 3bits. eg YZZ
Example 11bit frame: 7E8 06 41 00 BE 3F B8 13 00
Where the 7E8 is the ID to talk directly to that device eg processor for coolant ect.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3458
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

Oops, made a mistake in the latest version.. Set the Timeout value incorrectly, value is meant to be between 00 and FF (hex values). Where the largest timeout would be 4.026ms x FF (255dec) = 1026.63ms = roughly 1 sec.
Will update this error since the elm will probably not respond to the last version from that command!
Last edited by Tazzi on Tue Jul 21, 2015 9:38 am, edited 1 time in total.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3458
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ELM327 Software Development

Post by Tazzi »

My bad on anyone following this, I have posts going everywhere on different topics.

So CAN 11bit seems to be a much more direct communication with a module through use of the header (xyz). Only thing with this is working out which devices are what, this is where a scantool log would reaaaaaly come in handy.

And CAN 29bit is for more general requests, is quite similar to that of VPW and can have multiple responses ect. With headers turned on, CAN actually displays how many bytes are to be expected.. so thats pretty useful! Easy frame verification right there.

Just adding the new protocols to the app, may be a bit of trial and error with different protocols to see which one responds. Alternatively, setting the protocol to automatic and clicking "detect" should give us an idea of protocol is being used.. which can then be used for the rest of the application requests. :thumbup:

Will be pretty stoked if I can get this working on multiple protocols for different commodores.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Holden202T
Posts: 10330
Joined: Sat Feb 28, 2009 9:05 pm
Location: Tenambit, NSW
Contact:

Re: ELM327 Software Development

Post by Holden202T »

let me know when the can stuff is sorted and i'll give it a test on the VZ.
User avatar
Jayme
Posts: 2585
Joined: Sun Mar 01, 2009 8:59 am
Location: North Coast, NSW

Re: ELM327 Software Development

Post by Jayme »

if give it a shot on my VZ alloytec too when its back together, its in pieces right now :( timing chain
Post Reply