 |
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
| Datasheet File OCR Text: |
| elm327 elm electronics ?circuits for the hobbyist www.elmelectronics.com obd to rs232 interpreter almost all of the automobiles produced today are required, by law, to provide an interface for the connection of diagnostic test equipment. the data transfer on these interfaces follow several standards, but none of them are directly usable by pcs or smart devices. the elm327 is designed to act as a bridge between these on-board diagnostics (obd) ports and a standard rs232 serial interface. in addition to being able to automatically detect and interpret nine obd protocols, the elm327 also provides support for high speed communications, a low power sleep mode, and the j1939 truck and bus standard. it is also completely customizable, should you wish to alter it to more closely suit your needs. the following pages discuss all of the elm327? features in detail, how to use it and configure it, as well as providing some background information on the protocols that are supported. there are also schematic diagrams and tips to help you to interface to microprocessors, construct a basic scan tool, and to use the low power mode. power control with standby mode universal serial (rs232) interface automatically searches for protocols fully configurable with at commands low power cmos design diagnostic trouble code readers automotive scan tools teaching aids description applications block diagram features 1 of 82 connection diagram pdip and soic (top view) obd tx led obd rx led rs232 tx led rs232 rx led can rx can tx iso l iso k vdd rs232 rx rs232 tx pwrctrl / busy ignmon / rts mclr memory baud rate lfmode j1850 volts xt1 xt2 vss iso in pwm in j1850 bus+ vpw in j1850 bus- vmeasure vss 18 17 command and protocol interpreter 6 rs232tx rs232rx lfmode rs232 interface 2 7 iso 15765-4 sae j1939 iso 9141-2 iso 14230-4 sae j1850 pwm & vpw 24 23 a/d converter 15 16 baud rate 5 memory obd interfaces 1 pwrctrl / busy 12 22 21 11 13 4 3 14 4.00 mhz 9 10 xt1 xt2 mclr vmeasure ignmon / rts 26 27 status leds 25 28 power control elm327dsi
elm327 elm electronics ?circuits for the hobbyist www.elmelectronics.com 2 of 82 elm327dsi electrical information pin descriptions........................................................................... 3 unused pins.................................................................................5 ordering information.................................................................... 5 absolute maximum ratings......................................................... 5 electrical characteristics..............................................................6 using the elm327 overview...................................................................................... 7 communicating with the elm327................................................ 7 at commands............................................................................. 9 at command summary...............................................................9 at command descriptions........................................................ 11 reading the battery voltage...................................................... 28 obd commands........................................................................ 29 talking to the vehicle.................................................................30 interpreting trouble codes........................................................ 32 resetting trouble codes........................................................... 33 quick guide for reading trouble codes................................... 33 bus initiation...............................................................................34 wakeup messages.....................................................................34 selecting protocols.................................................................... 35 obd message formats..............................................................36 setting the headers................................................................... 38 monitoring the bus..................................................................... 41 can receive filtering - the cra command............................. 42 using the can mask and filter..................................................43 multiline responses................................................................... 44 can message formats..............................................................46 restoring order..........................................................................47 advanced features altering flow control messages................................................ 48 using can extended addresses............................................... 49 sae j1939 messages................................................................50 using j1939............................................................................... 52 the fms standard.....................................................................55 programming serial numbers....................................................56 saving a data byte.................................................................... 56 programmable parameters........................................................ 57 programmable parameter summary......................................... 58 using higher rs232 baud rates...............................................63 setting timeouts - at st and at at commands..................... 65 the activity monitor....................................................................66 power control............................................................................ 66 design examples microprocessor interfaces..........................................................70 example applications.................................................................71 modifications for low power standby operation....................... 77 misc. error messages and alerts.........................................................78 outline diagrams....................................................................... 80 copyright and disclaimer........................................................... 80 index.......................................................................................... 81 contents elm327 elm electronics ?circuits for the hobbyist www.elmelectronics.com pin descriptions 3 of 82 mclr (pin 1) a momentary (>2?ec) logic low applied to this input will reset the elm327. if unused, this pin should be connected to a logic high (v dd) level. vmeasure (pin 2) this analog input is used to measure a 0 to 5v signal that is applied to it. care must be taken to prevent the voltage from going outside of the supply levels of the elm327, or damage may occur. if it is not used, this pin should be tied to either v dd or vss. j1850 volts (pin 3) this output can be used to control a voltage supply for the j1850 bus+ output. the pin normally outputs a logic high level when a nominal 8v is required (for j1850 vpw), and a low level for 5v (for j1850 pwm), but this can be changed with pp 12. if this switching capability is not required for your application, this output can be left open-circuited. j1850 bus+ (pin 4) this active high output is used to drive the j1850 bus+ line to an active level. note that this signal does not have to be used for the bus- line (as was the case for the elm320), since a separate j1850 bus- drive output is provided on pin 14. memory (pin 5) this input controls the default state of the memory option. if this pin is at a high level during power-up or reset, the memory function will be enabled by default. if it is at a low level, then the default will be to have it disabled. memory can always be enabled or disabled with the at m1 and at m0 commands. baud rate (pin 6) this input controls the baud rate of the rs232 interface. if it is at a high level during power-up or reset, the baud rate will be set to 38400 (or the rate that has been set by pp 0c). if at a low level, the baud rate will be initialized to 9600 bps. lfmode (pin 7) this input is used to select the default linefeed mode to be used after a power-up or system reset. if it is at a high level, then by default messages sent by the elm327 will be terminated with both a carriage return and a linefeed character. if it is at a low level, lines will be terminated by a carriage return only. this behaviour can always be modified by issuing an at l1 or at l0 command. vss (pin 8) circuit common must be connected to this pin. xt1 (pin 9) and xt2 (pin 10) a 4.000 mhz oscillator crystal is connected between these two pins. loading capacitors as required by the crystal (typically 27pf each) will also need to be connected between each of these pins and circuit common (vss). note that this device has not been configured for operation with an external oscillator ?it expects a crystal to be connected to these pins. use of an external clock source is not recommended. also, note that this oscillator is turned off when in the low power or ?tandby?mode of operation. vpw in (pin 11) this is the active high input for the j1850 vpw data signal. when at rest (bus recessive) this pin should be at a low logic level. this input has schmitt trigger wave shaping, so no special amplification is required. iso in (pin 12) this is the active low input for the iso 9141 and iso 14230 data signal. it is derived from the k line, and should be at a high logic level when at rest (bus recessive). no special amplification is required, as this input has schmitt trigger wave shaping. pwm in (pin 13) this is the active low input for the j1850 pwm data signal. it should normally be at a high level when at rest (ie. bus recessive). this input has schmitt trigger wave shaping, so no special amplification is required. j1850 bus- (pin 14) this active high output is used to drive the j1850 bus- line to an active (dominant) level for j1850 pwm applications. if unused, this output can be left open-circuited. elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com 4 of 82 elm327dsi ignmon / rts (pin 15) this input pin can serve one of two functions, depending on how the power control options (pp 0e) are set. if both bit 7 and bit 2 of pp 0e are ??, this pin will act as an ignition monitor. this will result in a switch to the low power mode of operation, should the signal go to a low level, as would happen if the vehicle? ignition were turned off. an internal ?ebounce?timer is used to ensure that the elm327 does not shut down for noise at the input. when the voltage at pin 15 is again restored to a high level, and a time of 1 or 5 seconds (as set by pp 0e bit 1) passes, the elm327 will perform a ?arm start?and return to normal operation. a low to high transition at pin 15 will in fact restore normal operation, regardless of the setting of pp 0e bit 2, or whether pin 15 was the initial cause for the low power mode. this feature allows a system to control how and when it switches to low power standby operation, but still have automatic wakeup by the ignition voltage, or even by a pushbutton. if either bit 7 or bit 2 of pp 0e are ?? this pin will function as an active low ?equest to send?input. this can be used to interrupt the obd processing in order to send a new command, or as previously mentioned, to highlight the fact that the ignition has been turned off. normally kept at a high level, this input is brought low for attention, and should remain so until the busy line (pin 16) indicates that the elm327 is no longer busy, or until a prompt character is received (if pin 16 is being used for power control). this input has schmitt trigger wave shaping. by default, pin 15 acts as the rts interrupt input. pwrctrl / busy (pin 16) this output pin can serve one of two functions, depending on how the power control options (pp 0e) are set. if bit 7 of pp 0e is a ??(the default), this pin will function as a power control output. the normal state of the pin will be as set by pp 0e bit 6, and the pin will remain in that state until the elm327 switches to the low power mode of operation, when the output changes to the opposite level. this output is typically used to control enable inputs, but may also be used for relay circuits, etc. with suitable buffering. the discussion on page 77 (?odifications for low power standby operation? provides more detail on how to use this output. if bit 7 of pp 0e is a ?? pin 16 will function as a ?usy?output, showing when the elm327 is actively processing a command (the output will be at a high level), or when it is idle, ready to receive commands (the output will be low). by default, bit 7 of pp 0e is ?? so pin 16 provides the power control function. rs232tx (pin 17) this is the rs232 data transmit output. the signal level is compatible with most interface ics (the output is high when idle), and there is sufficient current drive to allow interfacing using only a pnp transistor, if desired. rs232rx (pin 18) this is the rs232 receive data input. the signal level is compatible with most interface ics (when at idle, the level should be high), but can be used with other interfaces as well, since the input has schmitt trigger wave shaping. vss (pin 19) circuit common must be connected to this pin. vdd (pin 20) this pin is the positive supply pin, and should always be the most positive point in the circuit. internal circuitry connected to this pin is used to provide power on reset of the microprocessor, so an external reset signal is not required. refer to the electrical characteristics section for further information. iso k (pin 21) and iso l (pin 22) these are the active high output signals which are used to drive the iso 9141 and iso 14230 buses to an active (dominant) level. many new vehicles do not require the l line ?if yours does not, you can simply leave pin 22 open-circuited. can tx (pin 23) and can rx (pin 24) these are the two can interface signals that must be connected to a can transceiver ic (see the example applications section for more information). pin descriptions (continued) elm327 absolute maximum ratings storage temperature....................... -65? to +150? ambient temperature with power applied....................................-40? to +85? voltage on v dd with respect to vss ..... -0.3v to +7.5v voltage on any other pin with respect to vss ........................... -0.3v to (vdd + 0.3v) note: these values are given as a design guideline only. the ability to operate to these levels is neither inferred nor recommended, and stresses beyond those listed here will likely damage the device. 5 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com these integrated circuits are 28 pin devices, available in either a 300 mil wide plastic (?kinny? dip format or in a 300 mil (7.50 mm body) soic surface mount type of package. we do not offer an option for qfn packages. to order, add the appropriate suffix to the part number: 300 mil 28 pin plastic dip..............................elm327p 300 mil 28 pin soic....................................elm327sm elm327 if unused, pin 24 must be connected to a logic high (vdd) level. rs232 rx led (pin 25), rs232 tx led (pin 26), obd rx led (pin 27) and obd tx led (pin 28) these four output pins are normally high, and are driven to low levels when the elm327 is transmitting or receiving data. these outputs are suitable for directly driving most leds through current limiting resistors, or interfacing to other logic circuits. if unused, these pins may be left open-circuited. note that pin 28 can also be used to turn off all of the programmable parameters, if you can not do so by using the normal interface - see page 58 for details. pin descriptions (continued) unused pins when people only want to implement a portion of what the elm327 is capable of, they often ask what to do with the unused pins. the rule is that unused outputs may be left open-circuited with nothing connected to them, but unused inputs must be terminated. the elm327 is a cmos integrated circuit that can not have any inputs left floating (or you might damage the ic). connect unused inputs as follows: 1 2 5 6 7 11 12 13 15 18 24 pin level h h h h h* h* h* h* h* l* l* note that the inputs that are shown with an asterisk (*) may be connected to either a high (v dd) or a low (vss) level, but the level shown is preferred. ordering information electrical characteristics 6 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com notes: 1. this integrated circuit is based on microchip technology inc.? pic18f2480 device. for more detailed device specifications, and possibly clarification of those given, please refer to the microchip documentation (available at www.microchip.com). 2. this spec must be met in order to ensure that a correct power on reset occurs. it is quite easily achieved using most common types of supplies, but may be violated if one uses a slowly varying supply voltage, as may be obtained through direct connection to solar cells or some charge pump circuits. 3. this is the time between when the at rv command is received, and when the voltage reading response begins. all values are for operation at 25? and a 5v supply, unless otherwise noted. for further information, refer to note 1 below. characteristic minimum typical maximum conditions units supply voltage, v dd 4.2 5.0 5.5 v vdd rate of rise 0.05 v/ms average current, idd 12 ma input logic levels 0.8 3.0 v output low voltage output high voltage current (sink) = 10 ma current (source) = 10 ma see note 2 see note 3 elm327 device only - does not include any load currents schmitt trigger input thresholds brown-out reset voltage 2.65 2.79 2.93 v rising falling a/d conversion time 9 msec pins 5, 6, 7, and 24 only v v 0.3 4.4 v v 2.9 1.5 pins 1, 11, 12, 13, 15 and 18 only 1.0 4.0 elm327 ignmon debounce time at lp to pwrctrl output time lp alert to pwrctrl output time 2.0 sec msec sec 50 1.0 0.15 ma normal low power pin 18 low level pulse duration to wake the ic from low power mode ?ec 128 65 low high v vdd vss 7 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com communicating with the elm327 the elm327 expects to communicate with a pc through an rs232 serial connection. although modern computers do not usually provide a serial connection such as this, there are several ways in which a ?irtual serial port?can be created. the most common devices are usb to rs232 adapters, but there are several others such as pc cards, ethernet devices, or bluetooth to serial adapters. no matter how you physically connect to the elm327, you will need a way to send and receive data. the simplest method is to use one of the many ?erminal?programs that are available (hyperterminal, zterm, etc.), to allow typing the characters directly from your keyboard. to use a terminal program, you will need to adjust several settings. first, ensure that your software is set to use the proper ?om?port, and that you have chosen the proper data rate - this will be either 9600 baud (if pin 6 = 0v at power up), or 38400 baud (if pp 0c has not been changed). if you select the wrong ?om?port, you will not be able to send or receive any data. if you select the wrong data rate, the information that you send and receive will be all garbled, and unreadable by you or the elm327. don? forget to also set your connection for 8 data bits, no parity bits, and 1 stop bit, and to set it for the proper ?ine end?mode. all of the responses from the elm327 are terminated with a single carriage return character and, optionally, a linefeed character (depending on your settings). properly connected and powered, the elm327 will energize the four led outputs in sequence (as a lamp test) and will then send the message: elm327 v2.0 > in addition to identifying the version of this ic, receiving this string is a good way to confirm that the computer connections and terminal software settings are correct (however, at this point no communications have taken place with the vehicle, so the state of that connection is still unknown). the >?character that is shown on the second line is the elm327? prompt character. it indicates that the device is in the idle state, ready to receive characters on the rs232 port. if you did not see the identification string, you might try resetting the ic again with the at z (reset) command. simply type the letters a t and z (spaces are optional), then press the return key: >at z that should cause the leds to flash again, and the identification string to be printed. if you see strange looking characters, then check your baud rate - you have likely set it incorrectly. characters sent from the computer can either be intended for the elm327? internal use, or for reformatting and passing on to the vehicle. the elm327 can quickly determine where the received characters are to be directed by monitoring the contents of the message. commands that are intended for the elm327? internal use will begin with the characters ?t? while obd commands for the vehicle are only allowed to contain the ascii codes for hexadecimal digits (0 to 9 and a to f). whether it is an ?t?type internal command or a hex string for the obd bus, all messages to the elm327 must be terminated with a carriage return character (hex ?d? before it will be acted upon. the one exception is when an incomplete string is sent and no carriage return appears. in this case, an internal timer will automatically abort the incomplete message after about 20 seconds, and the elm327 will print a single question mark (?? to show that the input was not understood (and was not acted upon). messages that are not understood by the elm327 (syntax errors) will always be signalled by a single overview the following describes how to use the elm327 to obtain information from your vehicle. we begin by discussing just how to ?alk?to the ic using a pc, then explain how to change options using ?t?commands, and finally we show how to use the elm327 to obtain trouble codes (and reset them). for the more advanced experimenters, there are also sections on how to use some of the programmable features of this integrated circuit as well. using the elm327 is not as daunting as it first seems. many users will never need to issue an ?t command, adjust timeouts, or change the headers. for most, all that is required is a pc or smart device with a terminal program (such as hyperterminal or zterm), and a little knowledge of obd commands, which we will provide in the following sections communicating with the elm327 (continued) question mark. these include incomplete messages, incorrect at commands, or invalid hexadecimal digit strings, but are not an indication of whether or not the message was understood by the vehicle. one must keep in mind that the elm327 is a protocol interpreter that makes no attempt to assess the obd messages for validity ?it only ensures that hexadecimal digits were received, combined into bytes, then sent out the obd port, and it does not know if a message sent to the vehicle was in error. while processing obd commands, the elm327 will continually monitor for either an active rts input, or an rs232 character received. either one will interrupt the ic, quickly returning control to the user, while possibly aborting any initiation, etc. that was in progress. after generating a signal to interrupt the elm327, software should always wait for either the prompt character ( >?or hex 3e), or a low level on the busy output before beginning to send the next command. finally, it should be noted that the elm327 is not case-sensitive, so the commands ?tz? ?tz? and ?tz?are all exactly the same to the elm327. all commands may be entered as you prefer, as no one method is faster or better. the elm327 also ignores space characters and all control characters (tab, etc.), so they can be inserted anywhere in the input if that improves readability. one other feature of the elm327 is the ability to repeat any command (at or obd) when only a single carriage return character is received. if you have sent a command (for example, 01 0c to obtain the rpm), you do not have to resend the entire command in order to resend it to the vehicle - simply send a carriage return character, and the elm327 will repeat the command for you. the memory buffer only remembers the one command - there is no provision in the current elm327 to provide storage for any more. 8 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com please note: there is a very small chance that null characters (byte value 00) may occasionally be inserted into the rs232 data that is transmitted by the elm327. microchip technology has reported that some ics which use the same eusart as in the elm327 may, under very specific (and rare) conditions, insert an extra byte (always of value 00) into the transmitted data. if you are using a terminal program to view the data, you should select the ?ide control characters?option if it is available, and if you are writing software for the elm327, then ignore incoming bytes that are of value 00 (ie. remove nulls). several parameters within the elm327 can be adjusted in order to modify its behaviour. these do not normally have to be changed before attempting to talk to the vehicle, but occasionally the user may wish to customize these settings ?for example by turning the character echo off, adjusting a timeout value, or changing the header bytes. in order to do this, internal ?t?commands must be used. those familiar with pc modems will immediately recognize at commands as a standard way in which modems are internally configured. the elm327 uses essentially the same method, always watching the data sent by the pc, looking for messages that begin with the character ??followed by the character ?? if found, the next characters will be interpreted as an internal configuration or ?t?command, and will be executed upon receipt of a terminating carriage return character. if the command is just a setting change, the elm327 will reply with the characters ?k? to say that it was successfully completed. some of the following commands allow passing numbers as arguments in order to set the internal values. these will always be hexadecimal numbers which must generally be provided in pairs. the hexadecimal conversion chart in the obd commands section (page 29) may be helpful if you wish to interpret the values. also, one should be aware that for the on/off types of commands, the second character is the number 1 or the number 0, the universal terms for on and off. the remainder of this page, and the two pages following provide a summary of all of the commands that the current version of the elm327 recognizes. a more complete description of each command begins on page 11. note that the settings which are shown with an asterisk (*) are the default values. 9 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com at command summary at commands general commands 10 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com at command summary (continued) obd commands al allow long (>7 byte) messages amc display activity monitor count amt hh set the activity mon timeout to hh ar automatically receive at0, 1, 2 adaptive timing off, auto1*, auto2 bd perform a buffer dump bi bypass the initialization sequence dp describe the current protocol dpn describe the protocol by number h0, h1 headers off*, or on ma monitor all mr hh monitor for receiver = hh mt hh monitor for transmitter = hh nl normal length messages* pc protocol close r0, r1 responses off, or on* ra hh set the receive address to hh s0, s1 printing of spaces off, or on* sh xyz set header to xyz sh xxyyzz set header to xxyyzz sh wwxxyyzz set header to wwxxyyzz sp h set protocol to h and save it sp ah set protocol to auto, h and save it sp 00 erase stored protocol sr hh set the receive address to hh ss use standard search order (j1978) st hh set timeout to hh x 4 msec ta hh set tester address to hh tp h try protocol h tp ah try protocol h with auto search j1850 specific commands (protocols 1 and 2) ifr0, 1, 2 ifrs off, auto*, or on ifr h, s ifr value from header* or source iso specific commands (protocols 3 to 5) fi perform a fast initiation ib 10 set the iso baud rate to 10400* ib 48 set the iso baud rate to 4800 ib 96 set the iso baud rate to 9600 iia hh set iso (slow) init address to hh kw display the key words kw0, kw1 key word checking off, or on* si perform a slow (5 baud) initiation sw hh set wakeup interval to hh x 20 msec sw 00 stop sending wakeup messages wm [1 - 6 bytes] set the wakeup message can specific commands (protocols 6 to c) cea turn off can extended addressing cea hh use can extended address hh caf0, caf1 automatic formatting off, or on* cf hhh set the id filter to hhh cf hhhhhhhh set the id filter to hhhhhhhh cfc0, cfc1 flow controls off, or on* cm hhh set the id mask to hhh cm hhhhhhhh set the id mask to hhhhhhhh cp hh set can priority to hh (29 bit) cra reset the receive address filters cra hhh set can receive address to hhh cra hhhhhhhh set the rx address to hhhhhhhh cs show the can status counts csm0, csm1 silent monitoring off, or on* continued 12 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com at command descriptions (continued) example, here? one ?ump? >at bd 05 c1 33 f1 3e 23 c4 00 00 10 f8 00 00 the 05 is the length byte - it tells us that only the first 5 bytes (ie c1 33 f1 3e and 23) are valid. the remaining bytes are likely left over from a previous operation. the length byte always represents the actual number of bytes received, whether they fit into the obd buffer or not. this may be useful when viewing long data streams (with at al), as it represents the actual number of bytes received, mod 256. note that only the first twelve bytes received are stored in the buffer. bi [ bypass the initialization sequence ] this command should be used with caution. it allows an obd protocol to be made active without requiring any sort of initiation or handshaking to occur. the initiation process is normally used to validate the protocol, and without it, results may be difficult to predict. it should not be used for routine obd use, and has only been provided to allow the construction of ecu simulators and training demonstrators. brd hh [ try baud rate divisor hh ] this command is used to change the rs232 baud rate divisor to the hex value provided by hh, while under computer control. it is not intended for casual experimenting - if you wish to change the baud rate from a terminal program, you should use pp 0c. since some interface circuits are not able to operate at high data rates, the brd command uses a sequence of sends and receives to test the interface, with any failure resulting in a fallback to the previous baud rate. this allows several baud rates to be tested and a reliable one chosen for the communications. the entire process is described in detail in the ?sing higher rs232 baud rates?section, on pages 63 and 64. if successful, the actual baud rate (in kbps) will be 4000 divided by the divisor (hh). the value 00 is not accepted by the brd command. brt hh [ set baud rate timeout to hh ] this command allows the timeout used for the baud rate handshake (ie. at brd) to be varied. the the value that is used for the receive address is determined based on such things as the contents of the first header byte, and whether the message uses physical addressing, functional addressing, or if the user has set a value with the sr or ra commands. auto receive is turned on by default, and is not used by the j1939 protocol. at0, at1 and at2 [ adaptive timing control ] when receiving responses from a vehicle, the elm327 has traditionally waited the time set by the at st hh setting for a response. to ensure that the ic would work with a wide variety of vehicles, the default value was set to a conservative (slow) value. although it was adjustable, many people did not have the equipment or experience to determine a better value. the adaptive timing feature automatically sets the timeout value for you, to a value that is based on the actual response times that your vehicle is responding in. as conditions such as bus loading, etc. change, the algorithm learns from them, and makes appropriate adjustments. note that it always uses your at st hh setting as the maximum setting, and will never choose one which is longer. there are three adaptive timing settings that are available for use. by default, adaptive timing option 1 (at1) is enabled, and is the recommended setting. at0 is used to disable adaptive timing (so the timeout is always as set by at st), while at2 is a more aggressive version of at1 (the effect is more noticeable for very slow connections ?you may not see much difference with faster obd systems). the j1939 protocol does not support adaptive timing ?it uses fixed timeouts as set in the standard. bd [ perform an obd buffer dump ] all messages sent and received by the elm327 are stored temporarily in a set of twelve memory storage locations called the obd buffer. occasionally, it may be of use to view the contents of this buffer, perhaps to see why an initiation failed, to see the header bytes in the last message, or just to learn more of the structure of obd messages. you can ask at any time for the contents of this buffer to be ?umped?(ie printed) ?when you do, the elm327 sends a length byte (representing the length of the message in the buffer) followed by the contents of all twelve obd buffer locations. for 13 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com at command descriptions (continued) time delay is given by hh x 5.0 msec, where hh is a hexadecimal value. the default value for this setting is 0f, providing 75 msec. note that a value of 00 does not result in 0 msec - it provides the maximum time of 256 x 5.0 msec, or 1.28 seconds. caf0 and caf1 [ can auto formatting off or on ] these commands determine whether the elm327 assists you with the formatting of the can data that is sent and received. with can automatic formatting enabled (caf1), the ic will automatically generate the formatting (pci) bytes for you when sending, and will remove them when receiving. this means that you can continue to issue obd requests (01 00, etc.) as usual, without regard to the extra bytes that can diagnostics systems require. also, with formatting on, any extra (unused) data bytes that are received in the frame will be removed, and any messages with invalid pci bytes will be ignored. (when monitoring, however, messages with invalid pci bytes are shown, with a ?data error?message beside them). multi-frame responses may be returned by the vehicle with iso 15765 and sae j1939. to make these more readable, the auto formatting mode will extract the total data length and print it on one line, then show each line of data with the segment number followed by a colon (??, and then the data bytes. you may also see the characters 'fc:' on a line (if you are experimenting). this identifies a flow control message that has been sent as part of the multi-line message signalling. flow control messages are automatically generated by the elm327 in response to a ?irst frame?reply, as long as the cfc setting is on (it does not matter if auto formatting is on or not). another type of message ?the rtr (or ?emote transfer request? ?will be automatically hidden for you when in the caf1 mode, since they contain no data. when auto formatting is off (caf0), you will see the characters 'rtr' printed when a remote transfer request frame has been received. turning the can automatic formatting off (caf0), will cause the elm327 to print all of the received data bytes. no bytes will be hidden from you, and none will be inserted for you. similarly, when sending a data request with formatting off, you must provide all of the required data bytes exactly as they are to be sent the elm327 will not perform any formatting for you other than to add some trailing 'padding' bytes to ensure that the required eight data bytes are sent. this allows the elm327 to be used with protocols that have special formatting requirements. note that turning the display of headers on (with at h1) will override some of the caf1 formatting of the received data frames, so that the received bytes will appear much like in the caf0 mode (ie. as received). it is only the printing of the received data that will be affected when both caf1 and h1 modes are enabled, though; when sending data, the pci byte will still be created for you and padding bytes will still be added. auto formatting on (caf1) is the default setting for the elm327. cea [ turn off the can extended address ] the cea command is used to turn off the special features that are set with the cea hh command. cea hh [ set the can extended address to hh ] some can protocols extend the addressing fields by using the first of the eight data bytes as a target or receiver? address. this type of formatting does not comply with any obd standard, but by adding it, we allow for some experimentation. sending the cea hh command causes the elm327 to insert the hh value as the first data byte of all can messages that you send. it also adds one more filtering step to received messages, only passing ones that have the tester address in the first byte position (in addition to requiring that id bits match the patterns set by at cf and cm, or cra). the at cea hh command can be sent at any time, and changes are effective immediately, allowing for changes of the address ?n-the-fly? there is a more lengthy discussion of extended addressing in the ?sing can extended addresses?section on page 49. the cea mode of operation is off by default, and once on, can be turned off at any time by sending at cea, with no address. note that the cea setting has no effect when j1939 formatting is on. cf hhh [ set the can id filter to hhh ] the can filter works in conjunction with the can mask to determine what information is to be accepted by the receiver. as each message is received, the incoming can id bits are compared to the can filter bits (when the mask bit is a ??. if all of the relevant bits match, the message will be accepted, and processed by the elm327, otherwise it will be 14 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com discarded. this three nibble version of the can filter command makes it a little easier to set filters with 11 bit id can systems. only the rightmost 11 bits of the provided nibbles are used, and the most significant bit is ignored. the data is actually stored as four bytes internally however, with this command adding leading zeros for the other bytes. see the cm command(s) for more details. cf hh hh hh hh [ set the can id filter to hhhhhhhh ] this command allows all four bytes (actually 29 bits) of the can filter to be set at once. the 3 most significant bits will always be ignored, and may be given any value. this command may be used to enter 11 bit id filters as well, since they are stored in the same locations internally (entering at cf 00 00 0h hh is exactly the same as entering the shorter at cf hhh command). cfc0 and cfc1 [ can flow control off or on ] the iso 15765-4 can protocol expects a ?low control?message to always be sent in response to a ?irst frame?message, and the elm327 automatically sends these without any intervention by the user. if experimenting with a non-obd system, it may be desirable to turn this automatic response off, and the at cfc0 command has been provided for that purpose. as of firmware version 2.0, these commands also enable or disable the sending of j1939 tp.cm_cts messages in response to tp.cm_rts requests. during monitoring (at ma, mr, or mt), there are never any flow controls sent no matter what the cfc option is set to. the default setting is cfc1 - flow controls on. cm hhh [ set the can id mask to hhh ] there can be a great many messages being transmitted in a can system at any one time. in order to limit what the elm327 views, there needs to be a system of filtering out the relevant ones from all the others. this is accomplished by the filter, which works in conjunction with the mask. a mask is a group of bits that show the elm327 which bits in the filter are relevant, and which ones can be ignored. a ?ust match?condition is signalled by setting a mask bit to '1', while a 'don't care' is signalled by setting a bit to '0'. this three digit variation of the cm command is used to provide mask values for 11 bit id systems (the most significant bit is always ignored). note that a common storage location is used internally for the 29 bit and 11 bit masks, so an 11 bit mask could conceivably be assigned with the next command (cm hh hh hh hh), should you wish to do the extra typing. the values are right justified, so you would need to provide five leading zeros followed by the three mask bytes. cm hh hh hh hh [ set the can id mask to hhhhhhhh ] this command is used to assign mask values for 29 bit id systems. see the discussion under the cm hhh command as it is essentially identical, except for the length. note that the three most significant bits that you provide in the first digit will be ignored. cp hh [ set can priority bits to hh ] this command is used to assign the five most significant bits of the 29 bit can id that is used for sending messages (the other 24 bits are set with the at sh command). many systems use these bits to assign a priority value to messages, and to determine the protocol. any bits provided in excess of the five required are ignored, and not stored by the elm327 (it only uses the five least significant bits of this byte). the default value for these priority bits is hex 18, which can be restored at any time with the at d command. cra [reset the can rx addr] the at cra command is used to restore the can receive filters to their default values. note that it does not have any arguments (ie no data). cra hhh [set the can rx addr to hhh] setting the can masks and filters can be difficult at times, so if you only want to receive information from one address (ie. one can id), then this command may be very welcome. for example, if you only want to see information from 7e8, simply send at cra 7e8, and the elm327 will make the necessary adjustments to both the mask and the filter for you. if you wish to allow the reception of a range of values, you can use the letter x to signify a ?on? care condition. that is, at cra 7ex would allow all ids that start with 7e to pass (7e0, 7e1, etc.). for a more at command descriptions (continued) 15 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com specific range of ids, you may need to assign a mask and filter. to reverse the changes made by the cra command, simply send at cra or at ar. cra hhhhhhhh [set the can rx addr to hhhhhhhh] this command is identical to the previous one, except that it is used with 29 bit can ids. sending either at cra or at ar will also reverse any changes made by this command. cs [ show the can status counts ] the can protocol requires that statistics be kept regarding the number of transmit and receive errors detected. if there should be a significant number of errors (due to a hardware or software problem), the device will go off-line in order to not affect other data on the bus. the at cs command lets you see both the transmitter (tx) and the receiver (rx) error counts, in hexadecimal. if the transmitter should be off (count >ff), you will see ?ff?rather than a specific count. csm0 and csm1 [ can silent monitoring off or on ] the elm327 was designed to be completely silent while monitoring a can bus. because of this, it is able to report exactly what it sees, without colouring the information in any way. occasionally (when bench testing, or when connecting to a dedicated can port), it may be preferred that the elm327 does not operate silently (ie generates ack bits, etc.), and this is what the csm command is for. csm1 turns it on, csm0 turns it off, and the default value is determined by pp 21. be careful when experimenting with this. if you should choose the wrong baud rate then monitor the can bus with the silent monitoring off, you will disturb the flow of data. always keep the silent monitoring on until you are certain that you have chosen the correct baud rate. cv dddd [ calibrate the voltage to dd.dd volts ] the voltage reading that the elm327 shows for an at rv request can be calibrated with this command. the argument (?ddd? must always be provided as 4 digits, with no decimal point (it assumes that the decimal place is between the second and the third digits). to use this feature, simply use an accurate meter to read the actual input voltage, then use the cv command to change the internal calibration (scaling) factor. for example, if the elm327 shows the voltage as 12.2v while you measure 11.99 volts, then send at cv 1199 and the elm327 will recalibrate itself for that voltage (it will actually read 12.0v due to digit roundoff). see page 28 for some more information on how to read voltages and perform the calibration. cv 0000 [ restore the factory calibration value ] if you are experimenting with the cv dddd command but do not have an accurate voltmeter as a reference, you may soon get into trouble. if this happens, you can always send at cv 0000 to restore the elm327 to the original calibration value. d [ set all to defaults ] this command is used to set the options to their default (or factory) settings, as when power is first applied. the last stored protocol will be retrieved from memory, and will become the current setting (possibly closing other protocols that are active). any settings that the user had made for custom headers, filters, or masks will be restored to their default values, and all timer settings will also be restored to their defaults. d0 and d1 [ display of dlc off or on ] standard can (iso 15765-4) obd requires that all messages have 8 data bytes, so displaying the number of data bytes (the dlc) is not normally very useful. when experimenting with other protocols, however, it may be useful to be able to see what the data lengths are. the d0 and d1 commands control the display of the dlc digit (the headers must also be on in order to see this digit). when displayed, the single dlc digit will appear between the id (header) bytes and the data bytes. the default setting is determined by pp 29. dm1 [ monitor for dm1s ] the sae j1939 protocol broadcasts trouble codes periodically, by way of diagnostic mode 1 (dm1) messages. this command sets the elm327 to continually monitor for this type of message for you, following multi-segment transport protocols as required. note that a combination of masks and filters could be set to provide a similar output, but they would at command descriptions (continued) 16 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com not allow multiline messages to be detected. the dm1 command adds the extra logic that is needed for multiline messages. this command is only available when a can protocol (a, b, or c) has been selected for j1939 formatting. it returns an error if attempted under any other conditions. dp [ describe the current protocol ] the elm327 automatically detects a vehicle? obd protocol, but does not normally report what it is. the dp command is a convenient means of asking what protocol the ic is currently set to (even if it has not yet ?onnected?to the vehicle). if a protocol is chosen and the automatic option is also selected, at dp will show the word 'auto' before the protocol description. note that the description shows the actual protocol names, not the numbers used by the protocol setting commands. dpn [ describe the protocol by number ] this command is similar to the dp command, but it returns a number which represents the current protocol. if the automatic search function is also enabled, the number will be preceded with the letter ?? the number is the same one that is used with the set protocol and test protocol commands. e0 and e1 [ echo off or on ] these commands control whether or not the characters received on the rs232 port are echoed (retransmitted) back to the host computer. character echo can be used to confirm that the characters sent to the elm327 were received correctly. the default is e1 (or echo on). fc sd [1-5 bytes] [ flow control set data to?] the data bytes that are sent in a can flow control message may be defined with this command. one to five data bytes may be specified, with the remainder of the data bytes in the message being automatically set to the default can filler byte, if required by the protocol. data provided with this command is only used when flow control modes 1 or 2 have been enabled. fc sh hhh [ flow control set header to?] the header (or more properly ?an id? bytes used for can flow control messages can be set using this command. only the right-most 11 bits of those provided will be used - the most significant bit is always removed. this command only affects flow control mode 1. fc sh hhhhhhhh [ flow control set header to?] this command is used to set the header (or ?an id? bits for flow control responses with 29 bit can id systems. since the 8 nibbles define 32 bits, only the right-most 29 bits of those provided will be used - the most significant three bits are always removed. this command only affects flow control mode 1. fc sm h [ flow control set mode to h ] this command sets how the elm327 responds to first frame messages when automatic flow control responses are enabled. the single digit provided can either be ??(the default) for fully automatic responses, ??for completely user defined responses, or ??for user defined data bytes in the response. note that fc modes 1 and 2 can only be enabled if you have defined the needed data and possibly id bytes. if you have not, you will get an error. more complete details and examples can be found in the altering flow control messages section (page 48). fe [ forget events ] there are certain events which may change how the elm327 responds from that time onwards. one of these is the occurrence of a fatal can error (err94), which blocks subsequent searching through can protocols if pp 2a bit 5 is ?? normally, an event such as this will affect all searches until the next power off and on, but it can be ?orgotten?using software, with the at fe command. another example is an ?v reset?event which will prevent searches through can protocols if pp 2a bit 4 is ?? it may also be forgotten with the at fe command. fi [ perform a fast initiation ] one version of the keyword protocol uses what is known as a 'fast initiation' sequence to begin communications. usually, this sequence is performed at command descriptions (continued) when the first message needs to be sent, and then the message is sent immediately after. some ecus may need more time between the two however, and having a separate initiation command allows you to control this time. simply send at fi, wait a little, then send the message. you may need to experiment to get the right amount of delay. another use for this command might be if you would like to perform a fast initiation with an iso 9141 type protocol (ie 3 - carb format). simply follow these steps to do that: at sp 5 at fi at sp 3 at bi and you should be able to then communicate with the ecu. note that a protocol close (ie at pc) is not required in the above code, as the elm327 automatically performs one when you switch protocols. protocol 5 must be selected to use the at fi command, or an error will result. h0 and h1 [ headers off or on ] these commands control whether or not the additional (header) bytes of information are shown in the responses from the vehicle. these are not normally shown by the elm327, but may be of interest (especially if you receive multiple responses and wish to determine what modules they were from). turning the headers on (with at h1) actually shows more than just the header bytes ?you will see the complete message as transmitted, including the check-digits and pci bytes, and possibly the can data length code (dlc) if it has been enabled with pp 29 or at d1. the current version of this ic does not display the can crc code, nor the special j1850 ifr bytes (which some protocols use to acknowledge receipt of a message). i [ identify yourself ] issuing this command causes the chip to identify itself, by printing the startup product id string (currently ?lm327 v2.0?. software can use this to determine exactly which integrated circuit it is talking to, without having to reset the ic. ib 10 [ set the iso baud rate to 10400 ] this command restores the iso 9141-2 and iso 14230-4 baud rates to the default value of 10400. ib 48 [ set the iso baud rate to 4800 ] this command is used to change the baud rate used for the iso 9141-2 and iso 14230-4 protocols (numbers 3, 4, and 5) to 4800 baud, while relaxing some of the requirements for the initiation byte transfers. it may be useful for experimenting with some vehicles. normal (10,400 baud) operation may be restored at any time with the ib 10 command. ib 96 [ set the iso baud rate to 9600 ] this command is used to change the baud rate used for the iso 9141-2 and iso 14230-4 protocols (numbers 3, 4, and 5) to 9600 baud, while relaxing some of the requirements for the initiation byte transfers. it may be useful for experimenting with some vehicles. normal (10,400 baud) operation may be restored at any time with the ib 10 command. ifr0, ifr1, and ifr2 [ ifr control ] the sae j1850 protocol allows for an in-frame response (ifr) byte to be sent after each message, usually to acknowledge the correct receipt of that message. the elm327 automatically generates and sends this byte for you by default, but you can override this behaviour with this command. the at ifr0 command will disable the sending of all ifrs, no matter what the header bytes require. at ifr2 is the opposite - it will cause an ifr byte to always be sent, no matter what the header bytes say. the at ifr1 command is the default mode, with the sending of ifrs determined by the ??bit of the first header byte (for both pwm and vpw). ifr h and ifr s [ ifr from header or source ] the value sent in the j1850 in-frame response (ifr) byte is normally the same as the value sent as the source (or tester) address byte that was in the header of the request. there may be occasions when it is desirable to use some other value, however, and this set of commands allows for this. if you send at ifr s, the elm327 will use the value defined as the source address (usually f1, but it can be changed with pp 06), even if another value 17 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com at command descriptions (continued) 18 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com was sent in the header bytes. this is not what is normally required, and caution should be used when using at ifr s. at ifr h restores the sending of the ifr bytes to those provided in the header, and is the default setting. ign [ read the ignmon input level ] this command reads the signal level at pin 15. it assumes that the logic level is related to the ignition voltage, so if the input is at a high level, the response will be ?n? and a low level will report ?ff? this feature is most useful if you wish to perform the power control functions using your own software. if you disable the low power automatic response to a low input on this pin (by setting bit 2 of pp 0e to 0), then pin 15 will function as the rts input. a low level on the input will not turn the power off, but it will interrupt any obd activity that is in progress. all you need to do is detect the ?topped?message that is sent when the elm327 is interrupted, and then check the level at pin 15 using at ign. if it is found to be off, you can perform an orderly shutdown yourself. iia hh [ set the iso init address to hh ] the iso 9141-2 and iso 14230-4 standards state that when beginning a session with an ecu, the initiation sequence is to be directed to a specific address ($33). if you wish to experiment by directing the slow five baud sequence to another address, it is done with this command. for example, if you prefer that the initiation be performed with the ecu at address $7a, then simply send: >at iia 7a and the elm327 will use that address when called to do so (protocols 3 or 4). the full eight bit value is used exactly as provided ?no changes are made to it (ie no adding of parity bits, etc.) note that setting this value does not affect any address values used in the header bytes. the iso init address is restored to $33 whenever the defaults, or the elm327, are reset. je [ enables the j1939 elm data format ] the j1939 standard requires that pgn requests be sent with the byte order reversed from the standard ?eft-to-right?order, which many of us would expect. for example, to send a request for the engine temperature (pgn 00feee), the data bytes are actually sent in the reverse order (ie ee fe 00), and the elm327 would normally expect you to provide the data in that order for passing on to the vehicle. when experimenting, this constant need for byte reversals can be quite confusing, so we have defined an elm format that reverses the bytes for you. when the j1939 elm (je) format is enabled, and you have a j1939 protocol selected, and you provide three data bytes to the elm327, it will reverse the order for you before sending them to the ecu. to request the engine temperature pgn, you would send 00 fe ee (and not ee fe 00). the ?e?type of automatic formatting is enabled by default. jhf0 and jhf1 [ j1939 header formatting off or on ] when printing responses, the elm327 normally formats the j1939 id (ie header) bits in such a way as to isolate the priority bits and group all the pgn information, while keeping the source address byte separate. if you prefer to see the id information as four separate bytes (which a lot of the j1939 software seems to do), then simply turn off the formatting with jhf0. the caf0 command has the same effect (and overrides the jhf setting), but also affects other formatting. the default setting is jhf1. js [ enables the j1939 sae data format ] the at js command disables the automatic byte reordering that the je command performs for you. if you wish to send data bytes to the j1939 vehicle without any manipulation of the byte order, then select js formatting. using the above example for engine temperature (pgn 00feee) with the data format set to js, you must send the bytes to the elm327 as ee fe 00 (this is also known as little-endian byte ordering). the js type of data formatting is off by default, but was the only type of data formatting provided by the elm327 v1.2. if you are switching from version 1.2 of the ic, take note of this difference. jtm1 [ j1939 timer multiplier to 1 ] this command sets the j1939 at st time multiplier to 1, reversing any changes made by jtm5. jtm1 is the default setting. it has no effect for non- j1939 protocols. at command descriptions (continued) 19 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com at command descriptions (continued) jtm5 [ j1939 timer multiplier to 5 ] when using a j1939 protocol, it is occasionally useful to be able to set the at st time to values longer than one second. the jtm5 command will multiply the at st setting by a factor of 5, in order to provide longer times for the j1939 protocols (only). by default, this multiplier is off. kw [ display the key words ] when the iso 9141-2 and iso 14230-4 protocols are initialized, two special bytes (key words) are passed to the elm327 (the values are used internally to determine whether a particular protocol variation can be supported by the elm327). if you wish to see what the value of these bytes were, simply send the at kw command. kw0 and kw1 [ key word checks off or on ] the elm327 looks for specific bytes (called key words) to be sent to it during the iso 9141-2 and iso14230-4 initiation sequences. if the bytes are not found, the initiation is said to have failed (you might see ?nable to connect?or perhaps ?us init: ...error?. this might occur if you are trying to connect to a non-obd compliant ecu, or perhaps to an older one. if you wish to experiment with non-standard systems, you may have to tell the elm327 to perform the initiation sequence, but ignore the contents of the bytes that are sent and received. to do this, send: >at kw0 after turning keyword checking off, the elm327 will still require the two key word bytes in the response, but will not look at the actual values of the bytes. it will also send an acknowledgement to the ecu, and will wait for the final response from it (but will not stop and report an error if none is received). this may allow you to make a connection in an otherwise ?mpossible?situation. normal behaviour can be returned with at kw1, which is the default setting. l0 and l1 [ linefeeds off or on ] this option controls the sending of linefeed characters after each carriage return character. for at l1, linefeeds will be generated after every carriage return character, and for at l0, they will be off. users will generally wish to have this option on if using a terminal program, but off if using a custom computer interface (as the extra characters transmitted will only serve to slow the communications down). the default setting is determined by the voltage at pin 7 during power on (or reset). if the level is high, then linefeeds are on by default; otherwise they will be off. lp [ go to the low power mode ] this command causes the elm327 to shut off all but ?ssential services?in order to reduce the power consumption to a minimum. the elm327 will respond with an ?k?(but no carriage return) and then, one second later, will change the state of the pwrctrl output (pin 16) and will enter the low power (standby) mode. the ic can be brought back to normal operation through a character received at the rs232 input or a rising edge at the ignmon (pin 15) input, in addition to the usual methods of resetting the ic (power off then on, a low on pin 1, or a brownout). see the power control section (page 66) for more information. m0 and m1 [ memory off or on ] the elm327 has internal ?on-volatile?memory that is capable of remembering the last protocol used, even after the power is turned off. this can be convenient if the ic is often used for one particular protocol, as that will be the first one attempted when next powered on. to enable this memory function, it is necessary to either use an at command to select the m1 option, or to have chosen ?emory on?as the default power on mode (by connecting pin 5 of the elm327 to a high logic level). when the memory function is enabled, each time that the elm327 finds a valid obd protocol, that protocol will be memorized (stored) and will become the new default. if the memory function is not enabled, protocols found during a session will not be memorized, and the elm327 will always start at power up using the same (last saved) protocol. if the elm327 is to be used in an environment where the protocol is constantly changing, it would likely be best to turn the memory function off, and issue an at sp 0 command once. the sp 0 command tells the elm327 to start in an 'automatic' protocol search mode, which is the most useful for an unknown environment. ics come from the factory set to this mode. if, however, you have only one vehicle that you regularly connect to, storing that vehicle? protocol as the default would make the most sense. 20 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com at command descriptions (continued) the default setting for the memory function is determined by the voltage level at pin 5 during power up (or system reset). if it is connected to a high level (vdd), then the memory function will be on by default. if pin 5 is connected to a low level, the memory saving will be off by default. ma [ monitor all messages ] this command places the elm327 into a bus monitoring mode, in which it continually monitors for (and displays) all messages that it sees on the obd bus. it is a quiet monitor, not sending in frame responses for j1850 systems, acknowledges for can systems, or wakeup (?eep-alive? messages for the iso 9141 and iso 14230 protocols. monitoring will continue until it is stopped by activity on the rs232 input, or the rts pin. to stop the monitoring, simply send any single character to the elm327, then wait for it to respond with a prompt character ( >?, or a low level output on the busy pin. (setting the rts input to a low level will interrupt the device as well.) waiting for the prompt is necessary as the response time varies depending on what the ic was doing when it was interrupted. if for instance it is in the middle of printing a line, it will first complete that line then return to the command state, issuing the prompt character. if it were simply waiting for input, it would return immediately. note that the character which stops the monitoring will always be discarded, and will not affect subsequent commands. beginning with v1.3 of this ic, all messages will be printed as found, even if the can auto formatting is on (caf1). the previous version of this ic (v1.2) did not display some illegal can messages if the automatic formatting was on, but now all messages received are displayed, and if the data format does not appear to be correct, then ?data error?will be shown beside the data. if this command is used with can protocols, and if the can filter and/or mask were previously set (with cf, cm or cra), then the ma command will be affected by the settings. for example, if the receive address had been set previously with cra 4b0, then the at ma command would only be able to ?ee messages with an id of 4b0. this may not be what is desired - you may want to reset the masks and filters (with at ar) first. all of the monitoring commands (ma, mr and mt) operate by closing the current protocol (an at pc is executed internally), then configuring the ic for silent monitoring of the data (no wakeup messages, ifrs or can acknowledges are sent by the elm327). when the next obd command is to be transmitted, the protocol will again be initialized, and you may see messages stating this. ?earching...?may also be seen, depending on what changes were made while monitoring. mp hhhh [ monitor for pgn hhhh ] the at ma, mr and mt commands are quite useful for when you wish to monitor for a specific byte in the header of a typical obd message. for the sae j1939 protocol, however, it is often desirable to monitor for the multi-byte parameter group numbers (or pgns), which can appear in either the header, or the data bytes. the mp command is a special j1939 only command that is used to look for responses to a particular pgn request. note that this mp command provides no means to set the first two digits of the requested pgn, and they are always assumed to be 00. for example, the dm2 pgn has an assigned value of 00fecb (see sae j1939-73). to monitor for dm2 messages, you would issue at mp fecb, eliminating the 00, since the mp hhhh command always assumes that the pgn is preceded by two zeros. this command is only available when a can protocol (a, b, or c) has been selected for sae j1939 formatting. it returns an error if attempted under any other conditions. note also that this version of the elm327 only displays responses that match the criteria, not the requests that are asking for the pgn information. mp hhhh n [ monitor for pgn, get n messages ] this is very similar to the above command, but adds the ability to set the number of messages that should be fetched before the elm327 automatically stops monitoring and prints a prompt character. the value ??may be any single hex digit. mp hhhhhh [ monitor for pgn hhhhhh ] this command is very similar to the mp hhhh command, but it extends the number of bytes provided by one, so that there is complete control over the pgn definition (it does not make the assumption that the data page bit is 0, as the mp hhhh command does). 21 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com at command descriptions (continued) this allows for future expansion, should additional pgns be defined with the data page bit set. note that only the data page bit is relevant in the extra byte - the other bits are ignored. mp hhhhhh n [ monitor for pgn, get n messages ] this is very similar to the previous command, but it adds the ability to set the number of messages that should be fetched before the elm327 automatically stops monitoring and prints a prompt character. the value ??may be any single hex digit. mr hh [ monitor for receiver hh ] this command is very similar to the at ma command except that it will only display messages that were sent to the hex address given by hh. these are messages which are found to have the value hh in the second byte of a traditional three byte obd header, in bits 8 to 15 of a 29 bit can id, or in bits 8 to 10 of an 11 bit can id. any single rs232 character aborts the monitoring, as with the ma command. note that if this command is used with can protocols, and if the can filter and/or mask were previously set (with cf, cm or cra), then the mr command will over-write the previous values for these bits only - the others will remain unchanged. as an example, if the receive address has been set with cra 4b0, and then you send mr 02, the 02 will replace the 4, and the can masks/filters will only allow ids that are equal to 2b0. this is often not what is desired - you may want to reset the masks and filters (with at ar) first. as with the at ma command, this command begins by performing an internal protocol close. subsequent obd requests may show ?earching or ?us init? etc. messages when the protocol is reactivated. mt hh [ monitor for transmitter hh ] this command is also very similar to the at ma command, except that it will only display messages that were sent by the transmitter with the hex address given by hh. these are messages which are found to have that value in the third byte of a traditional three byte obd header, or in bits 0 to 7 for can ids. as with the ma and mr monitoring modes, any rs232 activity (single character) aborts the monitoring. note that if this command is used with can protocols, and if the can filter and/or mask were previously set (with cf, cm or cra), then the mt command will over-write the previous values for these bits only - the others will remain unchanged. as an example, if the receive address has been set with cra 4b0, and then you send mt 20, the 20 will replace the b0, and the can masks/filters will only allow ids that are equal to 420. this is often not what is desired - you may want to reset the masks and filters (with at ar) first. as with the at ma command, this command begins by performing an internal protocol close. subsequent obd requests may show ?earching or ?us init? etc. messages when the protocol is reactivated. nl [ normal length messages ] setting the nl mode on forces all sends and receives to be limited to the standard seven data bytes in length, similar to the other elm32x obd ics. to allow longer messages, use the al command. beginning with v1.2, the elm327 does not require a change to al to allow longer message lengths for the kwp protocols to be received (as determined by the header length values). you can simply leave the ic set to the default setting of nl, and all of the received bytes will be shown. pb xx yy [ set protocol b parameters ] this command allows you to change the protocol b (user1) options and baud rate without having to change the associated programmable parameters. this allows for easier testing, and program control. to use this feature, simply set xx to the value for pp 2c, and yy to the value for pp 2d, and issue the command. the next time that the protocol is initialized it will use these values. for example, assume that you wish to try monitoring a system that uses 11 bit can at 33.3 kbps. if you do not want any special formatting, this means a value of 11000000 or c0 for pp 2c, and 15 decimal or 0f hex for pp 2d. send these values to the elm327 in one command: >at pb c0 0f then monitor: >at ma if you see can errors, and realize that you wanted 22 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com at command descriptions (continued) an 83.3 kbps baud rate, close the protocol, and then send the new values: >at pc ok >at pb c0 06 ok >at ma values passed in this way do not affect those that are stored in the 2c and 2d programmable parameters, and are lost if the elm327 is reset. if you want to make your settings persist over power cycles, then you should store them in the programmable parameter memory (don? forget that there are two user1 and user2. pc [ protocol close ] there may be occasions where it is desirable to stop (deactivate) a protocol. perhaps you are not using the automatic protocol finding, and wish to manually activate and deactivate protocols. perhaps you wish to stop the sending of idle (wakeup) messages, or have another reason. the pc command is used in these cases to force a protocol to close. pp hh off [ turn prog. parameter hh off ] this command disables programmable parameter number hh. any value assigned using the pp hh sv command will no longer be used, and the factory default setting will once again be in effect. the actual time when the new value for this parameter becomes effective is determined by its type. refer to the programmable parameters section (page 58) for more information on the types. note that ?p ff off?is a special command that disables all of the programmable parameters, as if you had entered pp off for every possible one. it is possible to alter some of the programmable parameters so that it may be difficult, or even impossible, to communicate with the elm327. if this occurs, there is a hardware means of resetting all of the programmable parameters at once. connect a jumper from circuit common to pin 28, holding it there while powering up the elm327 circuit. hold it in position until you see the rs232 receive led begin to flash (which indicates that all of the pps have been turned off). at this point, remove the jumper to allow the ic to perform a normal startup. note that a reset of the pps occurs quite quickly ?if you are holding the jumper on for more than a few seconds and do not see the rs232 receive light flashing, remove the jumper and try again, as there may be a problem with your connection. this feature is only available beginning with v1.2, and is not a provided with any earlier versions of the elm327 ic. pp hh on [ turn programmable parameter hh on ] this command enables programmable parameter number hh. once enabled, any value assigned using the pp hh sv command will be used where the factory default value was before. (all of the programmable parameter values are set to their default values at the factory, so enabling a programmable parameter before assigning a value to it will not cause problems.) the actual time when the value for this parameter becomes effective is determined by its type. refer to the programmable parameters section (page 58) for more information on the types. note that ?p ff on?is a special command that enables all of the programmable parameters at the same time. pp hh sv yy [ prog. param. hh: set the value to yy ] a value is assigned to a programmable parameter using this command. the system will not be able to use this new value until the programmable parameter has been enabled, with pp hh on. pps [ programmable parameter summary ] the complete range of current programmable parameters are displayed with this command (even those not yet implemented). each is shown as a pp number followed by a colon and the value that is assigned to it. this is followed by a single digit ?either ??or ??to show that it is on (enabled), or off (disabled), respectively. see the programmable parameters section for a more complete discussion. r0 and r1 [ responses off or on ] these commands control the elm327? automatic receive (and display) of the messages returned by the vehicle. if responses have been turned off, the ic will not wait for a reply from the vehicle after sending a request, and will return immediately to wait for the next 23 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com at command descriptions (continued) rs232 command (the elm327 does not print anything to say that the send was successful, but you will see a message if it was not). r0 may be useful to send commands blindly when using the ic for a non-obd network application, or when simulating an ecu in a learning environment. it is not recommended that this option used for normal obd communications, however, as the vehicle may have difficulty if it is expecting an acknowledgement and never receives one. an r0 setting will always override any ?umber of responses digit?that is provided with an obd request. the default setting is r1, or responses on. ra hh [ set the receive address to hh ] depending on the application, users may wish to manually set the address to which the elm327 will respond. issuing this command will turn off the ar mode, and force the ic to only accept responses addressed to hh. use caution with this setting, as depending on what you set it to, you may end up accepting (ie. acknowledging with an ifr) a message that was actually meant for another module. to turn off the ra filtering, simply send at ar. this command is not very effective for use with the can protocols, as it only monitors for one portion of the id bits, and that is not likely enough for most can applications - the cra command may be a better choice. also, this command has no effect on the addresses used by the j1939 protocols, as the j1939 routines derive them from the header values, as required by the sae standard. the ra command is exactly the same as the sr command, and can be used interchangeably. note that can extended addressing does not use this value - it uses the one set by the at ta command. rd [ read the data in the user memory ] the byte value stored with the sd command is retrieved with this command. there is only one memory location, so no address is required. rtr [ send an rtr message ] this command causes a special ?emote frame can message to be sent. this type of message has no data bytes, and has its remote transmission request (rtr) bit set. the headers and filters will remain as previously set (ie the elm327 does not make any assumptions as to what format a response may have), so adjustments may need to be made to the mask and filter. this command must be used with an active can protocol (one that has been sending and receiving messages), as it can not initiate a protocol search. note that the caf1 setting normally eliminates the display of all rtrs, so if you are monitoring messages and want to see the rtrs, you will have to turn off formatting, or else turn the headers on. the elm327 treats an rtr just like any other message sent, and will wait for a response from the vehicle (unless at r0 has been chosen). rv [ read the input voltage ] this initiates the reading of the voltage present at pin 2, and the conversion of it to a decimal voltage. by default, it is assumed that the input is connected to the voltage to be measured through a 47k w and 10kw resistor divider (with the 10k w connected from pin 2 to vss), and that the elm327 supply is a nominal 5v. this will allow for the measurement of input voltages up to about 28v, with an uncalibrated accuracy of typically about 2%. s0 and s1 [ printing of spaces off or on ] these commands control whether or not space characters are inserted in the ecu response. the elm327 normally reports ecu responses as a series of hex characters that are separated by space characters (to improve readability), but messages can be transferred much more quickly if every third byte (the space) is removed. while this makes the message less readable for humans, it can provide significant improvements for computer processing of the data. by default, spaces are on (s1), and space characters are inserted in every response. sd hh [ save data byte hh ] the elm327 is able to save one byte of information for you in a special nonvolatile memory location, which is able to retain its contents even if the power is turned off. simply provide the byte to be stored, then retrieve it later with the read data (at rd) command. this location is ideal for storing user preferences, unit ids, occurrence counts, or other information. 24 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com sh xyz [ set the header to 00 0x yz ] entering can 11 bit id words (headers) normally requires that extra leading zeros be added (eg. at sh 00 07 df), but this command simplifies doing so. the at sh xyz command accepts a three digit argument, takes only the right-most 11 bits from that, adds leading zeros, and stores the result in the header storage locations for you. as an example, at sh 7df is a valid command, and is quite useful for working with 11 bit can systems. it actually results in the header bytes being stored internally as 00 07 df. sh xx yy zz [ set the header to xx yy zz ] this command allows the user to manually control the values that are sent as the three header bytes in a message. these bytes are normally assigned values for you (and are not required to be adjusted), but there may be occasions when it is desirable to change them (particularly if experimenting with physical addressing). if experimenting, it is not necessary but may be better to set the headers after a protocol is active. that way, wakeup messages, etc. that get set on protocol activation will use the default values. the header bytes are defined with hexadecimal digits - xx will be used for the first or priority/type byte, yy will be used for the second or receiver/target byte, and zz will be used for the third or transmitter/source byte. these remain in effect until set again, or until restored to their default values with the d, ws, or z commands. if new values for header bytes are set before the vehicle protocol has been determined, and if the search is not set for fully automatic (ie other than protocol 0), these new values will be used for the header bytes of the first request to the vehicle. if that first request should fail to obtain a response, and if the automatic search is enabled, the elm327 will then continue to search for a protocol using default values for the header bytes. once a valid protocol is found, the header bytes will revert to the values assigned with the at sh command. this command is used to assign all header bytes, whether they are for a j1850, iso 9141, iso 14230, or a can system. the can systems will use these three bytes to fill bits 0 to 23 of the id word (for a 29 bit id), or will use only the rightmost 11 bits for an 11 bit can id (and any extra bits assigned will be ignored). the additional 5 bits needed for a 29 bit system are set with the at cp command. if assigning header values for the kwp protocols (4 and 5), care must be taken when setting the first header byte (xx) value. the elm327 will always insert the number of data bytes for you, but how it is done depends on the values that you assign to this byte. if the second digit of this first header byte is anything other than 0 (zero), the elm327 assumes that you wish to have the length value inserted in that first byte when sending. in other words, providing a length value in the first header byte tells the elm327 that you wish to use a traditional 3 byte header, where the length is stored in the first byte of the header. if you provide a value of 0 for the second digit of the first header byte, the elm327 will assume that you wish that value to remain as 0, and that you want to have a fourth header (length) byte inserted into the message. this is contrary to the iso 14230-4 obd standard, but it is in use by many kwp2000 systems for (non-obd) data transfer, so may be useful when experimenting. support for 4 byte kwp headers was added with v1.2 of the elm327 ic, and is not available in previous versions. sh ww xx yy zz [ set the header to ww xx yy zz ] this four byte version of the at sh command allows setting a complete 29 bit can id in one instruction. alternatively, at sp (for the five most significant bits) and at sh (for the other three bytes) may be used. si [ perform a slow initiation ] protocols 3 and 4 use what is sometimes called a 5 baud, or slow initiation sequence in order to begin communications. usually, the sequence is performed when the first message needs to be sent, and then the message is sent immediately after. some ecus may need more time between the two however, and having a separate initiation command allows you to control this time. simply send at si, wait a little, then send the message. you may need to experiment a little to get the right amount of delay. protocol 3 or 4 must be selected to use the at si command, or an error will result. sp h [ set protocol to h ] this command is used to set the elm327 for operation using the protocol specified by 'h', and to also save it as the new default. note that the protocol at command descriptions (continued) 25 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com at command descriptions (continued) will be saved no matter what the at m0/m1 setting is. the elm327 supports 12 different protocols (two can be user-defined). they are: 0 - automatic 1 - sae j1850 pwm (41.6 kbaud) 2 - sae j1850 vpw (10.4 kbaud) 3 - iso 9141-2 (5 baud init, 10.4 kbaud) 4 - iso 14230-4 kwp (5 baud init, 10.4 kbaud) 5 - iso 14230-4 kwp (fast init, 10.4 kbaud) 6 - iso 15765-4 can (11 bit id, 500 kbaud) 7 - iso 15765-4 can (29 bit id, 500 kbaud) 8 - iso 15765-4 can (11 bit id, 250 kbaud) 9 - iso 15765-4 can (29 bit id, 250 kbaud) a - sae j1939 can (29 bit id, 250* kbaud) b - user1 can (11* bit id, 125* kbaud) c - user2 can (11* bit id, 50* kbaud) * default settings (user adjustable) the first protocol shown (0) is a convenient way of telling the elm327 that the vehicle? protocol is not known, and that it should perform a search. it causes the elm327 to try all protocols if necessary, looking for one that can be initiated correctly. when a valid protocol is found, and the memory function is enabled, that protocol will then be remembered, and will become the new default setting. when saved like this, the automatic mode searching will still be enabled, and the next time the elm327 fails to connect to the saved protocol, it will again search all protocols for another valid one. note that some vehicles respond to more than one protocol - during a search, you may see more than one type of response. elm327 users often use the at sp 0 command to reset the search protocol before starting (or restarting) a connection. this works well, but as with any set protocol command, it involves a write to eeprom, and an unnecessary delay (of about 30 msec) while the write occurs. beginning with v1.3 of the elm327, a write to eeprom will no longer be performed for an sp 0 (or an sp a0, or sp 0a) command, but the command will still reset the protocol to 0 for you. if you really want to change what is stored in the internal eeprom, you must now use the new at sp 00 command. if another protocol (other than 0) is selected with this command (eg. at sp 3), that protocol will become the default, and will be the only protocol used by the elm327. failure to initiate a connection in this situation will result in a response such as ?us init: ...error? and no other protocols will be attempted. this is a useful setting if you know that your vehicle(s) only require the one protocol, but also one that can cause a lot of problems if you do not understand it . sp 00 [ erase the stored protocol ] to speed up protocol initiation and detection, the sp 0 command sets the protocol to automatic, but does not perform a (very time-consuming) write to eeprom. some users felt it was necessary to be able to actually write to the elm327's eeprom, however, so we provided this command. it should not normally be used when connecting to a vehicle. sp ah [ set protocol to auto, h ] this variation of the sp command allows you to choose a starting (default) protocol, while still retaining the ability to automatically search for a valid protocol on a failure to connect. for example, if your vehicle is iso 9141-2, but you want to occasionally use the elm327 circuit on other vehicles, you might use the at sp a3 command, so that the first protocol tried will then be yours (3), but it will also automatically search for other protocols. don't forget to disable the memory function if doing this, or each new protocol detected will become your new default. sp ah will save the protocol information even if the memory option is off (but sp a0 and sp 0a do not- if you must write 0 to the eeprom, use command at sp 00). note that the ??can come before or after the h, so at sp a3 can also be entered as at sp 3a. sr hh [set the receive address to hh ] depending on the application, users may wish to manually set the address to which the elm327 will respond. issuing this command will turn off the ar mode, and force the ic to only accept responses addressed to hh. use caution with this setting, as depending on what you set it to, you may accept a message that was actually meant for another module, possibly sending an ifr when you should not. to turn off the sr filtering, simply send at ar. this command has limited use with can, as it only monitors one byte of the id bits, and that is not likely selective enough for most can applications (the cra 26 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com at command descriptions (continued) command may be a better choice). also, the command has no effect on the addresses used by the j1939 protocols, as the j1939 routines set their own receive addresses based on the id bit (header) values. this sr command is exactly the same as the ra command, and can be used interchangeably with it. note that can extended addressing does not use this value - it uses the one set by the at ta command. ss [ use the standard sequence for searches ] sae standard j1978 specifies a protocol search order that scan tools should use. it follows the number order that we have assigned to the elm327 protocols. in order to provide a faster search, the elm327 does not normally follow this order, but it will if you command it to with at ss. st hh [ set timeout to hh ] after sending a request, the elm327 waits a preset time for a response before it can declare that there was ?o data?received from the vehicle. the same timer setting is also used after a response has been received, while waiting to see if any more are coming. the at st command allows this timer to be adjusted, in increments of 4 msec (or 20 msec if in the j1939 protocol, with jtm5 selected). when adaptive timing is enabled, the at st time sets the maximum time that is to be allowed, even if the adaptive algorithm determines that the setting should be longer. in most circumstances, it is best to simply leave the at st time at the default setting, and let the adaptive timing algorithm determine what to use for the timeout. the st timer is set to 32 by default (giving a time of approximately 200 msec), but this default setting can be adjusted by changing pp 03. note that a value of 00 does not result in a time of 0 msec ?it will restore the timer to the default value. also, during protocol searches, an internally set minimum time is used - you may select longer times with at st, but not shorter. sw hh [ set wakeup to hh ] once a data connection has been established, some protocols require that there be data flow every few seconds, just so that the ecu knows to maintain the communications path open. if the messages do not appear, the ecu will assume that you are finished, and will close the channel. the connection will need to be initialized again to reestablish communications. the elm327 will automatically generate periodic messages, as required, in order to maintain a connection. any replies to these messages are ignored by the elm327, and are not visible to the user. (currently, only protocols 3, 4, and 5 support these messages - nothing is available for can. if you require can periodic messages, you must use the elm329.) the time interval between these periodic ?akeup messages can be adjusted in 20 msec increments using the at sw hh command, where hh is any hexadecimal value from 00 to ff. the maximum possible time delay of just over 5 seconds results when a value of ff (decimal 255) is used. the default setting (92) provides a nominal delay of 3 seconds between messages. note that the value 00 (zero) is special, as it will stop the periodic (wakeup) messages. this provides a control for experimenters to stop the messages while keeping the rest of the protocol functioning normally, and is not intended to be used regularly. issuing at sw 00 will not change a prior setting for the time between wakeup messages, if the protocol is re- initialized. once periodic messages have been turned off with at sw, they can only be reestablished by closing and reinitializing the protocol. ta hh [ set the tester address to hh ] this command is used to change the current tester (ie. scan tool) address that is used in the headers, periodic messages, filters, etc. the elm327 normally uses the value that is stored in pp 06 for this, but the ta command allows you to temporarily override that value. sending at ta will affect all protocols, including j1939. this provides a convenient means to change the j1939 address from the default value of f9, without affecting other settings. although this command may appear to work ?n the fly? it is not recommended that you try to change this address after a protocol is active, as the results may be unpredictable. tp h [ try protocol h ] this command is identical to the sp command, except that the protocol that you select is not immediately saved in internal eeprom memory, so does not change the default setting. note that if the 27 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com memory function is enabled (at m1), and this new protocol that you are trying is found to be valid, that protocol will then be stored in memory as the new default. tp ah [ try protocol h with auto ] this command is very similar to the at tp command above, except that if the protocol that is tried should fail to initialize, the elm327 will then automatically sequence through the other protocols, attempting to connect to one of them. v0 and v1 [ variable data lengths off or on ] many can protocols (ie iso 15765-4) expect to send eight data bytes at all times. the v0 and v1 commands may be used to override this behaviour (for any can protocol) should you wish. choosing v1 will cause the current can protocol to send variable data length messages, just as bit 6 of pp 2c and pp 2e do for protocols b and c. it does not matter what the protocol should be doing - v1 will override that. this allows experimenting with variable data length messages on demand. if you select v0 (the default setting), the forced sending of variable length can messages is turned off. the format of the sent messages reverts to the protocol? settings. wm [1 to 6 bytes] [ set wakeup message to?] this command allows the user to override the default settings for the wakeup messages (sometimes known as the ?eriodic idle?messages). simply provide the message that you wish to have sent (typically three header bytes and one to three data bytes), and the elm327 will add the checksum and send them as required, at the rate determined by the at sw setting. default settings send the bytes 68 6a f1 01 00 for iso 9141, and c1 33 f1 3e for kwp. ws [ warm start ] this command causes the elm327 to perform a complete reset. it is very similar to the at z command, but does not include the power on led test. users may find this a convenient way to quickly ?tart over without having the extra delay of the at z command. if using variable rs232 baud rates (ie at brd commands), it is preferred that you reset the ic using this command rather than at z, as at ws will not affect the chosen rs232 baud rate. z [ reset all ] this command causes the chip to perform a complete reset as if power were cycled off and then on again. all settings are returned to their default values, and the chip will be put into the idle state, waiting for characters on the rs232 bus. note that any baud rate that was set with the at brd command will be lost, and the elm327 will return to the default baud rate setting. @1 [ display the device description ] this command displays the device description string. the default text is ?bdii to rs232 interpreter? @2 [ display the device identifier ] a device identifier string that was recorded with the @3 command is displayed with the @2 command. all 12 characters and a terminating carriage return will be sent in response, if they have been defined. if no identifier has been set, the @2 command returns an error response (??. the identifier may be useful for storing product codes, production dates, serial numbers, or other such codes. see the ?rogramming serial numbers?section for more information. @3 cccccccccccc [ store the device identifier ] this command is used to set the device identifier code. exactly 12 characters must be sent, and once written to memory, they can not be changed (ie you may only use the @3 command one time). the characters sent must be printable (ascii character values 0x21 to 0x5f inclusive). if you are developing software to write device identifiers, you may be interested in the elm328 ic, as it allows multiple writes using the @3 command (but it can not send obd messages). at command descriptions (continued) 28 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com reading the battery voltage before learning the obd commands, we will show an example of how to use an at command. we will assume that you have built (or purchased) a circuit which is similar to that of figure 9 in the example applications section (page 71). this circuit provides a connection to read the vehicle? battery voltage, which many will find very useful. if you look in the at command list, you will see there is one command that is listed as rv [read the input voltage]. this is the command which you will need to use. first, be sure that the prompt character is shown (that is the >?character), then simply enter ?t followed by rv, and press return (or enter): >at rv note that we used upper case characters for this request, but it was not required, as the elm327 will accept upper case (at rv) as well as lower case (at rv) or any combination of these (at rv). it does not matter if you insert space characters (?? within the message either, as they are ignored by the elm327. a typical response to this command will show a voltage reading, followed by another prompt character: 12.6v > the accuracy of this reading depends on several factors. as shipped from the factory, the elm327 voltage reading circuitry will typically be accurate to about 2%. for many, this is all that is needed. some people may want to calibrate the circuitry for more accurate readings, however, so we have provided a special ?alibrate voltage?command for this. to change the internal calibration constants, you will need to know the actual battery voltage to more accuracy than the elm327 shows. many quality digital multimeters can do this, but you should verify the accuracy before making a change. let us assume that you have connected your accurate multimeter, and you find that it reads 12.47v. the elm327 is a little high at 12.6v, and you would like it to read the same as your meter. simply calibrate the elm327 to the measured voltage using the cv command: >at cv 1247 ok note that you should not provide a decimal point in the cv value, as the elm327 knows that it should be between the second and the third digits. at this point, the internal calibration values have been changed (ie. written to eeprom), and the elm327 now knows that the voltage at the input is actually 12.47v. to verify that the changes have taken place, simply read the voltage again: >at rv 12.5v the elm327 always rounds off the measurement to one decimal place, so the 12.47v actually appears as 12.5v (but the second decimal place is maintained internally for accuracy and is used in the calculations). the elm327 may be calibrated with any reference voltage that you have available, but note that the cv command always expects to receive four characters representing the voltage at the input. if you had used a 9v battery for your reference, and it is actually 9.32v, then you must add a leading zero to the actual voltage when calibrating the ic: >at cv 0932 ok if you should get into trouble with this command (for example, if you set calibration values to something arbitrary and do not have a voltmeter on hand to provide accurate values), you can restore the settings to the original (factory) values with the cv 0000 command. simply send: >at cv 0000 ok the other at commands are used in the same manner. simply type the letters a and t, then follow with the command you want to send and any arguments that are required. then press return (or enter, depending on your keyboard). remember - you can always insert space characters as often as you wish if it improves the readability for you, as they are ignored by the elm327. obd commands if the bytes that you send to the elm327 do not begin with the letters ??and ?? they are assumed to be obd commands for the vehicle. each pair of ascii bytes will be tested to ensure that they are valid hexadecimal digits, and will then be combined into data bytes for transmitting to the vehicle. obd commands are actually sent to the vehicle embedded in a data packet. most standards require that three header bytes and an error checksum byte be included with every obd message, and the elm327 adds these extra bytes to your command bytes for you. the initial (default) values for these extra bytes are usually appropriate for most requests, but if you wish to change them, there is a mechanism to do so (see the ?etting the headers?section). most obd commands are only one or two bytes in length, but some can be longer. the elm327 will limit the number of bytes that can be sent to the maximum number allowed by the standards (usually seven bytes or 14 hexadecimal digits). attempts to send more bytes will result in an error ?the entire command is then ignored and a single question mark printed. hexadecimal digits are used for all of the data exchange with the elm327 because it is the data format used most often in the obd standards. most mode request listings use hexadecimal notation, and it is the format most frequently used when results are shown. with a little practice, it should not be very difficult to deal in hex numbers, but some people may want to use a table such as figure 1, or keep a calculator nearby. dealing with the hex digits can not be avoided - eventually all users need to manipulate the results in some way (combining bytes and dividing by 4 to obtain rpm, dividing by 2 to obtain degrees of advance, converting temperatures, etc.). as an example of sending a command to the vehicle, assume that a6 (or decimal 166) is the command that is required to be sent. in this case, the user would type the letter a, then the number 6, then would press the return key. these three characters would be sent to the elm327 by way of the rs232 port. the elm327 would store the characters as they are received, and when the third character (the carriage return) was received, would begin to assess the other two. it would see that they are both valid hex digits, and would convert them to a one byte value (the decimal value is 166). the header bytes and a checksum byte would then be added, and a total of five bytes would typically be sent to the vehicle. note that the carriage return character is only a signal to the elm327, and is not sent to the vehicle. after sending the command, the elm327 listens on the obd bus for replies, looking for ones that are directed to it. if a message address matches, the received bytes will be sent on the rs232 port to the user, while messages received that do not have matching addresses will be ignored (but are often still available for viewing with the at bd command). the elm327 will continue to wait for messages addressed to it until there are none found in the time that was set by the at st command. as long as messages continue to be received, the elm327 will continue to reset this timer, and look for more. note that the ic will always respond to a request with some reply, even if it is to say ?o data?(meaning that there were no messages found, or that some were found but they did not match the receive criteria). 29 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com figure 1. hex to decimal conversion hexadecimal number decimal equivalent 0 1 3 2 4 5 6 0 1 3 2 4 5 6 7 7 8 8 9 9 a 10 b 11 c 12 d 13 e 14 f 15 talking to the vehicle the standards require that each obd command or request that is sent to the vehicle must adhere to a set format. the first byte sent (known as the ?ode? describes the type of data being requested, while the second byte (and possibly a third or more) specifies the actual information that is required. the bytes which follow after the mode byte are known as the ?arameter identification?or pid number bytes. the modes and pids are described in detail in documents such as the sae j1979, or iso 15031-5 standards, and may also be defined by the vehicle manufacturers. the sae j1979 standard currently defines ten possible diagnostic test modes, which are: 01 - show current data 02 - show freeze frame data 03 - show diagnostic trouble codes 04 - clear trouble codes and stored values 05 - test results, oxygen sensors 06 - test results, non-continuously monitored 07 - show ?ending?trouble codes 08 - special control mode 09 - request vehicle information 0a - request permanent trouble codes vehicles are not required to support all of the modes, and within modes, they are not required to support all possible pids (some of the first obdii vehicles only supported a very small number of them). within each mode, pid 00 is reserved to show which pids are supported by that mode. mode 01, pid 00 must be supported by all vehicles, and can be accessed as follows ensure that your elm327 interface is properly connected to the vehicle, and powered. most vehicles will not respond without the ignition key in the on position, so turn the ignition to on, but do not start the engine. if you have been experimenting, the state of your interface may be unknown, so reset it by sending: >at z you will see the interface leds flash, and then the ic should respond with ?lm327 v2.0? followed by a prompt character. now, you may choose a protocol that the elm327 should connect with, but it is usually easier to simply select protocol ??which tells the ic to search for one: >at sp 0 that? all that you need to do to prepare the elm327 for communicating with a vehicle. at the prompt, issue the mode 01 pid 00 command: >01 00 the elm327 should say that it is ?earching... for a protocol, then it should print a series of numbers, similar to these: 41 00 be 1f b8 10 the 41 in the above signifies a response from a mode 01 request (01 + 40 = 41), while the second number (00) repeats the pid number requested. a mode 02, request is answered with a 42, a mode 03 with a 43, etc. the next four bytes (be, 1f, b8, and 10) represent the requested data, in this case a bit pattern showing the pids that are supported by this mode (1=supported, 0=not). although this information is not very useful for the casual user, it does prove that the connection is working. another example requests the current engine coolant temperature (ect). coolant temperature is pid 05 of mode 01, and can be requested as follows: >01 05 the response will be of the form: 41 05 7b the 41 05 shows that this is a response to a mode 1 request for pid 05, while the 7b is the desired data. converting the hexadecimal 7b to decimal, one gets 7 x 16 + 11 = 123. this represents the current temperature in degrees celsius, but with the zero offset to allow for subzero temperatures. to convert to the actual coolant temperature, you need to subtract 40 from the value obtained. in this case, then, the coolant temperature is 123 - 40 or 83?. a final example shows a request for the engine rpm. this is pid 0c of mode 01, so at the prompt type: >01 0c if the engine is running, the response might be: 41 0c 1a f8 the returned value (1a f8) is actually a two byte hex number that must be converted to a decimal value to be useful. converting it, we get a value of 6904, which seems like a very high value for engine rpm. 30 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com 31 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com talking to the vehicle (continued) that is because rpm is sent in increments of 1/4 rpm! to convert to the actual engine speed, we need to divide the 6904 by 4. a value of 1726 rpm is much more reasonable. note that these examples asked the vehicle for information without regard for the type of obd protocol that the vehicle uses. this is because the elm327 takes care of all of the data formatting and translation for you. unless you are going to do more advanced functions, there is really no need to know what the protocol is. the above examples showed only a single line of response for each request, but the replies often consist of several separate messages, either from multiple ecus responding, or from one ecu providing messages that need to be combined to form one response (see ?ultiline responses?on page 44). in order to be adaptable to this variable number of responses, the elm327 normally waits to see if any more are coming. if no response arrives within a certain time, it assumes that the ecu is finished. this same timer is also used when waiting for the first response, and if that never arrives, causes ?o data to be printed. version 1.3 of the elm327 introduced a way to speed up the retrieval of information, if you know how many responses to expect. by telling the elm327 how many lines of data to receive, it knows when it is finished, so does not have to go through the final timeout, waiting for data that is not coming. simply add a single hex digit after the obd request bytes - the value of the digit providing the maximum number of responses to obtain, and the elm327 does the rest. for example, if you know that there is only one response coming for the engine temperature request that was previously discussed, you can now send: >01 05 1 and the elm327 will return immediately after obtaining only one response. this may save a considerable amount of time, as the default time for the at st timer is 200 msec. (the elm327 still sets the timer after sending the request, but that is only in case the single response does not arrive.) some protocols (like j1850 pwm) require an acknowledgement from the elm327 for every message sent. if you provide a number for the responses that is too small, the elm327 will return to the prompt too early, and you may cause bus congestion while the ecu tries several times to resend the messages that were not acknowledged. for this reason, you must know how many responses to expect before using this feature. as an example, consider a request for the vehicle identification number (vin). this number is 17 digits long, and typically takes 5 lines of data to be represented. it is obtained with mode 09, pid 02, and should be requested with: >09 02 or with: >09 02 5 if you know that there are five lines of data coming. if you should mistakenly send 09 02 1, you might cause problems. this ability to specify the number of responses was really added with the programmer in mind. an interface routine can determine how many responses to expect for a specific request, and then store that information for use with subsequent requests. that number can then be added to the requests and the response time can be optimized. for an individual trying to obtain a few trouble codes, the savings are not really worth the trouble, and it? easiest to use the old way to make a request. we offer one additional warning when trying to optimize the speed at which you obtain information from vehicles. prior to the apr2002 release of the j1979 standard, sending j1850 requests more frequently than every 100 msec was forbidden. with the apr2002 update, scan tools were allowed to send the next request without delay if it was determined that all the responses to the previous request had been received. vehicles made prior to this time may not be able to tolerate requests at too fast a rate, so use caution with them. hopefully this has shown how typical requests are made using the elm327. if you are looking for more information on modes and pids, it is available from the sae (www.sae.org), from iso (www.iso.org), or from various other sources on the web. interpreting trouble codes likely the most common use that the elm327 will be put to is in obtaining the current diagnostic trouble codes (or dtcs). minimally, this requires that a mode 03 request be made, but first one should determine how many trouble codes are presently stored. this is done with a mode 01 pid 01 request as follows: >01 01 to which a typical response might be: 41 01 81 07 65 04 the 41 01 signifies a response to the request, and the next data byte (81) is the number of current trouble codes. clearly there would not be 81 (hex) or 129 (decimal) trouble codes present if the vehicle is at all operational. in fact, this byte does double duty, with the most significant bit being used to indicate that the malfunction indicator lamp (mil, or ?heck engine light? has been turned on by one of this module? codes (if there are more than one), while the other 7 bits of this byte provide the actual number of stored trouble codes. in order to calculate the number of stored codes when the mil is on, simply subtract 128 (or 80 hex) from the number. the above response then indicates that there is one stored code, and it was the one that set the check engine lamp or mil on. the remaining bytes in the response provide information on the types of tests supported by that particular module (see the j1979 document for further information). in this instance, there was only one line to the response, but if there were codes stored in other modules, they each could have provided a line of response. to determine which module is reporting the trouble code, one would have to turn the headers on (at h1) and then look at the third byte of the three byte header for the address of the module that sent the information. having determined the number of codes stored, the next step is to request the actual trouble codes with a mode 03 request (there is no pid needed): >03 a response to this could be: 43 01 33 00 00 00 00 the ?3?in the above response simply indicates that this is a response to a mode 03 request. the other 6 bytes in the response have to be read in pairs to show the trouble codes (the above would be interpreted as 0133, 0000, and 0000). note that the response has been padded with 00? as required by the sae standard for this mode ?the 0000? do not represent actual trouble codes. as was the case when requesting the number of stored codes, the most significant bits of each trouble code also contain additional information. it is easiest to use the following table to interpret the extra bits in the first digit as follows: powertrain codes - sae defined 0 ? ? - manufacturer defined ? ? - sae defined ? ? - jointly defined 1 2 3 if the first hex digit received is this, replace it with these two characters chassis codes - sae defined 4 ? ? - reserved for future 5 6 7 body codes - sae defined 8 9 a b network codes - sae defined c d e f p0 p1 p2 p3 c0 c1 c2 c3 b0 b1 b2 b3 u0 u1 u2 u3 ? ? - reserved for future ? ? - manufacturer defined ? ? - manufacturer defined ? ? - manufacturer defined ? ? - manufacturer defined ? ? - manufacturer defined ? ? - manufacturer defined ? ? - reserved for future taking the example trouble code (0133), the first digit (0) would then be replaced with p0, and the 0133 reported would become p0133 (which is the code for an ?xygen sensor circuit slow response?. note that the iso 15765-4 (can) protocol is very similar, but it adds an extra data byte (in the second position), showing how many data items (dtcs) are to follow. to provide a few more examples, if the received code was d016, you would replace the d with u1, and the resulting trouble code would be u1016. similarly, 1131 received would actually be for the code p1131. 32 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com resetting trouble codes the elm327 is quite capable of resetting diagnostic trouble codes, as this only requires issuing a mode 04 command. the consequences should always be considered before sending it, however, as more than the mil (or ?heck engine light? will be reset. in fact, issuing a mode 04 will: - reset the number of trouble codes - erase any diagnostic trouble codes - erase any stored freeze frame data - erase the dtc that initiated the freeze frame - erase all oxygen sensor test data - erase mode 06 and 07 information - not erase permanent (mode 0a) trouble codes (these are reset by the ecu only) clearing of all of this data is not unique to the elm327 ?it occurs whenever any scan tool is used to reset the codes. the biggest problem with losing this data is that your vehicle may run poorly for a short time, while it performs a recalibration. to avoid inadvertently erasing stored information, the sae specifies that scan tools must verify that a mode 04 is intended (?re you sure?? before actually sending it to the vehicle, as all trouble code information is immediately lost when the mode is sent. remember that the elm327 does not monitor the content of the messages, so it will not know to ask for confirmation of the mode request ?this would have to be the duty of a software interface, if one is written. as stated, to actually erase diagnostic trouble codes, one need only issue a mode 04 command. a response of 44 from the vehicle indicates that the mode request has been carried out, the information erased, and the mil turned off. some vehicles may require a special condition to occur (eg. the ignition on but the engine must not be running) before they will respond to a mode 04 command. that is all there is to clearing trouble codes. once again, do not accidentally send the 04 code! quick guide for reading trouble codes if you do not use your elm327 for some time, this entire data sheet may seem like quite a bit to review when your ?heck engine?light eventually comes on, and you just want to know why. we offer this section as a quick guide to the basics that you will need. to get started, connect the elm327 circuit to your pc or pda and communicate with it using a terminal program such as hyperterminal, zterm, ptelnet, or a similar program. it should normally be set to either 9600 or 38400 baud, with 8 data bits, and no parity or handshaking. the chart at the right provides a quick procedure on what to do next: 33 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com ignition key to on, but vehicle not running >0101 to see how many codes (2nd digit of the 3rd byte) >03 to see the codes (ignore the first byte and read the others in pairs) >04 to reset the codes fix the vehicle ! 34 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com wakeup messages after an iso 9141 or iso 14230 connection has been established, there needs to be periodic data transfers in order to maintain that connection, and prevent it from ?oing to sleep.?if normal requests and responses are being sent, that is usually sufficient, but the elm327 occasionally has to create its own messages, to prevent the connection from timing out. we term these periodic messages that are created the ?akeup messages? as they keep the connection alive, and prevent the circuitry from going back to an idle or sleep mode. (some texts refer to these messages simply as ?dle messages.? the elm327 automatically creates and sends these for you if there appears to be no other activity ?there is nothing that you need do to ensure that they occur. to see that these are being sent, simply watch the obd transmit led ?you will see the periodic ?lips?as the elm327 sends each one. the elm327 normally sends wakeup messages after 3 seconds of no activity (this time is adjustable with the at sw command). this is within the five second limit set by the standard. the default content of these messages vary depending on the protocol - for iso 9141, the elm327 will send 68 6a f1 01 00, and it sends c1 33 f1 3e for iso 14230 (kwp). if you would prefer that a different message be sent, simply use the wakeup message command to define it. for example, if you would like to send the data bytes 44 55 with the header bytes set to 11 22 33, simply send the command: >at wm 11 22 33 44 55 and from that point forward, every wakeup message that the elm327 sends will be 11 22 33 44 55 (with a checksum byte following). you do not provide the checksum byte - it is automatically added for you. you can change these as often as you want, the only restriction being that every time you do, you must provide the complete message ?the header bytes and the data bytes. the current version of the elm327 allows for messages of one to six bytes total, not including the checksum. bus initiation both the iso 9141-2 and iso 14230-4 (kwp2000) standards require that the vehicle? obd bus be initialized before any communications can take place. the iso 9141 standard allows for only a slow (2 to 3 second) initiation process, while iso 14230 allows for both a slow method, and a faster alternative. the elm327 will perform this bus initiation for you, but generally not until a request needs to be sent (you can force one with the fi and si commands). if the bus initiation occurs during an automatic search, you will not see any status reporting, but if you have the auto option off (and are set to protocols 3, 4, or 5), then you will see a message similar to this: bus init: ... the three dots appear only as the slow initiation process is carried out ?a fast initiation does not show the dots. this will be followed by either the expression ?k?to say it was successful, or else an error message to indicate that there was a problem. (the most common error encountered is in forgetting to turn the vehicle? key to ?n?before attempting to talk to the vehicle.) once the bus has been initiated, communications must take place regularly (typically at least once every five seconds), or the bus will revert to a low-power ?leep?mode. if you are not sending data requests often enough, the elm327 will generate requests for you to ensure that the bus stays ?wake? you will never see the responses to these, but you may see the transmit led flash periodically when these are being sent. by default, the elm327 ensures that these ?akeup?or ?dle?messages are sent every 3 seconds, but this is adjustable with the at sw command. the contents of the wakeup message are also user programmable with the at wm command, if you should wish to change them. users generally do not have to change either of the above, as the default settings work well with most systems. 35 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com selecting protocols the elm327 supports several different obd protocols (see figure 2, at right). as a user, you may never have to choose which one it should use (since the factory settings cause an automatic search to be performed for you), but while experimenting, you may want to specify a protocol to be used. for example, if you know that your vehicle uses the sae j1850 vpw protocol, you may want the elm327 to use only that protocol, and no others. if that is what you want, simply determine the protocol number (from figure 2), then use the ?et protocol?at command as follows: >at sp 2 ok from this point on, the default protocol (used after every power-up or at d command) will be protocol 2 (or whichever one that you have chosen). verify this by asking the elm327 to describe the protocol: >at dp sae j1850 vpw now what happens if your friend has a vehicle that uses iso 9141-2? how do you now use the elm327 interface for that vehicle, if it is set for j1850? one possibility is to change your protocol selection to allow for the automatic searching for another protocol, on failure of the current one. this is done by putting an ??before the protocol number, as follows: >at sp a2 ok >at dp auto, sae j1850 vpw now, the elm327 will try protocol 2, but will then automatically begin searching for another protocol should the attempt to connect with protocol 2 fail (as would happen when you try to connect to your friend? vehicle). the set protocol commands cause an immediate write to the internal eeprom, before even attempting to connect to the vehicle. this write is time-consuming, affects the setting for the next powerup, and may not actually be appropriate, if the protocol selected is not correct for the vehicle. to allow a test before a write occurs, the elm327 offers one other command - the try protocol (tp) command. try protocol is very similar to set protocol. it is used in exactly the same way as the at sp command, the only difference being that a write to internal memory will only occur after a valid protocol is found, and only if the memory function is enabled (m0/m1). for the previous example, all that needs to be sent is: >at tp a2 ok many times, it is very difficult to even guess at a protocol to try first. in these cases, it is best to simply let the elm327 decide what to use. this is done by telling it to use protocol 0 (with either the sp or the tp commands). to have the elm327 automatically search for a protocol to use, simply send: >at sp 0 ok and when the next obd command is to be sent, the elm327 will automatically look for one that responds. you will see a ?earching...?message, followed by a response, after which you can ask the elm327 what protocol it found (by sending at dp). the first versions of the elm327 used the sae recommended search order (protocol 1, 2, 3, etc.), but recent versions of the ic modify the search order figure 2. elm327 protocol numbers description sae j1850 pwm (41.6 kbaud) protocol 0 1 2 3 4 5 6 7 8 9 automatic sae j1850 vpw (10.4 kbaud) iso 9141-2 (5 baud init) iso 14230-4 kwp (5 baud init) iso 14230-4 kwp (fast init) iso 15765-4 can (11 bit id, 500 kbaud) iso 15765-4 can (29 bit id, 500 kbaud) iso 15765-4 can (11 bit id, 250 kbaud) iso 15765-4 can (29 bit id, 250 kbaud) a b c sae j1939 can (29 bit id, 250* kbaud) user1 can (11* bit id, 125* kbaud) user2 can (11* bit id, 50* kbaud) *user adjustable obd message formats to this point we have only discussed the contents (data portion) of an obd message, and made only passing mention of other parts such as headers and checksums, which all messages use to some extent. on board diagnostics systems are designed to be very flexible, providing a means for several devices to communicate with one another. in order for messages to be sent between devices, it is necessary to add information describing the type of information being sent, the device that it is being sent to, and perhaps which device is doing the sending. additionally, the importance of the message becomes a concern as well ?crankshaft position information is certainly of considerably more importance to a running engine than a request for the number of trouble codes stored, 36 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com or the vehicle serial number. so to convey importance, messages are also assigned a priority. the information describing the priority, the intended recipient, and the transmitter are usually needed by the recipient even before they know the type of request that the message contains. to ensure that this information is obtained first, obd systems transmit it at the start (or head) of the message. since these bytes are at the head, they are usually referred to as header bytes. figure 3 below shows a typical obd message structure that is used by the sae j1850, iso 9141-2, and iso 14230-4 standards. it uses 3 header bytes as shown, to provide details concerning the priority, the receiver, and the transmitter. note that many texts refer to the receiver figure 3. an obd message up to 7 data bytes checksum 3 header bytes priority receiver transmitter ta sa based on any active inputs that are present. if you need to follow the sae j1978 order, you should send the elm327 an at ss command, or step through each protocol with the tp command. the automatic search works well with obdii systems, but may not be what you need if you are experimenting. during a search, the elm327 ignores any headers that you have previously defined (since there is always a chance that your headers may not result in a response), and it uses the default obd header values for each protocol. it will also use standard requests (ie 01 00) during the searches. if this is not what you want, the results may be a little frustrating. to use your own header (and data) values when attempting to connect to an ecu, do not tell the elm327 to use protocol 0. instead, tell it to either use selecting protocols (continued) only your target protocol (ie. at sp n), or else tell it to use yours with automatic searches allowed on failure (ie at sp an). then send your request, with headers assigned as required. the elm327 will then attempt to connect using your headers and your data, and only if that fails (and you have chosen the protocol with at sp an) will it search using the standard obd default values. in general, 99% of all users find that enabling the memory (setting pin 5 to 5v) and using the ?uto option when searching (you may need to send at sp 0) works very well. after the initial search, the protocol used by your vehicle becomes the new default, but it is still able to search for another, without your having to say at sp 0 again. 37 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com figure 4. a can obd message as the ?arget address?(ta), and the transmitter as the ?ource address?(sa). another concern when sending any message is that errors might occur in the transmission, and the received data may be falsely interpreted. to detect errors, the various protocols all provide some form of check on the received data. this may be as simple as a sum calculation (ie a ?unning total?of byte values) that is sent at the end of a message. if the receiver also calculates a sum as bytes are received, then the two values can be compared and if they do not agree, the receiver will know that an error has occurred. since simple sums might not detect multiple errors, a more reliable (and more complicated) sum called a cyclic redundancy check (or ?rc? is often used. all of the protocols specify how errors are to be detected, and the various ways of handling them if they occur. the obd data bytes are thus normally encapsulated within a message, with ?eader?bytes at the beginning, and a ?hecksum?at the end. the j1850, iso 9141-2, and iso 14230-4 protocols all use essentially the same structure, with three header bytes, a maximum of seven data bytes and one checksum byte. the iso 15765-4 (can) protocol uses a very similar structure (see figure 4, below), the main obd message formats (continued) difference really only relating to the structure of the header. can header bytes are not referred to as header bytes ?they are called ?d bits?instead. the initial can standard defined the id bits as being 11 in number, while the more recent can standard now allows for either 11 or 29 bit ids. the elm327 does not normally show any of these extra bytes unless you turn that feature on with the headers on command (at h1). issuing that allows you to see the header bytes and the checksum byte (for the j1850, iso 9141 and iso 14230 protocols). for the can protocols, you will see the id bits, and other items which are normally hidden such as the pci byte for iso 15765, or the data length codes (if they are enabled with pp 29, or at d1). note that the elm327 does not display the checksum information for can systems, or the ifr bytes for j1850 systems. it is not necessary to ever have to set these header byes, or to perform a checksum calculation, as the elm327 will always do this for you. the header bytes are adjustable however, should you wish to experiment with advanced messages such as those for physical addressing. the next section provides a discussion on how to do this id bits (11 or 29) 7 data bytes checksum pci data bytes (8 in total) ?eader?bytes setting the headers the emissions related diagnostic trouble codes that most people are familiar with are described in the sae j1979 standard (iso15031-5). they represent only a portion of the data that a vehicle may have available ?much more can be obtained if you are able to direct the requests elsewhere. accessing most obdii diagnostics information requires that requests be made to what is known as a a ?unctional address.?any processor that supports the function will respond to the request (and theoretically, many different processors can respond to a single functional request). in addition, every processor (or ecu) will also respond to what is known as their physical address. it is the physical address that uniquely identifies each module in a vehicle, and permits you to direct more specific queries to only one particular module. to retrieve information beyond that of the obdii requirements then, it will be necessary to direct your requests to either a different functional address, or to an ecu? physical address. this is done by changing the data bytes in the message header. as an example of functional addressing, let us assume that you want to request that the processor responsible for engine coolant provide the current fluid temperature. you do not know its address, so you consult the sae j2178 standard and determine that engine coolant is functional address 48. sae standard j2178 also tells you that for your j1850 vpw vehicle, a priority byte of a8 is appropriate. finally, knowing that a scan tool is normally address f1, you have enough information to specify the three header bytes (a8 48 and f1). to tell the elm327 to use these new header bytes, all you need is the set header command: >at sh a8 48 f1 ok the three header bytes assigned in this manner will stay in effect until changed by the next at sh command, a reset, or an at d. having set the header bytes, you now need only send the secondary id for fluid temperature (10) at the prompt. if the display of headers is turned off, the conversation could look like this: >10 10 2e the first byte in the response echoes the request, as usual, while the data that we requested is the 2e byte. you may find that some requests, being of a low priority, may not be answered immediately, possibly causing a ?o data?result. in these cases, you may want to adjust the timeout value, perhaps first trying the maximum (ie use at st ff). many vehicles will simply not support these extra addressing modes. the other, and more common method of obtaining information is by physical addressing, in which you direct your request to a specific device, not to a functional group. to do this, you again need to construct a set of header bytes that direct your query to the physical address of the processor, or ecu. if you do not know the address, recall that the sender of information is usually shown in the third byte of the header. by monitoring your system for a time with the headers turned on (at h1), you can quickly learn the main addresses of the senders. the sae document j2178 assigns address ranges to these devices if you are unsure of which might be most appropriate. when you know the address that you wish to ?peak to,?simply use it for the second byte in the header (assume an address of 10 for this example). combine that with your knowledge of sae j2178 to choose a priority/type byte (assume a value of e4 for this example, as if the vehicle is j1850 pwm). finally, you need to identify yourself to the target, so that responses can be returned to you. as is customary for diagnostic tools, we?l use an address of f1. as before, these three bytes are then assigned to the header with the set header command: >at sh e4 10 f1 ok from this point on, all messages that the elm327 sends will use these three bytes for the header. all that needs to be done now is to request data from the vehicle. for physical addressing, this is often done using mode 22: >22 11 6b 62 11 6b 00 00 the response to this command is of the same format to those seen for ?tandard?obd requests. the request has been repeated (with 40 added to the mode value in order to show that this is a response), and this is followed by the actual data (00 00 in this case). the pids used with mode 22 are usually proprietary to each manufacturer and are generally not published widely, so you may have difficulty in determining the ones to use with your vehicle. elm 38 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com setting the headers (continued) 39 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com electronics does not maintain lists of this information, and cannot provide any further details for you. mode 22 and others are described in more detail in the sae standards document j2190, ?nhanced e/e diagnostic test modes? the iso14230-4 standard defines its header bytes a little differently. advanced experimenters will be aware that for iso 14230-4, the first header byte must always include the length of the data field, which varies from message to message. from that, one might assume that the you would need to redefine the header for every message that is to be sent ?not so! the elm327 always determines the number of bytes that you are sending, and inserts that length for you, in the proper place for the header that you are using. if you are using the standard iso 14230-4 header, the length will be put into the first header byte, and you need only provide the two (most significant) bits of this byte when defining the header. what you place in the rest of the byte will be ignored by the elm327 unless you set it to 0. if it is 0, it is assumed that you are experimenting with kwp four byte headers, and the elm327 then creates the fourth header byte for you. again, you do not need to provide any length to be put into this byte ?it is done for you. addressing within the can (iso 15765-4) protocols is quite similar in many ways. first, consider the 29 bit standard. the elm327 splits the 29 bits into a can priority byte and the three header bytes that we are now familiar with. this is how they are combined for use by the elm327: >at sh xx yy zz >at cp vv vv xx yy zz 5 bits only xx yy zz vv 29 bit id the can standard states that for diagnostics, the priority byte (?v?in the diagram) will always be 18 (it is the default value used by the elm327). since it is rarely changed, it is assigned separately from the other header bytes, using the cp command. the next byte (?x? describes the type of message that this is, and is set to hex db for functional addressing, and to da if using physical addressing. the next two bytes are as defined previously for the other standards ??y?is the receiver (or target address), and ?z?is the transmitter (or source address). for the functional diagnostic requests, the receiver is always 33, and the transmitter is f1, which is very similar to iso 14230-4. those that are familiar with the sae j1939 standard will likely find this header structure to be very similar (j1939 is a can standard for use by ?eavy- duty vehicles?such as trucks and buses). it uses slightly different terminology, but there is a direct parallel between the bytes used by j1939 for the headers and the grouping of the bytes in the elm327. pages 50 and 51 provide more details of the j1939 message structure. another method to define all 29 can id bits at once is with the four byte version of the sh command. simply provide all 8 nibbles all at once: >at sh vv xx yy zz xx yy zz vv 29 bit id as with the at cp command, only 5 bits are used from the first byte (the 3 most significant bits are ignored). the final header format to discuss is that used by 11 bit can systems. they also use a priority and address structure, but shorten it into roughly three nibbles rather than three bytes. the elm327 uses the same commands to set these values as for other headers, except that it only uses the 11 least significant (?ight-most? bits of the provided header bytes, and ignores the others, as shown here: xx yy zz 11 bit id >at sh xx yy zz it quickly becomes inconvenient to have to enter elm327 40 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com setting the headers (continued) six digits when only three are required, so there is a special ?hort?version of the at sh command that uses only three hex digits. it actually operates by simply adding the leading zeros for you. the 11 bit can standard typically makes functional requests (id/header = 7df), but receives physical replies (7en). with headers turned on, it is a simple matter to learn the address of the module that is replying, then use that information to make physical requests if desired. for example, if the headers are on, and you send 01 00, you might see: >01 00 7e8 06 41 00 be 3f b8 13 00 the 7e8 shows that ecu#1 was the one responding. in order to talk directly to that ecu, all you need do is to set the header to the appropriate value (it is 7e0 to talk to the 7e8 device ?see iso 15765-4 for more information). from that point on, you can ?alk directly to the ecu using its physical address, as shown here: >at sh 7e0 ok >01 00 7e8 06 41 00 be 3f b8 13 00 >01 05 7e8 03 41 05 46 00 00 00 00 hopefully this has helped to get you started. as we often tell those that write for help ?if you are planning to do some serious experimenting with obd, you should buy the relevant standards. monitoring the bus some vehicles use the obd bus for information transfer during normal vehicle operation, passing a great deal of information over it. a lot can be learned if you have the good fortune to connect to one of these vehicles, and are able to decipher the contents of the messages. to see how your vehicle uses the obd bus, you can enter the elm327? ?onitor all?mode, by sending the command at ma from your terminal program. this will cause the ic to display any information that it sees on the obd bus, regardless of transmitter or receiver addresses (it will show all). note that the elm327 remains silent while monitoring, so periodic ?akeup messages are not sent (if you have an iso 9141 or iso 14230 bus that had been initialized previously, it may ?o to sleep?, ifrs are not sent, and the can module does not acknowledge messages. the monitoring mode can be stopped by putting a logic low level on the rts pin, or by sending a single rs232 character to the elm327. any convenient character can be used to interrupt the ic ?there are no restrictions on whether it is printable, etc. note that any character that you send will be discarded, and will have no effect on any subsequent commands. the time it takes to respond to such an interrupt will depend on what the elm327 is doing when the character is received. the ic will always finish a task that is in progress (printing a line, for example) before printing ?topped?and returning to wait for your input, so it is best to wait for the prompt character (?? to be sent, or the busy line to go low, before beginning to send a new command. one unexpected result may occur if you have the automatic protocol search feature enabled, and you tell the elm327 to begin monitoring. if the bus is quiet, the elm327 will begin searching for an active protocol, which may not be what you were expecting. be aware also that the iso 9141 and iso 14230 protocols look identical when monitoring, so the elm327 may stop searching at iso 9141, even if the actual protocol is iso 14230. with the automatic searching enabled, this should correct itself, however, when an obd request is later made. if the ?onitor all?command provides too much information (it certainly does for most can systems), then you can restrict the range of data that is to be displayed. perhaps you only want to see messages that are being transmitted by the ecu with address 10. to do that, you only need to type: >at mt 10 and all messages that contain 10 in the third byte of the header will be displayed. using this command with 11 bit can systems can be a little confusing at first. recall the way in which all header bytes are stored within the elm327. an 11 bit can id is actually stored as the least significant 11 bits in the 3 byte ?eader storage?location. it will be stored with 3 bits in the receiver? address location, and the remaining 8 bits in the transmitter? address location. for this example, we have requested that all messages created by transmitter ?0?be printed, so all 11 bit can ids that end in 10 will be displayed (ie all that look like ?10?. the other monitoring command that is very useful is the at mr command, which looks for specific addresses in the middle byte of the header. using this command, you can look for all messages being sent to a particular address. for example, to use it to look for messages being sent to the ecu with address 10, simply send: >at mr 10 and all messages that contain 10 in the second byte of the header will be displayed. using this command with the 11 bit can systems will again need further explanation. it may be helpful to first picture the hex number ?0?in the above example as the binary number ?001 0000? recall from above that 11 bit can ids are actually stored as the least significant 11 bits in the 3 byte ?eader storage locations, and only 3 bits are actually stored in the middle byte (receiver? address) position. when comparing the received can id to the address you provide with the mr command then, only the right- most 3 bits of your mr address are considered and the other 5 bits are ignored. in this example, the at mr 10 effectively becomes at mr 0 for 11 bit can systems, and so all messages that begin with ? as the first digit will be displayed. it is best not to use the at mt or mr commands when monitoring can systems. the elm327 provides another command (at cra) that allows much better control over the received data - see the next section for complete details. 41 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com can receive filtering - the cra command when receiving can data, the elm327 actually retrieves every message from the can bus, and then decides whether or not to display it, based on criteria that you or the firmware set. the ?an receive address?or cra command may be used to define this criteria for you, in one simple step. as an example, assume that the only messages that you wish to see are those that have the can id 7e9. to see only them, tell the elm327 that the receive address should be 7e9: >at cra 7e9 and the elm327 will set the necessary values so that the only messages that are accepted are the ones with id 7e9. if you do not want an exact address, but would prefer to see a range of values, for example all the obd addresses (those that begin with 7e), then simply use an ??for the digit that you do not want the elm327 to be specific about. that is, to see all messages with can ids that start with 7e (7e0, 7e1, 7e2,..., 7ee, and 7ef), send: >at cra 7ex and the elm327 will set the necessary values for you. this command works exactly the same way for the 29 bit ids. for example, if you wish to see all messages that are being sent from the engine ecu (address 10) to the scan tool (address f1), then you can send: >at cra xx xx f1 10 and all the settings will be taken care of for you. if you wish to be more specific and see only the obd replies sent by the engine to the scan tool, you would say: >at cra 18 da f1 10 and again, the elm327 makes the necessary changes for you. perhaps you do not care which device is sending the information, but you want to see all messages that start with 18 da and are being sent to the scan tool. for this, use the character ??to tell the elm327 that you do not care what value a digit has: >at cra 18 da f1 xx 42 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com and the elm327 takes care of the details for you. when working with j1939 data, the elm327 normally formats the data for you, in order to separate the priority from the pgn information. this is usually not a concern when using the cra command, except when you are trying to filter for a specific priority. for example, you might typically see: >at ma 3 0fe6c 00 ff ff ff ff ff ff 40 b5 6 0feee 00 15 50 ff ff ff ff ff ff 6 0fef5 00 fe ff ff ff 19 00 23... the single priority digit out front (the 3 or 6 above) as well as the leading 0 with the pgn information are actually part of the first two digits (5 bits) of the id, and need to be interpreted as such, in order to use the cra command. it may be easier if you turn off the j1939 header formatting in order to see this: >at jhf0 ok >at ma 0c fe 6c 00 ff ff ff ff ff ff 40 b5 18 fe ee 00 15 50 ff ff ff ff ff ff 18 fe f5 00 fe ff ff ff 19 00 23... this more clearly shows the four bytes that need to be defined for the cra command to be set. to search for all messages that begin with 6 0fef5, you would actually need to send the command: >at cra 18 fe f5 xx in summary then, the cra command allows you to tell the elm327 what id codes to look for, and the letter ??may be used in it to represent any single digit that you do not want the elm327 to be specific about. this is usually selective enough for most applications, but occasionally, there is a need to be specific down to the bit level, rather than to the nibble. for those applications, you will need to program a separate mask and filter, as we show in the next section. 43 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com using the can mask and filter filtering of can messages (that is, deciding which to keep and which to reject), is usually handled most easily with the cra command. the cra command only allows for definition to the nibble level, however - if you need more selectivity (to the bit level), you must program the mask and filter. internally, the elm327 configures an ?cceptance filter?with 1? and 0? based on the type of message that it wishes to receive (obd, j1939, etc.). this pattern is then compared to the id bits of all incoming messages. if the two patterns match, then the entire message is accepted, and if they do not, the message is rejected. having to match all 11 or 29 bits of the id may be very restrictive in some cases (and would require a very large number of filters for some applications). to allow a little more flexibility in what to accept, and what to reject, a mask is also defined, in addition to the filter. this mask acts just like the type worn on your face - some features are exposed and some are hidden. if the mask has a ??in a bit position, that bit in the filter must match with the bit in the id, or the message will be rejected. if the mask bit is a ?? then the elm327 does not care if that filter bit matches with the message id bit or not. as an example, consider the standard response to an 11 bit obd request. iso15765-4 states that all responses will use ids in the range from 7e8 to 7ef. that is: 1. there must always be a ? ?(binary 111) as the first nibble (so the filter should have the value 111 or 7). all 3 bits are relevant (so the mask should be binary 111 or 7). note that this first nibble is only 3 bits wide for the 11 bit can id. 2. there must always be an ?? (binary 1110) in the second position, so the filter needs to be of value 1110 or e. since all 4 bits are relevant, the mask needs to be of value 1111 or f. 3. if you analyze the patterns for the binary numbers from 8 to f, you will see that the only thing in common is that the most significant bit is always set. that is, the mask will have a value of 1000 since only that one bit is relevant, and you do not care what the other bits are. the filter needs to be assigned a value that has a 1 in the first position, but we do not care what is in the other three positions. in the following, we use 0? in the positions (but it doesn? really matter). putting this together, the filter will have a value: 111 1110 1000 = 7e8 and the mask will have a value: 111 1111 1000 = 7f8 in order to make these active, you will need to issue both a can filter and a can mask command: >at cf 7e8 ok >at cm 7f8 ok from that point on, only the ids from 7e8 to 7ef will be accepted by the chip. the 29 bit ids work in exactly the same way. for example, assume that you wish to receive only messages of the form: 18 da f1 xx where xx is the address of the ecu that is sending the message, but you do not care what the value is (this is the standard obd response format). putting 0? in the mask for don? care bits, then the mask needs to be set as follows: >at cm 1f ff ff 00 ok (as every bit except those in the last byte are relevant) while the filter may be set to: >at cf 18 da f1 00 ok note that if a filter has been set, it will be used for all can messages, so setting filters and masks may cause standard obd requests to be ignored, and you may begin seeing ?o data?replies. if this happens, and you are unsure of why, you may want to reset everything to the default values (with at cra, at d, or possibly at ws) and start over. quite likely, you will never have to use the cm and cf commands. if you do, then creating your own masks and filters can be difficult. you may find it helpful to draw the bit patterns first, and think about which ones matter, and which ones do not. it may also help to connect to a vehicle, apply test settings, and send at ma to see how the settings affect the displayed data. multiline responses there are occasions when a vehicle must respond with more information than one ?essage?is able to show. in these cases, it responds with several lines which the receiver must assemble into one complete message. one example of this is a request for the 17 digit vehicle identification number, or vin. this is available from newer vehicles using a mode 09, pid 02 request (but was not initially a requirement, so many older vehicles do not support it). here is one example of a response that might be obtained from a j1850 vehicle: >0902 49 02 01 00 00 00 31 49 02 02 44 34 47 50 49 02 03 30 30 52 35 49 02 04 35 42 31 32 49 02 05 33 34 35 36 the first two bytes (49 and 02) on each line of the response are used to show that the information is in reply to an 09 02 request. the next byte shows which response it is, while the remaining four bytes are the data bytes that are being sent. assembling the data in the order specified by the third byte, and ignoring the first few 00? (they are filler bytes - see j1979) gives: 31 44 34 47 50 30 30 52 35 35 42 31 32 33 34 35 36 the data values actually represent the ascii codes for the digits of the vin. using an ascii table to convert these into characters gives the following vin for the vehicle: 1 d 4 g p 0 0 r 5 5 b 1 2 3 4 5 6 can systems will display this information in a somewhat different fashion. here is a typical response from a can vehicle: >0902 014 0: 49 02 01 31 44 34 1: 47 50 30 30 52 35 35 2: 42 31 32 33 34 35 36 the can formatting has been left on (the default), making the reading of the data easier. with formatting on, the sequence numbers are shown with a colon (?? after each. can systems add this single hex digit (it goes from 0 to f then repeats), to aid in reassembling elm327 44 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com the data, instead of the byte value that the j1850 vehicle did. the first line of this response says that there are 014 bytes of information in total. that is 14 in hex, or 20 in decimal terms, which agrees with the 6 + 7 + 7 bytes shown on the three lines. the vin numbers are generally 17 digits long, however, so how do we assemble the number from 20 digits? this is done by discarding the first three bytes of the message. the first two are the familiar 49 02, as this is a response to an 09 02 request, so are not part of the vin. the third byte (the ?1?, tells the number of data items that are to follow (the vehicle can only have one vin, and this agrees with that). ignoring the third byte leaves 17 data bytes which are the serial number (purposely chosen to be identical to the those of the previous example). all that is needed is a conversion to ascii, in order to read them, exactly as before. from these two examples, you can see that the format of the data received may depend on the protocol used to transmit it. for this reason, a copy of the sae j1979 standard would be essential if you are planning to do a lot of work with this, for example if you were writing software to display the received data. the following shows an example of a different type of multiline response that can occur when two or more ecus respond to one request. here is a typical response to an 01 00 request: >01 00 41 00 be 3e b8 11 41 00 80 10 80 00 this is difficult to decipher without knowing a little more information. first, turn the headers on to actually see ?ho?is doing the talking: >at h1 ok >01 00 48 6b 10 41 00 be 3e b8 11 fa 48 6b 18 41 00 80 10 80 00 c0 now, if you analyze the header, you can see that the third byte shows ecu 10 (the engine controller) and ecu 18 (the transmission) are both responding with a reply to the 01 00 request. with modern vehicles, this type of response occurs often, and you should be prepared for it. a final example shows how similar messages multiline responses (continued) might occasionally be ?ixed up?in a can system. we ask the vehicle for the calibration id (09 04) and are presented with the following response: >09 04 013 0: 49 04 01 35 36 30 1: 32 38 39 34 39 41 43 013 0: 49 04 01 35 36 30 2: 00 00 00 00 00 00 31 1: 32 38 39 35 34 41 43 2: 00 00 00 00 00 00 00 which is quite confusing. the first group (the 013, 0:, 1: group) seems to make some sense (but the number of data bytes do not agree with the response), and the following group is very confusing, as it has two segment twos. it seems that two ecus are responding and the information is getting mixed up. which ecu do the responses belong to? the only way to know is to turn on the headers, and repeat your request: >at h1 ok >09 04 7e8 10 13 49 04 01 35 36 30 7e8 21 32 38 39 34 39 41 43 7e9 10 13 49 04 01 35 36 30 7e8 22 00 00 00 00 00 00 31 7e9 21 32 38 39 35 34 41 43 7e9 22 00 00 00 00 00 00 00 this time, the order appears to be the same, but be aware that it may not be ?that is why the standard requires that sequence codes be transmitted with multiline responses. looking at the first digits of these responses, you can see that some begin with 7e8, and some begin with 7e9, which are the can ids representing ecu#1 and ecu#2, respectively. grouping the responses by ecu gives: 7e8 10 13 49 04 01 35 36 30 7e8 21 32 38 39 34 39 41 43 7e8 22 00 00 00 00 00 00 31 and 7e9 10 13 49 04 01 35 36 30 7e9 21 32 38 39 35 34 41 43 7e9 22 00 00 00 00 00 00 00 from these, the messages can be assembled in their proper order. to do this, look at the byte following the can id - it is what is known as the pci byte, and is used to tell what type of data follows. in this case, the pci byte begins with either a 1 (for a ?irst frame message), or a 2 (for the ?onsecutive frames?. the second half of the pci byte shows the order in which the information is to be assembled (ie. the segment number). in this case, the segment numbers are already in order, but if they had not been, it would have been necessary to rearrange the messages to place them in order. each obd standard has some minor peculiarities, but hopefully this has helped you with some of the more common ones. if you are still having trouble, we urge you to purchase the relevant standard, and study it. elm327 45 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com can message formats the iso 15765-4 (can) standard defines several message types that are to be used with diagnostic systems. currently, there are four that may be used: sf - the single frame ff - the first frame (of a multiframe message) cf - the consecutive frame ( ? ? ) fc - the flow control frame the single frame message contains storage for up to seven data bytes in addition to what is known as a pci (protocol control information) byte. the pci byte is always the first of the data bytes, and tells how many data bytes are to follow. if the can auto formatting option is on (caf1) then the elm327 will create this byte for you when sending, and remove it for you when receiving. (if the headers are enabled, you will see it in the responses.) if you turn the auto formatting off (with caf0), it is expected that you will provide all of the data bytes to be sent. for diagnostics systems, this means the pci byte and the data bytes. the elm327 will not modify your data in any way, except to add extra padding bytes for you, to ensure that you always send as many data data bytes as are required (eight for iso15765). you do not need to set the allow long (at al) option in order to send eight bytes, as the ic overrides it for you. a first frame message is used to say that a multi- frame message is about to be sent, and tells the receiver just how many data bytes to expect. the length descriptor is limited to 12 bits, so a maximum of 4095 byes can be received at once using this method. consecutive frame messages are sent after the first frame message to provide the remainder of the data. each consecutive frame message includes a single hex digit ?equence number?that is used to determine the order when reassembling the data. it is expected that if a message were corrupted and resent, it could be out of order by a few packets, but not by more than 16, so the single digit is normally more than adequate. as seen previously, the serial number for a vehicle is often a multiframe response: >0902 014 0: 49 02 01 31 44 34 1: 47 50 30 30 52 35 35 2: 42 31 32 33 34 35 36 in this example, the line that begins with 0: is the 46 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com first frame message. the length (014) was actually extracted from that message by the elm327 and printed on the first line as shown. following the first frame line are two consecutive frames (that begin with 1: and 2:). to learn more details of the exact formatting, you may want to send a request such as the one above, then repeat the same request with the headers enabled (at h1). this will show the pci bytes that are actually used to send these components of the total message. the flow control frame is one that you do not normally have to deal with. when a first frame message is sent as part of a reply, the elm327 must tell the sender some technical things (such as how long to delay between consecutive frames, etc.) and does so by replying immediately with a flow control message. these are predefined by the iso 15765-4 standard, so can be automatically inserted for you. if you wish to generate custom flow control messages, then refer to the ?ltering flow control messages section, on page 48. if a flow control frame is detected while monitoring, the line will be displayed with ?c: ?before the data, to help you with decoding of the information. there is a final type of message that is occasionally reported, but is not supported by the diagnostics standard. the (bosch) can standard allows for the transmission of a data request without sending any data in the requesting message. to ensure that the message is seen as such, the sender also sets a special flag in the message (the rtr bit), which is seen at each receiver. the elm327 always looks for this flag, or for zero data bytes, and may report to you that an rtr was detected while monitoring. this is shown by the characters rtr where data would normally appear, but only if the can auto formatting is off, or headers are enabled. often, when monitoring a can system with an incorrect baud rate chosen, rtrs may be seen. note that the can system is quite robust with several error detecting methods in place, so that during normal data transmission you will rarely see any errors. when monitoring buses however, you may well see errors (especially if the elm327 is set to an incorrect baud rate). as a diagnostic aid, when errors do occur, the elm327 will print all bytes (no matter what caf, etc., is set to), followed by the message ?rx error? elm327 elm327 47 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com restoring order there may be times when it seems the elm327 is out of control, and you will need to know how to restore order. before we continue to discuss modifying too many parameters, this seems to be a good point to discuss how to ?et back to the start? perhaps you have told the elm327 to monitor all data, and there are screens and screens of data flying by. perhaps the ic is now responding with ?o data?when it did work previously. this is when a few tips may help. the elm327 can always be interrupted from a task by a single keystroke from the keyboard. as part of its normal operation, checks are made for received characters and if found, the ic will stop what it is doing at the next opportunity. often this means that it will continue to send the information on the current line, then stop, print a prompt character, and wait for your input. the stopping may not always seem immediate if the rs232 send buffer is almost full, though ?you will not actually see the prompt character until the buffer has emptied, and your terminal program has finished printing what it has received. there are times when the problems seem more serious and you don? remember just what you did to make them so bad. perhaps you have ?djusted?some of the timers, then experimented with the can filter, or perhaps tried to see what happens if the header bytes are changed. all of these can be reset by sending the ?et to defaults?at command: >at d ok this will often be sufficient to restore order, but it can occasionally bring unexpected results. one such surprise will occur if you are connected to a vehicle using one protocol, but the saved (default) protocol is a different one. in this case, the elm327 will close the current session and then change the protocol to the default one, exactly as instructed. if the at d does not bring the expected results, it may be necessary to do something more drastic - like resetting the entire ic. there are a few ways that this can be performed with the elm327. one way is to simply remove the power and then reapply it. another way that acts exactly the same way as a power off and then on is to send the full reset command: >at z it takes approximately one second for the ic to perform this reset, initialize everything and then test the four status leds in sequence. a much quicker option is available with the elm327, however, if the led test is not required ?the ?arm start?command: >at ws the at ws command performs a software reset, restoring exactly the same items as the at z does, but it omits the led test, making it considerably faster. also, it does not affect any baud rates that have been set with the at brd command (which at z does), so is essential if you are modifying the rs232 baud rates with software. any of the above methods should be effective in restoring order while experimenting. there is always the chance that you may have changed a programmable parameter, however, and are still having problems with your system. in this case, you may want to simply turn off all of the programmable parameters (which forces them to their default values). to do so, send the command: >at pp ff off which should disable all of the changes that you have made. since some of the programmable parameters are only read during a system reset, you may have to follow this command with a system reset: >at z after which, you can start over with what is essentially a device with ?actory settings? there may be times when even this command is not recognized, however. if that is the case, you will need to use the hardware method of turning the pps off. see the section on ?rogrammable parameters?(pages 57 and 58) for more details. elm327 altering flow control messages 48 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com iso 15765-4 (can) provides for only eight data bytes per frame of data. of course, there are many cases where the data which needs to be sent is longer than 8 bytes, and can has made provision for this by allowing data to be separated into segments, then recombined at the receiver. to send one of these multi-line messages, the transmitter in a can system will send a ?irst frame message, and then wait for a reply from the receiver. this reply, called a ?low control?message contains information concerning acceptable message timing, etc., and is required to be sent before the transmitter will send any more data. for iso 15765-4, the type of response is well defined, and never changes. the elm327 will automatically send this iso 15765-4 flow control response for you as long as the can flow control option is enabled (cfc1), which it is by default. in order to provide complete control over the sending of flow control messages and their content, the elm327 defines several at fc commands. the way in which the elm327 responds to a first frame message is determined by the flow control ?ode? set by the at fc sm command. there are three modes, as shown in the chart at the right. the default flow control mode is number ?? meaning that the elm327 will do everything for you. flow control mode 1 is provided for those users that want complete control over their flow control messages. to use it, simply define the can id (header) and data bytes that you require to be sent in response to a first frame message. note that if you try to set the mode before defining these values, you will get an error: >at fc sm 1 ? you must set the headers and data first: >at fc sh 7e8 ok >at fc sd 00 11 22 ok and then you can set the mode: >at fc sm 1 ok from this point on, every first frame message received will be responded to with the custom message that you have defined (7e8 00 11 22 in this example). the third mode currently supported allows the user to set the data bytes which are to be sent, but not the id bits. the id bits (header bytes) in mode 2 are set to those which were received in the first frame message, without change. to use this mode, first define your data bytes, then activate the mode: >at fc sd 00 11 22 ok >at fc sm 2 ok at any time while you are experimenting, if you should wish to restore the automatic flow control responses (for iso 15765-4), simply set the mode to 0: >at fc sm 0 ok this will immediately restore the responses to their default settings. for most people, there will be little need to manipulate these ?low control?messages, as the defaults are designed to work with the can obd standards. if you wish to experiment, these special at commands offer that control for you. the following chart summarizes the currently supported flow control modes: elm327 provides fc mode 0 1 2 id bits & data bytes user provides id bits data bytes no values no values id bits & data bytes flow control modes elm327 49 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com using can extended addresses some vehicles with can interfaces use a data format that is slightly different from what we have described so far. the data packets look very similar, except that the first byte is used for the receiver? (ie target?) address. the remaining seven bytes are used as described previously. we refer to this type of addressing as ?an extended addressing? and provide support for it with the at cea commands. perhaps an example would better describe how to use them. here is a portion of a data transfer that was taken from a vehicle. for the moment, ignore the first data bytes on each line and only look at the remaining data bytes (that are outlined in grey): 7b0 04 02 10 81 00 00 00 00 7c0 f1 02 50 81 00 00 00 00 7b0 04 02 21 a2 00 00 00 00 7c0 f1 10 16 61 a2 01 02 05 7b0 04 30 ff 00 00 00 00 00 7c0 f1 20 df 01 00 04 09 01 7c0 f1 21 02 05 df 01 00 04 7c0 f1 22 09 01 00 04 01 00 if you are familiar with the iso 15765 data format, you will be able to recognize that the data bytes shown inside the box seem to conform to the standard. the rows that begin with 02 are single frames, the one that starts with 10 is a first frame, while the one with 30 is a flow control, and the others are consecutive frames. the remaining bytes, shown outside the box, are the standard 11 bit can id, and an extra address byte. the lines with f1 for the extra address are directed to the scan tool (all scan tools generally use f1 as the default address), and the other lines are being sent to the vehicle? module (at address 04). version 1.4 of the elm327 is able to handle these types of messages, but does require some setup. for example, if the messages use 11 bit ids with iso 15765 formatting, and the baud rate is 50 kbps, then the pb command to configure protocol b is: >at pb 81 0a ok next, we?l want to receive all messages with an id of 7c0, and send with an id (header) of 7b0: >at cra 7c0 ok >at sh 7b0 ok notice that there was a flow control message that was sent in this group, but it? not quite the same as the one for obd systems. for this reason, you?l need to define your own flow control with the following three statements (we won? show the ok? any more, to save space): >at fc sh 7b0 >at fc sd 04 30 ff 00 >at fc sm1 the final setup statement that you will need is to tell the elm327 to send to can extended address 04: >at cea 04 now everything is configured. next, tell the ic to use this protocol, and to bypass any initiation (as it is not standard obd, and would likely fail): >at sp b >at bi that? all. to exactly reproduce the flow of data shown, you only need to send the relevant data bytes and the elm327 will add the rest: >10 81 50 81 >21 a2 016 0: 61 a2 01 02 05 0: df 01 00 04 09 01 1: 02 05 df 01 00 04 2: 09 01 00 04 01 00 notice that for some reason, this vehicle has sent two segment 0?, but that just means that it doesn? exactly follow the iso 15765 protocol. the above shows what the responses would look like with formatting on, and headers off. if you change either, the data exchange would look more like what we initially showed. elm327 50 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com sae j1939 messages the sae j1939 can standard is being used by many types of heavy machinery ?trucks, buses, and agricultural equipment, to name a few. it uses the familiar can (iso 11898) physical interface, and defines its own format for data transfer (which is very similar to the iso 15765 standard that is used for automobiles). the following will discuss a little of how data is transferred using the j1939 standard. considerably more information is provided in the society of automotive engineers (sae) standards documents, so if you are going to be doing a lot of work with j1939, it may be wise to purchase copies of them. at minimum, the j1939-73 diagnostics, the j1939-21 data transfer, and the j1939-71 vehicle application documents should be purchased. another great reference for this work is the hs-j1939 two book set, also available from the sae. the current version of the j1939 standard allows only one data rate (250 kbps), but work is underway to amend the standard so that an alternate rate of 500 kbps will also be allowed. for the purpose of this discussion, the data rate is not important - it is the format of the information that we will discuss. all can messages are sent in ?rames? which are data structures that have id bits and data bytes, as well as checksums and other items. many of the j1939 frames are sent with eight data bytes, although there is no requirement to do so (unlike iso 15765, which must always send eight data bytes in each frame). if a j1939 message is eight bytes or less, it will be sent in one frame, while longer messages are sent using multiple frames, just like iso 15765. when sending multiple frames, a single data byte is used to assign a ?equence number? which helps in determining if a frame is missing, as well as in the reassembly of the received message. sequence numbers always start with 01, so there is a maximum of 255 frames in a message, or 1785 bytes. one major feature of the j1939 standard is its very orderly, well defined data structures. related data is defined and specified in what are called ?arameter groups? each parameter group is assigned a ?arameter group number? or pgn, that uniquely defines that packet of information. often, the parameter groups consist of eight bytes of data (which is convenient for can messages), but they are not restricted to this. many of the pgns, and the data within them (the spns) are defined in the j1939-71 document, and manufacturers also have the ability to define their own proprietary pgns. the id portion of a j1939 can frame is always 29 bits in length. it provides information as to the type of message that is being sent, the priority of the message, the device address that is sending it, and the intended recipient. information within the id bits is divided roughly into byte size pieces as follows: priority pdu format destination address source address 8 bits 8 bits 8 bits 2 bits 3 bits pdu1 format the data structure formed by the 29 bit id, and the associated data bytes is called a protocol data unit, or pdu. when the id bits have a destination address specified, as is shown above, it is said to be a pdu1 format message. the two bits shown between the priority and the pdu format are known as the extended data page (edp), and the data page (dp) bits. for j1939, edp must always be set to ?? while the dp bit is used to extend the range of values that the pdu format may have. while the dp bit is typically ??now, that may not be true in the future. not all j1939 information is sent to a specific address. in fact, one of the unique features of this standard is that there is a large amount of information that is being continually broadcast over the network, with receivers using it as they see fit. in this way, multiple devices requiring the same information do not have to make multiple requests to obtain it, information is provided at regular time intervals, and bus loading is reduced. if information is being broadcast over the network to no particular address, then the destination address field is not required. the eight bits can be put to better use, possibly by extending the pdu format field. this is what is done for a pdu2 format frame, as shown here: priority pdu format group extension source address 8 bits 8 bits 8 bits 2 bits 3 bits pdu2 format so how does one know if they are looking at a pdu1 format frame that contains an address, or a pdu2 format frame that does not? the secret lies in elm327 51 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com j1939 support (continued) the values assigned to the pdu format field. if the pdu format value begins with ??(when expressed as a hexadecimal number), it is pdu2. any other value for the first digit means that it is a pdu1 format frame, which contains an address. to summarize, pdu1 format frames are sent to a specific address, and pdu2 frames are sent to all addresses. to further complicate matters, however, pdu1 frames may be sent to all addresses. this is done by sending the message to a special ?lobal address?which has the value ff. that is, if you see a pdu1 message (where the first digit of the pdu format byte is not an f), and the destination address is ff, then that message is being sent to all devices. the j1939 recommended practices document provides a list of addresses that should be used by devices. it is particularly important to adhere to this list with the elm327, as the ic uses a fixed address method and is not able to negotiate a different one, per j1939-81. obd service tools should use either f9 or fa as their address (the elm327 uses f9). if you wish to change this, you can use the at ta (tester address) command, or simply define it with the header. you may use either the at sh or the at cp and at sh commands to assign values for the j1939 id bits, just the same as with the other can protocols. how these are used was discussed previously, but we will repeat it here. since the priority (and dp and edp) values only rarely change, they may be assigned with the cp command. by default, the elm327 uses a priority of 6 (binary 110), and sets the edp and dp bits both to 0. the default value for the cp setting is then 110+0+0 (which would be entered as 11000 or 18 in hex). the values for the other bytes of the j1939 id are entered with the at sh command, as shown in figure 5. this has tried to cover the basics of the j1939 message structure, but if you want more information, you should look at the standards mentioned previously. one other one that gives good examples of actual data is j1939-84 which describes the compliance tests and shows the expected responses. even at 250 kbps, j1939 data is transferred at a rate that is more than ten times faster than the previous heavy duty vehicle standard (sae j1708), and several of the light duty standards. as designers build more into each system, the amount of information required continues to grow, however, so the 500 kbps version of j1939 will be a welcome addition. sae j1939 messages (continued) figure 5. setting the j1939 can id >at sh xx yy zz >at cp vv 5 bits only priority pdu format destination address source address >at sh vv xx yy zz or: use either: and vv xx yy zz the values will be used as follows: 52 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com elm327 using j1939 this section provides a few examples which show how to monitor an sae j1939 data bus, and how to make requests of devices that are connected to it. to begin, you will need to configure the elm327 for j1939 operation, at the correct baud rate. protocol a is predefined for j1939 at 250 kbps, which is what most applications require. to use protocol a, send: >at sp a protocols b and c may also be used with j1939, if you wish to experiment with other baud rates. to use them for j1939, the option value (in pp 2c or 2e) must be set to 42, and the baud rate divisor (in pp 2d or 2f) must be set to the appropriate value. perhaps the simplest way to provide an alternate rate is to use the at pb command, that allows you to set both the options byte (which is always 42), and the baud rate divisor (which is 500k ?the desired baud rate) at the same time. for example, to set protocol b for j1939 operation at 500 kbps, simply send: >at pb 42 01 then send: >at sp b to begin. note that this setting will not be maintained if the ic is reset, so if you want a more permanent setting, you should store the values in pp 2c and 2d. j1939 often provides slowly broadcast information, and for this reason, the elm327 automatically sets a response timeout (at st time) as required by the message (typically 1.25 seconds, but it varies). if this is too long for you, or if you are using an older version of our product (ie. v1.3a or older), then you might want to set this time manually (we recommend starting with at st ff for the older ics). you will not do any harm if you set the timeout with a newer chip, but the timing will not be optimal as you will stop the elm327 from varying the setting based on the type of message being received. the elm327 also offers one other variation on the timer setting - the ability to extend the at st time by switching a x5 timer multiplier on (see the jtm5 command description). this may be useful or even necessary when requesting data that will have a multiline response, if similar data is already flowing. in these circumstances, there can only be one message like this at a time on the bus, so the response to your request might have to wait while an initial response completes (and this could take more than the normal st time, since broadcast responses must be spaced at least 50 msec apart). if you know that a reply should be coming, and you are seeing ?o data?responses, then send at jtm5 and try it again, as that may be the problem. restore the timer multiplier to normal with at jtm1. once the j1939 protocol is selected, and the timeout value has been adjusted, the elm327 is ready for a command. the first one that we will send is called a dm1 or ?iagnostic message 1? which provides the currently active diagnostic trouble codes. dm1 is one of more than 50 predefined diagnostic messages, and is special in that it is the only one that is broadcast continually over the bus at regular intervals. the elm327 has an at command that is used to obtain the dm1 trouble codes: >at dm1 if you are connected to a vehicle, you should now see messages printed at one second intervals. if you are only connected to a single device (for example, with a simulator on the bench, or to a device with a single can data port), you may see data with 53 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com elm327 to see the exact same response, you can also monitor for pgn 00feca (which is the code for dm1): >at mp 00feca note that the elm327 requires that you send hex digits for all data, as shown above (and as used by all other protocols). many of the pgn numbers are listed in the j1939 standard as both a decimal and a hex number, so choose the hex version. you will likely find in your testing that the pgns you encounter often begin with a 00 byte as above. to simplify matters for you, the elm327 has a special version of the mp command that will accept a four digit pgn, and assumes that the missing byte should be 00. an equivalent way to ask for 00feca is then: >at mp feca which is a little more convenient. one feature of the elm327 is the ability to tell the ic how many messages to retrieve when monitoring for pgns. for example, to see only two responses to the mp feca command, send: >at mp feca 2 this saves having to send a character to stop the flow of data, and also is very convenient when dealing with multiline messages. while the standard obd requests allow you to define how many frames (ie lines) of information are to be printed with a similar single digit, the single digit with the mp command actually defines how many complete messages to obtain. for example, if the dm1 message is 33 lines long, then sending at mp feca 1 will cause the elm327 to show all 33 lines, then stop monitoring and print a prompt character. by default, all j1939 messages have the ?eader information hidden from view. in order to see this information (actually the id bits), you will need to turn the header display on: >at h1 a single response to feca might then look like: >at mp feca 1 6 0feca 00 00 ff 00 00 00 00 ff ff notice that the elm327 separates the priority bits from the pgn information. the elm327 also uses only one digit to represent the two extra pgn bits, both of which may seem unusual if you are used to different software. we find this a convenient way to show the actual j1939 information in the header. if you prefer to see the id bits separated into bytes instead, simply turn off the j1939 header formatting with: >at jhf0 repeating the above request would then result in a response of this type: >at mp feca 1 18 fe ca 00 00 ff 00 00 00 00 ff ff the differences are clearly seen. if displaying the information in this manner, remember that the first ?yte?shown actually represents five bits, and of them, the leftmost three are the priority bits. the mp command is very useful for getting information in a j1939 system, but not all information is broadcast. some information must be obtained by making a query for it. just like the other obd requests where you specify the information that you need (with a mode and a pid), to make a query in a j1939 system, you provide the pgn number and the system responds with the required data. for example, to request the current value of the engine coolant temperature (which is part of pgn 00feee), you would send a request for pgn 00feee, and extract the data. to do this, send: >00feee to which you might receive: 6 0feee 00 8c ff ff ff ff ff ff ff if the headers were on. note that if you request a pgn that is already being broadcast, you may very well receive many replies, as the elm327 configures itself to receive anything that is related to the pgn requested. if you are familiar with the j1939 standard, you will be aware that it actually specifies a reverse order for the sending of the data bytes of a pgn request. that is, the data bytes for the above request are actually sent as ee fe 00, and not as 00 fe ee. since it can be very confusing to have to reverse some numbers and not others, the elm327 automatically handles this for you, reversing the bytes provided. in this way, you using j1939 (continued) can directly request pgns using numbers as they are written on the page (if they are written as hex digits), and the elm327 will make it work for you. if you do not want the elm327 to alter the byte order, the feature can be disabled (by sending an at js command). the elm327 always assumes that when you start making requests of this type, you do not know what devices are connected to the j1939 bus. that is, by default the elm327 sends all requests to the 'global address' (ie all devices), and then looks for replies. often, this works well, but j1939 devices are not required to respond to such general inquiries, and may not if they are busy. for this reason, it is usually better to direct your queries to a specific address, once it is known. in order to determine the address to send to, you may have to monitor the information on the bus for a while. make sure that the headers (id bits) are being displayed, and note what is shown in the source address position, which is immediately before the data bytes. in the previous example, this would be 00 (which j1939 defines as the address for engine #1). as an example, let us assume that it is engine #1 that you wish to direct your queries to. to do this, you will want to change the destination address from ff (the global address) to 00 (engine #1). by default, the elm327 uses 6 0eaff f9 for the id bits of all requests (or 18 ea ff f9 if you prefer). that is, it uses a priority of 6, to make a request (ea) to the global address (ff) by the device at f9 (the scan tool). since you only wish to alter the eaff f9 portion of the id bits and not the priority, you may do this with the set header command: >at sh ea 00 f9 the priority bits rarely need to be changed, but if you do need to change them, it is done with the can priority (at cp) command. after making the above change, all data requests will be directed to the engine, so don? forget to change the headers if you wish to again make global requests. note that the at sh command allows you to change the source (or tester) address at will, so be careful with this as addresses should really be negotiated using the method described in j1939-81 and you might conceivably choose an address that is already in use. the current version of the elm327 does not support j1939-81 address negotiation, so can not obtain an address for you. once the elm327 has been configured to send all messages to address 00, repeat the request: >00feee 6 0e8ff 00 01 ff ff ff ff ee fe 00 this response is of the ?cknowledgement?type (e8), which is being broadcast to all (ff) by the device with address 00. the last three data bytes show the pgn requested, in reverse byte order, so we know this is a response to our request. looking at the other data bytes, the first is not 00 (which we would expect for a positive acknowledgement), it is 01 which means negative acknowledgement. since all requests to a specific address must be responded to, the device at address 00 is responding by saying that it is not able to respond. that is, retrieve the information using the mp command. if the ecu had been able to reply to the request, the format of the response would have been slightly different. for example, if a request for engine run time (pgn 00fee5) had been made, the response might have been like this: >00fee5 6 0fee5 00 80 84 1e 00 ff ff ff ff notice that the pgn appears in the header for these types of replies, and the data bytes are those defined for the spns in the pgn. all responses to a request are printed by the elm327, whether they are a single can message, or a multisegment transmission as defined by the transport protocol (j1939-21). if the responses are multisegment, the elm327 handles all of the negotiation for you. as an example, a multisegment response to a dm2 request might look like this: >00fecb 012 7 0ebf9 00 01 04 ff 50 00 04 0b 54 7 0ebf9 00 02 00 00 01 5f 05 02 31 7 0ebf9 00 03 6d 05 03 03 ff ff ff if the headers are on, and would appear as: >00fecb 012 01: 04 ff 50 00 04 0b 54 02: 00 00 01 5f 05 02 31 03: 6d 05 03 03 ff ff ff using j1939 (continued) 54 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com elm327 55 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com elm327 if the headers are off. note that multiframe messages always send eight bytes of data, and fill in unused byte positions with ffs. with the headers off, the multiline response looks very similar to the multiline responses for iso15765-4. the first line shows the total number of bytes in the message, and the other lines show the segment number, then a colon, and the data bytes following. note that the byte count is a hexadecimal value (ie the ?12?shown means that there are 18 bytes of data). the one line that shows the total number of data bytes is actually called a ?onnection management?or ?p.cm?message. it has a specific format, but the only bytes that are typically relevant are those that provide the total message size in bytes. in order to see the other bytes, you must turn can auto formatting off (at caf0), and then repeat the request. note that this will only show the entire tp.cm message if you have a version 1.4b or newer elm327. this has been a brief description of how to use the elm327 in a typical j1939 environment. if you can monitor for information, make global requests as well as specific ones, and receive single or multiframe responses, then you have the tools necessary to at least diagnose most vehicle problems. using j1939 (continued) several european heavy duty truck and bus manufacturers have joined to form an organization for standardizing the way in which information is retrieved from these large vehicles. the result of their work is the fms (or fleet management systems) standard, and the bus-fms standard. the fms standard is based on a subset of the 250 kbps j1939 protocol, which uses only broadcast messages for the information. in order to not compromise the integrity of the vehicle? can bus, the standard also specifies a gateway device to provide separation between (potentially unskilled) users and the critical control information on the vehicle. the information contained in the fms messages is defined by pgns, using the same pgn numbers as for j1939. the difference is that they only define a small subset of those specified by j1939. to monitor the information provided by an fms gateway, simply use the at mp command with the the fms standard appropriate pgn number. we should caution that some information (vin, software version, etc.) is only transmitted every 10 seconds, so some patience is required when waiting for the data. the fms standard is completely open, and still evolving (the latest update was september 2010). for more information, visit the web sites: fms standard www.fms-standard.com bus fms standard bus-fms-standard.com 56 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com elm327 programming serial numbers saving a data byte a number of our customers have asked for ways to uniquely identify the circuit that uses our integrated circuit. while this often took the form of a ?erial number? people occasionally asked for a way to store dates, and possibly version codes. the @2 and @3 commands were created to assist with this. if you send the command at @2 to a new elm327 integrated circuit, you will receive an error. that is, you will see a response that looks like this: >at @2 ? in the above dialog, the elm327 is trying to tell you that either the chip is very old and does not support the command, or that nothing has been programmed into the @2 memory locations yet. to program characters into the @2 memory, you must provide exactly 12 characters using the @3 command. these characters must be in the ascii printable group - ie in the range from ??to ??(ie hex 21 to hex 5f). typically, the command would look like: >at @3 myboard_9906 ok this number can never be altered once it is entered, so you must be sure that you are entering the values properly. if developing code which does this, you may find that purchasing an elm328 ic will save some trial and error coding with elm327s. once the @3 code is set, it will always be available through the @2 command: >at @2 myboard_9906 that? all there is to using the elm327 device identifier. the elm327 provides one memory location that can be used to save any single byte of information. typically, users set flags depending on software choices, and store these flags in this one spot. storing data is easily done with the save data command - for example, to save the value 7f, simply send: >at sd 7f ok and data is just as easily retrieved using the read data command: >at rd 7f this single byte of data is stored in the internal eeprom array, and is subject to the usual limits of the eeprom technology - unlimited reads, but typically only about 1 million writes, with a retention rating of more than 40 years. this does not pose any limits to any users that we are aware of. programmable parameters the elm327 contains several memory locations that retain their data even after power is turned off. every time the ic is reset, these locations are read and used to change the default settings for such things as whether to display the headers, or how often to send ?akeup?messages. because they define the operation of the elm327, we refer to these memory locations as the programmable parameters. all of the programmable parameters are easily altered at any time using a few simple commands. these commands are standard at commands, with one exception: each one requires a two-step process to complete. this extra step provides some security against random inputs that might otherwise cause changes. as an example of how to change a programmable parameter, consider pp 01 (shown on page 58) which sets the default state for the at h command. if you are constantly powering your elm327 and then using at h1 to turn the headers on, you may want to change the default setting, so that the headers are always on by default. to do this, simply set the value of pp 01 to 00: >at pp 01 sv 00 ok this changes the value associated with pp 01, but does not yet enable it. to make the change effective, you must also type: >at pp 01 on ok at this point, you have changed the default setting for at h1/h0, but you have not changed the current at h1/h0 setting. from the ?ype?column in the table on page 58, you can see that pp 01 is a type ? parameter, so the change only becomes effective the next time that defaults are restored. this could be from a reset, a power off/on, or possibly an at d command. if you send the command at d, then you should find that the headers are now displayed by default. as there are many programmable parameters that you can alter, it might occasionally be difficult to know what changes you have made to them. to help with that, the elm327 provides a programmable parameter summary (pps) command. this command simply prints a list of the entire range of pps (whether currently supported or not), their current value, and whether they are on/enabled (n), or off/disabled (f). for a version 2.0 elm327, with only the headers enabled (as discussed above), the summary table would look like this: >at pps 00:ff f 01:00 n 02:ff f 03:32 f 04:01 f 05:ff f 06:f1 f 07:09 f 08:ff f 09:00 f 0a:0a f 0b:ff f 0c:68 f 0d:0d f 0e:9a f 0f:d5 f 10:0d f 11:00 f 12:ff f 13:32 f 14:50 f 15:0a f 16:ff f 17:6d f 18:00 f 19:62 f 1a:ff f 1b:ff f 1c:03 f 1d:0f f 1e:ff f 1f:ff f 20:ff f 21:ff f 22:ff f 23:ff f 24:00 f 25:00 f 26:00 f 27:ff f 28:ff f 29:ff f 2a:38 f 2b:02 f 2c:e0 f 2d:04 f 2e:80 f 2f:0a f you can see that pp 01 now shows a value of 00, and it is enabled (on), while the others are all off. another example shows how you might change the can filler byte. some systems use ?a?as the value to send for unused can data bytes, while the elm327 uses ?0?by default. to change the elm327 in order to have it send aas instead, simply change pp 26: >at pp 26 sv aa ok >at pp 26 on ok again, pp 26 is of type ?? so the above change will not actually take effect until the defaults are restored, whether it be by an at d command, or by resetting the elm327. the programmable parameters are a great way to customize your elm327 for your own use, but you should do so with caution if using commercial software. most software expects an elm327 to respond in certain ways to commands, and may be confused if the carriage return character has been redefined, or if the can response shows a data length code digit, for example. if you make changes, it might be best to make small changes and then see the effect of each, so that it is easier to retrace your steps and ?ndo?what you have done, should you have to. if you get in too deeply, don? forget the ?ll off?command: >at pp ff off no matter what software you use, you might get into more serious trouble, should you change the baud 57 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com elm327 programmable parameters (continued) 58 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com elm327 rate, or the carriage return character, for example, and forget what you have set them to. the carriage return value that is set by pp 0d is the only character that is recognized by the elm327 as ending a command, so if you change its value, you may not be able to undo your change. in this case, your only recourse may be to force all of the pps off with a special hardware trick. when the elm327 first powers up, it looks for a jumper between pin 28 (the obd tx led output) and circuit common (v ss). if a jumper is in place, it will turn off all of the pps for you, restoring the ic to the factory defaults. to use this feature, simply connect a jumper to circuit common (which appears in numerous places - pins 8 or 19 of the elm327, pin 5 of an rs232 connector, one end of most capacitors, or at the obd connector), then hold the other end of the jumper to pin 28 while turning the power on. when you see the rs232 rx led begin to flash quickly, remove the jumper ?the flashing led means that it worked and the pps are off. this feature should only be used when you get into serious trouble, and it? your only choice (since putting jumpers into a live circuit might cause damage if you put it into the wrong place). be careful if you need to use it. 01 printing of header bytes (at h default setting) d 02 allow long messages (at al default setting) d 03 no data timeout time (at st default setting) setting = value x 4.096 msec 00 to ff 32 (205 msec) d 00 perform an at ma command after powerup or reset ff (off) r 00 = on ff = off ff (off) ff (off) 00 = on ff = off 00 = on ff = off programmable parameter summary the following pages provide a list of the currently available programmable parameters. the character shown in the ?ype?column indicates when changes will take effect. possible values are: i - the effect is immediate, d - takes effect after defaults are restored (at d, at z, at ws, mclr or power off/on) r - takes effect after a reset (at z, at ws, mclr or power off/on) p - needs a power off/on type reset (at z, mclr, or power off/on) pp description values default type programmable parameter summary (continued) 59 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com elm327 p rs232 baud rate divisor when pin 6 is high (logic 1) the baud rate (in kbps) is given by 4000 ?(pp 0c value) for example, 500 kbps requires a setting of 08 (since 4000/8 = 500) here are some example baud rates, and the divisor to be used: 68 (38.4) 00 to ff 0c notes: 1. the pp 0c value must be provided as hex digits only. the decimal values (listed above in brackets) are only shown for your convenience. 2. the elm327 can only process continuous byte receives at rates of about 600 kbps maximum. if you need to connect at a higher rate, consider adding a delay between the bytes to maintain an average rate of 60k bytes per second or less. 3. a value of 00 is allowed for pp 0c, and it results in a baud rate of 9600 bps. 0d carriage return character used to detect and send line ends r 0d 06 obd source (tester) address. not used for j1939 protocols. f1 r 07 i last protocol to try during automatic searches 09 09 character echo (at e default setting) r 0a linefeed character 0a r 00 (on) 00 to ff 01 to 0c 00 to ff 00 to 02 01 d 04 default adaptive timing mode (at at setting) 00 = on ff = off 00 to ff baud rate (kbps) 19.2 38.4 57.6 115.2 230.4 pp 0c value d0 (208) 68 (104) 45 (69) 23 (35) 11 (17) 500 08 (8) hex (dec) pp description values default type 0e 9a (10011010) 00 to ff power control options each bit controls an option, as follows: b7: master enable 0: off 1: on if 0, pins 15 and 16 perform as described for v1.0 to v1.3a (must be 1 to allow any low power functions) b6: pin 16 full power level 0: low 1: high normal output level, is inverted when in low power mode b5: auto lp control 0: disabled 1: enabled allows low power mode if the rs232 activity stops b4: auto lp timeout 0: 5 mins 1: 20 mins no rs232 activity timeout setting b3: auto lp warning 0: disabled 1: enabled if enabled, says ?ct alert?1 minute before rs232 timeout b2: ignition control 0: disabled 1: enabled allows low power mode if the ignmon input goes low b1: ignition delay 0: 1 sec 1: 5 sec delay after ignmon (pin 15) returns to a high level, before normal operation resumes b0: reserved for future - leave set at 0 r programmable parameter summary (continued) 60 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com elm327 10 j1850 voltage settling time setting = value x 4.096 msec 0d (53 msec) 00 to ff 0f d5 (11010101) 00 to ff activity monitor options each bit controls an option, as follows: b7: master control 0: disabled 1: enabled must be 1 to allow b3 to b6 b6: allow wake from low power 0: no 1: yes wake requires shift from no activity to activity b5: auto lp control 0: disabled 1: enabled allows low power mode if the obd activity stops b4: auto lp timeout 0: 30 secs 1: 150 secs no obd activity timeout setting b3: auto lp warning 0: disabled 1: enabled if enabled, says ?ct alert?on timeout b2: reserved for future - leave set at 1 b1: allow exclamation mark 0: no 1: yes if 1, adds ??before act alert and lp alert b0: lp led 0: disabled 1: enabled if 1, the obd tx led will flash when in low power mode (16 msec flash every 4 seconds) d r pp description values default type programmable parameter summary (continued) 11 j1850 break signal monitor enable (reports bus error if break signal duration limits are exceeded) d 13 auto search time delay between protocols 1 & 2 setting = value x 4.096 msec 16 default iso/kwp baud rate (at ib default setting) 4800 baud can not be a default - set it with at ib 48 ff (10.4k) r iso/kwp wakeup message rate (at sw default setting) setting = value x 20.48 msec d 18 i 24 can auto formatting (at caf default setting) d 25 d can filler byte (used to pad out messages) 00 17 auto search time delay between protocols 4 & 5 setting = value x 4.096 msec 00 (no delay) can auto flow control (at cfc default setting) 92 (2.99 sec) i 32 (205 msec) 00 (on) 00 (on) 00 (on) pp description values default type 00 to ff 00 to ff 00 to ff 00 to ff 00 = on ff = off 00 = 96 ff = 10 00 = on ff = off 00 = on ff = off 61 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com elm327 26 d 15 iso/kwp maximum inter-byte time (p1), and minimum inter-message time (p2). setting = value x 2.112 msec d 0a (21 msec) 00 to ff 19 i delay after protocol 5 attempt during an automatic search, if protocols 3 & 4 have not been tried. setting = value x 20.48 msec 62 (2.0 sec) 00 to ff 12 j1850 volts (pin 3) output polarity normal = low output for 5v, high output for 8v invert = high output for 5v, low output for 8v r 00 = invert ff = normal ff (normal) 21 default can silent monitoring setting (for at csm) r ff (on) ff = on 00 = off protocol 5 fast initiation active time (tini l) setting = value x 2.5 msec d 1a 0a (25 msec) 00 to ff iso/kwp outputs used for initiation b7 to b2: not used - leave set at 0 b1: l line (pin 22) 0: disabled 1: enabled b0: k line (pin 21) 0: disabled 1: enabled (if disabled, an output remains low during initiation) d 1c 00 to ff iso/kwp p3 time (delay before sending requests) ave time = (value - 0.5) x 4.096 msec d 1d 0f (59 msec) 00 to ff iso/kwp final stop bit width (provides p4 interbyte time) setting = 98 + value x 64 ?ec d 14 50 (5.2 msec) 00 to ff protocol 5 fast initiation passive time (tini h) setting = value x 2.5 msec d 1b 0a (25 msec) 00 to ff 03 (00000011) 62 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com elm327 programmable parameter summary (continued) 29 printing of the can data length (dlc) when printing header bytes (at d0/d1 default setting) d ff (off) 2c 2d 2e 80 (10000000) 2f 0a (50 kbps) protocol b (user1) baud rate divisor. see pp 2b for a description. 00 to ff e0 (11100000) 04 (125 kbps) 01 to 40 00 to ff protocol c (user2) can options. see pp 2c for a description. protocol c (user2) baud rate divisor. see pp 2b for a description. 01 to 40 r protocol b (user1) can options. each bit of this byte controls an option, as follows: b7: transmit id length 0: 29 bit id 1: 11 bit id b6: data length 0: fixed 8 byte 1: variable dlc b5: receive id length 0: as set by b7 1: both 11 and 29 bit b4: baud rate multiplier 0: x1 1: x 8/7 (see note 3) b3: reserved for future - leave set at 0. b2, b1, and b0 determine the data formatting options: b2 b1 b0 data format 0 0 0 none 0 0 1 iso 15765-4 0 1 0 sae j1939 other combinations are reserved for future updates ?results will be unpredictable if you should select one of them. r r r 2b 02 (250 kbps) 01 to 40 protocol a (sae j1939) can baud rate divisor. the protocol a can baud rate is determined by this value rate (in kbps) = 500 ?value for example, setting this pp to 19 (ie. decimal 25) provides a baud rate of 500/25 = 20 kbps. r 00 = on ff = off 2a 38 (00111000) 00 to ff d can error checking (applies to protocols 6 to c) each bit of this byte controls an option, as follows: b7: iso15765 data length 0: accept any 1: must be 8 bytes b6: iso15765 pci = 00 0: allowed 1: not allowed b5: search after err94 0: normal 1: can is blocked b4: search after lv reset 0: normal 1: can is blocked b3: wiring test 0: bypass 1: perform b2 to b0: reserved for future - leave set to 0 notes: 1. the elm327 does not accept decimal digits for the programmable parameters - all values are hexadecimal. 2. for programmable parameters that describe options in terms of bits, b7 is the msb, and b0 is the lsb. 3. when b4 of pp 2c or pp 2e are set, the can baud rate will be increased by a factor of 8/7, but the baud rate displayed by the at dp command will still show the base rate (as set by pp 2d or pp 2f). for example, if you set pp 2c b4 to 1, and then pp 2d to 06, the base frequency will be 83.3 kbps. the at dp command will report 83 kbps, but the actual baud rate will be 83.3x8/7 = 95.2 kbps. pp description values default type 63 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com elm327 using higher rs232 baud rates the rs232 serial interface has been maintained throughout the elm obd products, largely due to its versatility. older computers, microprocessors and pdas can use it directly, as can usb, bluetooth, ethernet and wifi devices. it is simply one of the most versatile interfaces available. most people will construct their elm327 circuits with an rs232 interface, mainly because it is relatively easy and inexpensive to do. a circuit such as the one shown in figure 9 requires very few components and works extremely well at speeds of up to 57600 bps. depending on your interface? rs232 voltages, your wiring practices, and your choice of components, it may also work well at speeds as high as 115200 bps, but that is the approximate limit of such a circuit, and any design using this speed should be thoroughly tested. users that would like to operate at speeds in the range of 115200 bps or higher may wish to look at some of the single ic solutions that are available. these include devices such as the adm232a from analog devices (www.analog.com), or the popular max232 series of ics from maxim integrated products (www.maximintegrated.com). these are all excellent devices that can be used for speeds of up to 115.2 kbps. we do caution that many of these types of devices are only rated for operation up to 120 kbps, however, so may not be suitable for higher data rates - be sure to check the manufacturers data sheet before committing to a design. an rs232 interface needs relatively large voltage swings, which are difficult to maintain at higher rates with large cable capacitances to contend with. (a typical interface is often limited to about 230.4 kbps under ideal conditions.) if you need to operate the elm327 at these speeds or higher, it is recommended that you consider alternatives. one popular alternative is a usb data connection, which is capable of very high data transfer rates. several manufacturers offer special ?ridge?circuits that simplify connecting an rs232 device (such as the elm327) directly to the usb bus. examples are the cp2102 from silicon labs (www.silabs.com) or the ft232r from future technology devices (www.ftdichip.com). if planning to use the higher baud rates (ie up to 500 kbaud), these interfaces are essential. we are often asked if it is possible to use a direct connection to a microprocessor. that is certainly an option, and one that allows a full speed connection at essentially zero cost. if you are developing such an interface, refer to page 70 for more details. the default configuration for the elm327 provides an rs232 data rate of either 9600 baud, or 38400 baud, depending on the voltage level at pin 6 during power up or reset. while the 9600 baud rate is not adjustable, the 38400 one is (beginning with v1.2 of the ic). there are two ways that the rate can be changed ?either permanently with a programmable parameter, or temporarily with an at command. programmable parameter ?c?is the memory location that allows you to store a new baud rate which replaces the 38.4 kbps high speed rate. the value is stored in ?on-volatile?memory (eeprom) that is not affected by power cycles or resets (but changing this value may affect the operation of some software packages, so be careful how you use it). if you store a new value in pp 0c, then enable it, and if pin 6 is at a high level during the next powerup, then your stored rate will become the new data rate. (if it has not been enabled, the rate will revert to the factory default of 38.4 kbps.) as an example, perhaps you would like to have the elm327 use a baud rate of 57.6 kbps, rather than the factory setting of 38.4 kbps. to do this, determine the required value for pp 0c, store this value in pp 0c, and then enable the pp. the value stored in pp 0c is actually an internal divisor that is used to determine the baud rate (it will be 4000 kbps divided by the value of pp 0c). to obtain a setting of 57.6, a baud rate divisor of 69 is required (4000/69 is approximately 57.6). since 69 in decimal is 45 in hexadecimal, you need to tell the elm327 to set the value of pp 0c to 45, with this command: >at pp 0c sv 45 then enable the new value for use: >at pp 0c on from that point (until pp 0c is turned off), the default data rate will be 57.6k, and not 38.4k. note that the value that you write does not become effective until the next full reset (a power off/on, at z, or mclr pulse). if you are designing your own circuitry, you will know what your circuit is capable of, and can assign a value to pp 0c. software developers will not usually know what hardware is to be connected, however, so will not know what the limitations are. for these users, we have provided the brd command. elm327 64 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com using higher rs232 baud rates (continued) * the 75 msec time is adjustable with the at brt hh command the brd command allows a new baud rate divisor to be tested, and then accepted or rejected depending on the results of the test. see the chart at the right, which shows how the command works. as can be seen, the software first makes a request for a new baud rate divisor, using this at command. for example, to try the 57.6k rate that was previously discussed, the controlling pc would send: at brd 45 if the elm327 is an older version, it will not support this command, and will return with the familiar ??character. if it does support the command, it will respond with ?k? so the software knows whether to proceed or not. no prompt character follows the ?k reply; it is followed only by a carriage return character (and optionally, a linefeed character). having sent an ?k? the elm327 then switches to the new (proposed) baud rate, and then simply waits a predetermined time (nominally 75 msec). this period is to allow the pc sufficient time to change its baud rate. when the time is up, the elm327 then sends the id string (currently ?lm327 v2.0? to the pc at the new baud rate (followed by a carriage return) and waits for a response. knowing that it should receive the elm327 id string, the pc software compares what was actually received to what was expected. if they match, the pc responds with a carriage return character, but if there is a problem, the pc sends nothing. the elm327 is meanwhile waiting for a valid carriage return character to arrive. if it does (within 75 msec), the proposed baud rate is retained, and the elm327 says ?k?at this new rate. if it does not see the carriage return, the baud rate reverts back to the old rate. note that the pc might correctly output the carriage return at this new rate, but the interface circuitry could corrupt the character, and the elm327 might not see a valid response, so your software must check for an ?k response before assuming that the new rate has been accepted. using this method, a program can quickly try several baud rates, and determine the most suitable one for the connected hardware. the new baud rate will stay in effect until reset by an at z, a power off/on, or a mclr input. it is not affected by the at d (set defaults), or at ws (warm start) commands. request for a new baud rate divisor: at brd hh elm327 responds with ?k (if it is supported) elm327 sends the at i string program switches to the new baud rate, and waits for input elm327 waits up to 75 msec* for a carriage return if the rx is good, program sends a carriage return elm327 says ?k (and remains at the new baud setting) baud rate reverts to the previous baud rate pc elm327 cr received ? yes no print a prompt, and wait for the next command elm327 switches to new baud rate and waits for 75 msec* elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com setting timeouts - at st and at at commands users often ask about how to obtain faster obd scanning rates. there is no definite answer for all vehicles, but the following information may help with understanding how the settings might apply to your vehicle. a typical vehicle request and response is shown in the diagram below: elm327 vehicle request is sent response elm waits up to 200 msec elm waits 200 msec for more responses the elm327 sends a request then waits up to 200 msec for a reply. if none were to come, an internal timer would stop the waiting, and the elm327 would print ?o data? after each reply has been received, the elm327 must wait to see if any more replies are coming (and it uses the same internal timer to stop the waiting if no more replies arrive). with our initial obd products (the elm320, elm322 and elm323) we found that older vehicles often needed a timeout setting of about 100 msec, and occasionally needed more, so we settled on a standard default setting of 200 msec. if a typical vehicle query response time were about 50 msec, and the timeout were set to 200 msec, the fastest scan rate possible would only be about 4 queries per second. changing the st time to about 100 msec would almost double that rate, giving about 7 queries per second. clearly, if you were to know how long it takes for your vehicle to reply, you might be able to improve on the scan rate, by adjusting the st time. it is not easy to tell how fast a vehicle replies to requests. for one thing, requests all have priorities assigned, so responses may be fast at some times, and slower at others. the physical measurement of the time is not easy either - it requires expensive test equipment just to make one measurement. to help with this, we added a feature to the elm327 called ?daptive timing? adaptive timing actually makes the response time measurements for you, and adjusts the at st time to a value that should work for most situations. it is enabled by default, but can be disabled with the at0 command should you not agree with what it is doing (there is also an at2 setting that is a little more aggressive, should you wish to experiment). for 99% of all vehicles, we recommend that you simply leave the settings at their default values, and let the elm327 make the adjustments for you. consider the following times taken from a j1850 vpw vehicle, in response to an 01 00 request: elm327 vehicle 58 msec engine (ecu 10) transmission (ecu 18) 4 msec the engine controller responds very quickly, but the transmission takes considerably longer. the adaptive timing algorithm measures the longer transmission response times and will use them to set the timeout, likely to a value in the range of 90 msec. with a timeout of 90 msec, the maximum scan rate would be about 6 readings per second. surely there has to be a way to eliminate that final timeout, if you know how many responses to expect? there is a way (as of v1.3 of the elm327). instead of sending 01 00 for the above request, the elm327 will also accept 01 00 2. this tells the ic to send 01 00, then return immediately after receiving 2 responses. it can not speed up a slow ecu, but it will eliminate the final delay, as the elm327 knows the number of responses to expect. this one change might give you 10 to 12 responses per second, instead of the 6 obtained previously. we do caution that you use this feature carefully. if you set the last digit to a number that is less than the actual number of responses, then acknowledgements that may be required will not be sent, and some protocols may begin resending the message, looking for a response. this will lead to unnecessary network congestion, which must be avoided. before using this feature, always determine the number of responses that will be coming from the vehicle, and then set the responses digit to that value. 65 of 82 power control often, the elm327 is connected to a vehicle for only a short time, so power consumption is not of great concern. occasionally, the elm327 may be connected for longer times, however, possibly without the engine running. for those applications, it is often desirable to be able to put the circuit into a low power ?tandby state, and have it return to normal operation when needed. the power control features of the elm327 were introduced for this. there are four ways in which the elm327 can be placed into the low power standby mode (shown pictorially in figure 6). none of them will work without having the master enable (ie bit 7 of pp 0e) set to ?? which it is by default. the first method is with an at command. you may simply send: >at lp and the ic will go to the low power mode after a one second delay (which allows the controlling circuit a little time to perform some housekeeping tasks). when in low power mode, the elm327 sets all outputs to their recessive/off state, sets pin 3 (j1850 voltage control) to a low level, and it reverses the state of the pin 16 control output. the elm327 will then reduce its own power level, and begin monitoring for inputs that would cause a shift back to full power. the next method allows automatic switching to the low power mode when there has been no rs232 input for a period of time - the controlling computer has stopped for some reason. to enable this method, both b7 and b5 of pp 0e must be set to ?? the time delay (either 5 or 20 minutes) is set by b4, and the printing of a warning is enabled with b3. the warning is handy in some cases ?it is the activity alert message (?ct alert? and is sent 1 minute before the timer is about to time out. when the timer does time out, you will see a low power alert warning (?p alert?, and then 2 seconds later, all of the outputs will change as described above for the at lp command. in a similar way, the activity monitor may be used elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com 66 of 82 the activity monitor the elm327 contains some firmware that is used to monitor the obd input pins (ie pins 11, 12, 13, and 24). these routines continually ?oll?the inputs, looking for any active levels on them. of course, we don? want to look at a pin while we are sending, so there is also some logic to block those inputs during a send, and to filter the levels as well as provide timing. collectively, these routines are known as the activity monitor. the activity monitor software ensures that each obd input pin is checked at least once every 4 msec, (and sometimes as often as every few ?ec). this may not be perfect (since very short messages on an otherwise quiet bus could be missed), but it does make sure that the elm327 detects normal activity on active busses. the presence or absence of activity can then be used to cause the elm327 to go to low power operation, or wake from it. see the next section for details. if you do not want the activity monitor to initiate low power operation, you may set pp 0f so that only ?ct alert?reports are provided. of course, you may also disable that as well, and make your own decisions based on what the activity monitor is seeing. to help with this, the elm327 offers an instruction that is able to report the current activity monitor counts. the count is an internal value that represents the time since obd activity was detected. the actual time is given by (amc value + 1) x 0.65536 seconds. to use it, send the amc command and note the value returned: >at amc 31 in this case, the value returned is 31 hexadecimal (ie 49 in decimal). this means that the elm327 has not detected any obd activity in the past 32.8 seconds. the activity monitor count is limited to a single byte value (max is ff), and internal logic prevents it from ?olling over? that is, it will count to ff and stop there. the activity monitor is initially disabled (to give you time to perform setup tasks), and becomes enabled as soon as you attempt to send the first obd message. also, the monitor is always disabled while the elm327 is in a monitoring mode so that you can use the circuit as a reliable monitor of bus activity (you don? want the circuit to go to sleep, or miss anything while waking from sleep). 67 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com to cause the elm327 to shift to low power operation, if there is no obd activity for some time. if you follow the logic path, you will see that b7 and b5 of pp 0f must both be ?? as well as b7 of pp 0e in order to allow this switch to occur. the default time that it allows before switching is set by b4, and can be changed at any time with the at amt command. setting the activity monitor timeout to 00 blocks all the activity monitor outputs. the final method to enter the low power mode is by a low level appearing at the ignition monitor input (pin 15 - ignmon), when both b7 and b2 of pp 0e are set to ?? allowing it. the ignition monitor logic inserts a short internal delay (?ebounce? to be sure that the low level seen is a legitimate ?ey off?and not just some noise. after it is figure 6. enabling the low power mode power control (continued) at lp command b4 b7 b5 1 min remaining print lp alert b7 go to low power 65 msec debounce ignmon (pin 15) voltage is low rs232 rx (pin 18) input is quiet 160 sec timer b4* all are quiet sent a message b7* b3* obd inputs not monitoring print act alert b0* flash obd tx led activity monitor (read with at amc) timeout setting amt > amt 1 00 b7 b5* 1 sec delay 2 sec delay b3 print act alert 1 sec delay rs232 detector not monitoring b7 b2 voltage monitor notes bits with an asterisk (*) are for pp 0f. all other bits are for pp 0e. represents an and gate represents an or gate 5 min or 20 min timer 68 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com sure, the elm327 will then send a low power alert message (?p alert?, and 2 seconds later it will switch to low power operation, just the same as was described for the other methods. when connecting to pin 15, care should be taken to not allow excessive current (ie >0.5 ma) to pass through the internal protection diodes. typically all that is required is a series resistor, but adding a capacitor helps to filter out ignition noise (note that the schmitt input on pin 15 allows the use of large value capacitors). a second resistor ensures a discharge path for the capacitor, while raising the threshold voltage. a circuit like this works well: 14 15 16 +12v switched by the ignition 47kw 22kw 0.1uf note that the at ign command can always be used to read the level at pin 15, regardless of the setting of the pp 0e enable bits. this may be used to advantage if you wish to manually shut down the ic, using your own timing and criteria. recall that the alternate function for pin 15 is the rts input which will interrupt any obd processing that is in progress. if the elm327 reports an interrupt with the ?topped message, you can then check the level at pin 15 with the at ign command, and make your own decisions as to what should be done. for that matter, you don? even need to reduce the power based on the input - you might possibly do something entirely different. having put the elm327 into low power mode, you will need a method to wake it up. this is done by ?nterrupting?the ic in ways that are very similar to that used to put it into low power mode. figure 7 shows the three ways to ?ake?the elm327 from low power mode (other than toggling the power, or pulsing pin 1). any of these can wake the ic - they do not have to be the cause of its going to low power. the first way is with a low level pulse at the rs232 rx input (pin 18). the rs232 circuitry is not as power control (continued) figure 7. returning to normal operation 1 or 5 sec timer ignmon (pin 15) voltage is high rs232 rx (pin 18) input is active obd inputs 1 sec delay rs232 detector voltage monitor b1 activity monitor voltage was low an input is active all inputs were inactive 128 ?ec min pulse width perform a warm start (see text) go to full power ?? to normal ?pin 16 = b6 69 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com sensitive as normal when in the low power mode, so to be sure that your input is seen, the elm327 requires that the pulse width be at least 128 usec wide. this is easily accomplished by sending a space or @ character, if the baud rate is 57.6 kbps or less. if using higher baud rates, you may wish to consider temporarily shifting to a lower baud rate and sending a character, or possibly see if your software can generate a ?reak?signal for you. the break signal is not always the same length, but is typically several msec long (ie much longer than 128 ?ec), and can often be sent by usb through usb to rs232 conversion devices. you will have to experiment if using other methods (bluetooth or wifi, for example). the second method to have the elm327 circuit go back to full power is by having activity appear on the obd input pins. at the first sign of an active level, the circuit will start its wakeup, and within seconds, will be at full capability. note that the logic is configured so that it must see all quiet on the obd inputs before it will allow an automatic wakeup. this does not normally present a problem, and is implemented so that you can manually put the circuit to low power (at lp), even if there is activity on one of the obd inputs. otherwise, the circuit would wake up immediately after the at lp. when connected to protocols 3, 4 or 5 (iso 9141- 2 or iso 14230-4), there may be no obd activity when the vehicle is first turned on. in this case, you could not rely on the activity monitor to wake the circuit and you would have to look for other means. the final method that is provided to wake up the circuit is by way of the ignition monitor input and logic. a low then high level at the ignmon input will cause the elm327 to return to full power operation, and perform a reset. note that pp 0e bit 2 does not have to be set for the ignmon to wake the circuit - the elm327 always monitors this pin, and will wake the circuit after the delay that is set by pp 0e bit 1. we are often asked if a switched ?gnition?voltage is available at the vehicle? diagnostic connector for this purpose. it is not - you must connect a separate wire yourself. often there are convenient places that you can use for this - possibly radio power, or the connection to a convenience outlet. note that we present the pin 15 input as if it is an ignition monitoring circuit, but in fact, it will monitor for any change in voltage level (as long as the change is stable for the debounce period). you might consider connecting to other inputs (such as the 5v from a usb cable, for example) - just be sure to protect the elm327 input circuitry from transients. this usually just requires a series resistor of 1k to 10k in value. if you also provide a pullup resistor, you don? need a voltage input, and can use a mechanical switch. this circuit shows a momentary pushbutton connected: 14 15 16 2.2kw 47kw +5v if the circuit is in low power mode, a momentary push of the button should wake it up. this is just one of the many ways in which you can use this logic. one final note has to do with the changes to the startup process, beginning with firmware version 2.0. initially (with v1.4 and v1.4b), the elm327 simply used a warm start command (at ws) to exit from the low power mode. the positive feedback that we received from our elm329 changes has led us to also change the process with the elm327. now, on switching back to full power operation, the elm327 retains the following settings: e0/1 h0/1 l0/1 m0/1 r0/1 d0/1 s0/1 at0/1/2 caf0/1 cfc0/1 csm0/1 cea jtm1/5 al/nl iia also, the current protocol is not changed, but it is reset (with at pc), and the iso/kwp baud rate is retained. this has discussed how to have the elm327 go to low power operation, and wake from it. while in the low power mode, the question of ?ust how low is the power consumption?arises. we discuss that in the ?odifications for low power standby operation section, which is on page 77. power control (continued) a very common question that we receive is ?an i connect the elm327 directly to my own circuit, or must i use the rs232 interface shown??certainly you may connect directly to our ics, and you do not need to use an rs232 interface. there are a few items to consider, however. the elm327 is actually a microprocessor that contains a standard uart type interface, connected to the rs232 tx and rx pins. the logic type is cmos, and this is compatible with virtually all 5v ttl and cmos circuits, so you should be able to connect directly to these pins provided that the two devices share the same power supply (5v), and that they are not physically more than about 10 to 20 inches apart (cmos circuits are subject to latchup from induced currents, which may be a problem if you have long leads). if your microprocessor uses a different supply voltage (for example 3.3v), we recommend that you look into a commercial interface product, such as the texas instruments txb0102. the normal (idle) levels of the elm327 transmit and receive pins are at the vdd (5v) level. most microprocessors and rs232 interface ics expect that to be the idle level, but you should verify it for your microprocessor before connecting to the elm327. the connections are straightforward - transmit connects to receive, and receive connects to transmit, as shown below. don? forget to set both devices to the same baud rate. 70 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com the elm327 also provides a hand-shaking feature that may simplify the flow of data for you. the interface consists of two pins - an input an an output. the input is called ?equest to send?(rts), and it is used to interrupt the elm327, just the same as tapping a key on the keyboard when using a terminal program. the output pin (?usy? is used by the elm327 to tell your system that it is processing data. to use the handshaking feature, set one of your port pins to normally provide a high output, and connect it to the rts input (pin 15). use another port pin as an input to monitor the elm327 busy output (pin 16). when you want to send a command, simply check the busy output first. if it is at a high logic level, then either wait for it to go low, or if you need to interrupt the ic, then bring the rts line low and wait for the busy line to go low. (you might want to consider using an edge triggered interrupt on the busy output, if one is available). when busy does go low, restore your rts line to a high level, and then send your command to the elm327. no need to worry about the elm327 becoming busy again after you raise the rts line at this point ?once busy goes low, the elm327 will wait (indefinitely) for your command. if you do not use the rts input on the elm327, it must be connected to a high logic level, as shown below. microprocessor interfaces 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 +5v x1 4.00mhz c4 27pf r27-30 470w +5v c3 27pf +5v +5v to r15 to r21 n.c. +5v 327 l1-l4 your microprocessor tx rx tx rx the elm327 and your microprocessor should use the same 5v supply busy rts figure 8. the j1962 vehicle connector 8 1 9 16 example applications the sae j1962 standard dictates that all obd compliant vehicles must use a standard connector, the shape and pinout of which is shown in figure 8 below. the dimensions and pin connections for this ?ype a connector are fully described in the sae j1962 standard. the circuit that you build with the elm327 will be required to connect by way of a matching male j1962 connector. fortunately these are available from several sources, easily found with a web search. note that before obdii was adopted, several vehicles (most notably those made by general motors) used a connector like that shown above for factory communications. these vehicles typically used what is known as the aldl protocol, which the elm327 does not support. check that your vehicle is actually obdii compliant before building your elm327 circuit. the circuit on page 73 (figure 9) shows how the elm327 might typically be used. circuit power is obtained from the vehicle via obd pins 16 and 5 and, after a protecting diode and some capacitive filtering, is presented to a five volt regulator. (note that a few vehicles have been reported to not have a pin 5 ?on these you will use pin 4 instead of pin 5.) the regulator powers several points in the circuit as well as an led (l5) for visual confirmation that power is present. we have used an lp2950 for the regulator as that limits the current available to about 100ma which is a safe value for experimenting. the can interface is a low impedance circuit however, and if doing sustained transmissions on can, this type of regulator may cause lv resets or possibly shut down on over- temperature. should you experience either of these problems, you may want to consider using a device that is capable of more current (such as a 78m05 or 7805). the top left corner of figure 9 shows the can interface circuitry. we do not advise making your own interface using discrete components ?can buses typically have a lot of critical information on them, and you can easily do more harm than good here. it is strongly recommended that you use a commercial transceiver chip as shown. we show a microchip mcp2551 in this circuit, but most major manufacturers produce can transceiver ics ?look at the nxp pca82c251, the texas instruments sn65lbc031, and the linear technology lt1796, to name only a few. be sure to pay attention to the voltage limits as depending on the application, you may have to tolerate 24v, and not just 12v. the next interface shown is for the iso 9141 and iso 14230 connections. we provide two output lines, as required by the standards, but depending on your vehicle, you may not need to use the iso-l output. (many vehicles do not require this signal for initiation, but some do, so it is shown here.) if your vehicle does not require the l line, simply leave pin 22 unused, and do not install q6, r16 or r17. the elm327 controls both of the iso outputs through npn transistors q6 and q7 as shown. these transistors have 510 w pullup resistors connected to their collectors, as the standard requires. we are often asked about substitutes for these resistors ?the standard specifies 510 w but in a pinch you might be able to use 560 w. a better solution would be to make 510w from 240w and 270 w 1/4w resistors in series. we do not recommend using a lower value for the resistance as it stresses every device on the bus. note that 1/2w resistors are specified in figure 10 as a short at 13.8v causes about 0.4w dissipation. be careful if you are designing a circuit that might monitor other scan tools. both the elm327 and the other scan tool would present 510 w resistors, so the vehicle would see 255 w. this would very likely cause data errors, and might even damage some circuitry. to avoid this, you might wish to build in a way to switch the elm327? 510 w resistors out, and replace them with a larger value. for example, you might put 10k w resistors in series with the 510 w ones, and add jumpers or switches across the 10k w resistors. the jumpers could be removed or the switches opened if you are monitoring a scan tool. data is both sent and received on the iso-k line. when receiving, the data signal is presented to pin 12 after being reduced by the r20-r21 voltage divider. because of the schmitt trigger input on pin 12, these resistors will give typical threshold levels of 7.0v (rising) and 3.6v (falling), providing a large amount of noise immunity while also protecting the ic. if you connect test equipment in parallel with r21, it will cause these thresholds to increase, so be conscious of 71 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com what you are doing while testing. the final obd interface shown is for the two j1850 standards. the j1850 vpw standard needs a positive supply of up to 8v while the j1850 pwm needs 5v, so we have shown a two level supply that can provide both. this dual voltage supply uses a 317l adjustable regulator as shown, controlled by the pin 3 output. with the resistor values given, the selected voltages will be about 8.0v and 5.5v, which works well for most vehicles. the two j1850 outputs are driven by the q1-q2 combination for the bus+, and q3 for the bus-. the j1850 vpw input uses a resistor divider, similar to that which was used for the iso input. typical threshold voltages with the resistors shown will be about 4.2v (rising) and 2.2v (falling). the j1850 pwm input is a little different in that it must convert a differential input into a single-ended one for use by the elm327. this is done by connecting q4 across the input so that it operates as a difference amplifier. the q4-d3 series combination sets a threshold voltage of about 1v (for improved noise immunity), while r11 limits the current flow, and r12 makes sure that q4 is off when it should be. the circuit works well as shown, but the r14 passive pullup time constant can be easily affected by stray capacitance - be aware of this when connecting test equipment to the pwm input pin. resistor r1 is the final j1850 component. we added this to help discharge the data bus more rapidly when it was found that some vehicles showed higher capacitance than others. the resistor may not be required at all for many vehicles - the choice is yours. if you should see reports of bus errors with a j1850 vehicle, it may be this capacitance causing problems (you will need to ?cope the signal to be sure). the r25-r26 voltage divider shown connected to pin 2 is used for the vehicle voltage monitoring circuitry. the two resistors simply divide the battery voltage to a safer level for the elm327, and the capacitor (c2) helps to filter out noise. as shipped, the elm327 expects a resistor divider ratio as shown, and sets nominal calibration constants assuming that. if your application needs a different range of values, simply choose your resistor values to maintain the input within the elm327? v ss to vdd voltage range, and then perform an at cv to calibrate the elm327 to your new ratio. the maximum voltage that the elm327 can show is 99.9v (it? a software limit, not hardware). the four leds shown (on pins 25 to 28) have been provided as a visual means of confirming circuit activity. they are not essential, but it is nice to see the visual feedback. on the right side of the circuit, the elm327? rs232 pins (17 and 18) are shown connected to an ftdi usb module. this module makes it very easy to connect the elm327 circuit to your computer - all you need is the vcp driver software, which is available for free from the ftdi web site (www.ftdichip.com). the module pinout matches a 9 pin d-sub connector, so you can simply solder it in where the rs232 circuitry used to go. diode d5 and resistor r32 have been added to the interface to prevent backfeeds from the usb supply into the elm327. finally, the crystal shown connected between pins 9 and 10 is a standard 4.000mhz microprocessor type crystal. the 27pf crystal loading capacitors shown are typical only, and you may have to select other values depending on what is specified for the crystal that you use. the crystal frequency is critical to circuit operation and must not be altered. we often receive requests for parts lists to accompany our example applications circuits. since this circuit is more complex than most, we have named and numbered all of the components and provided a summary parts list (figure 10). note that these are only suggestions for parts. if you prefer another led colour, or have a different general purpose transistor on hand, etc., by all means make the change. a quick tip for those having trouble finding a 0.3?wide socket for the elm327: many of the standard 14 pin sockets can be placed end-to-end to form one 0.3?wide 28 pin socket. for more help with building and testing the circuit, see our ?n02 - elm327 circuit construction application note. what if you only want to support one of the protocols? well, you need to be careful with the unused pins, but other than that, the connections are straight-forward. figure 11 shows how you might support only the sae j1850 vpw protocol. compare the obd protocol portions of the circuits in figures 9 and 11 - the differences should be very apparent. the unused protocols in figure 11 have simply had their outputs ignored (left open circuit), and their inputs wired directly to high or low logic levels. which level to connect them to is shown in the ?nused pins?section on page 5. note that unused cmos inputs must always be connected to either a high or a low level - they should never be left floating. the circuit of figure 11 maintains the status leds, example applications (continued) 72 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com figure 9. an obd to usb interpreter elm327 73 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com r1 22kw x1 4.00mhz c4 27pf obd interface r27-30 470w +5v c3 27pf +5v +5v 317l +12v elm327 pin 14 r15 4.7kw to r15 +5v (j1962) j1850 bus + 2 j1850 bus - 10 q5 to r21 +5v +5v can-h 6 can-l 14 1 2 3 4 5 6 7 8 mcp2551 vbat vbat iso-l 15 iso-k 7 elm327 pin 12 vbat 327 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 u1 battery positive 16 lp2950 vbat +12v signal ground 5 c7 10? 10v c5 2.2? 50v d1 l1-l4 +5v r31 470w l5 r22 100w r23 100w c8 560pf 50v c9 560pf 50v r24 4.7kw c1 0.1? r19 510w r17 510w r16 2.2kw r18 2.2kw r20 47kw r21 33kw r25 47kw r26 10kw c2 0.1? r5 470w r3 470 w r4 2.2kw r2 2.2kw r8 10kw r7 4.7kw q1 q2 r6 4.7kw r10 22kw r9 10kw r11 10kw r12 47kw d3 q4 r13 10kw r14 4.7kw q3 d2 q6 q7 u2 u3 u4 r32 4.7kw usb interface (mini b) 3 (txd) 5 (sg) 1 (dcd) 4 (dtr) 6 (dsr) 7 (rts) 8 (cts) ftdi db9-usb-d5-f 9 (ri) 2 (rxd) +5v d5 u5 + +5v c6 0.1? 50v + d4 5.0v tvs in out adj resistors (1/8w or greater, except as noted) r22, r23 = 100 w r3, r5, r27, r28, r29, r30, r31 = 470 w r17, r19 = 510 w 1/2w r2, r4, r16, r18 = 2.2 kw r6, r7, r14, r15, r24, r32 = 4.7 kw r8, r9, r11, r13, r26 = 10 kw r1, r10 = 22 kw r21 = 33kw r12, r20, r25 = 47 kw capacitors (16v or greater, except as noted) c3, c4 = 27pf c8, c9 = 560pf 50v c1, c2 = 0.1uf c6 = 0.1uf 50v c5 = 2.2? 50v c7 = 10? 10v semiconductors d1 = 1n4001 d2, d3, d5 = 1n4148 d4 = 1n5232b or sa5.0ag tvs l1, l2, l3, l4 = yellow led l5 = green led q1, q3, q5, q6, q7 = 2n3904 (npn) q2, q4 = 2n3906 (pnp) u1 = elm327 u2 = mcp2551 u3 = lp2950 (5v 100 ma regulator) u4 = 317l (100 ma adjustable regulator) u5 = ftdi dbp-usb-d5-f usb module misc x1 = 4.000mhz crystal db9m connector for obd cable? ic socket = 28 pin 0.3" wide (or 2 x 14pin) figure 10. parts list for figure 9 example applications (continued) 74 of 82 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com elm327 and the j1850 bus+ circuitry, but the majority of the rest has been eliminated. the j1850 voltage switching circuitry has been reduced to a single 8v regulator as well, since there will be no need to switch to 5v. note that pin 3 has been intentionally left open-circuited as it is not required by the voltage regulator. the first time that this circuit is used, it will likely be set to protocol 0, which is the default ?utomatic search?setting when shipped from the factory. when you connect it to a j1850 vpw vehicle, it will then automatically detect the protocol, and if the memory is enabled (it is as shown), j1850 vpw will then become the new default, with no action required by you. this will work well for most applications, but if the circuit is used on a vehicle with the key off, for example, then it will again go searching for a new protocol. in general, you do not want this to happen every time (simply because the search may take several seconds). it may be only a minor inconvenience to have to wait while the elm327 determines that it is ?nable to connect? but why go through it if you do not have to? if you know that you will be using the circuit in a j1850 vpw only application (protocol 2) then you should issue the command at sp 2 the very first time that the circuit is powered. from that point on, the elm327 will remain set for protocol 2, whether it fails to make a connection or not. the usb interface in figure 11 uses a different product than that of figure 9, just to show how simple it is to interface other products. this one is the cp2102 which is produced by silicon laboratories (www.silabs.com). if using the cp2102, we do caution that it is very small and difficult to solder by hand, so be prepared for that. also, if you provide protection on the data lines with transient voltage suppressors (tvs?), be careful of which ones you choose, as some exhibit a very large capacitance and will affect the transmission of the usb data. the circuits of figures 9 and 11 will both power up and begin communicating at 38400 bps. you will need to set your terminal or obd software to this same rate in order to communicate with them. should you want to experiment with other rates, you will need to change example applications (continued) figure 11. a j1850 vpw to usb interpreter 75 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com 2 (d-) 4.00mhz 27pf usb interface (type ? connector) obd interface 4 x 470w +5v 27pf +5v 1 (+5) 4 (sg) +5v 78l08 +12v (j1962) j1850 bus + 2 1 2 3 4 5 6 7 8 9 10 11 12 13 14 +5v 15 16 17 18 19 20 21 22 23 24 25 26 27 28 10kw 4.7kw 4.7kw 22kw 10kw pwr battery positive 16 78l05 +12v signal ground 5 +5v 470w 0.1? 0.1? +5v 3 (d+) silabs cp2102 0.1? 5.0v tvs 1? 7 6 26 25 3 4 5 8 +5v 327 the value of pp 0c (the baud rate divisor), then change your software to that same value. changes to pp 0c require a power down then power up in order for them to take effect, so don? forget that. changing pp 0c requires two steps. for example, to switch to 115200 baud, use these at pp commands: >at pp 0c sv 23 ok > at pp 0c on ok if you power down then up, the circuit will then default to 115200 bps, rather than to 38400 bps. if you go through the calculations, you will note that this baud rate is actually off by about 0.8%, which should pose no problems with modern interfaces. some people still prefer to interface their circuits with standard rs232 circuitry. for these, we offer the sub-circuits of figures 12 and 13. figure 12 shows a discrete rs232 interface, that may be connected directly to the elm327. this circuit uses a resistor, diode, and capacitor between the two signal lines to ?teal?power from the host computer. in this way, the required rs232 negative voltage is obtained without adding a complicated power supply to 76 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com example applications (continued) the elm327 circuit. the rs232 connections shown are for a standard 9 pin connector. if you are using a 25 pin one, you will need to compensate for the differences. this circuit works well at baud rates of 57600 bps or less, but begins to show some errors at rates of 115200 bps and above. the circuit of figure 13 offers another solution that works well at higher baud rates. it uses a maxim product (the max3222e) that is capable of 250 kbps operation. visit www.maximintegrated.com for more information. the max3222e rs232 transceiver contains internal charge pump circuitry that generates the voltages required for rs232 communications, in addition to the analog interface circuitry needed. all you have to do is provide a few capacitors, and it does the rest. we do caution that the max3222e does seem to place some extra demands on the 5v power supply, so if you use it, we recommend changing some capacitors in the circuit of figure 9. we suggest changing c5 from 2.2 ? to 10 ?, and c7 from 10 ? to 33 ? (their voltage ratings stay the same). if after these changes, you still see the occasional ?v reset? you may wish to consider a more powerful regulator. many wireless modules (wifi or bluetooth? use serial interfaces just like what we have shown for the rs232 connections. connecting to them should not be very difficult if you follow the manufacturers directions. if you are considering bluetooth, you might read our ?n-04 elm327 and bluetooth application note first. this has provided a few examples of how the elm327 integrated circuit might typically be used. hopefully it has been enough to get you started on your way to many more. the following section shows how you might be able to optimize these circuits to reduce power consumption figure 12. a discrete rs232 interface figure 13. an integrated rs232 interface 2 (rxd) rs232 interface (db9f) +5v +5v 3 (txd) 5 (sg) 1 (dcd) 4 (dtr) 6 (dsr) 7 (rts) 8 (cts) r26 4.7kw r24 10kw r25 10kw d4 d5 c5 0.1? r23 4.7kw r22 10kw q8 q9 +5v 15 16 17 18 19 327 2 (rxd) 3 (txd) 5 (sg) 1 (dcd) 4 (dtr) 6 (dsr) 7 (rts) 8 (cts) 0.1? 1 2 3 4 5 6 7 8 9 rs232 interface (db9f) +5v 0.1? 10 11 12 13 14 15 16 17 18 +5v 15 16 17 18 19 327 77 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com modifications for low power standby operation if you wish to semi-permanently install your elm327 circuit in a vehicle, current consumption becomes an issue. the typical circuit draws about as much current as a dome lamp, so can not be left on for long without the vehicle? engine running. when it is not needed, the elm327 may be placed in a low power ?tandby?mode in which it consumes very little current. reducing the integrated circuit current itself is great, but is generally not enough - you will still need to consider other ways to reduce power consumption further. consider the circuit of figure 9, in the example applications section. with 12v to 15v applied to the ?attery positive?input, our tests showed that the total current used by the circuit is typically: base current = 25.7 ma without making any wiring changes, you can reduce this current by sending the low power command (at lp). the resulting current is about: current after at lp = 3.6 ma this large change is not only due to the drop in elm327 current, but is also from that of the mcp2551 and the ?ower on?led (l5). all of these change because of the connection to pin 16. while the 3.6 ma represents a considerable reduction, it would be nice to bring the total circuit current to less than 1 ma. if you look at figure 9, the one remaining ic that does not change current during low power mode is the 317l (u4). in fact, a quick calculation shows that it is likely using about 2.7 ma when idle. if we replace this ic with another that uses less current, we will be close to getting the total current to less than 1 ma. figure 14 shows an lp2951acm regulator in the circuit, as a replacement for the 317l. it uses much less current than the 317 during normal operation, and offers a shutdown control input as well to minimize current when it is not required. using this ic as shown, you should obtain a total circuit current of less than 1 ma. note that the lp2951 circuit needs the elm327 to provide a high level at pin 3 for a 5v output, and a low for 8v, so an inversion is needed. to do this, set pp 12 to 00 with: >at pp 12 sv 00 >at pp 12 on then reset the chip, and the voltages will always be correct for j1850 from that point on. reducing current further will require careful design and parts selection. as a point to start, perhaps you could find better choices for the voltage regulators, and possibly look at different values for the r25-r26 and r20-r21 resistor pairs, maybe turn off the flashing led while in low power mode, or else use a more efficient version. there are many little currents that all make up the total. 25 26 27 28 1 2 3 4 5 +5v +12v 22kw 4.7kw 47kw r8 10kw r7 4.7kw q1 q2 d2 + 4.7? 16v 1 2 3 4 5 6 7 8 lp2951 u4 r6 4.7kw elm327 pin 16 327 figure 14. replacing u4 with an lp2951 error messages and alerts ? this is the standard response for a misunderstood command received on the rs232 input. usually it is due to a typing mistake, but it can also occur if you try to do something that is not appropriate (eg. trying to do an at fi command if you are not set for protocol 5). act alert or !act alert this message occurs as a warning that there has been no rs232 or obd activity for some time (see the power control section for details). if allowed, the ic will be initiating a switch to the low power (standby) mode of operation. if this was initiated by no rs232 activity, sending something within the next minute will stop the switch to low power. note that !act alert is printed if pp 0f bit 1 is 1. buffer full the elm327 provides a 512 byte internal rs232 transmit buffer so that obd messages can be received quickly, stored, and sent to the computer at a more constant rate. occasionally (particularly with can systems) the buffer will fill at a faster rate than it is being emptied by the pc. eventually it may become full, and no more data can be stored (it is lost). if you are receiving buffer full messages, and you are using a lower baud data rate, give serious consideration to changing your data rate to something higher. if you still receive buffer full messages after that, you might consider turning the headers and maybe the spaces off (with at h0, and at s0), or using the can filtering commands (at cra, or cm and cf) to reduce the amount of data being sent. bus busy this occurs when the elm327 tries to send a message, or to initialize the bus, and detects too much activity to do so (it needs a pause in activity in order to insert the message). although this could be because the bus was in fact very busy, it is almost always due to a wiring problem that is giving a continuously active input. if this is an initial trial with your new elm327 circuit, then check all of the voltage levels at the offending obd input, as this error is very likely due to a wiring problem (see our ?n02 - elm327 circuit construction?for some typical voltages). bus error a generic problem has occurred. this is most often from an invalid signal being detected on the bus (for example, a pulse that is longer than a valid break signal), but usually is from a wiring error. note that some vehicles may generate long pulses as part of their startup process, so you may see this message as part of a normal vehicle startup while ?onitoring all. can error the can system had difficulty initializing, sending, or receiving. often this is simply from not being connected to a can system when you attempt to send a message, but it may be because you have set the system to an incorrect protocol, or to a baud rate that does not match the actual data rate. as with bus errors, the can error might also be the result of a wiring problem, so if this is the first time using your elm327 circuit, review all of your can interface circuitry before proceeding. data error there was a response from the vehicle, but the information was incorrect or could not be recovered. errxx there are a number of internal errors that might be reported as err with a two digit code following. these occur if an internally monitored parameter is found to be out of limits, or if a module is not responding correctly. if you witness one of these, contact elm electronics for advice. one error that is not necessarily a result of an internal problem is err94. this code represents a ?atal can error? and may be seen if there are can network issues (some non-can vehicles may use pins 6 and 14 of the connector for other functions, and this may cause problems). if you see an err94, it means that the can module was not able to reset itself, and needed a complete ic reset to do so. you will need to restore any settings that you had previously made, as they will have been returned to their default values. beginning with v1.3a of this ic, an err94 will also block further automatic searches through the can protocols, if bit 5 of pp 2a is a ??(it is by default). this is done because most err94s will be as a result of serious can wiring problems. blocking of the can protocols remains in effect until the next power off and on, or until an at fe is sent. fb error when an obd output is energized, a check is always made to ensure that the signal also appears at the respective input. if there is a problem, and no active input is detected, the ic turns the output off and declares that there was a problem with the feedback (fb) of the signal. if this is an initial trial with your elm327, this is almost certainly a wiring problem. check your wiring before proceeding. lp alert or !lp alert this appears as a warning that the elm327 is about to switch to the low power (standby) mode of operation in 2 seconds time. this delay is provided to allow an external controller enough time to prepare for the change in state. no inputs or voltages on pins can stop this action once initiated. !lp alert is printed if pp 0f bit 1 is 1. lv reset the elm327 continually monitors the 5v supply to ensure that it is within acceptable limits. if the voltage error messages and alerts (continued) should go below the low limit, a ?rownout reset?circuit is activated, and the ic stops all activity. in rare cases, a sudden large change in v dd can also trigger a low voltage reset. when the voltage returns to normal, the elm327 performs a full reset, and then prints lv reset. note that this type of reset is exactly the same as an at z or mclr reset (but it does not print elm327 v2.0). an lv reset will also block automatic searches through the can protocols, if bit 4 of pp 2a is a ??(it is by default). this is done because most lv resets seem to occur as a result of can wiring problems (the transceiver is capable of passing very large currents). blocking of the can protocols is only done until the next reset (at z, ws, etc.) or until an at fe is sent. no data the ic waited for the period of time that was set by at st, and detected no response from the vehicle. it may be that the vehicle had no data to offer for that particular pid, that the mode requested was not supported, that the vehicle was attending to higher priority issues, or in the case of the can systems, the filter may have been set so that the response was ignored, even though one was sent. if you are certain that there should have been a response, try increasing the st time (to be sure that you have allowed enough time for the ecu to respond), or restoring the can filter to its default setting. f features, 1 figure 9, 73 flow control messages, altering, 48 fms standard, 55 h headers, setting them, 38-40 higher rs232 baud rates, 63-64 i initiation, bus, 34 inputs, unused, 5 interface, microprocessor, 70 interpreting trouble codes, 32 j j1939, fms standard, 55 messages, 50-51 number of responses, 53 using, 52-55 k keepalive (wakeup) messages, 34 l low power operation, description, 66-69 modifications, 77 m maximum ratings, absolute, 5 messages and filtering, can, 42 messages, error, 78-80 message formats, can, 46 message formats, obd, 36-37 microprocessor interfaces, 70 modifications for low power, 77 monitoring the bus, 41 multiline responses, 44-45 index a absolute maximum ratings, 5 altering flow control messages, 48 applications, example, 71-76 at commands, 9 at command descriptions, 11-27 summary, 9-11 alerts, error messages and, 78-80 b battery voltage, 28 baud rates, using higher rs232, 63-64 block diagram, 1 bus fms standard, 55 bus initiation, 34 c can extended addresses, using, 49 can message formats, 46 can receive filtering, 42 codes, trouble, interpreting, 32 resetting, 33 commands, at descriptions,11-27 summary, 9-11 commands, obd, 29 communicating with the the elm327, 7-8 the cra command, 42 d description and features, 1 e electrical characteristics, 6 error messages, 78-80 example applications basic, 71-73 figure 9, 73 usb, 72-75 low power, 77 extended addresses, can, 49 81 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com index (continued) n number of responses, j1939, 53 obdii, 31, 65 o obd commands, 29 obd message formats, 36-37 order, restoring, 47 ordering information, 5 outline diagrams, 80 overview, 7 p pin descriptions, 3-5 pin 28, resetting prog parameters, 58 power control, description, 66-69 modifications, 77 programmable parameters, general, 57-58 reset with pin 28, 58 summary, 58-62 types, 58 protocols, list of supported, 35 protocols, selecting, 35-36 q quick guide for reading trouble codes, 33 r reading the battery voltage, 28 reading trouble codes, quick guide for, 33 resetting, prog parameters, 58 trouble codes, 33 responses, multiline, 44-45 restoring order, 47 rs232 baud rates, using higher, 63-64 s selecting protocols, 35-36 setting the headers, 38-40 setting timeouts (at & st commands), 65 specify the number of responses, 31, 53, 65 summary, at commands, 9-11 programmable parameters, 58-62 t talking to the vehicle, 30-31 timeouts (at & st commands), 65 trouble codes, interpreting, 32 resetting, 33 u unused pins, 5 using j1939, 52-55 using can extended addresses, 49 using higher rs232 baud rates, 63-64 v voltage, reading the battery, 28 w wakeup messages, 34 82 of 82 elm327 elm327dsi elm electronics ?circuits for the hobbyist www.elmelectronics.com |
Price & Availability of ELM327-13
 |
|
|
|
|
All Rights Reserved © IC-ON-LINE 2003 - 2022 |
| [Add Bookmark] [Contact Us] [Link exchange] [Privacy policy] |
|
Mirror Sites : [www.datasheet.hk]
[www.maxim4u.com] [www.ic-on-line.cn]
[www.ic-on-line.com] [www.ic-on-line.net]
[www.alldatasheet.com.cn]
[www.gdcy.com]
[www.gdcy.net] |