ELM327 & Class 2 Serial Data

TorqueMonster

Member
Jul 25, 2020
21
USA
Hi all, I'm in a a similar boat trying to figure things out that are class 2 for my Corvette. It's a 2007 Z06 so some things translate over with it having the LS7 motor. I have some TPMS info I've figured out that I'll share. It appears to be the individual tire pressure and temperature.

I came here looking for what messages to monitor to know how to get my oil and coolant temp for an application I'm making on a Raspberry Pi. I've been at it for a week or two trying to find that information on class 2 because I don't want to have to use two adapters to monitor the CAN bus, as well. Can I share some data to see if anyone can help me decipher what I need to look for?
 

Attachments

  • tpms.png
    tpms.png
    51.7 KB · Views: 39

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
Hi all, I'm in a a similar boat trying to figure things out that are class 2 for my Corvette. It's a 2007 Z06 so some things translate over with it having the LS7 motor. I have some TPMS info I've figured out that I'll share. It appears to be the individual tire pressure and temperature.

I came here looking for what messages to monitor to know how to get my oil and coolant temp for an application I'm making on a Raspberry Pi. I've been at it for a week or two trying to find that information on class 2 because I don't want to have to use two adapters to monitor the CAN bus, as well. Can I share some data to see if anyone can help me decipher what I need to look for?


Have a text file of the captured data? It is easier to have a spreadsheet decode that way and not have to do the mental gymnastics of pulling out the W bit, the Q bit, the C bit and then all the lookups!

Do you already know the tires extended byte as to location?

11 = left front
17 = right front
31 = left rear
37 = right rear
 

TorqueMonster

Member
Jul 25, 2020
21
USA
Have a text file of the captured data? It is easier to have a spreadsheet decode that way and not have to do the mental gymnastics of pulling out the W bit, the Q bit, the C bit and then all the lookups!

Do you already know the tires extended byte as to location?

11 = left front
17 = right front
31 = left rear
37 = right rear

I do, attaching it here. Do you want me to format it in any way?

Tires - I've not worked that out yet as to which tires is which. It doesn't help that the shop that put my tires on made a mistake and two sensors are swapped. Right is left and left is right and I can't remember if it's the front or the back.

Sorry, I'm pretty new at this. I've really just been banging around hoping I see a correlation between button presses, etc. Thanks for your time. I can share the main project I'm working on if you'd like.
 

Attachments

  • ride2.txt
    9.6 KB · Views: 20
  • ride1.txt
    224.4 KB · Views: 16

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
Hi all, I'm in a a similar boat trying to figure things out that are class 2 for my Corvette. It's a 2007 Z06 so some things translate over with it having the LS7 motor. I have some TPMS info I've figured out that I'll share. It appears to be the individual tire pressure and temperature.

I came here looking for what messages to monitor to know how to get my oil and coolant temp for an application I'm making on a Raspberry Pi. I've been at it for a week or two trying to find that information on class 2 because I don't want to have to use two adapters to monitor the CAN bus, as well. Can I share some data to see if anyone can help me decipher what I need to look for?

The left column of data in your spreadsheet pic are acknowledgement messages.

They are a priority 7 (lowest possibility), type 11 message from physical address 28 to primary ID E4, with the C bit high. A type 11 message with Q bit low and C bit high is a "Report Acknowledge Extended" message.
 

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
I do, attaching it here. Do you want me to format it in any way?

Tires - I've not worked that out yet as to which tires is which. It doesn't help that the shop that put my tires on made a mistake and two sensors are swapped. Right is left and left is right and I can't remember if it's the front or the back.

Sorry, I'm pretty new at this. I've really just been banging around hoping I see a correlation between button presses, etc. Thanks for your time. I can share the main project I'm working on if you'd like.

I'm not a programmer but I'm handy with google spreadsheets. As you saw in the screenshots I've posted I have a spreadsheet set up to do all the bit breakouts and resultung lookups for me. I learn as I go. The easiest format is to duplicate the source I am using but we can also adapt.
 

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
I do, attaching it here. Do you want me to format it in any way?

Tires - I've not worked that out yet as to which tires is which. It doesn't help that the shop that put my tires on made a mistake and two sensors are swapped. Right is left and left is right and I can't remember if it's the front or the back.

Sorry, I'm pretty new at this. I've really just been banging around hoping I see a correlation between button presses, etc. Thanks for your time. I can share the main project I'm working on if you'd like.

Have a look at this.... I just threw it together, a copy of my working spreadsheet and kludged your ride 1 data into it. It will do the message type and priority bit breakouts and do some lookups. We can build on this as we go..
 

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
and do some lookups. We can build on this as we go..

Some of the node lookups will be wrong as I do not have your node list. So your C1 node will display as vehicle theft deterent, my node C0. We can add your nodes as we discover them. What is your node $C1?
 

TorqueMonster

Member
Jul 25, 2020
21
USA
Some of the node lookups will be wrong as I do not have your node list. So your C1 node will display as vehicle theft deterent, my node C0. We can add your nodes as we discover them. What is your node $C1?
I'm going to sound stupid but I wish I knew. I think you're asking which module on the network has that address, right? With a little bit of guidance I'm sure I'll be brought up to speed on what all of this means.
 

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
I'm going to sound stupid but I wish I knew. I think you're asking which module on the network has that address, right? With a little bit of guidance I'm sure I'll be brought up to speed on what all of this means.
Yep! We can figure this all out! It will take a bit but we can get there! I think!!
 

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
These are the addresses of all the nodes in your ride 1 log. There is some guidance standards that should help sorting them out.
11
28
38
40
58
60
62
80
89
97
99
A0
A1
A4
A6
C1

 

TorqueMonster

Member
Jul 25, 2020
21
USA
These are the addresses of all the nodes in your ride 1 log. There is some guidance standards that should help sorting them out.
11
28
38
40
58
60
62
80
89
97
99
A0
A1
A4
A6
C1

Got it, I'll work on that today and tomorrow. It's a bit of a hot day so I might wait a bit until I go back out in the driveway and take more data. Here's a quick thread about my project. Ask whatever you want about it if it interests you.

 

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
I do, attaching it here. Do you want me to format it in any way?

Tires - I've not worked that out yet as to which tires is which. It doesn't help that the shop that put my tires on made a mistake and two sensors are swapped. Right is left and left is right and I can't remember if it's the front or the back.

Sorry, I'm pretty new at this. I've really just been banging around hoping I see a correlation between button presses, etc. Thanks for your time. I can share the main project I'm working on if you'd like.


Here's a screenshot of your ride 1 data. We will look at an example of report status extended and an acknowledgement of that message.

Screenshot_20200725-115036.png

Look at row 872 and 873. You will see message type report status extended and report acknowledge extended. Just above and below those rows you will see report staus and report acknowledge messages. Some parameters can be addressed with a single byte and others need more detail. The "extended versions use an extended address byte seen in data byte 1, Column N. In this tire example the Secondary ID (Col M) tells us what parameter (pressure, temp,etc) and the Extended Address (Col N) tells us which tire (LF, RR, etc)

I've been throwing bit this and bit that around without describing where they come from. Each has a purpose that defines what the message operation is.

W bit is bit 0 of the Target address also called the Primary ID, Col K.
Q bit is bit 7 of the secondary ID, Col M.
C bit is bit 6 of the secondary ID, also Col M.

The values of the message type and the W bit and C bit determines what is the purpose of the message. Look at the second tab of the spreadsheet for the breakdown.
 

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
Got it, I'll work on that today and tomorrow. It's a bit of a hot day so I might wait a bit until I go back out in the driveway and take more data.

We should be able to determine some of them by the nature of what they are doing and reporting. As example my PCM is $10. Your engine RPM is being reported by $11 so it's a pretty safe bet your ECM is $11
 

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
Just noticed you were looking for ECT. It happens that we captured that parameter in the screenshot above, row 882. Your raw data appears as this


68491110838E

1st Byte = message priority and type.
2nd byte = Target address (Primary ID).
3rd byte = Source address (ECM).
4th byte = Secondary ID.
5th byte = data
6th byte = CRC

So your data value is $83.

(Hex2Dec(83)-40)*1.8+32 gives us 195.8 degrees Fahrenheit.
 

TorqueMonster

Member
Jul 25, 2020
21
USA
Yup, the car usually runs around 198F while cruising. You're really good at this. I think I just need the oil temperature now since the TPMS sends updates periodically that I can watch for. I don't think I can get the transmission gear from the OBD port. I'm going to set something up for that, likely with magnets on the shifter and some hall sensors.

Pick something from this list that matters to you. $10 will go to it for the help so far and another $10 if we can narrow down the oil temp - https://www.charitywatch.org/top-rated-charities
 

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
Yup, the car usually runs around 198F while cruising. You're really good at this. I think I just need the oil temperature now since the TPMS sends updates periodically that I can watch for. I don't think I can get the transmission gear from the OBD port. I'm going to set something up for that, likely with magnets on the shifter and some hall sensors.

Pick something from this list that matters to you. $10 will go to it for the help so far and another $10 if we can narrow down the oil temp - https://www.charitywatch.org/top-rated-charities

I have that oil temperature for you there as well. Look at the spreadsheet, output tab, scroll over the right some and you will see a bunch of headers and the values will be down wherever they appear in the data. I have oil temp in there. The colored headers up top are ones that I believe working from your data. The oil pressure seems high though.


Edit: are you seeing the slreadsheet as html? It's much better in Chrome or Sheets App. If you have a gmail account you could PM me that and I canngrant full edit rights to that cooy if my spreadsheet.
 

Enroute

Member
Jul 21, 2020
55
Miami
I am feeling empowered. I actually followed all that. Really looking forward to deciphering some of my LM7 stuff once my ELM327 get here on Wednesday. A question for TorqueMonster. Are you planning on turning this info into PIDS to use on a scan tool?
 

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
@TorqueMonster

If there are more datasets you want to research it's a snap for me to add them to the spreadsheet. We can load multiple datasets and select the one to work with in cell $A$1 of the output tab.
 

Enroute

Member
Jul 21, 2020
55
Miami
Trying to work out the math since I can not see second tab for the legend as to what the value is being presented as (C or F degrees). Please clarify as my hex to decimal converter says that $83 equeals 131 in decimal.
 

TorqueMonster

Member
Jul 25, 2020
21
USA
@TJBaker57 Ah, I see now. I think there's an offset I need to calculate for the oil. It usually stays around 165-170F if I'm cruising and 185-200F when I'm having fun. I'll try to grab some more data tonight. Know anything about deciphering the CAN bus messages? (I owe you $20)
 

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
Trying to work out the math since I can not see second tab for the legend as to what the value is being presented as (C or F degrees). Please clarify as my hex to decimal converter says that $83 equeals 131 in decimal.

Not sure what you mean by "second tab for legend".

However... You are correct that $83 = 131 dec. Then the offset is -40 for 91 celcius. Multiply by 1.8 and add 32 converts to Farenheit.
 

Enroute

Member
Jul 21, 2020
55
Miami
Sorry for the confusion and again thank you for the math clarification. I did not state my question well as I see where it looks like one question where it was really two separate requests. My bad!

Got messed up with the -40 part. What/where tells you it was being reported in Celsius?

In post #53 at the bottom you say “look at second tab of the spreadsheet for breakdown” for message type values. When I try and load your sheet, it fails so I am not able to look at “second tab”. Will try on my laptop instead of my iPad as I am sure that makes a difference. This has really been a great thread and I appreciate your help.
 

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
post #53 at the bottom you say “look at second tab of the spreadsheet for breakdown” for message type values. When I try and load your sheet, it fails so I am not able to look at “second tab”.


Ahh, I thought that might be it. The spreadsheet is somewhat sluggish due to the volume of data and mostly due to the conditional formatting that colors cells based on content. I have way too much of that going on but it helps me to follow certain "message threads".
 

TorqueMonster

Member
Jul 25, 2020
21
USA
This is dead on with -40 applied. The Z06 is a standard so I'm not optimistic about it showing what gear I'm in. I know my WRX, that does show what gear I'm in, does so by calculating the RPM vs vehicle speed.
 

Attachments

  • oiltemp.png
    oiltemp.png
    5.6 KB · Views: 8

TorqueMonster

Member
Jul 25, 2020
21
USA
Fresh data. Uploading from a random parking lot. I played with the climate controls, too, for giggles.
 

Attachments

  • tonight725.txt
    253 KB · Views: 22

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
The Z06 is a standard so I'm not optimistic about it showing what gear I'm in


Ahhh!! Funny as it may seem, I'm not a "car guy". Don't know squat about what model is what or whose. Never have been. Can't even tell who makes the car if it isn't written on it!!
 

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
Fresh data. Uploading from a random parking lot. I played with the climate controls, too, for giggles.
I found a temperature in here just now that is using a primary ID assigned to transmision/transaxle. 141.8 F maximum.

Also an outside temperature, around 78 degrees.


There is something else reporting to the same primary ID of the transmission and the report seems to be from the Body Control Module. Haven't nailed that one down yet.
 

TorqueMonster

Member
Jul 25, 2020
21
USA
I found a temperature in here just now that is using a primary ID assigned to transmision/transaxle. 141.8 F maximum.

Also an outside temperature, around 78 degrees.


There is something else reporting to the same primary ID of the transmission and the report seems to be from the Body Control Module. Haven't nailed that one down yet.

You're a wizard, I swear. I believe I have heard of people saying they've gotten transmission over-temp warnings and it makes sense for that car to be monitoring that. And that was roughly the temperature outside where I was.
 

TorqueMonster

Member
Jul 25, 2020
21
USA
I think I might be all set by using class 2. It seems to have all the relevant info. How hard is it to generate a request for values instead of monitoring? I'll just poll for info on the bus every 30-60 seconds to update my graphs and values.
 

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
How hard is it to generate a request for values instead of monitoring?


Much of what I do is simply mimicing existing messages I capture. Then modify that message to suit my needs. Sometimes I even know how it works!! :smile:

Here is a captured priority 6, type 11 message, an extended request from the IPC to the Primary ID of the tires requesting the front tire pressures.

CBE4601110A5

Substituting F1 (scantool) for the source address, and '10' for the tire temps instead of 11 for pressures I would try...

'$CB $E4 $F1 $10 $10'

Might work. Just never send a message that claims to be from the ECM, BCM, or some other existing address. You risk running afoul of message arbitration and cause a message collision.
 

TJBaker57

Original poster
Member
Aug 16, 2015
2,907
Colorado
Much of what I do is simply mimicing existing messages I capture. Then modify that message to suit my needs. Sometimes I even know how it works!! :smile:

Here is a captured priority 6, type 11 message, an extended request from the IPC to the Primary ID of the tires requesting the front tire pressures.

CBE4601110A5
Substituting F1 (scantool) for the source address, and '10' for the tire temps instead of 11 for pressures I would try...








'$CB $E4 $F1 $10 $10'

Might work. Just never send a message that claims to be from the ECM, BCM, or some other existing address. You risk running afoul of message arbitration and cause a message collision.

I succesfully got my tire pressures from my Yukon. The Yukon uses a different means of broadcasting tire pressures.

The example above from the Corvette uses an extended address message type and then requests the address value for 'all front' tires. It does so by the use of the Extended Address '10' as the final byte in the example above (previous post). Extended Address for front left wheel is $11, front right is $17. The rears are $31 LR and $37 RR so using a value of $30 in the request would return all rear tire pressures.


On the Yukon, instead of addressing tires individually or even front vs rear they are all reported in a single type 8 status report message periodically broadcast. Maybe an attempt to reduce message traffic on the bus?? Who knows but that is what I found.

So I constructed a low priority, type 9 'Status Request' message addressed to the Primary ID of $E4 (tires), and the same Secondary ID I had seen in the tire pressure broadcasts, $21.

C9E4F121
1st byte is priority and message type. Priority is determined by bits 7,6,5. 0 is high priority and 7 low. So in the example above the first byte is $C9. Expressed as binary that is 11001001. Take bits 7,6,5 and convert that '110' to decimal and we have a priority 6 message.






There are 16 message types defined for the system GM is using on these trucks and for various reasons only types 8 through 11 are used. So we only need to concern ourselves to bits 3,2,1,0 for our message type. Take those bits from our $C9 example here and we have binary 1001 which is decimal 9. A type 9 message.

Second byte is target address, in the case here a 'Functional Address' of $E4 which is one of the 'Primary ID' pair assigned to 'Tires'. It seems that requests are sent to the lower of the pair, in this case $E4 and replies come back on the higher, $E5 in this case. (we see this when we request trouble codes on $6A and the replies come back on $6B)

Third byte is the source address and I am using the default value for scantools, $F1. This is a Physical Address on the network and must be unique. (I have 'spoofed' messages claiming to be the liftgate module for the purpose of unlocking doors though)

That completes the header section of the message. If I am using my elm327 to send such a message I must first set this header with the command 'AT SH C9 E4 F1'. That command doesn't go out to the vehicle network immediately, it just sets the header in the elm327 and then later when you do send out a message to the vehicle this is the header that will be sent with your message.

Byte 4 here is the 'Secondary ID' I saw in captured class 2 data from this Yukon. The Secodary ID further defines the Primary ID. It represents a parameter, so with Primary ($E4) + Secondary ($21) we have Tires/All Pressures. This completes my status request.

The ELM327 takes care of appending our '$21' to the header we previously set with the 'AT SH' command as well as the required checksum so all that needs to be done to send this message using our elm327 is to type out '21' and hit send.

A response came from the passenger door module to Primary ID $E5, Secondary ID $21, with all the tire pressures, including a null value for the spare for which I have no sensor installed.

A8E5A12124272428FF00D4


The first 4 bytes are header and the secondary ID of $21.


Bytes 5 through 10 are the data and byte 11 is the checksum. Bytes 5,6,7,8 are my tire pressures in hexadecimal and Byte 9 would be the soare if I had a sensor there. I think byte 10 is just padding.

So my pressures of $24, $27, $24, $28 convert to 36, 39, 36, 40. Need to make an adjustment there it would appear.


I didn't delve into just what makes THIS message I sent a status request as opposed to a status report or a message acknowledgement. That will have to be another post.
 
Last edited:

Mooseman

Moderator
Dec 4, 2011
25,487
Ottawa, ON
Should we be making a new thread for this? What to keep with site rules since we have moved away from the 4.2 and on to the 5.3. Your call as i am new to this forum.

I see no problem since this thread is not engine specific in the Scan Tools general section. And there could be come cross pollination between engine families.
 

Forum Statistics

Threads
23,394
Posts
638,791
Members
18,604
Latest member
vulcantoolman

Members Online