code wizards, help with some coding? (OBDII diagnostic codes)

CTdubbin · 09-23-2009, 01:23 PM

while downloading the OBDMPG Roadrunner plugin, i decided to look into the feasibility of polling and storing diagnostic trouble codes.

the information is pretty much out there, and here it is:

http://en.wikipedia.org/wiki/OBD-II_PIDs

and

http://obddiagnostics.com/obdinfo/pwmmode1.TXT

i'm confused when it comes to transferring data streams into usable DTCs.... anybody know how to do this?

the code for a P0123 code (that i came up with) would look like this:

00 00 00 01 00 10 00 11
\_/ \_/ \__/ \__/ \__/
P 0 1 2 3

unfurtunately, noone has any logs with data codes for me to try

also, the business with these A,B,C,D thingys is confusing me, especially for Mode1 PID1....using the first set of data entries and its definition, 00 would indicate no MIL lamp on (0=false) and 0 codes (because the light's not on, ignoring pending codes for a moment)

BTW, here's the data im working with : Recd 0A 41 6B 10 41 01 00 07 E1 01 7B (the 00 07 E1 01 is what we need)

the next bit "07" is supposed to represent something, according to the page, B7 i guess would be "reserved: incomplete"? (going on the possibly erroneous assumption that "b" just represents (or is a placeholder for) the 2nd set of data values, aka B7=07, on the 2nd byte)

even if that's the case, the next data byte is E1?

chunkyks · 09-23-2009, 01:39 PM

The ELM327 datasheet from elm electronics has a complete walkthrough to do exactly what you want [the walkthrough starts on page 28, but I strongly suggest starting at the beginning - as far as datasheets go, that one's surprisingly palatable].

A,B,C,D are the four bytes returned by the device as actual values. Note that a lot of OBDII mode 1 PIDs return less than four bytes [so you'd just populate A and B, for example]. Also, some mode 1 PIDs return more [according to the spec], although you're unlikely to actually need that.

Once you've decoded the trouble code, you'll need to look up what it means. You may find this gentleman's work to also be useful.

Gary (-;

Rooster · 09-23-2009, 01:50 PM

I believe a mode 01 PID 01 request just gives the MIL status and number of codes.

To get the actual codes, you need to do a mode 03 request.

The datasheet for the ELM327 at elm electronics has some good info.

Vitaliy · 09-23-2009, 02:19 PM

Quote:

i'm confused when it comes to transferring data streams into usable DTCs.... anybody know how to do this?

the code for a P0123 code (that i came up with) would look like this:

00 00 00 01 00 10 00 11
\_/ \_/ \__/ \__/ \__/
P 0 1 2 3

That's correct. In hex, "P0123" would be 0x0123. The cool thing is that you can easily just read the codes out of the raw OBD stream, I do it sometimes to impress the uninitiated.

Quote:

also, the business with these A,B,C,D thingys is confusing me, especially for Mode1 PID1....using the first set of data entries and its definition, 00 would indicate no MIL lamp on (0=false) and 0 codes (because the light's not on, ignoring pending codes for a moment)

You are absolutely correct, so which part is confusing?

Quote:

BTW, here's the data im working with : Recd 0A 41 6B 10 41 01 00 07 E1 01 7B (the 00 07 E1 01 is what we need)

This is a response to 01 01, which as you correctly said above, means that the MIL is off and there are no stored DTCs.

Here's a log generated from the ECU Sim (hint: there are two CAN ECUs responding, 10 and 18):

Code:

>0101
18 DA F1 18 06 41 01 81 00 00 00
18 DA F1 10 06 41 01 86 07 EF 80
18 DA F1 18 06 41 01 81 00 00 00

>03
18 DA F1 10 10 0E 43 06 01 00 02 00
18 DA F1 10 21 03 00 43 00 82 00 C1
18 DA F1 10 22 00 00 00 00 00 00 00
18 DA F1 18 04 43 01 01 01

>

Can you make sense of it?

Vitaliy

mgile · 09-23-2009, 03:27 PM

Here's a quick 5 lines of Python that will decode a given DTC. Note however there may be more than one DTC per response, with each DTC being 2 bytes long.

Code:

_SYSTEM             = ['P', 'C', 'B', 'U',]
_DTC_SYS_MASK       = 0xC0
_DTC_DIGIT_0_1_MASK = 0x3F
_DTC_DIGIT_2_3_MASK = 0xFF


dtc = "%s%02d%02d" % (_SYSTEM[data[0] & _DTC_SYS_MASK], data[0] & _DTC_DIGIT_0_1_MASK, data[1] & _DTC_DIGIT_2_3_MASK)

-Mike

CTdubbin · 09-28-2009, 12:43 AM

lol, some pathetic update, managed to find the source code written in ? language available here:

http://www.apeirokalia.com/elm323/clsELM323.cls.txt

i'm teaching myself how to read it, so maybe it can be reverse engineered to accomplish what i need.

right off the bat i found this

If bMode = 4 Then
send_to_OBD = False
updatestatus "Won't send mode 4 by design."
Exit Function

so that's gotta go.

im guessing this would have to be rewritten as:

If bMode = 4 Then
updatestatus "Clear codes Y/N"
If Private Sub CommandA_Click() Then
send_to_OBD = True
If Private Sub CommandB_Click()Then
send_to_OBD = False
Exit Function

and the code to pull codes would be:

send_to_obd "03"

to read the response would be:

i dunno, but i think it's under "Private Sub parse_obd_response(ByVal r$)"

and to make sense out of it would be (stealing mgile's code a bit)

If dtc = P0123 Then
updatestatus "Throttle Position Sensor/Switch A Circuit High Input"

If dtc = P0125 Then
Updatestatus "Insufficient Coolant Temperature For Closed Loop Fuel Control"

If dtc = P0126 Then
Updatestatus "Insufficient Coolant Temperature for Stable Operation"

IF someone can help me write the code for this (and what i wrote above is useful code), i'll do the monkey work and produce a txt file with every code imaginable and its description..... actually it was done already by aonther forum member, but i can still format it correctly

let me know if im on the right track with this and i'll keep trying....

chunkyks · 09-28-2009, 01:18 AM

Quote:

clsELM323 - VB6 class to interface with ELM323 chip (OBD interface)

Ugh. VB. Also, I'm not convinced it counts as "reverse engineering" if you have the source.

Polling and storing trouble codes really is easy. Perhaps if you could flick through the ELM327 [note! ELM327, not elm323 as the code you linked was] datasheet as I suggested and point out exactly which bits you need help understanding, that might be easier. Other forum users have also pointed you in the right direction.

Knowing full well that this will probably only make everything more opaque to you, I feel obliged to offer up my C implementation of mgile's code:

http://svn.icculus.org/obdgpslogger/....c?view=markup
Scroll down to obderrconvert_r. Looking at it, mgile's is probably a little bit faster, but I feel mine's a lot clearer; either one will compile down to not more than a handful of asm instructions, so I don't think it matters either way.

And off the top of my head, formatting AntiBNI's text files as you desire:

Code:

perl -pei.orig 's/^([^\[].*)$/   Updatestatus \"\1\"/;s/\[(.*)\]/If dtc == \"\1\" Then/' *.txt

Gary (-;

CTdubbin · 09-28-2009, 10:26 AM

chunksys: thanks for your response. i know that that code was written for the 323, but "the plugin uses the ELM327 VB6 class posted on these boards a while back by member Erorus to communicate to the vehicle." that's the source code used by the original OBDMPG plugin that i'm just attempting to add functionality to. Also, Mezz64 (obdmpg's creator) used that code to create his plugin, so if i wanted to write it in some other programming language, i'd have to start all over.

lol, i guess, by reverse engineer i meant to repurpose already written code to do a different job...

i couldn't possibly write this code, but i started this thread in the hopes that someone else out there wanted the ability to pull OBD codes via their carpc for free, and in a seamless manner (which is why i'm trying to piggyback the hell out of already written code)

if it's really that easy, i don't know why someone hasn't just whipped it up real quick. my only guess is those same people who could whip it up real quick already have their hand in the cookie jar (so to speak). and i'm not going to knock their hustle....

i dunno, just my rambling thoughts this morning..... i think when i get out of class and work tonite i'll get back to work on creating the skins... seems i'm more adept with the gimp paintbrush than computer code....

i think my final goal is to have everything written and ready to go, then just basically beg Mezz64 to implement it into the next release....

chunkyks · 09-28-2009, 11:24 AM

Quote:

my only guess is those same people who could whip it up real quick already have their hand in the cookie jar (so to speak). and i'm not going to knock their hustle....

Or, perhaps, because it's not an itch they wish to scratch, or because they don't use RR, or because any of a number of less financially selfish motives.

Gary (-;

CTdubbin · 09-28-2009, 03:51 PM

hey hey, in my defense, i said that i wasn't trying to knock their hustle, and also, it's source code, it could be implemented in other ways than thru a RR plugin....

also, i thought that someone else besides me cared enough, maybe not tho

Rooster · 09-30-2009, 01:35 PM

Quote: Originally Posted by Vitaliy

That's correct. In hex, "P0123" would be 0x0123. The cool thing is that you can easily just read the codes out of the raw OBD stream, I do it sometimes to impress the uninitiated.

You are absolutely correct, so which part is confusing?

This is a response to 01 01, which as you correctly said above, means that the MIL is off and there are no stored DTCs.

Here's a log generated from the ECU Sim (hint: there are two CAN ECUs responding, 10 and 18):

Code:

>0101
18 DA F1 18 06 41 01 81 00 00 00
18 DA F1 10 06 41 01 86 07 EF 80
18 DA F1 18 06 41 01 81 00 00 00

>03
18 DA F1 10 10 0E 43 06 01 00 02 00
18 DA F1 10 21 03 00 43 00 82 00 C1
18 DA F1 10 22 00 00 00 00 00 00 00
18 DA F1 18 04 43 01 01 01

>

Can you make sense of it?

Vitaliy

OK, I'll take a stab at it:

ECU 10 has 6 stored DTC's
P0E43
P0601
P0002
P0003
P0043
P0082

ECU 18 has 1 stored DTC
P0403

Am I close?

Vitaliy · 10-01-2009, 12:45 AM

Quote: Originally Posted by Rooster

OK, I'll take a stab at it:

ECU 10 has 6 stored DTC's
P0E43
P0601
P0002
P0003
P0043
P0082

ECU 18 has 1 stored DTC
P0403

Am I close?

Almost! You did very well but sorry -- it was a trick question!

18 DA F1 10 10 0E 43 06 01 00 02 00
18 DA F1 10 21 03 00 43 00 82 00 C1
18 DA F1 10 22 00 00 00 00 00 00 00

So the parts in blue are the headers, followed by the sequence numbers. So far so good. What tripped you up was the fact that you also have a byte count ($0E = 15), followed by reply to mode 3 ($43), followed by the number of DTCs (06).

Wanna give it another try?

Vitaliy

Rooster · 10-01-2009, 07:18 AM

OK, yeah the $0E threw me off.

How about:
P0100
P0200
P0300
C0300
B0200
U0100

Rooster · 10-01-2009, 07:40 AM

Quote: Originally Posted by CTdubbin

if it's really that easy, i don't know why someone hasn't just whipped it up real quick. my only guess is those same people who could whip it up real quick already have their hand in the cookie jar (so to speak). and i'm not going to knock their hustle....

For what it's worth, here is some of my code.
It assumes the response from the ELM to a $03 request is contained in the buffer 'ELMrxstr' in the fomat '43 01 33 00 00 00 00' and the number of codes is in 'num_codes'.
At this point it only handles up to 3 stored DTC's and it does not handle the CAN format (yet).

I don't know about others, but I am always a little reluctant to post my code because I am just a hacker, so don't be too hard on me !

(I'm not sure how to use the code window, I hope it is readable. And I don't think the quote at the start from CTdubbin worked quite right?? )

Code:

	if(num_codes > 0)
	{		
		sendMODEcmd(0x03);				/* request the trouble codes, wait for response */
			
			/* --------------- first trouble code ------------------ */
		MAX_goto_row_col(4,2);				/* set cursor */
		show_code_hdr(ELMrxstr[3]);			/* 1st char of 1st code */
		printf("%c", ELMrxstr[4]);			/* print next char */
		printf("%c", ELMrxstr[6]);			/* ... and next char */
		printf("%c", ELMrxstr[7]);			/* ... and last char */

			/* --------------- second trouble code ------------------ */
		if(ELMrxstr[10] == 0x30 & ELMrxstr[12] == 0x30 & ELMrxstr[13] == 0x30);		/* 000 = no code */
		else
		{
			MAX_goto_row_col(5,2);				/* set cursor */
			show_code_hdr(ELMrxstr[9]);			/* 1st char of 2nd code */
			printf("%c", ELMrxstr[10]);			/* print next char */
			printf("%c", ELMrxstr[12]);			/* ... and next char */
			printf("%c", ELMrxstr[13]);			/* ... and last char */
		}

			/* --------------- third trouble code ------------------ */
		if(ELMrxstr[16] == 0x30 & ELMrxstr[18] == 0x30 & ELMrxstr[19] == 0x30);		/* 000 = no code */
		else
		{
			MAX_goto_row_col(6,2);				/* set cursor */
			show_code_hdr(ELMrxstr[15]);		/* 1st char of 2nd code */
			printf("%c", ELMrxstr[16]);			/* print next char */
			printf("%c", ELMrxstr[18]);			/* ... and next char */
			printf("%c", ELMrxstr[19]);			/* ... and last char */
		}
	}

/* ----------------------------------------------------- */
// show_code_hdr()
//
// Show the first part of a trouble code.
// Pass the first byte of a trouble code to this function.
// Set cursor position before calling this function.
//
/* ----------------------------------------------------- */
void show_code_hdr(unsigned char value)
{
	switch(value)
	{
		case 0x30:				/* '0' Powertrain Code - SAE defined */
		{
			printf("P0");
			break ;	
		}
		case 0x31:				/* '1' Powertrain Code - manufacturer defined */
		{
			printf("P1");
			break ;	
		}
		case 0x32:				/* '2' Powertrain Code - SAE defined */
		{
			printf("P2");
			break ;	
		}
		case 0x33:				/* '3' Powertrain Code - jointly defined */
		{
			printf("P3");
			break ;	
		}
		case 0x34:				/* '4' Chassis Code - SAE defined  */
		{
			printf("C0");
			break ;	
		}
		case 0x35:				/* '5' Chassis Code - manufacturer defined */
		{
			printf("C1");
			break ;	
		}
		case 0x36:				/* '6' Chassis Code - manufacturer defined */
		{
			printf("C2");
			break ;	
		}
		case 0x37:				/* '7' Chassis Code - reserved for future */
		{
			printf("C3");
			break ;	
		}
		case 0x38:				/* '8' Body Code - SAE defined */
		{
			printf("B0");
			break ;	
		}
		case 0x39:				/* '9' Body Code - manufacturer defined */
		{
			printf("B1");
			break ;	
		}
		case 0x41:				/* 'A' Body Code - manufacturer defined */
		{
			printf("B2");
			break ;	
		}
		case 0x42:				/* 'B' Body Code - reserved for future */
		{
			printf("B3");
			break ;	
		}
		case 0x43:				/* 'C' Network Code - SAE defined */
		{
			printf("U0");
			break ;	
		}
		case 0x44:				/* 'D' Network Code - manufacturer defined */
		{
			printf("U1");
			break ;	
		}
		case 0x45:				/* 'E' Network Code - manufacturer defined */
		{
			printf("U2");
			break ;	
		}
		case 0x46:				/* 'F' Network Code - reserved for future */
		{
			printf("U3");
			break ;	
		}
		default:				/* unrecognized */
		{
			printf("xx");
			break ;	
		}
	}
}

Vitaliy · 10-01-2009, 02:50 PM

Quote: Originally Posted by Rooster

OK, yeah the $0E threw me off.

How about:
P0100
P0200
P0300
C0300
B0200
U0100

You got it.

User Name		Remember Me?
Password