AU Scantool Experiments (codes/live data!)

[AUFanboy]

Hi Folks,

I bought a cheap ELM327-based OBDII to USB scantool recently ($20) to play around with getting codes and live data from my AU. I've found some info floating around on fordmods and managed to get code reading working, and am now in the processes of figuring out the live data. I've written a small Windows application for reading and clearing codes which I'll be releasing (freely) soon. Will be using this thread to document my findings, so stay tuned!

The AU is not OBDII compliant and therefore won't work with standard OBDII scantools and software. But it does have an OBDII type connector under the dash and a J1850 PWM data network. It does not support standard OBDII Mode 01 to mode 09 PIDs, codes, etc, but does support some of the extended OBDII modes (mode 13 for getting codes, mode 22 for data). It does not support functional addressing so we need to know the physical addresses of the various modules, but the info for that is out there (PCM is address 10).

First we need to set up the ELM327 to talk to the car using AT commands. This can be done from hyperterminal or any other terminal emulator, see the ELM327 datasheed for more info elmelectronics.com/DSheets/ELM327DS.pdf

ATSP 1

This tells the ELM327 to use J1850 PWM protocol.

ATSH E4 10 F1

This sets the headers which the ELM327 will stick on the front of the messages we send. E4 specifies that we are using physical addressing, 10 is the address of the PCM, F1 is the address of the scantool.

13

This gives a list of codes. The response in my case was:

53 03 50 00 00 00 00

The first byte signifies a sucessfull request (40 + 13). Then the codes are sent as two bytes each. In this case we have one code, 0350, which is ignition coil malfunction. The following four bytes (00) are just fillers.

To clear the codes:

14

Google SAE J2190 for more info on these modes...

By issuing commands to mode 22 we can get live data from the PCM. Mode 22 PIDs are manufacturer-specific, but seems to be similar accross many fords, so there is some info out there. EG, to get current spark advance:

22 11 6B

Response with engine off:

62 11 6B 00 00

62 signifies sucessfull request (40 + 22), then the PID request is echoed (11 6B), then the data is sent, in this case as two bytes. However, there are often scale factors and offsets applied to the data returned. This is the tricky part. Going to have a play this afternoon and will post more later...