ELM327DS详解：OBD2接口桥接器与RS232适配器

需积分: 12 74 浏览量更新于2024-07-21 收藏 446KB PDF 举报

"ELM327DS-cracker 是一份关于ELM327的使用文档，专注于ELM327DS的解释说明，适合进行OBD2开发的人员参考学习。" ELM327是一种广泛应用的汽车诊断工具，由Elm Electronics为业余爱好者和专业技术人员设计。它是一款串行接口适配器，可以将车辆的On-Board Diagnostics (OBD)端口转换成标准的RS232串行接口，以便于个人电脑、智能手机或其他智能设备与汽车的诊断系统通信。 OBD是汽车制造商为满足法规要求而提供的诊断接口，用于检测和修复车辆故障。不同的制造商遵循不同的通信协议，但这些协议通常不直接适用于PC或智能设备。ELM327的独特之处在于它能自动识别并解析九种不同的OBD协议，包括OBD-I、OBD-II及各种特定于制造商的协议，如PWM、KWP2000、ISO9141等。此外，ELM327支持高速通信，这意味着它可以快速读取和解析来自汽车ECU（电子控制单元）的数据。它还具有低功耗睡眠模式，这对于长时间监控车辆状态或构建电池供电的诊断设备尤其有用。对于J1939协议的支持，则意味着ELM327能够与卡车和公交车等商用车辆进行通信，这是许多工业应用所必需的。文档中详细介绍了ELM327的各种特性，如何使用和配置该设备，以及关于支持的协议的背景知识。其中还包括电路原理图，为连接微处理器、构建基础扫描工具和利用低功耗模式提供了实用的指导。通过这份文档，读者可以学习到如何与ELM327建立连接，设置通信参数，以及如何解读从车辆获取的数据。这将帮助开发者和汽车爱好者更好地理解车辆的运行状况，进行故障排查，甚至进行更高级的自定义功能开发。 ELM327DS-cracker是一个宝贵的资源，无论是对汽车维修人员还是对希望探索OBD2技术的DIY爱好者，都能提供丰富的知识和实践指导。

16 of 94

ELM327

ELM327DSJ Elm Electronics – Circuits for the Hobbyist

www.elmelectronics.com

detected. If there should be a significant number of

errors (due to a hardware or software problem), the

device will go off-line in order to not affect other data

on the bus. The AT CS command lets you see both

the transmitter (Tx) and the receiver (Rx) error counts,

in hexadecimal. If the transmitter should be off (count

>FF), you will see ‘OFF’ rather than a specific count.

CSM0 and CSM1 [ CAN Silent Monitoring off or on ]

The ELM327 was designed to be completely silent

while monitoring a CAN bus. Because of this, it is able

to report exactly what it sees, without colouring the

information in any way. Occasionally (when bench

testing, or when connecting to a dedicated CAN port),

it may be preferred that the ELM327 does not operate

silently (ie generates ACK bits, etc.), and this is what

the CSM command is for. CSM1 turns it on, CSM0

turns it off, and the default value is determined by

PP 21. Be careful when experimenting with this. If you

should choose the wrong baud rate then monitor the

CAN bus with the silent monitoring off, you will disturb

the flow of data. Always keep the silent monitoring on

until you are certain that you have chosen the correct

baud rate.

CTM1 [ set the Timer Multiplier to 1 ]

This command causes all timeouts set by AT ST

to be multiplied by a factor of 1. Note that this currently

only affects the CAN protocols (6 to C). CTM1 is the

default setting.

CTM5 [ set the Timer Multiplier to 5 ]

This command causes all timeouts set by AT ST

to be multiplied by a factor of 5. Note that this currently

only affects the CAN protocols (6 to C).

This command was originally added (as JTM5) to

assist with the retrieving of some J1939 messages.

We have since had several requests to allow it to

affect all CAN modes, and so have modified the JTM5

code and added the new CTM1/CTM5 commands. If

using CTM5, we caution that the Adaptive Timing code

does not monitor changes in the setting, so we advise

turning it off (with AT AT0).

By default, this multiplier is off.

CV dddd [ Calibrate the Voltage to dd.dd volts ]

The voltage reading that the ELM327 shows for an

AT RV request can be calibrated with this command.

The argument (‘dddd’) must always be provided as 4

digits, with no decimal point (it assumes that the

decimal place is between the second and the third

digits).

To use this feature, simply use an accurate meter

to read the actual input voltage, then use the CV

command to change the internal calibration (scaling)

factor. For example, if the ELM327 shows the voltage

as 12.2V while you measure 11.99 volts, then send

AT CV 1199 and the ELM327 will recalibrate itself for

that voltage (it will actually read 12.0V due to digit

roundoff). See page 29 for some more information on

how to read voltages and perform the calibration.

CV 0000 [ restore the factory Calibration Value ]

If you are experimenting with the CV dddd

command but do not have an accurate voltmeter as a

reference, you may soon get into trouble. If this

happens, you can always send AT CV 0000 to restore

the ELM327 to the original calibration value.

D [ set all to Defaults ]

This command is used to set the options to their

default (or factory) settings, as when power is first

applied. The last stored protocol will be retrieved from

memory, and will become the current setting (possibly

closing other protocols that are active). Any settings

that the user had made for custom headers, filters, or

masks will be restored to their default values, and all

timer settings will also be restored to their defaults.

D0 and D1 [ display of DLC off or on ]

Standard CAN (ISO 15765-4) OBD requires that

all messages have 8 data bytes, so displaying the

number of data bytes (the DLC) is not normally very

useful. When experimenting with other protocols,

however, it may be useful to be able to see what the

data lengths are. The D0 and D1 commands control

the display of the DLC digit (the headers must also be

on in order to see this digit). When displayed, the

single DLC digit will appear between the ID (header)

bytes and the data bytes. The default setting is

determined by PP 29.

DM1 [ monitor for DM1s ]

The SAE J1939 Protocol broadcasts trouble codes

periodically, by way of Diagnostic Mode 1 (DM1)

messages. This command sets the ELM327 to

AT Command Descriptions (continued)

17 of 94

ELM327

ELM327DSJ Elm Electronics – Circuits for the Hobbyist

www.elmelectronics.com

continually monitor for this type of message for you,

following multi-segment transport protocols as

required. Note that a combination of masks and filters

could be set to provide a similar output, but they would

not allow multiline messages to be detected. The DM1

command adds the extra logic that is needed for

multiline messages.

This command is only available when a CAN

Protocol (A, B, or C) has been selected for J1939

formatting. It returns an error if attempted under any

other conditions.

DP [ Describe the current Protocol ]

The ELM327 automatically detects a vehicle’s

OBD protocol, but does not normally report what it is.

The DP command is a convenient means of asking

what protocol the IC is currently set to (even if it has

not yet ‘connected’ to the vehicle).

If a protocol is chosen and the automatic option is

also selected, AT DP will show the word 'AUTO' before

the protocol description. Note that the description

shows the actual protocol names, not the numbers

used by the protocol setting commands.

DPN [ Describe the Protocol by Number ]

This command is similar to the DP command, but

it returns a number which represents the current

protocol. If the automatic search function is also

enabled, the number will be preceded with the letter

‘A’. The number is the same one that is used with the

set protocol and test protocol commands.

E0 and E1 [ Echo off or on ]

These commands control whether or not the

characters received on the RS232 port are echoed

(retransmitted) back to the host computer. Character

echo can be used to confirm that the characters sent

to the ELM327 were received correctly. The default is

E1 (or echo on).

FC SD [1-5 bytes] [ Flow Control Set Data to… ]

The data bytes that are sent in a CAN Flow

Control message may be defined with this command.

One to five data bytes may be specified, with the

remainder of the data bytes in the message being

automatically set to the default CAN filler byte, if

required by the protocol. Data provided with this

command is only used when Flow Control modes 1 or

2 have been enabled.

FC SH hhh [ Flow Control Set Header to… ]

The header (or more properly ‘CAN ID’) bytes

used for CAN Flow Control messages can be set using

this command. Only the right-most 11 bits of those

provided will be used - the most significant bit is

always removed. This command only affects Flow

Control mode 1.

FC SH hhhhhhhh [ Flow Control Set Header to… ]

This command is used to set the header (or ‘CAN

ID’) bits for Flow Control responses with 29 bit CAN ID

systems. Since the 8 nibbles define 32 bits, only the

right-most 29 bits of those provided will be used - the

most significant three bits are always removed. This

command only affects Flow Control mode 1.

FC SM h [ Flow Control Set Mode to h ]

This command sets how the ELM327 responds to

First Frame messages when automatic Flow Control

responses are enabled. The single digit provided can

either be ‘0’ (the default) for fully automatic responses,

‘1’ for completely user defined responses, or ‘2’ for

user defined data bytes in the response. Note that FC

modes 1 and 2 can only be enabled if you have

defined the needed data and possibly ID bytes. If you

have not, you will get an error. More complete details

and examples can be found in the Altering Flow

Control Messages section (page 60).

FE [ Forget Events ]

There are certain events which may change how

the ELM327 responds from that time onwards. One of

these is the occurrence of a fatal CAN error (ERR94),

which blocks subsequent searching through CAN

protocols if PP 2A bit 5 is ‘1’. Normally, an event such

as this will affect all searches until the next power off

and on, but it can be ‘forgotten’ using software, with

the AT FE command.

Another example is an ‘LV RESET’ event which

will prevent searches through CAN protocols if PP 2A

bit 4 is ‘1’. It may also be forgotten with the AT FE

command.

AT Command Descriptions (continued)

FI [ perform a Fast Initiation ]

One version of the Keyword protocol uses what is

known as a 'fast initiation' sequence to begin

communications. Usually, this sequence is performed

when the first message needs to be sent, and then the

message is sent immediately after. Some ECUs may

need more time between the two however, and having

a separate initiation command allows you to control

this time. Simply send AT FI, wait a little, then send the

message. You may need to experiment to get the right

amount of delay.

Another use for this command might be if you

would like to perform a fast initiation with an ISO 9141

type protocol (ie 3 - CARB format). Simply follow these

steps to do that:

AT SP 5

AT FI

AT SP 3

AT BI

and you should be able to then communicate with the

ECU. Note that a protocol close (ie AT PC) is not

required in the above code, as the ELM327

automatically performs one when you switch protocols.

Protocol 5 must be selected to use the AT FI

command, or an error will result.

H0 and H1 [ Headers off or on ]

These commands control whether or not the

additional (header) bytes of information are shown in

the responses from the vehicle. These are not

normally shown by the ELM327, but may be of interest

(especially if you receive multiple responses and wish

to determine what modules they were from).

Turning the headers on (with AT H1) actually

shows more than just the header bytes – you will see

the complete message as transmitted, including the

check-digits and PCI bytes, and possibly the CAN data

length code (DLC) if it has been enabled with PP 29 or

AT D1. The current version of this IC does not display

the CAN CRC code, nor the special J1850 IFR bytes

(which some protocols use to acknowledge receipt of a

message).

I [ Identify yourself ]

Issuing this command causes the chip to identify

itself, by printing the startup product ID string (currently

‘ELM327 v2.1’). Software can use this to determine

exactly which integrated circuit it is talking to, without

having to reset the IC.

IB 10 [ set the ISO Baud rate to 10400 ]

This command restores the ISO 9141-2 and

ISO 14230-4 baud rates to the default value of 10400.

IB 48 [ set the ISO Baud rate to 4800 ]

This command is used to change the baud rate

used for the ISO 9141-2 and ISO 14230-4 protocols

(numbers 3, 4, and 5) to 4800 baud, while relaxing

some of the requirements for the initiation byte

transfers. It may be useful for experimenting with some

vehicles. Normal (10,400 baud) operation may be

restored at any time with the IB 10 command.

IB 96 [ set the ISO Baud rate to 9600 ]

This command is used to change the baud rate

used for the ISO 9141-2 and ISO 14230-4 protocols

(numbers 3, 4, and 5) to 9600 baud, while relaxing

some of the requirements for the initiation byte

transfers. It may be useful for experimenting with some

vehicles. Normal (10,400 baud) operation may be

restored at any time with the IB 10 command.

IFR0, IFR1, and IFR2 [ IFR control ]

The SAE J1850 protocol allows for an In-Frame

Response (IFR) byte to be sent after each message,

usually to acknowledge the correct receipt of that

message. The ELM327 automatically generates and

sends this byte for you by default, but you can override

this behaviour with this command.

The AT IFR0 command will disable the sending of

all IFRs, no matter what the header bytes require.

AT IFR2 is the opposite - it will cause an IFR byte to

always be sent, no matter what the header bytes say.

The AT IFR1 command is the default mode, with the

sending of IFRs determined by the ‘K’ bit of the first

header byte (for both PWM and VPW).

IFR H and IFR S [ IFR from Header or Source ]

The value sent in the J1850 In-Frame Response

(IFR) byte is normally the same as the value sent as

the Source (or Tester) Address byte that was in the

header of the request. There may be occasions when

it is desirable to use some other value, however, and

this set of commands allows for this.

18 of 94

ELM327

ELM327DSJ Elm Electronics – Circuits for the Hobbyist

www.elmelectronics.com

AT Command Descriptions (continued)

19 of 94

ELM327

ELM327DSJ Elm Electronics – Circuits for the Hobbyist

www.elmelectronics.com

If you send AT IFR S, the ELM327 will use the

value defined as the Source Address (usually F1, but it

can be changed with PP 06), even if another value

was sent in the Header bytes. This is not what is

normally required, and caution should be used when

using AT IFR S. AT IFR H restores the sending of the

IFR bytes to those provided in the Header, and is the

default setting.

IGN [ read the IgnMon input level ]

This command reads the signal level at pin 15. It

assumes that the logic level is related to the ignition

voltage, so if the input is at a high level, the response

will be ‘ON’, and a low level will report ‘OFF’.

This feature is most useful if you wish to perform

the power control functions using your own software. If

you disable the Low Power automatic response to a

low input on this pin (by setting bit 2 of PP 0E to 0),

then pin 15 will function as the RTS input. A low level

on the input will not turn the power off, but it will

interrupt any OBD activity that is in progress. All you

need to do is detect the ‘STOPPED’ message that is

sent when the ELM327 is interrupted, and then check

the level at pin 15 using AT IGN. If it is found to be

OFF, you can perform an orderly shutdown yourself.

IIA hh [ set the ISO Init Address to hh ]

The ISO 9141-2 and ISO 14230-4 standards state

that when beginning a session with an ECU, the

initiation sequence is to be directed to a specific

address ($33). If you wish to experiment by directing

the slow five baud sequence to another address, it is

done with this command. For example, if you prefer

that the initiation be performed with the ECU at

address $7A, then simply send:

>AT IIA 7A

and the ELM327 will use that address when called to

do so (protocols 3 or 4). The full eight bit value is used

exactly as provided – no changes are made to it (ie no

adding of parity bits, etc.)

Note that setting this value does not affect any

address values used in the header bytes. The ISO init

address is restored to $33 whenever the defaults, or

the ELM327, are reset.

JE [ enables the J1939 ELM data format ]

The J1939 standard requires that PGN requests

be sent with the byte order reversed from the standard

‘left-to-right’ order, which many of us would expect. For

example, to send a request for the engine temperature

(PGN 00FEEE), the data bytes are actually sent in the

reverse order (ie EE FE 00), and the ELM327 would

normally expect you to provide the data in that order

for passing on to the vehicle.

When experimenting, this constant need for byte

reversals can be quite confusing, so we have defined

an ELM format that reverses the bytes for you. When

the J1939 ELM (JE) format is enabled, and you have a

J1939 protocol selected, and you provide three data

bytes to the ELM327, it will reverse the order for you

before sending them to the ECU. To request the

engine temperature PGN, you would send 00 FE EE

(and not EE FE 00). The ‘JE’ type of automatic

formatting is enabled by default.

JHF0 and JHF1 [ J1939 Header Formatting off or on ]

When printing responses, the ELM327 normally

formats the J1939 ID (ie Header) bits in such a way as

to isolate the priority bits and group all the PGN

information, while keeping the source address byte

separate. If you prefer to see the ID information as four

separate bytes (which a lot of the J1939 software

seems to do), then simply turn off the formatting with

JHF0. The CAF0 command has the same effect (and

overrides the JHF setting), but also affects other

formatting. The default setting is JHF1.

JS [ enables the J1939 SAE data format ]

The AT JS command disables the automatic byte

reordering that the JE command performs for you. If

you wish to send data bytes to the J1939 vehicle

without any manipulation of the byte order (ie in the

order specified by the SAE documents), then select JS

formatting.

As an example, when sending a request for

engine temperature (PGN 00FEEE) with the data

format set to JS, you must present the bytes to the

ELM327 as EE FE 00 (this is also known as little-

endian byte ordering).

The JS type of data formatting is off by default.

JTM1 [ set the J1939 Timer Multiplier to 1 ]

This used to set the AT ST time multiplier to 1, for

the SAE J1939 protocol. As of firmware v2.1, this

AT Command Descriptions (continued)

剩余93页未读，继续阅读

最伟大的程序员

粉丝: 18
资源: 2

ELM327DS详解：OBD2接口桥接器与RS232适配器

ELM327软件

ELM327资料

fern-wifi-cracker:自动从code.google.compfern-wifi-cracker导出

DSA-Cracker-Sheeet:DS和Algo的450个问题

gerix-wifi-cracker-2

polly-wants-a-cracker

Password-Cracker

sample-cracker

exe-cracker-lerning

JAccount-identifying-code-cracker:工具

最新资源