Elm327 PDF

ELM327
OBD to RS232 Interpreter
Description Features
Almost all new automobiles produced today are Supports 12 protocols
required, by law, to provide an interface from which
Automatically searches for a protocol
test equipment can obtain diagnostic information.
The data transfer on these interfaces follow several Fully configurable with AT commands
standards, none of which are directly compatible
RS232 baud rates to 500Kbps
with PCs or PDAs. The ELM327 is designed to act
as a bridge between these On-Board Diagnostics Voltage input for battery monitoring
(OBD) ports and standard RS232 ports.
Low power CMOS design
The ELM327 builds on improved versions of our
proven ELM320, ELM322, and ELM323 interfaces
by adding seven CAN protocols to them. The result Connection Diagram
is an IC that can automatically sense and convert PDIP and SOIC
the most common protocols in use today. There are (top view)
a number of other improvements as well a high
speed RS232 option, battery voltage monitoring, and MCLR OBD Tx LED
customizable features through programmable Vmeasure OBD Rx LED
parameters, to name only a few. J1850 Volts RS232 Tx LED
The ELM327 requires few external components J1850 Bus+ RS232 Rx LED
to make a fully functioning circuit. The following Memory CAN Rx
pages discuss the interface details, and show how to
Baud Rate CAN Tx
use the IC to talk to your vehicle, then concludes
LFmode ISO L
with two schematics to get you started.
VSS ISO K
XT1 VDD
Applications XT2 VSS
VPW In RS232 Rx
Diagnostic trouble code readers
ISO In RS232 Tx
Automotive scan tools PWM In Busy
Teaching aids J1850 Bus- RTS
4.00 MHz
Block Diagram
Memory MCLR
XT1 9 10 XT2
5 1 Vmeasure
2
Baud Rate 6 A/D

Command Converter
LFmode 7
and
Protocol
RS232Rx 18
Interpreter CAN
RS232 ISO 9141-2 SAE J1850
ISO 15765-4
RS232Tx Interface ISO 14230-4 PWM & VPW
17 SAE J1939*
RTS 15
23 24 21 22 12 3 4 14 13 11
Busy 16 25 28
status LEDs OBD interfaces *some support
ELM327DSC Elm Electronics Circuits for the Hobbyist 1 of 51

www.elmelectronics.com
ELM327
Pin Descriptions
MCLR (pin 1)
A momentary logic low applied to this input will reset interface. If it is at a high level during power-up or
the IC. If unused, this pin should be connected to a reset, the baud rate will be set to 38400 (or the
logic high (VDD) level. rate that has been set by PP 0C). If at a low level,
the baud rate will be 9600.
Vmeasure (pin 2)
This analog input is used to measure a 0 to 5V LFmode (pin 7)
signal that is applied to it. Care must be taken to This input is used to select the default linefeed
prevent the voltage from going outside of the supply mode to be used after a power-up or system reset.
levels of the ELM327, or damage may occur. If it is If it is at a high level, then by default messages
not used, this pin should be tied to either VDD or VSS. sent by the ELM327 will be terminated with both a
carriage return and a linefeed character. If it is at a
J1850 Volts (pin 3) low level, lines will be terminated by a carriage
This output can be used to control a voltage supply return only. This behaviour can always be modified
for the J1850 Bus+ output. The pin will output a logic by issuing an AT L1 or AT L0 command (see the
high level when a nominal 8V is required (for J1850 section on AT Commands).
VPW), and will output a low level when 5V is needed
(as for J1850 PWM applications). If this switching VSS (pins 8 and 19)
capability is not required for your application, this Circuit common must be connected to these pins.
output can be left open-circuited.
XT1 (pin 9) and XT2 (pin 10)
J1850 Bus+ (pin 4)
A 4.000 MHz oscillator crystal is connected
This active high output is used to drive the between these two pins. Loading capacitors as
J1850 Bus+ Line to an active level. Note that this required by the crystal (typically 27pF each) will
signal does not have to be used for the Bus- Line (as also need to be connected between each of these
was the case for the ELM320), since a separate pins and circuit common (Vss).
J1850 Bus- drive output is provided on pin 14.
Note that this device has not been configured for
operation with an external oscillator it expects a
Memory (pin 5)
crystal to be connected to these pins. Use of an
This input controls the default state of the memory external clock source is not recommended.
option. If this pin is at a high level during power-up or
reset, the memory function will be enabled by VPW In (pin 11)
default. If it is at a low level, then the default will be
This is the active high input for the J1850 VPW
to have it disabled. Memory can always be enabled
data signal. When at rest (bus recessive) this pin
or disabled with the AT M1 and AT M0 commands.
should be at a low logic level. This input has
Schmitt trigger waveshaping, so no special
Baud Rate (pin 6)
amplification is required.
This input controls the baud rate of the RS232
All rights reserved. Copyright 2005, 2006, and 2007 by Elm Electronics Inc.
Every effort is made to verify the accuracy of information provided in this document, but no representation or warranty can be
given and no liability assumed by Elm Electronics with respect to the accuracy and/or use of any products or information
described in this document. Elm Electronics will not be responsible for any patent infringements arising from the use of these
products or information, and does not authorize or warrant the use of any Elm Electronics product in life support devices and/or
systems. Elm Electronics reserves the right to make changes to the device(s) described in this document in order to improve
reliability, function, or design.

ELM327
Pin Descriptions (continued)

ISO In (pin 12) RS232Rx (pin 18)
This is the active low input for the ISO 9141 and This is the RS232 receive data input. The signal
ISO 14230 data signal. It is derived from the K Line, level is compatible with most interface ICs (when at
and should be at a high logic level when at rest (bus idle, the level is normally high), but can be used with
recessive). No special amplification is required, as other interfaces as well, since the input has Schmitt
this input has Schmitt trigger waveshaping. trigger waveshaping.
PWM In (pin 13) VDD (pin 20)

This is the active low input for the J1850 PWM data This pin is the positive supply pin, and should always
signal. It should normally be at a high level when at be the most positive point in the circuit. Internal
rest (ie. bus recessive). This input has Schmitt circuitry connected to this pin is used to provide
trigger waveshaping, so no special amplification is power on reset of the microprocessor, so an external
required. reset signal is not required. Refer to the Electrical
Characteristics section for further information.
J1850 Bus- (pin 14)
This active high output is used to drive the J1850 ISO K (pin 21) and ISO L (pin 22)
Bus- Line to an active (dominant) level for J1850 These are the active high output signals which are
PWM applications. If unused, this output can be left used to drive the ISO 9141 and ISO 14230 buses to
open-circuited. an active (dominant) level. Many new vehicles do not
require the L Line if yours does not, you can simply
RTS (pin 15) leave pin 22 open-circuited.
This active low Request To Send input can be used
to interrupt the OBD processing in order to send a CAN Tx (pin 23) and CAN Rx (pin 24)
new command. Normally high, the line is brought low These are the two CAN interface signals that must
for attention, and should remain so until the Busy be connected to a CAN transeiver IC for proper
line (pin 16) indicates that the ELM327 is no longer operation. If you are connecting to an existing CAN
busy. This input has Schmitt trigger waveshaping. system, the integrity of the entire system might be
jeopardized if a proper interface is not used. See the
Busy (pin 16) Example Applications section for more information.
This active high output shows the current state of the
ELM327. If it is at a low level, the processor is ready RS232 Rx LED (pin 25), RS232 Tx LED (pin 26),
to receive ASCII commands and characters, but if it OBD Rx LED (pin 27) and OBD Tx LED (pin 28)
is at a high level, commands are being processed. These four output pins are normally high, and are
driven to low levels when the ELM327 is transmitting
RS232Tx (pin 17) or receiving data. Current capability is suitable for
This is the RS232 data transmit output. The signal directly driving most LEDs through current limiting
level is compatible with most interface ICs (output is resistors, or interfacing to other logic for status
normally high), and there is sufficient current drive to reporting. If unused, these pins should be left open-
allow interfacing using only a PNP transistor, if circuited.
desired.
Ordering Information
These integrated circuits are 28 pin devices, available in either a 300 mil wide plastic (skinny) DIP format or in a
300 mil SOIC surface mount type of package. To order, add the appropriate suffix to the part number:
300 mil 28 pin Plastic DIP..............................ELM327P 300 mil 28 pin SOIC....................................ELM327SM

ELM327
Absolute Maximum Ratings

Storage Temperature....................... -65C to +150C Note:
Ambient Temperature with Stresses beyond those listed here will likely damage
Power Applied....................................-40C to +85C the device. These values are given as a design
guideline only. The ability to operate to these levels
Voltage on VDD with respect to VSS............ 0 to +7.5V is neither inferred nor recommended.
Voltage on any other pin with
respect to VSS........................... -0.3V to (VDD + 0.3V)
Electrical Characteristics
All values are for operation at 25C and a 5V supply, unless otherwise noted. For further information, refer to note 1 below.
Characteristic Minimum Typical Maximum Units Conditions
Supply voltage, VDD 4.5 5.0 5.5 V
VDD rate of rise 0.05 V/ms see note 2
Average supply current, IDD 9 mA see note 3
Input threshold voltage 1.0 1.3 V all except Schmitt inputs
Schmitt trigger rising 2.9 4.0 V see note 4

input thresholds
falling 1.0 1.5 V
Output low voltage 0.3 V current (sink) = 10 mA
Output high voltage 4.6 V current (source) = 10 mA
Brown-out reset voltage 4.07 4.2 4.59 V
A/D conversion time 7 msec see note 5
Notes:
1. This integrated circuit is produced with one of Microchip Technology Inc.s PIC18F2x8x family of devices as
the core embedded microcontroller. For further device specifications, and possibly clarification of those
given, please refer to the appropriate Microchip documentation (available at http://www.microchip.com/).
2. This spec must be met in order to ensure that a correct power on reset occurs. It is quite easily achieved
using most common types of supplies, but may be violated if one uses a slowly varying supply voltage, as
may be obtained through direct connection to solar cells or some charge pump circuits.
3. Device only. Does not include any load currents.
4. Pins 1, 11, 12, 13, 15 and 18 (only) have internal Schmitt trigger waveshaping circuitry. All other inputs use
standard CMOS circuitry.
5. The typical width of the Busy output pulse while the ELM327 interprets the command, measures the voltage,
scales it and then transmits the result of a mid-range measurement, with the RS232 rate at 38400 baud.

ELM327
Overview
The following describes how to use the ELM327 to features of this product as well.
obtain information from your vehicle. Using the ELM327 is not as daunting as it first
We begin by discussing just how to talk to the IC seems. Many users will never need to issue an AT
using a PC, then explain how to change options using command, adjust timeouts, or change the headers. For
AT commands, and finally we show how to use the most, all that is required is a PC or a PDA with a
ELM327 to obtain trouble codes (and reset them). For terminal program (such as HyperTerminal or ZTerm),
the more advanced experimenters, there are also and knowledge of one or two OBD commands, which
sections on how to use some of the programmable we will provide in the following sections
Communicating with the ELM327

The ELM327 expects to communicate with the computer connections and terminal software settings
host through an RS232 serial connection. Modern are correct (however, at this point no communications
computers do not usually provide a physical have taken place with the vehicle, so the state of that
connection such as this, but there are several ways in connection is still unknown). The > character that is
which a virtual serial port can be created. The most shown on the second line is the ELM327s prompt
common devices are USB to RS232 adapters, but character. It indicates that the device is in the idle
there are several others such as ethernet to RS232 state, ready to receive characters on the RS232 port.
devices, or Bluetooth to serial adapters. Characters sent from the computer can either be
No matter how you physically connect to the intended for the ELM327s internal use, or for
ELM327, you will need a way to send and receive reformatting and passing on to the vehicle. The
characters. To do this, the simplest method is to use ELM327 can quickly determine where the received
one of the many terminal programs that are available characters are to be directed by analyzing the entire
(HyperTerminal, ZTerm, etc.), to allow typing the string once the complete message has been received.
characters directly from your keyboard. Commands for the ELM327s internal use will always
To use a terminal program, you will need to make begin with the characters AT, while OBD commands
several settings. First, ensure that your software is set for the vehicle are only allowed to contain the ASCII
to use the proper COM port, and that you have codes for hexadecimal digits (0 to 9 and A to F).
chosen the proper data rate - this will be either 9600 Whether an AT type internal command or a hex
baud (if pin 6=0V at power up), or 38400 baud (if string for the OBD bus, all messages to the ELM327
PP 0C has not been changed). If you select the wrong must be terminated with a carriage return character
COM port, you will not be able to send or receive any (hex 0D) before it will be acted upon. The one
data. If you select the wrong data rate, the information exception is when an incomplete string is sent and no
that you send and receive will be all garbled, and carriage return appears. In this case, an internal timer
unreadable by you or the ELM327. Dont forget to also will automatically abort the incomplete message after
set your connection for 8 data bits, no parity bits, and 1 about 20 seconds, and the ELM327 will print a single
stop bit, and to also set it for the proper line end question mark (?) to show that the input was not
mode. All of the responses from the ELM327 are understood (and was not acted upon).
terminated with a single carriage return character and, Messages that are not understood by the ELM327
optionally, a linefeed character (depending on your (syntax errors) will always be signalled by a single
settings). question mark. These include incomplete messages,
Properly connected and powered, the ELM327 will incorrect AT commands, or invalid hexadecimal digit
energize the four LED outputs in sequence (as a lamp strings, but are not an indication of whether or not the
test) and will then send the message: message was understood by the vehicle. One must
keep in mind that the ELM327 is a protocol interpreter
ELM327 v1.2
that makes no attempt to assess the OBD messages
> for validity it only ensures that an even number of
hex digits were received, combined into bytes, then
In addition to identifying the version of this IC,
sent out the OBD port, and it does not know if the
receiving this string is a good way to confirm that the

ELM327
Communicating with the ELM327 (continued)

message sent to the vehicle was in error. case-sensitive, so ATZ is equivalent to atz, and to
While processing OBD commands, the ELM327 AtZ. Also, it ignores space characters and all control
will continually monitor for an RTS input, or an RS232 characters (tab, linefeed, etc.) in the input, so they can
input. Either one will interrupt the IC, quickly returning be inserted anywhere to improve readability. Another
control to the user, and possibly aborting any initiation, feature is that sending only a single carriage return
etc. that was in progress. If you desire to interrupt the character will always repeat the last command (making
ELM327, thats fine, but for normal orderly data it easier to request updates on dynamic data such as
transfer, users should always wait for either the prompt engine rpm).
character (> or hex 3E), or a low level on the Busy
output before beginning to send the next command.
Finally, it should be noted that the ELM327 is not
AT Commands
Several parameters within the ELM327 can be command, so the user knows that it has been
adjusted in order to modify its behaviour. These do not executed.
normally have to be changed before attempting to talk Some of the following commands allow passing
to the vehicle, but occasionally the user may wish to numbers as arguments in order to set the internal
customize these settings for example by turning the values. These will always be hexadecimal numbers
character echo off, adjusting a timeout value, or which must generally be provided in pairs. The
changing the header bytes. In order to do this, internal hexadecimal conversion chart in the OBD Commands
AT commands must be issued. section may prove useful if you wish to interpret the
Those familiar with PC modems will immediately values. Also, one should be aware that for the on/off
recognize AT commands as a standard way in which types of commands, the second character is the
modems are internally configured. The ELM327 uses number 1 or 0, the universal terms for on and off.
essentially the same method, always watching the The following is a description of all of the AT
data sent by the PC, looking for messages that begin commands that are recognized by the current version
with the character A followed by the character T. If of the ELM327. Since there are many, a summary
found, the next characters will be interpreted as page is provided after this section.
internal configuration or AT commands, and will be
executed upon receipt of a terminating carriage return
character. The ELM327 will usually reply with the
characters OK on the successful completion of a
AL [ Allow Long messages ] message is being sent to. With the auto receive mode
in effect, the value used for the receive address will be
The standard OBDII protocols restrict the number
chosen based on the current header bytes, and will
of data bytes in a message to seven, which the
automatically be updated whenever the header bytes
ELM327 normally does as well (for both send and
are changed.
receive). If AL is selected, the ELM327 will allow long
The value that is used for the receive address is
sends (eight data bytes) and long receives (unlimited
determined based on the contents of the first header
in number). The default is AL off (and NL selected).
byte. If it shows that the message uses physical
addressing, the third header byte of the header is used
AR [ Automatically set the Receive address ] for the receive address, otherwise (for functional
addressing) the second header byte, increased in
Responses from the vehicle will be acknowledged value by 1, will be used. Auto Receive is turned on by
and displayed by the ELM327, if its internally stored default, and is not used by the J1939 formatting.
receive address matches the address that the

ELM327
AT Commands (continued)
AT0, AT1 and AT2 [ Adaptive Timing control ] BI [ Bypass the Initialization sequence ]
When receiving responses from a vehicle, the This command should be used with caution. It
ELM327 has traditionally waited the time set by the allows an OBD protocol to be made active without
AT ST hh setting for a response. To ensure that the IC requiring any sort of initiation or handshaking to occur.
would work with a wide variety of vehicles, the default The initiation process is normally used to validate the
value was set to a conservative (slow) value. Although protocol, and without it, results may be difficult to
it was adjustable, many people did not have the predict. It should not be used for routine OBD use, and
equipment or experience to determine a better value. has only been provided to allow the construction of
The new Adaptive Timing feature will automatically ECU simulators and training demonstrators.
set the timeout value for you, based on the actual
response times that your vehicle is responding in. As
conditions such as bus loading, etc. change, the BRD hh [ try Baud Rate Divisor hh ]
algorithm learns from them, and makes appropriate This command is used to change the RS232 baud
adjustments. Note that it always uses your AT ST hh rate divisor to the hex value provided by hh. The actual
setting as a maximum setting, however. With this new baud rate (in kbps) will be 4000 divided by this divisor.
Adaptive Timing, sampling rates are often doubled or For example, a setting of 115.2kbps would require a
tripled from those typically experienced with prior divisor of 4000/115.2 or 35. In hexadecimal notation,
versions. 35 is written as 23, so the actual command that needs
There are three adaptive timing settings that are to be sent would be AT BRD 23.
available for use. By default, Adaptive Timing option 1 Since the ELM327 may be able to operate at
(AT1) is selected, and is the recommended setting. much higher rates than some interfaces can support,
AT0 is used to disable Adaptive timing (usually used the BRD command allows requested rates to be tested
when experimenting), while AT2 is a more agressive before they are committed to (with automatic fall-back
version of AT1 (the effect is more noticeable for very to the previous baud rate if there are problems). In
slow connections you may not see much difference use, the command is sent to request a change in the
with faster OBD systems). The J1939 protocol does baud rate, and the ELM327 responds with the familiar
not support Adaptive Timing responses for J1939 OK. After that, an internal timer begins waiting, to
use fixed timeouts as set in the standard. ensure that the controlling computer has sufficient time
to change their baud rate to the new rate. The ELM327
BD [ perform an OBD Buffer Dump ] then sends the poweron message at the new baud
rate, and begins waiting while the controlling computer
All messages sent and received by the ELM327 assesses what has been received. If the AT I message
are stored temporarily in a set of twelve memory was received without errors, the controlling computer
storage locations called the OBD Buffer. Occasionally, sends a carriage return character, and if received by
it may be of use to view the contents of this buffer, the ELM327, the rate will be retained. If the controlling
perhaps to see why an initiation failed, to see the computer sees errors (or worse, nothing), it provides
header bytes in the last message, or just to learn more no response, and switches back to the initial baud
of the structure of OBD messages. You can ask at any rate. If the ELM327 times out after receiving no
time for the contents of this buffer to be dumped response, or has received something that does not
(printed) when you do, the ELM327 sends a length appear to be a carriage return character, it will revert
byte (representing the length of the message in the back to the former baud rate. A more detailed
buffer) followed by the contents of all twelve OBD discussion of this entire process is provided in the
buffer locations. Using Higher RS232 Baud Rates section.
The length byte represents the actual number of Any new baud rate that is set in this manner is
bytes received, whether they fit into the OBD buffer or retained across calls to set defaults (AT D), and for
not. This may be useful when viewing long data warm starts (AT WS), but will not survive a hardware
streams (with AT AL), as the number accurately reset (a power off/on or a call to AT Z). If you are in the
represents the number of bytes received, mod 256. habit of calling AT Z in your code, we advise using AT
Note that only the first twelve bytes received are WS instead.
stored in the buffer.

ELM327
BRT hh [ set Baud Rate Timeout to hh ] be inserted for you. Similarly, when sending a data
request with formatting off, you must provide all of the
This command allows the timeout used for the
required data bytes exactly as they are to be sent
Baud Rate handshake (AT BRD) to be varied. The
the ELM327 will not perform any formatting for you
time delay is given by hh x 5.0 msec, where hh is a
other than to add some trailing 'padding' bytes to
hexadecimal value. The default value for this setting is
ensure that the required eight data bytes are sent. This
0F, providing 75msec. Note that a value of 00 does not
allows operation in systems that do not use PCI bytes
result in 0 msec - it provides the maximum time of 256
as ISO 15765-4 does.
x 5.0 msec.
Note that turning the display of headers on (with
AT H1) will override some of the CAF1 formatting of
the received data frames, so that the received bytes
CAF0 and CAF1 [ CAN Auto Formatting off or on ]
will appear much like in the CAF0 mode (ie. as
These commands determine whether the ELM327 received). It is only the printing of the received data
assists you with the formatting of the CAN data that is that will be affected when both CAF1 and H1 modes
sent and received. With CAN Automatic Formatting are enabled, though; when sending data, the PCI byte
enabled (CAF1), the IC will automatically generate will still be created for you and padding bytes will still
formatting (PCI) bytes for you when sending, and will be added. Auto Formatting on (CAF1) is the default
remove them when receiving. This means that you can setting for the ELM327.
continue to issue OBD requests (01 00, etc.) as usual,
without regard to these extra bytes that the CAN
diagnostics systems require. With formatting on, the CF hhh [ set the CAN ID Filter to hhh ]
trailing (unused) data bytes that are received in a The CAN Filter works in conjunction with the CAN
frame will be removed as well, and only the relevant Mask to determine what information is to be accepted
ones will be shown. Beginning with v1.2 of the by the receiver. As each message is received, the
ELM327, lines with invalid PCI bytes are now ignored, incoming CAN ID bits are compared to the CAN Filter
rather than showing them as <DATA ERRORs. bits (when the mask bit is a 1). If all of the relevant
Occasionally, long (multi-frame) responses are bits match, the message will be accepted, and
returned by the vehicle. To help you analyze these, the processed by the ELM327, otherwise it will be
Auto Formatting mode will extract the total data length discarded. This three nibble version of the CAN Filter
and print it on one line. Following this will be each command makes it a little easier to set filters with 11
segment of the message, with the segment number (a bit ID CAN systems. Only the rightmost 11 bits of the
single hexadecimal digit) shown at the beginning of the provided nibbles are used, and the most significant bit
line with a colon (':') as a separator. is ignored. The data is actually stored as four bytes
You may also see the characters 'FC: ' at the internally however, with this command adding leading
beginning of a line (if you are experimenting). This zeros for the other bytes. See the CM command(s) for
represents a Flow Control message that is sent in more details.
response to a multi-line message. Flow Control
messages are automatically generated by the ELM327
in response to a First Frame reply, as long as the CF hh hh hh hh [ set the CAN ID Filter to hhhhhhhh ]
CFC setting is on (it does not matter whether you have
This command allows all four bytes (actually 29
selected the CAF1 or the CAF0 modes).
bits) of the CAN Filter to be set at once. The 3 most
Another type of message the RTR (or Remote
significant bits will always be ignored, and can be
Transfer Request) will be automatically hidden for
given any value. Note that this command can be used
you when in the CAF1 mode, since they contain no
to enter 11 bit ID filters as well, since they are stored in
data. When auto formatting is off (CAF0), you will see
the same locations internally (entering AT CF 00 00 0h
the characters 'RTR' printed when a remote transfer
hh is exactly the same as entering the shorter AT CF
request frame has been received.
hhh command).
Turning the CAN Automatic Formatting off (CAF0),
will cause the ELM327 to print all of the received data
bytes. No bytes will be hidden from you, and none will

ELM327
CFC0 and CFC1 [ CAN Flow Control off or on ] bits are set with the AT SH command). Some systems
use several of these bits to assign a priority value to
The ISO 15765-4 protocol expects a Flow
messages, which is how the command was named.
Control message to always be sent in response to a
Any bits provided in excess of the five required will be
First Frame message. The ELM327 automatically
ignored, and not stored by the ELM327 (it only uses
sends these, without any intervention by the user. If
the five least significant bits of this byte). The default
experimenting with a non-OBD system, it may be
value for these priority bits is hex 18.
desirable to turn this automatic response off, and the
AT CFC0 command has been provided for that
purpose. The default setting is CFC1 - Flow Controls CS [ show the CAN Status ]
on.
Note that during monitoring (AT MA, MR, or MT), The CAN protocol requires that statistics be kept
there are never any Flow Controls sent no matter what regarding the number of transmit and receive errors
the CFC option is set to. detected. If there should be a significant number of
them, the device can even go off-line in order not to
affect other data on the bus, should there be a
CM hhh [ set the CAN ID Mask to hhh ] hardware or software fault. The AT CS command lets
you see both the Tx and the Rx error counts. If the
There can be a great many messages being
transmitter should be off (count >FF), you will see
transmitted in a CAN system at any one time. In order
OFF rather than a specific count.
to limit what the ELM327 views, there needs to be a
system of filtering out the relevant ones from all the
others. This is accomplished by the filter, which works CV dddd [ Calibrate the Voltage to dd.dd volts ]
in conjunction with the mask. A mask is a group of bits
that show the ELM327 which bits in the filter are The voltage reading that the ELM327 presents for
relevant, and which ones can be ignored. A must an AT RV reading can be calibrated with this
match condition is signaled by setting a mask bit to '1', command. The argument (dddd) must always be
while a 'don't care' is signaled by setting a bit to '0'. provided as 4 digits, with no decimal point (it assumes
This three digit variation of the CM command is used that a decimal place is between the second and the
to provide mask values for 11 bit ID systems (the most third digits).
significant bit is always ignored). To use this calibration feature, simply use a meter
Note that a common storage location is used with sufficient accuracy to read the actual input
internally for the 29 bit and 11 bit masks, so an 11 bit voltage. If, for example, the ELM327 consistently says
mask could conceivably be assigned with the next the voltage is 12.2V when you measure 11.99 volts,
command (CM hh hh hh hh), should you wish to do the simply issue AT CV 1199, and the device will
extra typing. The values are right justified, so you recalibrate itself for the provided voltage (it should then
would need to provide five leading zeros followed by read 12.0V due to roundoff). If you use a test voltage
the three mask bytes. that is less than 10 volts, dont forget to add a leading
zero (that is, 9.02 volts should be entered as AT CV
0902).
CM hh hh hh hh [ set the CAN ID Mask to hhhhhhhh ]
This command is used to assign mask values for D [ set all to Defaults ]
29 bit ID systems. See the discussion under the
CM hhh command it is essentially identical, except This command is used to set the options to their
for the length. Note that the three most significant bits default (or factory) settings, as when power is first
that you provide in the first digit will be ignored. applied. The last stored protocol will be retrieved from
memory, and will become the current setting (possibly
closing other protocols that are active). Any settings
CP hh [ set CAN Priority bits to hh ] that the user had made for custom headers, filters, or
masks will be restored to their default values, and all
This command is used to set the five most
timer settings will also be restored to their defaults.
significant bits in a 29 bit CAN ID word (the other 24

ELM327
DM1 [ monitor for DM1s ] FC SM h [ Flow Control Set Mode to h ]
The SAE J1939 Protocol broadcasts trouble codes This command sets how the ELM327 responds to
periodically as they are detected, using Diagnostic First Frame messages when automatic Flow Control
Mode 1 (DM1) messages. This command sets the responses are enabled. The single digit provided can
ELM327 to continually monitor for this type of either be 0 (the default) for fully automatic responses,
message for you, following multi-segment transport 1 for completely user defined responses, or 2 for
protocols as required. Note that a combination of user defined data bytes in the response. More
masks and filters could be set to provide a similar complete details and examples can be found in the
output, but they would not allow multiline messages to Altering Flow Control Messages section.
be detected. The DM1 command adds the extra logic
needed for multiline messages.
This command is only available when a CAN FC SH hhh [ Flow Control Set Header to ]
Protocol (A, B, or C) has been selected for J1939 The header (or more properly CAN ID) bytes
formatting. It returns an error if attempted under any used for CAN Flow Control response messages can
other conditions. be set using this command. Only the right-most 11 bits
of those provided will be used - the most significant bit
DP [ Describe the current Protocol ] is always removed. This command currently only
affects Flow Control mode 1.
The ELM327 is capable of automatically
determining the appropriate OBD protocol to use for
each vehicle that it is connected to. When the IC FC SH hhhhhhhh [ Flow Control Set Header to ]
connects to a vehicle, however, it returns only the data
This command is used to set the header (or CAN
requested, and does not report the protocol found. The
ID) bits for Flow Control responses with 29 bit CAN ID
DP command is used to determine the current protocol
systems. Since the 8 nibbles define 32 bits, only the
that the ELM327 is selected for (even if not
right-most 29 bits of those provided will be used - the
connected). If the automatic option is also selected,
most significant three bits are always removed. This
the protocol will show the word "AUTO" before it,
command currently only affects Flow Control mode 1.
followed by the type. Note that the actual protocol
names are displayed, not the numbers used by the
protocol setting commands. FC SD [1-5 bytes] [ Flow Control Set Data to ]
The data bytes that are sent in a CAN Flow
DPN [ Describe the Protocol by Number ] Control message can be set with this command. The
current version of the software allows one to five data
This command is similar to the DP command, but
bytes to be defined, with the remainder of the data
it returns a number which represents the current
bytes in the message being automatically set to the
protocol. If the automatic search function is also
default CAN filler byte. Data provided with this
enabled, the number will be preceded with the letter
command is only used when Flow Control modes 1 or
A. The number is the same one that is used with the
2 have been enabled.
set protocol and test protocol commands.
H0 and H1 [ Headers off (0) or on(1) ]

E0 and E1 [ Echo off (0) or on(1) ]
These commands control whether or not the
These commands control whether or not
additional (header) bytes of information are shown in
characters received on the RS232 port are
the responses from the vehicle. These are normally
retransmitted (or echoed) back to the host computer.
not shown by the ELM327, but can be turned on by
To reduce traffic on the RS232 bus, users may wish to
issuing the AT H1 command.
turn echoing off by issuing ATE0. The default is E1 (or
Turning the headers on actually shows more than
echo on).
just the header bytes you will see the complete
message as transmitted, including the check-digits and

ELM327
PCI bytes, and possibly the CAN data length code (IFR) byte is normally the same as the value sent as
(DLC) if it has been enabled with PP 29. The current the Source (or Tester) Address byte that was in the
version of this IC does not display the CAN CRC code, header of the request. There may be occasions when
nor the special J1850 IFR bytes (which some protocols it is desireable to use some other value, however, and
use to acknowledge receipt of a message). this set of commands allows for this.
If you send AT IFR S, the ELM327 will use the
value defined as the Source Address (usually F1, but it
I [ Identify yourself ] can be changed by PP 06), even if another value was
Issuing this command causes the chip to identify sent in the Header bytes. This is not what is normally
itself, by printing the startup product ID string (currently required, and caution should be used when using
ELM327 v1.2). Software can use this to determine AT IFR S. AT IFR H restores the sending of the IFR
exactly which integrated circuit it is talking to, without bytes to those provided in the Header. AT IFR H is the
having to reset the IC. default setting.
IB 10 [set the ISO Baud rate to 10400 ] IIA hh [ set the ISO Init Address to hh ]
This command restores the ISO 9141-2 and The ISO 9141-2 and ISO 14230-4 standards state
ISO 14230-4 baud rates to the default value of 10400. that when beginning a session with an ECU, the
initiation sequence is to be directed to a specific
address ($33). If you wish to experiment by directing
IB 96 [set the ISO Baud rate to 9600 ] the slow five baud sequence to another address, it is
done with this command. For example, if you prefer
Several users have requested this command. It is
that the initiation be performed with the ECU at
used to change the baud rate used for the ISO 9141-2
address $7A, then simply send:
and ISO 14230-4 protocols (numbers 3, 4, and 5) to
9600 baud, while relaxing some of the requirements
>AT IIA 7A
for the initiation byte transfers. It may be useful for
experimenting with some vehicles. Normal 10,400
and the ELM327 will use that address when called to
baud operation can be restored at any time by issuing
do so (protocols 3 or 4). The full eight bit value is used
an IB 10 command.
exactly as provided no changes are made to it (ie no
adding of parity bits, etc.)
IFR0, IFR1, and IFR2 [ IFR control ] Note that setting this value does not affect any
address values used in the header bytes, and that this
The SAE J1850 protocol allows for an In-Frame value is reset to to $33 whenever the defaults, or the
Response (IFR) byte to be sent after each message, ELM327, are reset.
usually to acknowledge the correct receipt of that
message. The ELM327 automatically generates and
sends this byte for you by default, but you can override KW0 and KW1 [ Key Word checks off (0) or on (1) ]
this behaviour with this command. The ELM327 looks for specific bytes (called Key
The AT IFR0 command will disable the sending of Words) to be sent to it during the ISO 9141-2 and
all IFRs, no matter what the header bytes require. ISO14230-4 initiation sequences. If those bytes are
AT IFR2 is the opposite - it will force an IFR byte to not found, the initiation is said to have failed (you
always be sent, no matter what header bytes indicate. might see UNABLE TO CONNECT or perhaps BUS
The AT IFR1 command restores the response to INIT: ...ERROR). This may be because you are trying
provide the automatic sending of IFRs, as determined to connect to a non-OBD compliant ECU, or perhaps
by the K bit of the header byte. IFR1 is the default to an older one.
setting of the ELM327. If you wish to experiment, but do not want the
ELM327 to check the values contained in the key
IFR H and IFR S [ IFR from Header or Source ] words, you can turn the checking off with:
The value sent in the J1850 In-Frame Response >AT KW0

ELM327
after which the IC will look for a response, but will not tells the ELM327 to always start in an 'Automatic'
look at the actual values of the bytes in the response. protocol search mode, which is the most useful for an
This may allow a connection in an otherwise unknown environment. ICs come from the factory set
impossible situation. Normal behaviour can be to this mode. If, however, you have only one vehicle
returned with AT KW1, which is the default setting. that you regularly connect to, storing that vehicles
Caution should be used with this command, as protocol as the default would make the most sense.
you are bypassing the checks that are normally As mentioned, the default setting for the memory
performed on the keyword bytes. The ELM327 sends function is determined by the voltage level at pin 5 at
an acknowledgement to the ECU for these bytes, but power up (or system reset). If it is connected to a high
that is without considering what the bytes actually are. level (VDD), then the memory function will be on by
You could be incorrectly activating an ISO 9141, or default. If pin 5 is connected to a low level, the
KWP 2000 protocol, so should be very careful. memory saving will be off by default.
L0 and L1 [ Linefeeds off (0) or on(1) ] MA [ Monitor All messages ]

This option controls the sending of linefeed Using this command places the ELM327 into a
characters after each carriage return character. For bus monitoring mode, in which it displays all messages
AT L1, linefeeds will be generated after every carriage as it sees them on the OBD bus. It remains a quiet
return character, and for AT L0, they will be off. Users monitor on the bus, not sending In Frame Responses
will generally wish to have this option on if using a for J1850 systems or Acknowledges for CAN systems.
terminal program, but off if using a custom computer This continues indefinitely until stopped by activity on
interface (as the extra characters transmitted will only the RS232 input, or the RTS pin.
serve to slow the communications down). The default To stop the monitoring, one can send a single
setting is determined by the voltage at pin 7 during character then wait for the ELM327 to respond with a
power on (or reset). If the level is high, then linefeeds prompt character (>). Alternatively, the RTS input can
on will be the default; otherwise it will be linefeeds off. be brought to a low level to interrupt the device as
well. Waiting for the prompt is necessary as the
response time is unpredictable, varying depending on
M0 and M1 [ Memory off (0) or on(1) ]
what the IC was doing when interrupted. If for instance
The ELM327 has internal non-volatile memory it is in the middle of printing a line, it will first complete
that is capable of remembering the last protocol used, that line then return to the command state, issuing the
even after the power is turned off. This can be prompt character. If it were simply waiting for input, it
convenient if the IC is often used for one particular would return immediately. Note that the character
protocol, as that will be the first one attempted when which stops the monitoring will always be discarded,
next powered on. To enable this memory function, it is and will not affect subsequent commands.
necessary to either use an AT command to select the
M1 option, or to have chosen memory on as the
default power on mode (by connecting pin 5 of the MP hhhh [ Monitor for PGN hhhh ]
ELM327 to a high logic level). The AT MA, MR and MT commands are quite
When the memory function is enabled, each time useful for when you wish to monitor for a specific byte
that the ELM327 finds a valid OBD protocol, that in the header of a typical OBD message. For the SAE
protocol will be memorized (stored) and will become J1939 Protocol, however, it is often desireable to
the new default. If the memory function is not enabled, monitor for the multi-byte Parameter Group Numbers
protocols found during a session will not be (or PGNs), which can appear in either the header, or
memorized, and the ELM327 will always start at power the data bytes. The MP command is a special J1939
up using the same (last saved) protocol. only command that is used to look for responses to a
If the ELM327 is to be used in an environment particular PGN request, and follow any multi-segment
where the protocol is constantly changing, it would occurances of them.
likely be best to turn the memory function off, and Note that the MP command provides no means to
issue an AT SP 0 command once. The SP 0 command set the first two digits of the requested PGN, and they

ELM327
are always assumed to be 00. For example, the DM2 PC [ Protocol Close ]
PGN has an assigned value of 00FECB (see SAE
There may be occasions where it is desirable to
J1939-73). To monitor for all DM2 messages, you
stop (deactivate) a protocol. Perhaps you are not using
would issue AT MP FECB, eliminating the 00, since
the automatic protocol finding, and wish to manually
the ELM327 always assumes that the PGN is
activate and deactivate protocols. Perhaps you wish to
preceeded by these two zeros.
stop the sending of idle (wakeup) messages, or have
This command is only available when a CAN
another reason. The PC command is used in these
Protocol (A, B, or C) has been selected for SAE J1939
cases to force a protocol to close.
formatting. It returns an error if attempted under any
other conditions. Note also that this version of the
ELM327 only displays responses that match the PP hh OFF [ turn Prog. Parameter hh OFF ]
criteria, not the requests that are asking for the
information. This command disables Programmable Parameter
number hh. Any value assigned using the PP hh SV
command will no longer be used, and the factory
MR hh [ Monitor for Receiver hh ] default setting will once again be in effect. The actual
This command also places the IC in a bus time when the new value for this parameter becomes
monitoring mode, displaying only messages that were effective is determined by its type. Refer to the
sent to the hex address given by hh. These are Programmable Parameters section for more
messages which are found to have the value hh in the information on the types.
second byte of a traditional three byte OBD header, in Note that PP FF OFF is a special command that
bits 8 to 15 of a 29 bit CAN ID, or in bits 8 to 10 of an disables all of the Programmable Parameters, as if you
11 bit CAN ID. Any single RS232 character aborts the had entered PP OFF for every possible one.
monitoring, as with the MA command. It is possible to alter some of the Programmable
Parameters so that it may be difficult, or even
impossible, to communicate with the ELM327. If this
MT hh [ Monitor for Transmitter hh ] occurs, there is a hardware means of resetting all of
the Programmable Parameters at once. Connect a
This command places the IC in a bus monitoring
jumper from circuit common to pin 28, holding it there
mode, displaying only messages that were sent by the
while powering up the ELM327 circuit. Hold it in
transmitter at the hex address given by hh. These are
position until you see the RS232 Receive LED begin to
messages which are found to have that value in the
flash (which indicates that all of the PPs have been
third byte of a traditional three byte OBD header, or in
turned off). At this point, remove the jumper to allow
bits 0 to 7 for CAN IDs. As with the MA and MR
the IC to perform a normal startup. Note that a reset of
monitoring modes, any RS232 activity (single
the PPs occurs quite quickly if you are holding the
character) aborts the monitoring.
jumper on for more than a few seconds and do not see
the RS232 receive light flashing, remove the jumper
NL [ Normal Length messages ] and try again there may be a problem with your
connection. This feature is only available beginning
Setting the NL mode on forces all sends and with v1.2, and is not a provided with any earlier
receives to be limited to the standard seven data bytes versions of the ELM327 IC.
in length, similar to the other ELM32x OBD ICs. To
allow longer messages, use the AL command.
Beginning with v1.2, the ELM327 does not require PP hh ON [ turn Programmable Parameter hh ON ]
a change to AL to allow longer message lengths for
This command enables Programmable Parameter
the KWP protocols to be received (as determined by
number hh. Once enabled, any value assigned using
the header length values). You can simply leave the IC
the PP hh SV command will be used where the factory
set to the default setting of NL, and all of the received
default value was before. Note that all programmable
bytes will be shown.
parameter values are set to FF at the factory, so
enabling a programmable parameter before assigning

ELM327
a value to it might result in unexpected behaviour. The Vss), and that the ELM327 supply is a nominal 5V.
actual time when the value for this parameter becomes This will allow for the measurement of input voltages
effective is determined by its type. Refer to the up to about 28V, with an uncalibrated accuracy of
Programmable Parameters section for more typically about 2%.
information on the types.
Note that PP FF ON is a special command that
enables all of the Programmable Parameters at the SH xx yy zz [ Set the Header to xx yy zz ]
same time. This command allows the user to manually control
the values that are sent as the three header bytes in a
message. These bytes are normally assigned values
PP xx SV yy [ Prog. Param. xx: Set the Value to yy ]
for you (and are not required to be adjusted), but there
A value is assigned to a Programmable Parameter may be occasions when it is desirable to change them
using this command. The system will not be able to (particularly if experimenting with physical addressing).
use this new value until the Programmable Parameter The value of hex digits xx will be used for the first or
has been enabled, however. priority/type byte, yy will be used for the second or
receiver/target byte, and zz will be used for the third or
transmitter/source byte. These remain in effect until
PPS [ Programmable Parameter Summary ] set again, or until restored to their default values with
The complete range of current Programmable the D, WS, or Z commands.
Parameters are displayed with this command (even This command is used to assign all header bytes,
those not yet implemented). Each is shown as a PP whether they are for a J1850, ISO 9141, ISO 14230, or
value followed by a colon and the value that is a CAN system. The CAN systems will use these three
assigned to it. This is followed by a single digit either bytes to fill bits 0 to 23 of the ID word (for a 29 bit ID),
N or F to show that it is ON (enabled), or OFF or will use only the rightmost 11 bits for an 11 bit CAN
(disabled), respectively. See the Programmable ID. The additional 5 bits needed for a 29 bit system are
Parameters section for a more complete discussion. provided through the AT CP command (since they
rarely change).
If assigning header values for the KWP protocols
R0 and R1 [ Responses off (0) or on(1) ] (4 and 5), care must be taken when setting the first
header byte (xx) value. The ELM327 will always insert
These commands control the ELM327s automatic
the number of data bytes for you, but how it is done
display of responses. If responses have been turned
depends on the values that you assign to this byte. If
off, the IC will not wait for a reply from the vehicle after
the second digit of this first header byte is anything
sending a request, and will return immediately to wait
other than 0 (zero), the ELM327 assumes that you
for the next RS232 command. This is useful if sending
wish to have the length value inserted in that first byte
commands blindly when using the IC for a non-OBD
when sending. In other words, providing a length value
network application, or simulating an ECU in a basic
in the first header byte tells the ELM327 that you wish
learning environment. It is not recommended that this
to use a traditional 3 byte header, where the length is
option normally be used, however, as the vehicle may
stored in the first byte of the header.
have difficulty if it is expecting an acknowledgement
If you provide a value of 0 for that second digit of
byte and never receives one. The default is R1, or
the first header byte, the ELM327 will assume that you
responses on.
wish that value to remain as 0, and that you want to
have a fourth header (length) byte inserted into the
RV [ Read the input Voltage ] message. This is contrary to the ISO 14230-4 OBD
standard, but is in use by many KWP2000 systems for
This initiaties the reading of the voltage present at (non-OBD) data transfer, so may be useful when
pin 2, and the conversion of it to a decimal voltage. By experimenting. Support for 4 byte headers has only
default, it is assumed that the input is connected to the been added with v1.2 of the ELM327 IC, and was not
voltage to be measured through a 47K and 10K supported in previous versions.
resistor divider (with the 10K connected from pin 2 to

ELM327
SH xyz [ Set the Header to 00 0x yz ] is selected with this command (eg. AT SP 3), that
protocol will become the default, and will be the only
Entering CAN 11 bit ID words (headers) normally
protocol used by the ELM327. Failure to initiate a
requires that extra leading zeros be added (eg. AT SH
connection in this situation will result in familiar
00 07 DF), but this command simplifies doing so. The
responses such as BUS INIT: ...ERROR, and no
AT SH xyz command accepts a three digit argument,
other protocols will be attempted. This is a useful
takes only the right-most 11 bits from that, adds
setting if you know that your vehicle(s) only require the
leading zeros, and stores the result in the header
one protocol.
storage locations for you. As an example, AT SH 7DF
is a valid command, and is quite useful for working
with 11 bit CAN systems. It actually results in the SP Ah [ Set Protocol to Auto, h ]
header bytes being internally stored as 00 07 DF.
This variation of the SP command allows you to
choose a starting (default) protocol, while still retaining
SP h [ Set Protocol to h ] the ability to automatically search for a valid protocol
on a failure to connect. For example, if your vehicle is
This command is used to set the ELM327 for
ISO 9141-2, but you want to occasionally use the
operation using the protocol specified by 'h', and to
ELM327 circuit on other vehicles, you might set
also save it as the new default. Note that the protocol
AT SP A3. The default protocol will then be 3, but with
will be saved no matter what the AT M0/M1 setting is.
the ability to automatically search for other protocols.
The currently valid protocols are:
Don't forget to disable the memory function if doing
0 - Automatic this, or your neighbours protocol could become your
1 - SAE J1850 PWM (41.6 Kbaud) new default. As for AT SP h, an AT SP Ah will save
2 - SAE J1850 VPW (10.4 Kbaud) the protocol information even if the memory option is
off. Note that the A can come before or after the h, so
3 - ISO 9141-2 (5 baud init, 10.4 Kbaud)
AT SP A3 can also be entered as AT SP 3A.
4 - ISO 14230-4 KWP (5 baud init, 10.4 Kbaud)
5 - ISO 14230-4 KWP (fast init, 10.4 Kbaud)
6 - ISO 15765-4 CAN (11 bit ID, 500 Kbaud) SR hh [Set the Receive address to hh ]
7 - ISO 15765-4 CAN (29 bit ID, 500 Kbaud) Depending on the application, users may wish to
8 - ISO 15765-4 CAN (11 bit ID, 250 Kbaud) manually set the address to which the ELM327 will
9 - ISO 15765-4 CAN (29 bit ID, 250 Kbaud) respond. Issuing this command will turn off the AR
A - SAE J1939 CAN (29 bit ID, 250* Kbaud) mode, and force the IC to only accept responses
addressed to hh. Use caution with this setting, as
B - USER1 CAN (11* bit ID, 125* Kbaud)
depending on what you set it to, you may end up
C - USER2 CAN (11* bit ID, 50* Kbaud) accepting (acknowledging with an IFR) a message that
* default settings (user adjustable) was actually meant for another module.
This command does not affect addresses used by
The first protocol shown (0) is a convenient way of the J1939 protocol. The J1939 routines derive the
telling the ELM327 to automatically try all protocols, required addresses from the header values, as
when looking for a valid one. It causes the ELM327 to required by the SAE standard.
sequence through each of the protocols, looking for
one that can be initiated correctly. When a valid
protocol is found, and the memory function is enabled, ST hh [ Set Timeout to hh ]
that protocol will then be remembered, and will After sending a request, the ELM327 waits a
become the new default setting. When saved like this, preset time for a response before it can declare that
the automatic mode searching will still be enabled, and there was NO DATA from the vehicle. The same
the next time the ELM327 fails to connect to the saved timer setting is also used after a response has been
protocol, it will again search all protocols for another received, to be sure that no more responses are
valid one. coming. The AT ST command allows this time to be
If another protocol (other than the Automatic one) adjusted, in increments of about 4 msec.

ELM327
Setting the timer to a new value simply requires TP Ah [ Try Protocol h with Auto ]
using the ST command. For example, AT ST 19 will
This command is very similar to the AT TP
give a setting of about 100 msec (19 in hex is 25 in
command above, except that if the protocol that is tried
decimal). The ST timer is set to 32 by default (205
should fail to initialize, the ELM327 will then
msec), but the default setting can be adjusted by
automatically sequence through all of the protocols,
changing PP 03. Note that a value of 00 does not
attempting to connect to one of them.
result in 0 msec it is a special value that sets the
timer to the default value.
When Adaptive Timing is enabled, the AT ST time WM [1 to 6 bytes] [ set Wakeup Message to]
is modified by the actual measured response times,
however, the timer will never be set to a value that is This command allows the user to override the
greater than the AT ST setting. default settings for the wakeup messages (sometimes
known as the periodic idle messages). Simply provide
the bytes that you wish to have sent (one to six of
SW hh [ Set Wakeup to hh ] them), and the ELM327 will then send them as
Once a data connection has been made, some required, at the rate determined by the AT SW setting.
vehicles require that there be data flow every few Note that you do not have to add a checksum byte to
seconds, or the connection may time out and go to the data the ELM327 calculates the value and adds
sleep. The ELM327 will automatically generate it for you.
periodic wakeup messages in order to maintain this
connection, whenever the user is not requesting any
WS [ Warm Start ]
data. (Currently, only protocols 3, 4, and 5 generate
these messages.) The replies to these messages are This command causes the ELM327 to perform a
always ignored, and are not visible to the user. complete reset which is very similar to the AT Z
The time interval between these periodic wakeup command, but does not include the power on LED
messages can be adjusted in 20 msec increments test. Users may find this a convenient means to
using the AT SW hh command, where hh is any quickly start over without having the extra delay of the
hexadecimal value from 00 to FF. The maximum AT Z command.
possible time delay of just over 5 seconds thus occurs If using variable RS232 baud rates (ie AT BRD
when a value of FF (decimal 255) is used. The default commands), it is preferred that you reset the IC using
setting provides a nominal delay of 3 seconds between this command, rather than AT Z, as AT WS will not
messages. affect the chosen RS232 baud rate.
Note that the value 00 (zero) is treated as a very
special case, and must be used with caution, as it will
stop all periodic messages. This is provided as it may Z [ reset all ]
be convenient in certain circumstances. Issuing This command causes the chip to perform a
AT SW 00 will not change a prior setting for the time complete reset as if power were cycled off and then on
between wakeup messages, should the protocol be re- again. All settings are returned to their default values,
initialized. and the chip will be put in the idle state, waiting for
characters on the RS232 bus. Any baud rate set with
the AT BRD command will be reset to the default
TP h [ Try Protocol h ]
setting.
This command is identical to the SP command,
except that the protocol that you select is not
immediately saved in internal memory, so does not
change the default setting. Note that if the memory
function is enabled (AT M1), and this new protocol that
you are trying is found to be valid, that protocol will
then be stored in memory as the new default.

ELM327
AT Command Summary
General Commands J1850 Specific Commands (protocols 1 and 2)

BRD hh try Baud Rate Divisor hh IFR0, 1, 2 IFRs Off, Auto*, or On
BRT hh set Baud Rate handshake Timeout IFR H, S IFR value from Header or Source
D set all to Defaults
E0, E1 Echo Off, or On* ISO Specific Commands (protocols 3 to 5)
I print the version ID
IB 10 Set the ISO Baud rate to 10400*
L0, L1 Linefeeds Off, or On
IB 96 Set the ISO Baud rate to 9600
M0, M1 Memory Off, or On
IIA hh Set the ISO (slow) Init Address to hh
WS Warm Start (quick software restart)
KW0, KW1 Key Word checking Off, or On*
Z reset all
SW hh Set Wakeup interval to hh x 20 msec
<CR> repeat the last command
WM [1 - 6 bytes] Set the Wakeup Message
OBD Commands
CAN Specific Commands (protocols 6 to C)
AL Allow Long (>7 byte) messages
CAF0, CAF1 Automatic Formatting Off, or On*
AR Automatically Receive
CF hhh set the ID Filter to hhh
AT0, 1, 2 Adaptive Timing Off, Auto1*, Auto2
CF hhhhhhhh set the ID Filter to hhhhhhhh
BD perform a Buffer Dump
CFC0, CFC1 Flow Control Off, or On*
BI Bypass the Initialization sequence
CM hhh set the ID Mask to hhh
DP Describe the current Protocol
CM hhhhhhhh set the ID Mask to hhhhhhhh
DPN Describe the Protocol by Number
CP hh set CAN Priority (only for 29 bit)
H0, H1 Headers Off*, or On
CS show the CAN Status
MA Monitor All
DM1 (J1939) Monitor for DM1 messages
MR hh Monitor for Receiver = hh
FC SM h Flow Control Set the Mode to h
MT hh Monitor for Transmitter = hh
FC SH hhh FC Set the Header to hhh
NL Normal Length messages*
FC SH hhhhhhhh FC Set the Header to hhhhhhhh
PC Protocol Close
FC SD [1 - 5 bytes] FC Set Data to [...]
R0, R1 Responses Off, or On
MP hhhh (J1939) Monitor for PGN hhhh
SH xyz Set Header
SH xxyyzz Set Header
Misc. Commands
SP h Set Protocol to h and save it
SP Ah Set Protocol to Auto, h and save it CV dddd Calibrate the Voltage to dd.dd volts
SR hh Set the Receive address PP xx OFF disable Prog Parameter xx
ST hh Set Timeout to hh x 4 msec PP FF OFF all Prog Parameters Off
TP h Try Protocol h PP xx ON enable Prog Parameter xx
TP Ah Try Protocol h with Auto search PP FF ON all Prog Parameters On
PP xx SV yy for PP xx, Set the Value to yy
PPS print a PP Summary
* = default setting RV Read the Voltage

ELM327
Reading the Battery Voltage

Before proceding to the OBD Commands, we will voltage at the input is actually 12.47V. You should not
show an example of how to use an AT Command. We provide the decimal point in the CV value, as the IC
will assume that you have built (or purchased) a circuit knows that it should be between the second and the
which is similar to that of Figure 9 in the Example third digits. To verify that the changes have taken
Applications section. This circuit provides a connection place, simply read the voltage again:
to read the vehicles battery voltage, which many will
find very useful. >at rv
If you look in the AT Command list, you will see 12.5V
there is one command that is listed as RV [Read the
input Voltage]. This is the command which you will >
need to use. First, be sure that the prompt character is
shown (that is the > character), then simply enter AT The ELM327 always rounds off the measurement
followed by RV, and press return (or enter): to one decimal place, so the 12.47V actually appears
as 12.5V. Note that the second decimal place is
>at rv always maintained internally for accuracy and use in
12.6V the calculations, but it is never displayed.
The ELM327 can be calibrated with any reference
> voltage that you have available, but note that the CV
command always expects to receive four characters
Note that we did not use upper case characters in representing the voltage at the input. If you used a 9V
this example, mostly out of laziness. The ELM327 will battery for your reference, and it is actually 9.32V, then
accept upper case (AT RV) as well as lower case (at you must add a leading zero to that when calibrating
rv) or any combination of these (At rV). It does not the IC:
matter to the ELM327. Also note that we have shown a
space character ( ) between the at and the rv. This >at cv 0932
is only to separate the commands and make them OK
more readable. You do not have to add spaces, or if
you wish, you can add many spaces it does not >
affect the internal interpretation of the command.
As shipped from the factory, the ELM327 voltage The other AT Commands are used in the same
reading circuitry will typically be accurate to about 2%. manner. Simply type the letters A and T, follow that
For many, this is all that is needed. Some people may with the command you want to send, then any
want to calibrate the circuitry for more accurate arguments that are required for that command, and
readings, however, so we have provided a special press return (or enter, depending on your keyboard).
Calibrate Voltage command for this. You can place space characters as often as you wish
To change the internal calibration constants, you if it improves the readability for you, as they are
will need to know the actual battery voltage to more ignored by the ELM327.
accuracy than the ELM327 shows. Many quality digital
multimeters can do this, but you should verify the
accuracy before making too many changes. Perhaps
in this case, you have connected your multimeter, and
find that it reads 12.47V, and you would like the
ELM327 to read the same. Simply calibrate it to that
voltage using the CV command:
>at cv 1247
OK
At this point, the internal calibration values have

been changed, and the ELM327 knows that the

ELM327
OBD Commands
If the bytes that you send to the ELM327 do not five bytes would typically be sent to the vehicle. Note
begin with the letters A and T, they are assumed to that the carriage return character is only a signal to the
be OBD commands for the vehicle. Each pair of ASCII ELM327, and is not sent on to the vehicle.
bytes will be tested to ensure that they are valid After sending the command, the ELM327 listens
hexadecimal digits, and will then be combined into on the OBD bus for messages, looking for ones that
single data bytes for transmitting to the vehicle. are directed to it. If a message address matches,
OBD commands are actually sent to the vehicle those received bytes will be sent on the RS232 port to
embedded in a data packet. Most standards require the user, while messages received that do not have
that three header bytes and an error checksum byte matching addresses will be ignored (but are often still
be included with every OBD message, and the available for viewing with the AT BD command).
ELM327 adds these extra bytes to your command The ELM327 will continue to wait for messages
bytes automatically. The initial (default) values for addressed to it until there are none found in the time
these extra bytes are usually appropriate for most that was set by the AT ST command. As long as
requests, but if you wish to change them, there is a messages are received, the ELM327 will continue to
method to do so (see the Setting the Headers reset this timer. Note that the IC will always respond
section). with something, even if it is to say NO DATA
Most OBD commands are only one or two bytes in (meaning that there were no messages found that
length, but some can be longer. The ELM327 will limit were addressed to it).
the number of bytes that can be sent to the maximum
number allowed by the standards (seven bytes or 14
hexadecimal digits). Attempts to send more bytes, or
an odd number of hex digits, will result in a syntax
error the entire command is then ignored and a Hexadecimal Decimal
single question mark printed. Number Equivalent
Hexadecimal digits are used for all of the data 0 0
exchange with the ELM327 because it is the data 1 1
format used most often in the OBD standards. Most 2 2
mode request listings use haxadecimal notation, and it 3 3
is the format most frequently used when results are
4 4
shown. With a little practice, it should not be very
5 5
difficult to deal in hex numbers, but some people may
want to use a table such as Figure 1, or keep a 6 6
calculator nearby. All users will be required to 7 7
manipulate the results in some way, though 8 8
combining bytes and dividing by 4 to obtain rpm, 9 9
dividing by 2 to obtain degrees of advance, etc., and A 10
may find a software front-end to be of help. B 11
As an example of sending a command to the
C 12
vehicle, assume that A6 (or decimal 166) is the
D 13
command that is required to be sent. In this case, the
user would type the letter A, then the number 6, then E 14
would press the return key. These three characters F 15
would be sent to the ELM327 by way of the RS232
port. The ELM327 would store the characters as they Figure 1. Hex to Decimal Conversion
are received, and when the third character (the
carriage return) was received, would begin to assess
the other two. It would see that they are both valid hex
digits, and would convert them to a one byte value (the
decimal value is 166). The header bytes and a
checksum byte would then be added, and a total of

ELM327
Talking to the Vehicle

The OBD standards specify that each request that (1=supported, 0=not). Although this information is not
is sent to the vehicle must adhere to a set format. The very useful for the casual user, it does prove that the
first byte (known as the mode) always describes the connection is working.
type of data being requested, while the second, third, Another example requests the current engine
etc. bytes specify the actual information required coolant temperature (ECT). This is PID 05 in mode 01,
(given by a parameter identification or PID number). and can be requested as follows:
These modes and PIDs are described in detail in
documents such as the SAE J1979, or ISO 15031-5 >01 05
standards, and may also be expanded on by the
The response will be of the form:
vehicle manufacturers.
Normally, one is only concerned with the nine 41 05 7B
diagnostic test modes described by J1979 (although
there is provision for more). All of these modes are not The 41 05 shows that this is a response to a
required to be supported by every vehicle, and are mode 1 request for PID 05, while the 7B is the desired
often not. These are the nine modes: data. Converting the hexadecimal 7B to decimal, one
01 - show current data gets 7 x 16 + 11 = 123. This represents the current
temperature in degrees Celsius, but with the zero
02 - show freeze frame data
offset to allow for subzero temperatures. To convert to
03 - show diagnostic trouble codes
the actual coolant temperature, you need to subtract
04 - clear trouble codes and stored values 40 from the value obtained. In this case, then, the
05 - test results, oxygen sensors coolant temperature is 123 - 40 or 83 C.
06 - test results, non-continuously monitored A final example shows a request for the engine
07 - show pending trouble codes rpm. This is PID 0C of mode 01, so at the prompt type:
08 - special control mode
09 - request vehicle information >01 0C
Within each mode, PID 00 is normally reserved to A typical response would be:
show which PIDs are supported by that mode. Mode
01, PID 00 must be supported by all vehicles, and can 41 0C 1A F8
be accessed as follows
Ensure that your ELM327 interface is properly The returned value (1A F8) is actually a two byte
connected to the vehicle, and powered. Most vehicles value that must be converted to a decimal value to be
will not respond without the ignition key in the ON useful. Converting it, we get a value of 6904, which
position, so turn the ignition to on, but do not start the seems to be a very high value for engine rpm. That is
engine. At the prompt, issue the mode 01 PID 00 because rpm is sent in increments of 1/4 rpm! To
command: convert to the actual engine speed, we need to divide
the 6904 by 4. In this case, then, the rpm is 1726,
>01 00 which is much more reasonable.
Hopefully this has shown how typical requests
The first time the bus is accessed, you may see a proceed. It has not been meant to be a definitive guide
bus initialization message, and then the response, on modes and PIDs this information can be obtained
which might typically be as follows: from the manufacturer of your vehicle, the SAE
(http://www.sae.org/), from ISO (http://www.iso.org/),
41 00 BE 1F B8 10 or from various other sources on the web.
The 41 signifies a response from a mode 01
request (01+40=41), while the second number (00)
simply repeats the PID number requested. A mode 02,
request is answered with a 42, a mode 03 with a 43,
etc. The next four bytes (BE, 1F, B8, and 10)
represent the requested data, in this case a bit pattern
showing the PIDs supported by this mode

ELM327
Interpreting Trouble Codes

Likely the most common use that the ELM327 will 6 bytes in the response have to be read in pairs to
be put to is in obtaining the current Diagnostic Trouble show the trouble codes (the above would be
Codes (or DTCs). Minimally, this requires that a mode interpreted as 0133, 0000, and 0000). Note that the
03 request be made, but first one should determine response has been padded with 00s as required by
how many trouble codes are presently stored. This is the SAE standard for this mode the 0000s do not
done with a mode 01 PID 01 request as follows: represent actual trouble codes.
As was the case when requesting the number of
>01 01 stored codes, the most significant bits of each trouble
code also contain additional information. It is easiest to
To which a typical response might be:
use the following table to interpret the extra bits in the
41 01 81 07 65 04 first digit as follows:
If the first hex digit received is this,
The 41 01 signifies a response to the request, and
Replace it with these two characters
the next data byte (81) is the number of current trouble
codes. Clearly there would not be 81 (hex) or 129
(decimal) trouble codes present if the vehicle is at all 0 P0 Powertrain Codes - SAE defined
operational. In fact, this byte does double duty, with 1 P1 - manufacturer defined
the most significant bit being used to indicate that the P2 - SAE defined
2
malfunction indicator lamp (MIL, or Check Engine
Light) has been turned on by one of this modules 3 P3 - jointly defined
codes (if there are more than one), while the other 7 4 C0 Chassis Codes - SAE defined
bits of this byte provide the actual number of stored C1 - manufacturer defined
5
trouble codes. In order to calculate the number of
stored codes when the MIL is on, simply subtract 128 6 C2 - manufacturer defined
(or 80 hex) from the number. 7 C3 - reserved for future
The above response then indicates that there is
8 B0 Body Codes - SAE defined
one stored code, and it was the one that set the Check
Engine Lamp or MIL on. The remaining bytes in the 9 B1 - manufacturer defined
response provide information on the types of tests A B2 - manufacturer defined
supported by that particular module (see the SAE
B B3 - reserved for future
document J1979 for further information).
In this instance, there was only one line to the C U0 Network Codes - SAE defined
response, but if there were codes stored in other D U1 - manufacturer defined
modules, they each could have provided a line of
E U2 - manufacturer defined
response. To determine which module is reporting the
trouble code, one would have to turn the headers on F U3 - reserved for future
(AT H1) and then look at the third byte of the three
byte header for the address of the module that sent Taking the example trouble code (0133), the first
the information. digit (0) would then be replaced with P0, and the 0133
Having determined the number of codes stored, reported would become P0133 (which is the code for
the next step is to request the actual trouble codes an oxygen sensor circuit slow response). Note that
with a mode 03 request (there is no PID needed): the ISO 15765-4 (CAN) protocol is very similar, but it
adds an extra data byte (in the second position),
>03 showing how many data items (DTCs) are to follow.
To provide a few further examples, if the received
A response to this could be:
code was D016, you would replace the D with U1, and
43 01 33 00 00 00 00 the resulting trouble code would be U1016. Similarly,
1131 received would actually be for the code P1131.
The 43 in the above response simply indicates
that this is a response to a mode 03 request. The other

ELM327
Resetting Trouble Codes

The ELM327 is quite capable of resetting mode 04 is intended (Are you sure?) before actually
diagnostic trouble codes, as this only requires issuing sending it to the vehicle, as all trouble code
a mode 04 command. The consequences should information is immediately lost when the mode is sent.
always be considered before sending it, however, as Remember that the ELM327 does not monitor the
more than the MIL (or Check Engine Light) will be content of the messages, so it will not know to ask for
reset. In fact, issuing a mode 04 will: confirmation of the mode request this would have to
- reset the number of trouble codes be the duty of a software interface if one is written.
- erase any diagnostic trouble codes As stated, to actually erase diagnostic trouble
codes, one need only issue a mode 04 command. A
- erase any stored freeze frame data
response of 44 from the vehicle indicates that the
- erase the DTC that initiated the freeze frame mode request has been carried out, the information
- erase all oxygen sensor test data erased, and the MIL turned off. Some vehicles may
- erase mode 06 and 07 information require a special condition to occur (eg. the ignition on
Clearing of all of this data is not unique to the but the engine not running) before they will respond to
ELM327 it occurs whenever any scan tool is used to a mode 04 command.
reset the codes. The biggest problem with losing this That is all there is to clearing trouble codes. Once
data is that your vehicle may run poorly for a short again, do not accidentally send the 04 code!
time, while it performs a recalibration.
To avoid inadvertently erasing stored information,
the SAE specifies that scan tools must verify that a
Quick Guide for Reading Trouble Codes

Ignition Key to ON,
If you do not use your ELM327 for some time, this but vehicle not running
entire data sheet may seem like quite a bit to review
when your Check Engine light eventually comes on,
and you just want to know why. We offer this section
as a quick guide to the basics that you will need. >0101
To get started, connect the ELM327 circuit to your to see how many codes
PC or PDA and communicate with it using a terminal (2nd digit of the 3rd byte)
program such as HyperTerminal, ZTerm, ptelnet, or a
similar program. It should normally be set to either
9600 or 38400 baud, with 8 data bits, and no parity or
handshaking. >03
The chart at the right provides a quick procedure to see the codes
on what to do next: (ignore the first byte and
read the others in pairs)
FIX THE VEHICLE!
>04
to reset the codes

ELM327
Bus Initiation
Both the ISO 9141-2 and ISO 14230-4 (KWP2000) vehicle.)
standards require that the vehicles OBD bus be Once the bus has been initiated, communications
initialized before any communications can take place. must take place regularly (typically at least once every
The ISO 9141 standard allows for only a slow (2 to 3 five seconds), or the bus will revert to a low-power
second) initiation process, while ISO 14230 allows for sleep mode. If you are not sending data requests
both a slow method, and a faster alternative. often enough, the ELM327 will generate requests for
The ELM327 will perform this bus initiation for you, you to ensure that the bus stays awake. You will
but not until your request needs to be sent. If the bus never see the responses to these, but you may see
initiation occurs during the automatic search process, the transmit LED flash periodically when these are
you will not see any status reporting, but if you have being sent.
the Auto option off (and are set to protocols 3, 4, or 5), By default, the ELM327 ensures that these
then you will see a message similar to this: wakeup or idle messages are sent every 3 seconds,
but this is adjustable with the AT SW command. The
BUS INIT: ...
contents of the wakeup message are also user
The three dots appear only as the slow initiation programmable with the AT WM command, if you
process is carried out a fast initiation does not show should wish to change them. Users generally do not
them. This will be followed by either the expression have to change either of the above though, as the
OK to say it was successful, or else an error message default settings work well with almost all systems.
to indicate that there was a problem. (The most
common error encountered is in forgetting to turn the
vehicles key to ON before attempting to talk to the
Wakeup Messages
After an ISO 9141 or ISO 14230 connection has provide some margin, the ELM327 will send a wakeup
been established, there needs to be periodic data message after three seconds of inactivity. This time
transfers in order to maintain that connection, and interval is fully programmable, should you prefer a
prevent it from going to sleep. If normal requests and different setting (see the AT SW command).
responses are being sent, that is usually sufficient, but As with the ELM323, the ELM327 allows users to
the ELM327 occasionally has to create its own change the actual wakeup message that is sent. To do
messages to prevent the connecton from timing out. so, simply send the ELM327 a Wakeup Message
We term these periodic messages that are created command, telling it what you wish the message to be
the Wakeup Messages, as they keep the connection changed to. For example, if you would like to send the
alive, and prevent the circuitry from going back to an data bytes 44 55 with the header bytes set to 11 22
idle or sleep mode. (Some texts refer to these 33, simply send the command:
messages simply as idle messages.) The ELM327
automatically creates and sends these for you if there >AT WM 11 22 33 44 55
appears to be no other activity there is nothing that
you need do to ensure that they occur. To see these, From that point forward, every wakeup message
once a connection is made, simply monitor the OBD that the ELM327 sends will be as shown above.
transmit LED you will see the periodic blips created You can change these as often as you want, the
when the ELM327 sends one. If you are curious as to only restriction being that every time you do, you must
the actual contents of the messages, you can then provide the complete message the header bytes and
perform a Buffer Dump to see the bytes. Note that the the data bytes (the current version of the ELM327 only
ELM327 never obtains or prints a response to any of allows for messages of one to six bytes in length). You
the wakeup messages. should not provide a checksum byte, as it will be
The standards state that if there is no activity at automatically added for you.
least every five seconds, the data connection may
close. To ensure that this does not happen, and to

ELM327
Selecting Protocols
The ELM327 supports several different OBD you might want to use the Try Protocol command for
protocols (see Figure 2 below). As a user, you may your friends vehicle, rather than setting it to something
never have to choose which one it should use (since permanently. You can either say:
the factory settings cause an automatic search to be
>AT TP 3
performed for you), but while experimenting, you may
OK
want to specify which protocol is used.
For example, if you know that your vehicle uses if you already know that your friends vehicle uses
the SAE J1850 VPW protocol, you may want the protocol 3, or else you can say:
ELM327 to only try that protocol, and no others. If that
>AT TP 0
is what you want, simply determine the protocol
OK
number (from the chart below), then use the Set
Protocol AT Command as follows: which automatically tries all of the protocols (as
allowed by PP 07) looking for one that responds.
>AT SP 2
In general, users find that enabling the memory
OK
(setting pin 5 to 5V) and choosing the Auto option
From this point on, the default protocol (used after (the easiest way is to say AT SP 0) works very well.
every power-up or AT D command) will be protocol 2 After the initial search, the protocol used by your
(or whichever one that you have chosen). Verify this vehicle becomes the new default mode (so it is tried
by asking the ELM327 to describe the current protocol: first every time), and if the interface is used on another
vehicle, there is only a minor delay while it performs an
>AT DP
automatic search.
SAE J1850 VPW
Now what happens if your friend has a vehicle that
uses ISO 9141-2? How do you use the ELM327
interface for that vehicle? There are a few choices... Protocol Description
One possibility is to change your protocol selection
to allow for the automatic searching for another 0 Automatic
protocol, on failure of the current one. This is done by 1 SAE J1850 PWM (41.6 Kbaud)
putting an A with the protocol number, as follows:
2 SAE J1850 VPW (10.4 Kbaud)
>AT SP A2
OK 3 ISO 9141-2 (5 baud init)
>AT DP 4 ISO 14230-4 KWP (5 baud init)

AUTO, SAE J1850 VPW 5 ISO 14230-4 KWP (fast init)
Now, the ELM327 will begin by trying protocol 2, 6 ISO 15765-4 CAN (11 bit ID, 500 Kbaud)
but will then automatically begin searching for another
protocol should an attempt to connect with protocol 2 7 ISO 15765-4 CAN (29 bit ID, 500 Kbaud)
fail (as would happen when you try to connect to the 8 ISO 15765-4 CAN (11 bit ID, 250 Kbaud)
friends vehicle). If you have the memory function
enabled when you connect to your friends vehicle, 9 ISO 15765-4 CAN (29 bit ID, 250 Kbaud)
their protocol will then be stored in memory as the new A SAE J1939 CAN (29 bit ID, 250* Kbaud)
default protocol, but that is only a minor inconvenience
as the next time you connect to your vehicle, it will try B User1 CAN (11* bit ID, 125* Kbaud)
the friends protocol, fail, and search until it finds yours. C User2 CAN (11* bit ID, 50* Kbaud)
Your protocol will then be resaved as the new default.
*user adjustable
Perhaps you have disabled the memory function
(set pin 5 to 0V), and have used AT SP 2 to customize Figure 2. ELM327 Protocol Numbers
the IC for your vehicle only, and you dont want it to
search for others? (In effect, you have turned your
ELM327 into an ELM322 type interface.) In this case,

ELM327
OBD Message Formats

To this point we have only discussed the contents transmitter. Note that many texts refer to the receiver
(data portion) of an OBD message, and made only as the Target Address (TA), and the transmitter as
passing mention of other parts such as headers and the Source Address (SA).
checksums, which all messages use to some extent. Another concern when sending any message is
On Board Diagnostics systems are designed to be that errors might occur, and the received data may be
very flexible, providing a means for several devices to falsely interpreted. To detect errors, the various
communicate with one another. In order for messages protocols all provide some form of check on the
to be sent between devices, it is necessary to add received data, often as simple as a sum calculation (a
information describing the type of information being running total is maintained by the receiver as a
sent, the device that it is being sent to, and perhaps message is being processed). This is compared to the
which device is doing the sending. Additionally, the running total sent by the transmitter, and if they do
importance of the message becomes a concern as not agree, an error has occured. The total is generally
well crankshaft position information is certainly of referred to as a checksum or a CRC byte and is
considerably more importance to a running engine usually sent at the end of a message. If an error is
than a request for the number of trouble codes stored. detected, the different protocols provide various ways
So to convey importance, messages are also assigned of handling it.
a priority. The OBD data bytes are thus normally
The information describing the priority, the encapsulated within a message, with header bytes at
intended recipient, and the transmitter are usually the beginning, and a checksum at the end. The
needed by the recipient even before they know the J1850, ISO 9141-2, and ISO 14230-4 protocols all use
type of request that the message contains. To ensure essentially the same structure, with three header
that this information is obtained first, OBD systems bytes, a maximum of seven data bytes and one
transmit it at the start (or head) of the message. Since checksum byte, as shown in Figure 3 below.
these bytes are at the head, they are usually referred The ISO 15765-4 (CAN) protocol uses a very
to as header bytes. Figure 3 below shows a typical similar structure, the main difference really only
OBD message structure that is used by the relating to the structure of the header. CAN header
SAE J1850, ISO 9141-2, and ISO 14230-4 standards. bytes are not referred to as that they are called ID
It uses 3 header bytes as shown, to provide details bits instead. The initial CAN standard defined the ID
concerning the priority, the receiver, and the bits as being 11 in number, and the more recent CAN
TA SA
priority receiver transmitter
3 header bytes up to 7 data bytes checksum
Figure 3. An OBD Message
ID bits (11 or 29) PCI 7 data bytes checksum
Figure 4. A CAN OBD Message

ELM327
OBD Message Formats (continued)

standard now allows 29 in total.
The ELM327 does not normally show any of these
extra bytes unless you turn that feature on with the
Headers On command (AT H1). Issuing that allows
you to see the header bytes and the checksum byte
(for the J1850, ISO 9141 and ISO 14230 protocols).
For the CAN protocols, you will see the ID bits, and
other items which are normally hidden such as the PCI
byte for ISO 15765, or the data length codes (if they
are enabled with PP 29). Note that the ELM327 is not
able to display the checksum information for CAN
systems, or the IFR bytes for J1850 systems.
It is not necessary to ever have to set these
header byes, or to perform a checksum calculation, as
the ELM327 will always do this for you. The header
bytes are adjustable however, should you wish to
experiment by using advanced techniques such as
physical addressing. The next section provides a
discussion on how to do this

ELM327
Setting the Headers

The emissions related diagnostic trouble codes byte. You may find that some requests, being of a low
that most people are familiar with are described in the priority, may not be answered immediately, possibly
SAE J1979 standard (ISO15031-5). They represent causing a NO DATA result. In these cases, you may
only a portion of the data that a vehicle may have want to adjust the timeout value, perhaps first trying
available much more can be obtained if you are able the maximum (ie use AT ST FF). Many vehicles will
to direct the requests elsewhere. simply not support these extra addressing modes.
Accessing most OBDII diagnostics information The other, and more common method of obtaining
requires that requests be made to what is known as a information is by physical addressing, in which you
a functional address. Any processor that supports the direct your request to a specific device, not to a
function will respond to the request (and theoretically, functional group. To do this, you again need to
many different processors can respond to a single construct a set of header bytes that direct your query
functional request). In addition, every processor (or to the physical address of the processor, or ECU. If
ECU) will also respond to what is known as their you do not know the address, recall that the sender of
physical address. It is the physical address that information is usually shown in the third byte of the
uniquely identifies each module in a vehicle, and header. By monitoring your system for a time with the
permits you to direct more specific queries to only one headers turned on (AT H1), you can quickly learn the
particular module. main addresses of the senders. The SAE document
To retrieve information beyond that of the OBDII J2178 assigns address ranges to these devices if you
requirements then, it will be necessary to direct your are unsure of which might be most appropriate.
requests to either a different functional address, or to When you know the address that you wish to
an ECUs physical address. This is done by changing speak to, simply use it for the second byte in the
the data bytes in the message header. header (assume an address of 10 for this example).
As an example of functional addressing, let us Combine that with your knowledge of SAE J2178 to
assume that you want to request that the processor choose a priority/type byte (assume a value of E4 for
responsible for Engine Coolant provide the current this example, as if the vehicle is J1850 PWM). Finally,
Fluid Temperature. You do not know its address, so you need to identify yourself to the target, so that
you consult the SAE J2178 standard and determine responses can be returned to you. As is customary for
that Engine Coolant is functional address 48. SAE diagnostic tools, well use an address of F1. As before,
standard J2178 also tells you that for your J1850 VPW these three bytes are then assigned to the header with
vehicle, a priority byte of A8 is appropriate. Finally, the set header command:
knowing that a scan tool is normally address F1, you
>AT SH E4 10 F1
have enough information to specify the three header
OK
bytes (A8 48 and F1). To tell the ELM327 to use these
new header bytes, all you need is the Set Header From this point on, all messages that the ELM327
command: sends will use these three bytes for the header. All that
needs to be done now is to request data from the
>AT SH A8 48 F1
vehicle. For physical addressing, this is often done
OK
using mode 22:
The three header bytes assigned in this manner
>22 11 6B
will stay in effect until changed by the next AT SH
62 11 6B 00 00
command, a reset, or an AT D.
Having set the header bytes, you now need only The response to this command is of the same
send the secondary ID for fluid temperature (10) at the format to those seen for standard OBD requests. The
prompt. If the display of headers is turned off, the request has been repeated (with 40 added to the
conversation could look like this: mode value in order to show that this is a response),
and this is followed by the actual data (0000 in this
>10
case). The PIDs used with mode 22 are usually
10 2E
proprietary to each manufacturer and are generally not
The first byte in the response echos the request, published widely, so you may have difficulty in
as usual, while the data that we requested is the 2E determining the ones to use with your vehicle. Elm

ELM327
Setting the Headers (Contd)
>AT CP vv >AT SH xx yy zz
>AT SH xx yy zz
vv xx yy zz
5 bits only
xx yy zz
vv xx yy zz
11 bit ID
29 bit ID
Figure 5. Setting a 29 bit CAN ID Figure 6. Setting an 11 bit CAN ID
Electronics does not maintain lists of this information, is the default value used by the ELM327). Since it is
and cannot provide any further details for you. Mode rarely changed, it is assigned separately from the
22 and others are described in more detail in SAE other header bytes, using the CP command. Changing
document J2190, Enhanced E/E Diagnostic Test of this value is usually only required if experimenting
Modes. with J1939 systems.
The ISO14230-4 standard defines its header The next byte (xx) describes the type of message
bytes a little differently. Advanced experimenters will that this is, and is set to hex DB for functional
be aware that for ISO 14230-4, the first header byte addressing, and to DA if using physical addressing.
must always include the length of the data field, which The next two bytes are as defined previously for the
varies from message to message. From that, one other standards yy is the receiver (or Target
might assume that the you would need to redefine the Address), and zz is the transmitter (or Source
header for every message that is to be sent not so! Address). For the functional diagnostic requests, the
The ELM327 always determines the number of bytes receiver is always 33, and the transmitter is F1, which
that you are sending, and inserts that length for you, in is very similar to ISO 14230-4.
the proper place for the header that you are using. If Those that are familiar with the SAE J1939
you are using the standard ISO 14230-4 header, the standard will likely find this header structure to be very
length will be put into the first header byte, and you familiar (J1939 is a CAN standard for use by heavy-
need only provide the two (most significant) bits of this duty vehicles such as trucks and buses). We use
byte when defining the header. What you place in the slightly different terminology, but there is a direct
rest of the byte will be ignored by the ELM327 unless parallel between the bytes used by J1939 for the
you set them all to 0s. If they are all 0, it is assumed headers and the grouping of the bytes in the ELM327.
that you are experimenting with KWP four byte Refer to page 36 for a discussion of the J1939 support
headers, and the ELM327 then creates the fourth that is provided by the ELM327.
header byte for you. Again, you do not need to provide The final header format to discuss is that used in
any length to be put into this byte it is done for you. 11 bit CAN systems. They also use a priority/address
Addressing within the CAN (ISO 15765-4) structure, but shorten it into roughly three nibbles
protocols is quite similar in many ways. First, consider rather than three bytes. The ELM327 uses the same
the 29 bit standard. The ELM327 splits the 29 bits into commands to set these values as for other headers,
a CAN Priority byte and the three header bytes that we except that it only uses the 11 least significant (right-
are now familiar with. Figure 5 shows how these are most) bits of the provided header bytes, and ignores
combined for use by the ELM327. the others (as shown in Figure 6). It quickly becomes
The CAN standard states that for diagnostics, the inconvenient to have to enter six digits when only three
priority byte (vv in the diagram) will always be 1B (this are required, so there is a special short version of the

ELM327
Setting the Headers (Contd)

AT SH command that uses only three hex digits. It
actually operates by simply adding the leading zeroes
for you.
The 11 bit CAN standard typically makes
functional requests (ID/header = 7DF), but receives
physical replies (7En). With headers turned on, it is a
simple matter to learn the address of the module that
is replying, then use that information to make physical
requests if desired. For example, if the headers are on,
and you send 01 00, you might see:
>01 00
7E8 06 41 00 BE 3F B8 13 00
The 7E8 shows that ECU#1 was the one

responding. In order to talk directly to that ECU, all you
need do is to set the header to the appropriate value (it
is 7E0 to talk to the 7E8 device see ISO 15765-4 for
more information). From that point on, you can talk
directly to the ECU using its physical address, as
shown here:
>AT SH 7E0
OK
>01 05
7E8 03 41 05 46 00 00 00 00
Hopefully this has helped to get you started. As we

often tell those that write if you are planning to do
some serious experimenting with OBD, you should buy
the relevant standards.

ELM327
Monitoring the Bus

Some vehicles use the OBD bus for information the header will be displayed.
transfer during normal vehicle operation, passing a Using this command with 11 bit CAN systems can
great deal of information over it. A lot can be learned if be a little confusing at first. Recall the way in which all
you have the good fortune to connect to one of these header bytes are stored within the ELM327. An 11 bit
vehicles, and are able to decipher the contents of the CAN ID is actually stored as the least significant 11
messages. bits in the 3 byte header storage location. It will be
To see how your vehicle uses the OBD bus, you stored with 3 bits in the receivers address location,
can enter the ELM327s Monitor All mode, by sending and the remaining 8 bits in the transmitters address
the command AT MA from your terminal program. This location. For this example, we have requested that all
will cause the IC to display any information that it sees messages created by transmitter 10 be printed, so all
on the OBD bus, regardless of transmitter or receiver 11 bit CAN IDs that end in 10 will be displayed (ie all
addresses (it will show all). Note that the periodic that look like x10).
wakeup messages are not sent while in this mode, so The other monitoring command that is very useful
if you have an ISO 9141 or ISO 14230 bus that had is the AT MR command, which looks for specific
been initialized previously, it may go to sleep while addresses in the middle byte of the header. Using this
monitoring. command, you can look for all messages being sent to
The monitoring mode can be stopped by putting a a particular address. For example, to use it to look for
logic low level on the RTS pin, or by sending a single messages being sent to the ECU with address 10,
RS232 character to the ELM327. Any convenient simply send:
character can be used to interrupt the IC there are
>AT MR 10
no restrictions on whether it is printable, etc. Note that
the character you send will be discarded, and will have and all messages that contain 10 in the second byte of
no effect on any subsequent commands. The time it the header will be displayed.
takes to respond to this interrupting character will Using this command with the 11 bit CAN systems
depend on what the ELM327 is doing when the will again need further explanation. It may be helpful to
character is received. The IC will always finish a task first picture the hex number 10 in the above example
that is in progress (printing a line, for example) before as the binary number 0001 0000. Recall from above
returning to wait for input, so you should always wait that 11 bit CAN IDs are actually stored as the least
for the prompt character (>), or the Busy line to go significant 11 bits in the 3 byte header storage
low, before beginning to send a command. locations, and only 3 bits are actually stored in the
One unexpected result may occur if you have the middle byte (receivers address) position. When
automatic protocol search feature enabled, and you comparing the received CAN ID to the address you
tell the ELM327 to begin monitoring. If the bus is quiet, provide with the MR command then, only the right-
the ELM327 will begin searching for an active protocol, most 3 bits of your MR address are considered and
which may not be what you were expecting. Be aware the other 5 bits are ignored. In this example, the
also that the ISO 9141 and ISO 14230 protocols look AT MR 10 effectively becomes AT MR 0 for 11 bit
identical when monitoring, so the ELM327 will likely CAN systems, and all messages that begin with 0 as
stop searching at ISO 9141, even if the actual protocol the first digit will actually be displayed.
is ISO 14230. With the Automatic searching enabled, In order to use the AT MR command with CAN 11
this should correct itself, however, when the first OBD bit identifiers, you should always try to use the format
request is made. AT MR 0x, where x is the digit that you want the
If the Monitor All command provides too much identifiers to begin with. To look for all 2xxs, use the
information (it certainly does for most CAN systems!), command AT MR 02, and to see all of the 7xxs, you
then you can restrict the range of data that is to be should use AT MR 07.
displayed. Perhaps you only want to see messages
that are being transmitted by the ECU with address 10.
To do that, simply type:
>AT MT 10
and all messages that contain 10 in the third byte of

ELM327
CAN Messages and Filtering

The ELM327 monitoring commands (AT MA, MR bit ID. We need to set a filter to look for 6 in that digit:
and MT) usually work very well with the slower
protocols J1850, ISO 9141 and ISO 14230. The >AT CF 00 00 06 00
CAN systems are a different story, however, as they
The 11 bit ID is stored in the last three locations,
often have an order of magnitude more information
so the 6 would appear where it is shown. Now, to
passing over them. The relatively small 256 byte buffer
make that digit relevant, we create the mask:
that the ELM327 uses for sending can quickly fill up
when data is arriving at 500 Kbps and leaving at >AT CM 00 00 0F 00
38.4 Kbps, or even 115.2 Kbps.
To help reduce the amount of information seen by The system only uses the 11 right-most bits in this
the ELM327, the internal CAN module has a filter that case, so we can be lazy and enter the F as shown (the
can be used to pass only messages with specific ID first bit of the F will be ignored, and it will be treated as
bits. A range of values can be passed when the filter is if we had entered a 7).
used with what is called a mask to say which bits are Clearly, this can be quite cumbersome if using 11
relevant. bit CAN systems routinely. To help with that, the
As an example, consider an application where you ELM327 offers some shorter versions of the CF and
are trying to monitor for 29 bit CAN diagnostic CM commands. To use them for the example above,
messages, exactly like the ELM327 does. By you need only enter three digit arguments:
definition, these messages will be sent to the scan tool
at address F1. From ISO 15765-4, you know then that >AT CF 600
the ID portion of the reply must be of the form:
and
18 DA F1 xx
>AT CM F00
where xx is the address of the module that is sending
As for the full eight digit versions, only the 11 least
the message. To use the filter, then, enter what you
significant (right-most) digits are actually used, so you
have into it, putting anything in for the unknown portion
do not need to take special care with the first bit.
(you will see why in a moment). The command to set
With a little practice, these commands are fairly
the CAN filter is AT CF
easy to master. Initially, try entering the filter and mask
>AT CF 18 DA F1 00 values, then use a command such as AT MA to see
what the results are. The ELM327 knows that you are
How, you ask, do you tell the ELM327 to ignore trying to filter, and combines the effects of both
those last two 0s? You do that with the mask. The commands (it will do that for MR and MT as well). The
mask is a set of bits that tell the ELM327 which bits in MA, MR and MT commands all have the extra benefit
the filter are relevant. If the mask bit is 1, that filter bit that while they are in effect, the ELM327 will remain
is relevant, and is required to match. If it is 0, then that quiet, not sending acknowledgement or error signals,
filter bit will be ignored. All bits in the above message so anything you do while monitoring should not disrupt
are relevant, except those of the last two digits. To set other devices that are on the bus.
the mask for this example then, you would need to use Note that if a filter has been set, it will be used for
the CAN Mask command, as follows: all CAN messages. Setting filters and masks may
cause standard OBD requests to be ignored though,
>AT CM 1F FF FF 00 and you may begin seeing NO DATA responses. If
this happens, and you are unsure of why, you may
If desired, you can convert the hexadecimal to
want to reset everything to their default values (AT D)
binary to see what has been done.
and start over.
The 11 bit CAN IDs are treated in the same
manner. Recall that they are stored internally in the
right-most 11 bits of the locations used for 29 bit CAN,
which must be considered when creating a filter or
mask. As an example, assume that we wish to display
all messages that have a 6 as the first digit of the 11

ELM327
Multiline Responses
There are occasions when a vehicle must respond making the reading of the data easier. With formatting
with more information than one message is able to on, the sequence numbers are shown with a colon (:)
show. In these cases, it responds with several lines after each, so that they clearly stand out (0:, 1:, etc.).
which must be assembled into one complete message. CAN systems add this hex digit (it goes from 0 to F
One example of this is a request for the serial then repeats), to aid in reassembling the data, just as
number of the vehicle (mode 09, PID 02). This is often the J1850 vehicle did.
a multiline reply that needs to be joined. In these The first line of this response says that there are
situations, you must take care to ensure that all of the 014 bytes of information to follow. That is 14 in
reply has been received and it is in the correct order hexadecimal, or 20 in decimal terms, which agrees
before assembling the message. The actual response with the 6 + 7 + 7 bytes shown on the three lines.
usually has a byte that shows the sequence of the Serial numbers are generally 17 digits long however,
data, to help with this. Here is one example for a so how do we assemble the number from 20 digits?
typical SAE J1850 vehicle: The second line shown begins with the familiar 49
02, as this is a response to an 09 02 request. Clearly
>0902
they are not part of the serial number. CAN will
49 02 01 00 00 00 31
occasionally add a third byte to the response which we
49 02 02 44 34 47 50
see next (the 01), which shows the number of data
49 02 03 30 30 52 35
items that are to follow (the vehicle can only have one
49 02 04 35 42 31 32
VIN, so the response says there is only one data item).
49 02 05 33 34 35 36
That third byte can be ignored, so this leaves 17 data
Note that all OBD compliant vehicles do not bytes which are the serial number (purposely chosen
necessarily provide this information. Many older ones to be identical to the those of the previous example).
do not, but as a rule the newer ones do. If your vehicle All that is needed is a conversion to ASCII, in order to
does not support this parameter, you will only see a read them, exactly as before.
NO DATA response. The following shows an example of a different type
The first two bytes (49 and 02) on each line of the of multiline response that can occur when two or more
above response do not show any vehicle information. ECUs respond to one request. Here is a typical
They only show that this is a response to an 09 02 response to an 01 00 request:
request. The next byte on each line shows the order in
>01 00
which the data is to be assembled. Assembling the
41 00 BE 3E B8 11
remainder of the data in that order, and ignoring the
41 00 80 10 80 00
first few 00s gives:
This is difficult to decipher without knowing a little
31 44 34 47 50 30 30 52 35 35 42 31 32
more information. We need to turn the headers on to
33 34 35 36
actually see who is doing the talking:
Using an ASCII table to convert these hex digits >AT H1
gives the following serial number for the vehicle: OK
1 D 4 G P 0 0 R 5 5 B 1 2 3 4 5 6 >01 00
48 6B 10 41 00 BE 3E B8 11 FA
CAN systems will display this information in a 48 6B 18 41 00 80 10 80 00 C0
somewhat different fashion. Here is a typical response
Now, if you analyze the header, you can see that
from a CAN vehicle:
the third byte shows ECU 10 (the engine controller)
>0902 and ECU 18 (the transmission) are both responding
014 with a reply that is valid for them. This type of
0: 49 02 01 31 44 34 response occurs often, and you should be prepared for
1: 47 50 30 30 52 35 35 it.
2: 42 31 32 33 34 35 36 A final example shows how similar messages
might occasionally be mixed up in a CAN system. We
CAN Formatting has been left on (the default),

ELM327
Multiline Responses (Contd)

ask the vehicle for the Calibration ID (09 04) and are their proper order. To do this, look at the byte following
presented with the following response: the CAN ID - it is what is known as the PCI byte, and
is used to tell what type of data follows. In this case,
>09 04 the PCI byte begins with either a 1 (for a First Frame
013 message), or a 2 (for the Consecutive Frames). The
0: 49 04 01 35 36 30 second half of the PCI byte shows the order in which
1: 32 38 39 34 39 41 43 the information is to be assembled (ie. the segment
013 number). In this case, the segment numbers are
0: 49 04 01 35 36 30 already in order, but if they had not been, it would
2: 00 00 00 00 00 00 31 have been necessary to rearrange the messages to
1: 32 38 39 35 34 41 43 place them in order.
2: 00 00 00 00 00 00 00 Each OBD standard has some minor peculiarities.
Hopefully this has helped you with some of the more
which is quite confusing. The first group (the 013, 0:, 1: difficult ones. If you are still having trouble, we urge
group) seems to make some sense, but the following you to purchase the relevant standard, and study it.
group is very confusing. Why are there two segment
twos? Which ECU do these belong to? The only way
to tell is to turn on the headers, and repeat your
request:
>AT H1
OK
>09 04
7E8 10 13 49 04 01 35 36 30
7E8 21 32 38 39 34 39 41 43
7E9 10 13 49 04 01 35 36 30
7E8 22 00 00 00 00 00 00 31
7E9 21 32 38 39 35 34 41 43
7E9 22 00 00 00 00 00 00 00
This time, the order appears to be the same, but

be aware that it may not be that is why the standard
requires that sequence codes be transmitted with
multiline responses.
Looking at the first digits of these responses, you
can see that some begin with 7E8, and some begin
with 7E9. This is the special CAN IDs representing
ECU#1 and ECU#2, respectively. Grouping the
responses from the two ECUs gives:
7E8 10 13 49 04 01 35 36 30
7E8 21 32 38 39 34 39 41 43
7E8 22 00 00 00 00 00 00 31
and
7E9 10 13 49 04 01 35 36 30
7E9 21 32 38 39 35 34 41 43
7E9 22 00 00 00 00 00 00 00
From these, the messages can be assembled in

ELM327
CAN Message Formats

The ISO 15765-4 (CAN) standard defines several In this example, the line that begins with 0: is the
message types that are to be used with diagnostic First Frame message. The length (014) was actually
systems. Currently, there are four main ones that may extracted from the message by the ELM327 and
be used: printed on the separate line as shown. Following the
First Frame line are two Consecutive Frames as
SF - the Single Frame
shown (1: and 2:). To learn more details of the exact
FF - the First Frame (of a multiframe message) formatting, you may want to send a request such as
CF - the Consecutive Frame ( ) the one above, then repeat the same request with the
FC - the Flow Control frame headers enabled (AT H1). This will show the PCI bytes
that are actually used to send these components of the
The Single Frame message contains storage for total message.
up to seven data bytes and what is known as a PCI The Flow Control frame is one that you do not
(Protocol Control Information) byte. The PCI byte is normally have to deal with. When a First Frame
always the first byte of them all, and tells how many message is sent as part of a reply, the ELM327 must
data bytes are to follow. If the CAN Auto Formatting tell the sender some technical things (such as how
option is on (CAF1) then the ELM327 will create this long to delay between Consecutive Frames, etc.) and
byte for you when sending, and remove it for you when does so by replying immediately with a Flow Control
receiving. (If the headers are enabled, you will always message. These are predefined by the ISO 15765-4
see it.) standard, so can be automatically inserted for you. If
If you turn the Auto Formatting off (with CAF0), it you wish to generate custom Flow Control messages,
is expected that you will provide all of the data bytes to then refer to the next section.
be sent. For diagnostics systems, this means the PCI If a Flow Control frame is detected while
byte and the data bytes. The ELM327 will not modify monitoring, the line will be displayed with FC: before
your data in any way, except to add extra padding the data, to help you with decoding of the information.
bytes for you, to ensure that you always send a total of There is a final type of message that is
eight data bytes (the data length is not adjustable with occasionally reported, but is not supported by the
this version of the ELM327). You do not need to set diagnostics standard. The (Bosch) CAN standard
the Allow Long (AT AL) option in order to do this, as allows for the transmission of a data request without
the IC overrides it for you. sending any data in the requesting message. To
A First Frame message is used to say that a ensure that the message is seen as such, the sender
multiframe message is about to be sent, and tells the also sets a special flag in the message (the RTR bit),
receiver just how many data bytes to expect. The which is seen at each receiver. The ELM327 always
length descripter is limited to 12 bits, so a maximum of looks for this flag, or for zero data bytes, and may
4095 byes can be received at once using this method. report to you that an RTR was detected while
Consecutive Frame messages are sent after the monitoring. This is shown by the characters RTR
First Frame message to provide the remainder of the where data would normally appear, but only if the CAN
data. Each Consecutive Frame message includes a Auto Formatting is off, or headers are enabled. Often,
single hex digit sequence number that is used to when monitoring a CAN system with an incorrect baud
determine the order when reassembling the data. It is rate chosen, RTRs may be seen.
expected that if a message were corrupted and resent, Note that the CAN system is quite robust with
it could be out of order by a few packets, but not by several error detecting methods in place, so that
more than 16, so the single digit is normally more than during normal data transmission you will rarely see
adequate. As seen previously, the serial number for a any errors. When monitoring buses however, you may
vehicle is often a multiframe response: well see errors (especially if the ELM327 is set to an
incorrect baud rate). As a diagnostic aid, when errors
>0902 do occur, the ELM327 will print all bytes (no matter
014 what CAF, etc., is set to), followed by the message
0: 49 02 01 31 44 34 <RX ERROR.
1: 47 50 30 30 52 35 35
2: 42 31 32 33 34 35 36

ELM327
Altering Flow Control Messages

ISO 15765-4 (CAN) provides for only eight data then you can set the mode:
bytes per frame of data. Of course, there are many
cases where the data which needs to be sent is longer >AT FC SM 1
that 8 bytes and CAN has made provision for this, OK
allowing data to be separated into segments, then
From this point on, every First Frame message
recombined at the receiver.
received will be responded to with your custom
To send one of these multi-line messages, the
message.
transmitter in a CAN system will send a First Frame
The final mode currently supported allows the user
message, and then wait for a reply from the receiver.
to set the data bytes which are to be sent, but not the
This reply, called a Flow Control message contains
ID bits. The ID bits (header bytes) in mode 2 are set to
information concerning acceptable message timing,
those which were received in the First Frame
etc., and is required to be sent before the transmitter
message, without change. To use this mode, first
will send any more data. For ISO 15765-4, the type of
define your data bytes, then activate the mode:
response is well defined, and never changes. The
ELM327 will automatically send this ISO 15765-4 Flow >AT FC SD 00 11 22
Control response for you as long as the CAN Flow OK
Control option is enabled (CFC1), which it is by
default.
Several users have requested that we provide >AT FC SM 2
more flexibility over the data sent in the Flow Control OK
message, and as of v1.1, we have provided a means
For most people, there will be little need to
to do this. In order to change how the ELM327
manipulate these Flow Control messages, as the
responds when it needs to send a Flow Control
defaults are designed to work with the CAN OBD
message, you need to change Flow Control modes.
standards. If you wish to experiment, these special AT
The default Flow Control mode is number 0. At
commands offer that control for you.
any time while you are experimenting, if you should
Figure 7 summarizes the currently supported
wish to restore the automatic Flow Control responses
modes:
(for ISO 15765-4), simply set the mode to 0:
>AT FC SM 0 FC ELM327 User

OK Mode Provides Provides
This will immediately restore the responses to their ID Bits

0 no values
default settings. Data Bytes
Mode 1 has been provided for those that need
ID Bits
complete control over their Flow Control messages. To 1 no values
Data Bytes
use it, simply define the CAN ID (header) and data
bytes that you require be sent in response to a First
Frame message. If you try to set the mode before 2 ID Bits Data Bytes
defining these values, you will get an error:
>AT FC SM 1 Figure 7. Flow Control Mode Numbers

?
You must set the headers and data first:
>AT FC SH 7E8
OK
>AT FC SD 00 11 22
OK

ELM327
J1939 Support
The SAE J1939 CAN standard is a relatively new defined by the transport protocol (J1939-21). If the
protocol that is being used in many types of heavy responses are multisegment, the ELM327 handles all
machinery trucks, agricultural equipment, and of the negotiation for you (transparently - you wont
busses, to name a few. It uses a standard CAN see it happen). If formatting is on (ie CAF1), the output
(ISO 11898) physical interface, and defines its own will resemble the format used to print the ISO 15765-4
format for data transfer (although it is very similar to multiline responses. Note that if you provide three data
the ISO 15765 that is used for automobiles). bytes, the ELM327 will assume that you are sending a
The ELM327 offers some support for the J1939 PGN, and will look for responses to that. If you send
standard in Protocol A. (Protocols B and C can be other than 3 data bytes, it will assume that you are
selected for J1939 formatting if needed, with making a general request, and will only look for
Programmable Parameters 2C and 2E). Although this responses to the Source Address (as given in the third
is not full support as dictated by the standards, the byte of the header).
ELM327 implementation should at least allow you to The SAE J1939 standard predefines several
begin experimenting. Diagnostic Messages, and assigns ID values to them.
The default data rate for Protocol A has been set The first of these (designated DM1) are reserved for
to 250 kbps, as set by the SAE J1939-11 standard. trouble codes, which are periodically broadcast over
Should your application require a different speed, it is the CAN network. Since these are commonly required,
easily changed with PP 2B. the ELM327 provides a special command to monitor
J1939 messages use 29 bit CAN IDs, and up to 8 for them (aptly named DM1). If you wish to monitor for
data bytes for each message (ISO 15765 always uses all DM1 messages, simply issue:
8 bytes). Diagnostics on SAE J1939 are defined by the
J1939-73 standard, and the actual data transfer >AT DM1
protocol is described in J1939-21. If you are going to
and the ELM327 will print out all that it finds.
do a lot of work with J1939, it may be wise to purchase
The DM1 message is the only one that is presently
these standards documents from the Society of
predefined by the ELM327 for you. To monitor for any
Automotive Engineers (SAE).
other diagnostic message, you need to know its PGN
The ELM327 handles the sending of messages
number (in hexadecimal), and monitor for that using
with the J1939 protocol in the same way as any of the
the AT MP command. For example, the DM2 PGN
other protocols. The header bytes are predefined for
number is 65227, or 00FECB in hexadecimal. The
you and all you need do is provide the data bytes that
ELM327 requires hexadecimal, and assumes that all
you wish to send.
PGNs begin with 00 so to monitor for DM2s, you
For example, assume that you wish to send a
need only send:
request for engine temperature (PGN 00FEEE). J1939
specifies a reverse order for the data bytes, so when >AT MP FECB
you tell the ELM327 what to send, you need to switch
the order of the data bytes, and then send them as you and the IC will begin looking for all replies to DM2
would any other request: requests.
Please note that the ELM327s support for the
>EE FE 00 SAE J1939 standard is only basic (it does not support
address negotiation as described in J1939-73, for
The ELM327 then adds the required header (ID)
example), and it has not undergone the extensive
bytes, etc. and sends the message for you. (It also
testing that our automotive protocols have. We simply
configures itself correctly to be able to receive the
have had a large number of requests for support of the
response.) Note that the ELM327 sets the header
protocol, and wanted to provide something for you to
bytes to EC FF F9 by default (for global requests from
begin experimenting with. As always, we are quite
OBD service tool #1), so if you want something else,
open to your feedback and your suggestions for future
you will have to change the headers, using the AT SH
upgrades.
command.
All responses to a request are printed by the
ELM327, whether they are a single CAN message
transmission, or a multisegment transmission as

ELM327
Restoring Order
There may be times when it seems the ELM327 is the four status LEDs in sequence. A much quicker
out of control, and you will need to know how to option is available with the ELM327, however, if the
restore order. Before we continue to discuss modifying led test is not required the Warm Start command:
too many parameters, this seems to be a good point to
discuss how to get back to the start. Perhaps you >AT WS
have told the ELM327 to monitor all data, and there
This new command performs a software reset,
are screens and screens of data flying by. Perhaps the
restoring exactly the same items as the AT Z does, but
IC is now responding with NO DATA when it did work
it omits the LED test, so it is considerably faster. Also,
previously. This is when a few tips may help.
it does not affect any baud rates that have been set
The ELM327 can always be interrupted from a
with the AT BRD command, so is essential if you are
task by a single keystroke from the keyboard. As part
modifying baud rates with software.
of its normal operation, checks are made for received
Any of the above methods should be effective in
characters, and if found the IC will stop what it is doing
restoring order while experimenting. There is always
at the next opportunity. Often this means that it will
the chance that you may have changed a
continue to send the information on the current line,
Programmable Parameter, however, and are still
then stop, print a prompt character, and wait for your
having problems with your system. In this case, you
input. The stopping may not always seem immediate if
may want to simply turn off all Programmable
the RS232 send buffer is almost full, though you will
Parameters (which forces them to their default values).
not actually see the prompt character until the buffer
To do so, send the command:
has emptied, and your terminal program has finished
printing what it has received. >AT PP FF OFF
There are times when the problems seem more
serious and you dont remember just what you did to which should disable all of the changes that you have
make them so bad. Perhaps you have adjusted some made. You can then start over with what is essentially
of the timers, then experimented with the CAN filter, or a device with factory settings. There may be times
perhaps tried to see what happens if the header bytes when even this command is not recognized, however.
were changed. All of these can be reset by sending If that is the case, you will need to use the hardware
the set to Defaults AT Command: method of turning the PPs off (see the next section
Programmable Parameters, for more details).
>AT D
OK
This will often be sufficient to restore order, but it

can occasionally bring unexpected results. One such
surprise will occur if you are connected to a vehicle
using one protocol, but the saved (default) protocol is
a different one. In this case, the ELM327 will close the
current session and then change the protocol to the
default one, exactly as instructed.
If the AT D does not bring the expected results, it
may be necessary to do something more drastic - like
resetting the entire IC. There are a few ways that this
can be performed with the ELM327. One way is to
simply remove the power and then reapply it. Another
way that acts exactly the same way as a power off and
then on is to send the full reset command:
>AT Z
It takes approximately one second for the IC to

perform this reset, initialize everything and then test

ELM327
Programmable Parameters
The ELM327 contains several programmable >AT PPS
memory locations that retain their data even after 00:FF F 01:00 N 02:FF F 03:32 F
power is turned off. Every time the IC is powered up, 04:01 F 05:FF F 06:F1 F 07:09 F
these locations are read and used to change the 08:FF F 09:00 F 0A:0A F 0B:FF F
default settings for such things as whether to display 0C:68 F 0D:0D F 0E:FF F 0F:FF F
the headers, or how often to send wakeup messages. 10:0D F 11:00 F 12:FF F 13:32 F
The settings, or parameters, can be altered by the 14:FF F 15:FF F 16:FF F 17:92 F
user at any time using a few simple commands. These 18:00 F 19:FF F 1A:FF F 1B:FF F
Programmable Parameter commands are standard AT 1C:FF F 1D:FF F 1E:FF F 1F:FF F
Commands, with one exception: each one requires a 20:FF F 21:FF F 22:FF F 23:FF F
two-step process to complete. This extra step provides 24:00 F 25:00 F 26:00 F 27:FF F
some security against random inputs that might try to 28:FF F 29:FF F 2A:FF F 2B:02 F
make changes. 2C:E0 F 2D:04 F 2E:80 F 2F:0A F
The following pages list the currently supported
Programmable Parameters for this version of the You can see that PP 01 now shows a value of 00,
ELM327. As an example of how to use a and it is enabled (oN).
Programmable Parameter, consider PP 01 (the Another example shows how you might change
printing of headers). If you are constantly powering the CAN filler byte. Some systems use AA as the
your ELM327 and then using AT H1 to turn the value to put into unused CAN bytes, while the ELM327
headers on, you may want to change its default uses 00 by default. To change the ELM327s
setting, so that they are always on by default. To do behaviour, simply change PP 26:
this, simply set the value of PP 01 to 00:
>AT PP 26 SV AA
>AT PP 01 SV 00 OK
OK
>AT PP 26 ON
This changes the value associated with PP 01, but OK
does not enabled it. To make the change effective, you
Again, PP 26 is of type D, so the above change
must also type:
will not actually take effect until the AT D command is
>AT PP 01 ON issued, or the ELM327 is reset.
OK The Programmable Parameters are a great way to
customize your ELM327 for your own use, but you
At this point, you have changed the default setting
should do so with caution if using commercial
for AT H1/H0, but you have not changed the actual
software. Most software expects an ELM327 to
value of the current AT H1/H0 setting. From the Type
respond in certain ways to commands, and may be
column in the table on page 39, you can see that the
confused if the headers are on when not expected, or
change only becomes effective the next time that
if the CAN response shows data length codes, for
defaults are restored. This could be from a reset, a
example. If you make changes, it might be best to
power off/on, or possibly an AT D command.
make small changes and then see the effect of each,
It is occasionally difficult to know what changes
so that it is easier to retrace your steps and undo
you have made to the Programmable Parameters. To
what you have done. If you get in too deeply, dont
help with that, the ELM327 provides a Programmable
forget the all off command:
Parameter Summary (PPS) command. This simply
prints a list of all of the supported PPs, their current >AT PP FF OFF
value, and whether they are on/enabled (N), or
No matter what software you use, you might get
off/disabled (F). For an ELM327 v1.2 IC, with only the
into more serious trouble, should you change the baud
headers enabled (as discussed above), the summary
rate, or the Carriage Return character, for example,
table would look as follows:
and forget what you have set them to. The Carriage
Return value set by PP 0D is the only character that is
recognized by the ELM327 as ending a command, so

ELM327
Programmable Parameters (Contd)

if you change its value, you may not be able to undo you can remove the jumper the PPs are off. This
your change. In this case, your only recourse may be feature should only be used when you get into trouble
to force all of the PPs off with a hardware trick. too deeply, and its your only choice (since putting
When the ELM327 first powers up, it looks for a jumpers into a live circuit might cause damage if you
jumper from pin 28 (the OBD Tx LED) to circuit put it into the wrong place). As well, it is only available
common (V DD). If a jumper is in place, it will turn off all beginning with version 1.2 of the IC, and should not be
of the PPs for you, restoring the IC to the factory used on any previous versions.
defaults. To use this feature, simply connect a jumper
to circuit common, then hold the other end of the
jumper to pin 28 while turning the power on. As soon
as you see the RS232 Rx LED begin to flash quickly,
The following is a summary of the currently implemented Programmable Parameters (ELM327 v1.2):
PP Description Values Default Type
00 Perform AT MA after powerup or reset 00 = ON FF R

FF = OFF (OFF)
01 Printing of header bytes (AT H default setting) 00 = ON FF D

FF = OFF (OFF)
02 Allow long messages (AT AL default setting) 00 = ON FF D

FF = OFF (OFF)
03 NO DATA timeout time (AT ST default setting) 00 to FF 32 D

setting = value x 4.096 msec (205 msec)
04 Default Adaptive Timing mode (AT AT setting) 00 to 02 01 D
06 OBD Source (Tester) Address. Not used for J1939 protocols. 00 to FF F1 R
07 Last Protocol to try during automatic searches 01 to 0C 09 D
09 Character echo (AT E default setting) 00 = ON 00 R

FF = OFF (ON)
0A Linefeed Character 00 to FF 0A R
0C RS232 baud rate divisor when pin 6=1 08 to FF 68 P

The baud rate (in kbps) is given by 4000/(this value) (38.4)
For example, to obtain 500kbps, use a setting of 08 (4000/8 = 500)
(Continued on the next page)

ELM327
0C Here are some example baud rates, and the divisor to be used for
(contd) each:
Baud Rate PP 0C value

(kbps) hex (dec)
19.2 D0 (208)
38.4 68 (104)
57.6 45 (69)
115.2 23 (35)
230.4 11 (17)
500 08 (8)
Note that the PP 0C value must be provided to the ELM327 as

hex digits only. The decimal values that are shown above in
brackets are for your convenience only.
0D Carriage Return Character 00 to FF 0D R
10 J1850 voltage settling time 00 to FF 0D I

setting = value x 4.096 msec (53 msec)
11 J1850 Break Signal monitor enable 00 = ON 00 D

(reports BUS ERROR if break signal duration limits are exceeded) FF = OFF (ON)
13 Auto search time delay between protocols 1 & 2 00 to FF 32 I

setting = value x 4.096 msec (205 msec) (see note 2)
16 ISO baud rate (AT IB default setting) 00 = 96 FF R

FF = 10 (10.4K)
17 ISO wakeup message rate (AT SW default setting) 00 to FF 92 D

setting = value x 20.48 msec (2.99 sec)
18 Auto search time delay between protocols 4 & 5 00 to FF 00 I

setting = value x 4.096 msec (no delay)
24 CAN auto formatting (AT CAF default setting) 00 = ON 00 D

FF = OFF (ON)
25 CAN auto flow control (AT CFC default setting) 00 = ON 00 D

FF = OFF (ON)
26 CAN filler byte (used to pad out messages) 00 to FF 00 D

ELM327
29 Printing of the CAN data length (DLC) when printing header bytes 00 = ON FF D
FF = OFF (OFF) (see note 2)
2B Protocol A (SAE J1939) CAN baud rate divisor. 01 to 40 02 R

(250 Kbps)
The protocol A CAN baud rate is determined by this value (rate in
kbps = 500/value). For example, setting this PP to 19 (ie. decimal
25) provides a baud rate of 500/25 = 20 kbps.
2C Protocol B (USER1) CAN protocol options. 00 to FF E0 R

(11100000)
Each bit of this byte controls an option, as follows:
b7: Transmit ID Length, 0=29 bit ID, 1=11 bit ID
b6: Data Length, 0=fixed 8 byte, 1= Variable DLC
b5: Receive ID Length, 0=as set by b7, 1=both 11 bit and 29 bit
b4: reserved for future - leave set at 0
b3: reserved for future - leave set at 0.
b2, b1, and b0 determine the data formatting options, as follows:
b2 b1 b0 Data Format
0 0 0 none
0 0 1 ISO 15765-4
0 1 0 SAE J1939
Other combinations are reserved for future results might be
unpredictable if you should select one of them.
Note that b7 is the msb, and b0 is the lsb. For example, the default
value of E0 can be shown as 11100000 in binary, which has b7, b6
and b5 set to 1s. This means that by default, 11 bit IDs will be
sent, the data length will vary, and the ELM327 will receive
messages with either 11 or 29 bit IDs.
2D Protocol B (USER1) baud rate divisor. See PP 2B for a description. 01 to 40 04 R

(125 Kbps)
2E Protocol C (USER2) CAN options. See PP 2C for a description. 00 to FF 80 R

(10000000)
2F Protocol C (USER2) baud rate divisor. See PP 2B for a description. 01 to 40 0A R

(50 Kbps)
Notes: 1. The Type column indicates when changes to the Programmable Parameter take effect. Possible values
are:
I - the effect is immediate,
D - takes effect after Defaults are restored (AT D, AT Z, AT WS or power off/on)
R - will only become apparent after a Reset (AT Z, AT WS or power off/on)
P - only takes effect after power off/on or AT Z.
2. These are changes since the last version of the IC.

ELM327
Using Higher RS232 Baud Rates

The RS232 serial interface has been maintained connection to microprocessor. That is certainly an
throughout the ELM OBD products, largely due to its option, and one that allows a full speed connection at
versatility. Older computers and PDAs can use it essentially zero cost. If you are developing such a
directly, as can microprocessors. Newer computers system, you can often simply connect the transmit
generally do not have RS232 ports, but they do have output from your microprocessor to the ELM327s
USB and ethernet ports, both of which can be receive, and the receive input to the ELM327s
converted to RS232 with a simple adapter. transmit. Provided that they share the same power
Most people will build their ELM327 circuits with supplies, and you use good wiring practices between
an RS232 interface, mainly because it is relatively them, the connection should work well. You do not
easy and inexpensive to do so. A circuit such as the have to convert to RS232 voltage levels in order to use
one shown in Figure 9 requires very few components the RS232 signals.
and works extremely well at speeds up to 57600 bps. The default configuration for the ELM327 provides
Depending on your computers RS232 voltages, your an RS232 data rate of either 9600 baud, or 38400
wiring practices, and your choice of components, it baud, depending on the level at pin 6 during power up
may also work well at speeds as high as 115200 bps. or reset. While the 9600 baud rate is not adjustable,
This is the approximate limit of such a circuit however, the 38400 one is (beginning with v1.2 of the IC). There
and anything operating at this speed should be are two ways that the rate can be changed either
thoroughly tested. permanently with a Programmable Parameter, or
Users that would like to operate at speeds in the temporarily with an AT command.
range of 115200 bps (or higher) may wish to look at Programmable Parameter 0C has been provided
some of the single IC solutions that are available. to allow you to change the high speed baud rate to
These include devices such as the ADM232A from what works best for you. You can change the value
Analog Devices (http://www.analog.com/), or the several times if you wish, and each time that you do,
popular MAX232 series of ICs from Maxim Integrated that new value becomes your power on default setting.
Products (http://www.maxim-ic.com/). These are all The type of storage used for this value is actually
excellent devices that can be used for speeds of up to called non-volatile, as it is not affected by power
115.2 Kbps. We do caution that many of these types of cycles or resets. To change the setting requires only a
devices are only rated for operation up to 120 Kbps, write to the ELM327s EEPROM, using the AT PP
however, so may not be suitable for higher data rates; commands.
be sure to check the manufacturers data sheet before If, for example, you would like to have the IC use a
committing to a design. baud rate of 57.6K rather than the factory setting of
An RS232 interface needs relatively large voltage 38.4K, simply change the value of PP 0C, and then
swings, which are difficult to maintain at higher rates enable it. PP 0C is actually an internal divisor that is
with large cable capacitances to contend with. (A stored in memory the baud rate is calculated from
typical interface is often limited to about 230400 bps 4000 divided by the value of the number that is stored.
under ideal conditions.) If you need to operate the To obtain a setting of 57.6, a baud rate divisor of 69 is
ELM327 at these speeds or higher, it is recommended required (4000/69 is approximately 57.6). Since 69 in
that you consider alternatives. decimal is 45 in hexadecimal, you tell the ELM327 to
One popular alternative is a USB data connection. set the value to 45:
The USB interface is capable of very high data transfer
>AT PP 0C SV 45
rates, certainly much higher than the 500 Kbps limit of
the ELM327. Several manufacturers offer special then enable the new value for use:
bridge circuits that simplify connecting an RS232
>AT PP 0C ON
device (such as the ELM327) directly to the USB bus.
Examples are the CP2102 from Silicon Labs from that point on (until PP 0C is turned off), the
(http://www.silabs.com/) or the FT232R from Future ELM327 will communicate at the new baud rate.
Technology Devices (http://www.ftdichip.com/). If If you are designing your own circuitry, it is
planning to use the higher baud rates (ie up to 500 relatively easy to know what your circuit is capable of,
Kbaud), these interfaces are essential. and then write a value to PP 0C once. Software
We are often asked about the use of a direct developers will not usually know what hardware is

ELM327
Using Higher RS232 Baud Rates (Contd)

connected to the ELM327 however, so will not know
what the limitations are. For these users, we have PC ELM327
provided the AT BRD command.
The AT BRD command allows a new baud rate to
Request for a new
be tested, and then accepted or rejected depending on
baud rate divisor:
the results of the test. See the chart at the right, which
AT BRD hh
shows how the command works. ELM327 responds
As can be seen, the software first makes a request with OK
for a new baud rate divisor, using this command. For (if it is supported)
example, to try the 57600 baud rate that was
Program switches to
previously discussed, the controlling PC would send
the new baud rate,
the command:
and waits for input
AT BRD 45 ELM327 waits for
75msec*, then sends
If the ELM327 is an older version, it will not
the AT I string
support this command, and will return with the familiar
? character. If it does support the command, it will If the Rx is good,
respond with OK, so the software knows whether to Program sends a
proceed or not. carriage return
Having sent an OK, the ELM327 then switches to Wait up to 75 msec*
the new (proposed) baud rate, and then simply waits a for a carriage return
predetermined time (nominally 75 msec). This period character
is to allow the PC sufficient time to change its baud
rate. When the time is up, the ELM327 then sends the
ID string (currently ELM327 v1.2) to the PC at the
new baud rate, and then waits for a response.
Knowing that it should receive the ELM327 ID
yes CR
string, the PC software compares what was actually
received
received to what was expected. If they match, the PC
?
responds with a carriage return character, but if there
is a problem, the PC sends nothing. The ELM327 is
meanwhile waiting for a valid carriage return character no
Print OK
to arrive. If it does (within 75 msec), the proposed
baud rate is retained, and the ELM327 says OK at
this new rate. If it does not, the baud rate then reverts Revert to the
back to the old rate. Note that the PC might correctly old baud rate
output the carriage return at this new rate, but the
interface circuitry could corrupt the character, so that Print a prompt,
the ELM327 does not see a valid response. Your then wait for the
software must check for the OK response before next command
assuming that the new rate has been accepted.
Using this method, a program can quickly try
several baud rates, evaluating the connection each
time, and settling on the fastest suitable one. The new
baud rate will stay in effect until reset by an AT Z, or a
Power Off/On. It is not affected by the AT WS (Warm
Start) command.
* Note that the 75msec time is adjustable
(with the AT BRT hh command)

ELM327
Computer Control
A common question we receive with our OBD ready to receive an input. To use them, set one of your
interpreters is Can I connect the ELM32x circuit port pins to normally provide a high output, and
directly to my own circuit, or must I use the RS232 connect it to the RTS input. Use another port pin as an
interface shown? Certainly you may connect directly input to monitor the ELM327 Busy output. When you
to our ICs you do not need to use an RS232 want to send a command, simply check the Busy
interface. output first. If it is at a logic high level, then bring your
The ELM327 does not use an inverted RS232 Rx RTS line low and wait for the Busy line to go low (you
input (as was the case with the ELM320, ELM322 and might want to consider using an edge triggered
ELM323), so interfacing without RS232 levels is now interrupt for this, if one is available). When Busy does
even simpler. If you have a microprocessor that uses go low, restore your RTS line to a high level, and then
the same 5V supply as the ELM327, and has an send your command to the ELM327. No need to worry
internal UART, all you will generally need to do is about the ELM327 becoming busy again after you
connect your processors transmit output to the raise the RTS line at this point once Busy goes low,
ELM327s receive input, and then your receive input to the ELM327 waits (indefinitely) for your command.
the ELM327s transmit output. Communications should If you do not use the RTS input on the ELM327,
work fine with this connection (and a correct baud rate dont forget to tie it to a high logic level.
setting). The ELM327 is a CMOS device that uses
industry standard levels for all inputs and outputs, so is
easily interfaced to almost any logic circuit.
The ELM327 has a hand-shaking feature that may
be very useful for some interfaces. There is a request
to send (RTS) input, and a Busy output that can be
used to interrupt the ELM327, and to see when it is
Error Messages
When hardware or data problems occur, the ELM327 automatic search for a protocol, and are only visible if
will respond with one of the following short messages. not in the auto mode. Here is a brief description of
Some of the messages are suppressed during an each:
BUFFER FULL BUS BUSY

The ELM327 provides a 256 byte internal RS232 The ELM327 tried to send the message, or tried to
transmit buffer so that OBD messages can be received initialize the bus, and detected too much activity to do
quickly, stored, and sent to the computer or PDA at a so (it needs a pause in activity in order to insert the
more constant rate. Occasionally (particularly with message). Although this could be because the bus
CAN systems) the buffer will fill at a faster rate than it was in fact very busy, it is most often due a wiring
is being emptied. Eventually it may become full, and problem that is giving a continuously active input. If
no more data can be stored (it is lost). this is an initial trial with your ELM327 circuit, check all
If you are receiving BUFFER FULL messages, of the voltage levels at the offending OBD input this
and are using a 9600 baud data rate, give serious error is very likely due to a wiring problem.
consideration to changing your data rate to 38400
baud. If you still receive BUFFER FULL messages BUS ERROR
after that, consider some of the filtering options (the
MR, MT, CF and CM AT Commands). A generic problem has occured. This is most often
from an invalid signal being detected (a pulse that is
longer than a Break signal, etc.) on the bus, but could

ELM327
Error Messages (Contd)

be from a wiring error. Note that some vehicles may It may be that the vehicle had no data to offer for that
generate long pulses as part of their startup process, particular PID, that the mode requested was not
so you may see this message as part of a normal supported, that the vehicle was attending to higher
vehicle startup while monitoring all. priority issues, or in the case of the CAN systems, the
filter may have been set to ignore the response, even
though one was sent. If you are certain that there
CAN ERROR
should have been a response, try adjusting the AT ST
The CAN system had difficulty initializing, sending, time (to be sure that you have allowed sufficient time
or receiving. Often this is simply from not being to obtain a response), or restoring the CAN filter to its
connected to a CAN system when you attempt to send default setting.
a message, but it may be because you have set the
system to an incorrect protocol, or to a rate that does
not match the actual data rate. As with BUS ERRORs, <RX ERROR
the CAN ERROR might also be the result of a wiring An error was detected in the received CAN data.
problem, so if this is the first time using your ELM327 This will usually only occur if monitoring a CAN bus,
circuit, review all of your CAN interface circuitry before and the ELM327 is set to an incorrect baud rate, or if
proceeding. monitoring and there are messages found that that are
not being acknowledged, or that contain bit errors. Try
a different protocol, or a different baud rate.
FB ERROR
When an OBD output is energized, a check is
always made to ensure that the signal also appears at UNABLE TO CONNECT
the respective input. If there is a problem, and no The ELM327 has tried all of the available
active input is detected, the IC turns the output off and protocols, and could not detect a compatible one. This
declares that there was a problem with the FeedBack could be because your vehicle uses an unsupported
(FB) of the signal. If this is an initial trial with your protocol, or could be as simple as forgetting to turn the
ELM327, this is almost certainly a wiring problem. ignition key on. Check all of your connections, and the
Check your wiring before proceeding. ignition, then try the command again.
DATA ERROR ?
There was a response from the vehicle, but the This is the standard response for a misunderstood
information was incorrect or could not be recovered. command received on the RS232 input. Usually it is
due to a typing mistake.
<DATA ERROR
There was an error in the line that this points to,
either from an incorrect checksum, or a problem with
the format of the message (the ELM327 still shows
you what it received). There could have been a noise
burst which interfered, possibly a circuit problem, or
perhaps you have the CAN Auto Formatting (CAF) on
and you are looking at a system that is not of the
ISO 15765-4 format. Try re-sending the command
again if it was a noise burst, it may be received
correctly the second time.
NO DATA
The IC waited for the period of time that was set
by AT ST, but detected no response from the vehicle.

ELM327
Example Applications
The SAE J1962 standard dictates that all OBD produce CAN transceiver ICs look at the NXP
compliant vehicles must provide a standard connector 82C251 (NXP was formerly Philips), the Texas
near the drivers seat, the shape and pinout of which is Instruments SN65LBC031, and the Linear Technology
shown in Figure 8 below. The circuitry described here LT1796, to name only a few. Be sure to pay attention
can be used to connect to this J1962 plug without to the voltage limits depending on the application,
modification to your vehicle. you may have to tolerate 24V, not just 12V.
The male J1962 connector required to mate with a The next interface shown is for the ISO 9141 and
ISO 14230 connections. We provide two output lines,
as required by the standards, but depending on your
vehicle, you may not need to use the ISO-L output.
1 8 (Many vehicles do not require this signal for initiation,
9 16
but some do, so it is shown here.) If your vehicle does
not require the L line, simply leave pin 22 unused.
The ELM327 controls both of the ISO outputs
Figure 8. The J1962 Vehicle Connector through NPN transistors Q6 and Q7 as shown. These
transistors have 510 pullup resistors connected to
their collectors, as the standard requires. We are often
vehicles connector may be difficult to obtain in some asked about substitutes for these resistors if you
locations, and you could be tempted to improvise by need to substitute, you can either go up to 560 or
making your own connections to the back of your possibly make 510 from two resistors (1/4W 240 +
vehicles connector. If doing so, we recommend that 270 resistors work well), but we do not recommend
you do nothing that would compromise the integrity of using a lower value as it stresses every device on the
your vehicles OBD network. The use of any connector bus. Note that 1/2W resistors should be used as a
which could easily short pins (such as an RJ11 type short at 13.8V causes about 0.4W dissipation.
telephone connector) is definitely not recommended. Data is received from the K Line of the OBD bus
The circuit on page 48 (Figure 9) shows how the and connected to pin 12 after being reduced by the
ELM327 might typically be used. Circuit power is R20/R21 voltage divider shown. Because of the
obtained from the vehicle (via OBD pins 16 and 5) Schmitt trigger input on pin 12, these resistors will give
and, after a protecting diode and some capacitive typical threshold levels of 9.1V (rising) and 4.7V
filtering, is presented to a five volt regulator. (Note that (falling), providing a large amount of noise immunity
a few vehicles have been reported to not have a pin 5 while also protecting the IC.
on these you will use pin 4 instead of pin 5.) The The final OBD interface shown is for the two
regulator powers several points in the circuit as well as J1850 standards. The J1850 VPW standard needs a
an LED (for visual confirmation that power is present). positive supply of up to 8V while the J1850 PWM
We have shown a 78L05 for the regulator as that limits needs 5V, so we have shown a two level supply that
the current available to about 100mA which is a safe can provide both. This dual voltage supply uses a
value for experimenting. The CAN interface is a low 317L adjustable regulator as shown, controlled by the
impedance circuit however, and if doing sustained pin 3 output. With the resistor values given, the
transmissions on CAN, this type of regulator may shut selected voltages will be about 7.5V and 5V, which
down on over-temperature. Should you experience this works well for most vehicles. The two J1850 outputs
problem, you may want to consider using a 1 Amp are driven by the Q1-Q2 combination for the Bus+,
version of the regulator. and Q3 for the Bus-.
The top left corner of Figure 9 shows the CAN The J1850 VPW input uses a resistor divider as
interface circuitry. We do not advise making your own was used for the ISO input. Typical threshold voltages
interface using discrete components CAN buses with the resistors shown will be about 4.2V (rising) and
may have a lot of critical information on them, and you 2.2V (falling). The J1850 PWM input is a little different
can easily do more harm than good if you fail. It is in that it must convert a differential input into a single-
strongly recommended that you use a commercial ended one for use by the ELM327. In operation, Q4 is
transceiver chip as shown. The Microchip MCP2551 is actually used as the difference amplifier. The Q4-D3
used in our circuit, but most major manufacturers series circuit sets a threshold voltage of about 1V (for

ELM327
Example Applications (Contd)

noise immunity), while R11 limits the current flow, and a summary parts list (see Figure 10). Note that these
R12 keeps Q4 off when the input is left open-circuited. are only suggestions for parts. If you prefer another
Resistor R36 has been added to the circuit of LED colour, or have a different general purpose
Figure 9, to help turn transistor Q4 off more rapidly in transistor on hand, etc., by all means make the
certain circumstances. The resistor is generally not change. A quick tip for those having trouble finding a
required, but it may be helpful if you are connected to 0.3 wide socket for the ELM327: many of the standard
a very high capacitance J1850 VPW system then force 14 pin sockets can be placed end-to-end to form one
the ELM327 to operate in the J1850 PWM mode, and 0.3 wide 28 pin socket.
experience some false BUS ERRORs. We show the What if you only want to use one of the protocols?
resistor as an option and leave the choice whether to What if you want to use a USB interface? These are
install it up to you. common questions that we receive, and both are
The voltage monitoring circuitry for the AT RV addressed in Figure 11.
command is shown in this schematic connected to pin There are a few single IC products on the market
2 of the ELM327. The two resistors simply divide the that allow you to connect an RS232 system directly to
battery voltage to a safe level for the ELM327, and the USB. We have shown the CP2102 by Silicon
capacitor filters out noise. As shipped, the ELM327 Laboratories (http://www.silabs.com) in Figure 11, but
expects a resistor divider ratio as shown, and sets there are others available as well Future Technology
nominal calibration constants assuming that. If your Devices (http://www.ftdichip.com), for example,
application needs a different range of values, simply produces several. These ICs provide a very simple
choose the resistor values to maintain the input within and relatively inexpensive way to bridge between
the specified 0-5V limit, and then perform an AT CV to RS232 and USB, and as you can see, require very few
calibrate the ELM327 to your new divider ratio. The components to support them.
maximum voltage that the ELM327 can show is 99.9V. If using the CP2102, we do caution that it is very
A very basic RS232 interface is shown connected small and difficult to solder by hand, so be prepared
to pins 17 and 18 of the ELM327. This circuit steals for that. Also, if you provide protection on the data
power from the host computer in order to provide a full lines with transient voltage suppressors (TVSs), be
swing of the RS232 voltages without the need for a careful of which ones you choose, as some exhibit a
negative supply. The RS232 pin connections shown very large capacitance and will affect the transmission
are for a standard 9 pin connector. If you are using a of the USB data. Note also that the circuit as
25 pin one, you will need to compensate for the presented will operate at a 38400 bits per second rate.
differences. The polarity of the ELM327s RS232 pins If you want to take full advantage of the speed of the
is such that they are compatible with standard USB interface, you will need to change PP 0C.
interface ICs (MAX232, etc.), so if you should prefer Considering the OBD protocol portions of the
such an interface, you can remove all of the discrete circuits in Figures 9 and 11, the differences should be
components shown and use one of those. very apparent. The unused protocols in Figure 11 have
The four LEDs shown (on pins 25 to 28) have simply had their outputs ignored (left open circuit), and
been provided as a visual means of confirming circuit their inputs wired to a convenient logic level (as CMOS
activity. They are not essential, but it is nice to see the inputs must never be left floating).
visual feedback when experimenting. The circuit maintains the status LEDs, and the
Finally, the crystal shown connected between pins J1850 Bus+ circuitry, but the majority of the rest has
9 and 10 is a standard 4.000MHz microprocessor type been eliminated. The voltage switching circuitry has
crystal. The 27pF crystal loading capacitors shown are been reduced to a single 8V regulator as well, since
typical only, and you may have to select other values there will be no need to switch to 5V. Note that pin 3
depending on what is specified for the crystal you has been intentionally left open-circuited as it is not
obtain. The crystal frequency is critical to circuit required by the voltage regulator.
operation and must not be altered. The first time that this circuit is used, it will likely be
We often receive requests for parts lists to set to protocol 0, the default automatic search mode
accompany our Example Applications circuits. Since of operation (as shipped from the factory). When you
this circuit is more complex than most, we have connect it to the J1850 VPW vehicle, it will first try a
named/numbered all of the components and provided J1850 PWM (protocol 1) connection, fail, and then

ELM327
CAN-L
14
Vbat +12V U3 +5V
6
CAN-H R32 R33 16 78L05
8 7 6 5 Battery L5
100 100 R31 D1 PWR
Positive
4.7K C1 C6
C8 C9 MCP2551 0.1F 0.1F
560pF 560pF U2 R1
5 470
1 2 3 4
+5V Signal
Ground
Vbat Vbat C7 +5V

0.1F
RS232
R19 R17 R26 Interface
510 510 4.7K (DB9F)
R24
15 10K
ISO-L 3 (TxD)
R16 2.2K Q9
Q6 R25
7 D5 10K D4
ISO-K
R18 2.2K
C5
Q7 5 (SG)
+5V +5V
0.1F
ELM327 R22
pin 12 10K R23
R20 Q8 4.7K
47K R21 L1-L4
22K 2 (RxD)
R27-30 +5V +5V
470
Vbat 1 (DCD)
n.c.
28 27 26 25 24 23 22 21 20 19 18 17 16 15
4 (DTR)
R34 327
47K +5V U1 6 (DSR)
1 2 3 4 5 6 7 8 9 10 11 12 13 14
R35 7 (RTS)
10K C2
0.1F to
to R15 8 (CTS)
+12V X1 R21
U4 4.00MHz
OBD R2
317L 470 C3 C4
Interface R5 27pF
240 27pF
(J1962) R3 470
R8 R4
10K 470 R6
Q2 4.7K R10
R7 22K
4.7K Q1 Figure 9.
D2
An OBD to RS232 Interpreter
R9 10K
2
J1850 Bus + R36* R11
22K 10K +5V
10
J1850 Bus - R14
R12 4.7K
R15 D3 100K
4.7K Q4
ELM327
Q3 pin 14 Q5
R13
10K
*see text, pg 47

ELM327

proceed to try J1850 VPW. If the memory is enabled
(as shown), J1850 VPW will then become the new
default, with no input required by you. This will work
well for most applications, but if the circuit is used on a
vehicle with the key off, for example, then it will again
go searching for a new protocol. In general, you do not
want this to happen every time. It may be only a minor
inconvenience to have to wait while the ELM327
determines that it is UNABLE TO CONNECT, but
why go through it if you do not have to? If you know
that you are using the circuit in a J1850 VPW only
application (protocol 2) then you should issue the
command AT SP 2 the very first time that the circuit is
powered. From that point on, it will remain in protocol
2, whether it fails to make a connection or not.
This has provided two examples of how the
ELM327 integrated circuit might be used. Hopefully it
has been enough to get you started on your way to
many more we hope that you enjoy the journey!
Semiconductors Resistors
D1 = 1N4001 R32, R33= 100
D2, D3, D4, D5 = 1N4148 R5 = 240
L1, L2, L3, L4 = Yellow LED R1, R2, R3, R4, R27, R28, R29, R30 = 470
L5 = Green LED R17, R19 = 510 1/2W
Q1, Q3, Q5, Q6, Q7, Q9 = 2N3904 (NPN) R16, R18 = 2.2 K
Q2, Q4, Q8 = 2N3906 (PNP) R6, R7, R14, R15, R23, R26, R31 = 4.7 K
U1 = ELM327 R8, R9, R11, R13, R22, R24, R25, R35 = 10 K
U2 = MCP2551 R10, R21, R36 = 22 K
U3 = 78L05 (5V, 100mA regulator) R20, R34 = 47 K
U4 = 317L (adj. 100mA regulator) R12 = 100 K
Capacitors Misc
C1, C2, C5, C6, C7 = 0.1uF 16V X1 = 4.000MHz crystal
C3, C4 = 27pF RS232 Conn = DB9F
C8, C9 = 560pF IC Socket = 28pin 0.3 (or 2 x 14pin)
Figure 10. Parts List for Figure 9

ELM327
+12V +5V
16 78L05
USB
Battery PWR 5.0V
Positive TVS Interface
+5V (type B
0.1F 0.1F
470 connector)
5
Signal
Ground 7 8 1 (+5)
SiLabs 5 2 (D-)
1F 6 CP2102 4 3 (D+)
+5V
3 4 (SG)
26 25
0.1F
4x +5V +5V
470
28 27 26 25 24 23 22 21 20 19 18 17 16 15
OBD +5V 327

Interface
1 2 3 4 5 6 7 8 9 10 11 12 13 14
(J1962)
4.00MHz
+12V
78L08 27pF 27pF
10K
4.7K
22K
4.7K
10K
2
J1850 Bus +
Figure 11. An OBD (J1850 VPW) to USB Interpreter

ELM327
Section Index
Description and Features....................................................................................... 1
Pin Descriptions..................................................................................................... 2
Ordering Information.............................................................................................. 3
Absolute Maximum Ratings....................................................................................4
Electrical Characteristics........................................................................................ 4
Overview................................................................................................................ 5
Communicating with the ELM327...........................................................................5
AT Commands....................................................................................................... 6
AT Command Summary.......................................................................................17
Reading the Battery Voltage................................................................................ 18
OBD Commands.................................................................................................. 19
Talking to the Vehicle........................................................................................... 20
Interpreting Trouble Codes...................................................................................21
Resetting Trouble Codes......................................................................................22
Quick Guide for Reading Trouble Codes............................................................. 22
Bus Initiation.........................................................................................................23
Wakeup Messages...............................................................................................23
Selecting Protocols...............................................................................................24
OBD Message Formats........................................................................................25
Setting the Headers..............................................................................................27
Monitoring the Bus............................................................................................... 30
CAN Messages and Filtering................................................................................31
Multiline Responses............................................................................................. 32
CAN Message Formats........................................................................................ 34
Altering Flow Control Messages...........................................................................35
J1939 Support...................................................................................................... 36
Restoring Order....................................................................................................37
Programmable Parameters.................................................................................. 38
Using Higher RS232 Baud Rates.........................................................................42
Computer Control................................................................................................. 44
Error Messages.................................................................................................... 44
Example Applications........................................................................................... 46


Elm327 PDF

Uploaded by

Document Informationclick to expand document information

Document Informationclick to expand document information

Copyright:

Available Formats

Elm327 PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Elm327 PDF

Uploaded by

Copyright:

Available Formats

ELM327

OBD to RS232 Interpreter

Baud Rate 6 A/D

ELM327DSC Elm Electronics Circuits for the Hobbyist 1 of 51

ELM327DSC Elm Electronics Circuits for the Hobbyist 2 of 51

Pin Descriptions (continued)

PWM In (pin 13) VDD (pin 20)

ELM327DSC Elm Electronics Circuits for the Hobbyist 3 of 51

Absolute Maximum Ratings

Characteristic Minimum Typical Maximum Units Conditions

Supply voltage, VDD 4.5 5.0 5.5 V

VDD rate of rise 0.05 V/ms see note 2

Average supply current, IDD 9 mA see note 3

Input threshold voltage 1.0 1.3 V all except Schmitt inputs

Schmitt trigger rising 2.9 4.0 V see note 4

Output low voltage 0.3 V current (sink) = 10 mA

Output high voltage 4.6 V current (source) = 10 mA

Brown-out reset voltage 4.07 4.2 4.59 V

A/D conversion time 7 msec see note 5

ELM327DSC Elm Electronics Circuits for the Hobbyist 4 of 51

Communicating with the ELM327

ELM327DSC Elm Electronics Circuits for the Hobbyist 5 of 51

Communicating with the ELM327 (continued)

ELM327DSC Elm Electronics Circuits for the Hobbyist 6 of 51

ELM327DSC Elm Electronics Circuits for the Hobbyist 7 of 51

ELM327DSC Elm Electronics Circuits for the Hobbyist 8 of 51

ELM327DSC Elm Electronics Circuits for the Hobbyist 9 of 51

H0 and H1 [ Headers off (0) or on(1) ]

ELM327DSC Elm Electronics Circuits for the Hobbyist 10 of 51

The value sent in the J1850 In-Frame Response >AT KW0

ELM327DSC Elm Electronics Circuits for the Hobbyist 11 of 51

L0 and L1 [ Linefeeds off (0) or on(1) ] MA [ Monitor All messages ]

ELM327DSC Elm Electronics Circuits for the Hobbyist 12 of 51

ELM327DSC Elm Electronics Circuits for the Hobbyist 13 of 51

ELM327DSC Elm Electronics Circuits for the Hobbyist 14 of 51

ELM327DSC Elm Electronics Circuits for the Hobbyist 15 of 51

ELM327DSC Elm Electronics Circuits for the Hobbyist 16 of 51

General Commands J1850 Specific Commands (protocols 1 and 2)

ELM327DSC Elm Electronics Circuits for the Hobbyist 17 of 51

Reading the Battery Voltage

At this point, the internal calibration values have

ELM327DSC Elm Electronics Circuits for the Hobbyist 18 of 51

ELM327DSC Elm Electronics Circuits for the Hobbyist 19 of 51

Talking to the Vehicle

ELM327DSC Elm Electronics Circuits for the Hobbyist 20 of 51

Interpreting Trouble Codes

ELM327DSC Elm Electronics Circuits for the Hobbyist 21 of 51

Resetting Trouble Codes

Quick Guide for Reading Trouble Codes

FIX THE VEHICLE!

ELM327DSC Elm Electronics Circuits for the Hobbyist 22 of 51

ELM327DSC Elm Electronics Circuits for the Hobbyist 23 of 51

>AT DP 4 ISO 14230-4 KWP (5 baud init)

ELM327DSC Elm Electronics Circuits for the Hobbyist 24 of 51

OBD Message Formats

3 header bytes up to 7 data bytes checksum

Figure 3. An OBD Message