ELM327 is a text-based communication protocol built around AT commands, originally developed for the OBD interpreter of the same name from ELM Electronics. Thanks to its simplicity, it has become the de facto standard for OBD-II diagnostics and is supported by the vast majority of diagnostic applications and libraries.
The ScanDoc adapter implements ELM327 v2.3 with an extended command set that includes support for DoIP (Diagnostics over IP) for Ethernet diagnostics of modern vehicles.
Data exchange takes place over a serial interface (WiFi, BLE or USB). Commands are sent as ASCII text and terminated by a carriage return character (CR, 0x0D). The adapter replies with the result followed by the prompt character >.
There are two types of commands:
AT).BMW vehicles use CAN Extended Addressing, in which the first data byte of the CAN frame contains the target ECU address. Below is a real-world example of a diagnostic session.
// --- Adapter initialization --- >ATZ // Full adapter reset ELM327 v2.1 >ATE0 // Disable echo OK >ATS0 // Disable spaces in responses OK >ATH1 // Enable headers in responses OK >ATL0 // Disable line feed OK >ATAL // Allow long messages (>7 bytes) OK >ATAT0 // Disable adaptive timing OK >ATSTff // Maximum timeout (FF × 4 ms ≈ 1 s) OK // --- CAN protocol configuration for BMW --- >ATPBC101 // Protocol B: C1 = 11-bit ID + ISO 15765, 01 = 500 kBaud OK >ATSPB // Select protocol B (USER1 CAN) OK >ATBI // Bypass initialization (BMW does not use the standard OBD init) OK >ATSH6F1 // Send CAN ID = 0x6F1 (BMW tester address) OK // --- Flow Control and extended addressing --- >ATFCSH6F1 // Flow Control header = 0x6F1 OK >ATFCSD4030FF32 // FC data: 40=ECU address, 30=CTS, FF=no limit, 32=50 ms OK >ATFCSM1 // FC mode = 1 (fully user-defined) OK >ATCRA640 // Receive responses with CAN ID = 0x640 OK >ATCEA40 // CAN Extended Address = 0x40 (ECU address) OK // --- Request to ECU at address 0x40 — no response --- >1A80 // Service 0x1A (Read ECU Identification), parameter 0x80 NO DATA >22F150 // UDS: service 0x22 (ReadDataByIdentifier), DID=F150 NO DATA // --- Switching to ECU at address 0x10 --- >ATFCSD1030FF32 // FC data: ECU address = 0x10 OK >ATFCSM1 // FC mode = 1 OK >ATCRA610 // Receive responses with CAN ID = 0x610 OK >ATCEA10 // CAN Extended Address = 0x10 OK // --- Successful response --- >22F150 // UDS: ReadDataByIdentifier, DID=F150 610F10662F1500F25F0 // 610=CAN ID, F1=tester, 06=length, 62=response, F150=DID, 0F25F0=data
| Command | Description |
|---|---|
AT <CR> |
repeat the last command Sending a single carriage return character causes the ELM327 to repeat the last command that it performed. This is typically used when you wish to obtain updates to a value at the fastest possible rate - for example, you may send 01 0C to obtain the engine rpm, then send only a carriage return character each time you wish to receive an update. |
AT AL |
Allow Long messages The standard OBDII protocols restrict the number of data bytes in a message to seven, which the ELM327 normally does as well (for both send and receive). If AL is selected, the ELM327 will allow long sends (eight data bytes) and long receives (unlimited in number). The default is AL off (and NL selected). The ELM327 does not require a change to AL to allow 8 byte CAN messages to be sent, but you should be aware that if you provide 8 CAN data bytes with CAN Extended Addressing or normal ISO 15765 formatting on, then data bytes may be lost. This is because a CAN message is only capable of sending 8 data bytes, so if an extended address or PCI byte needs to be added, fewer data bytes may be sent. |
AT AMC |
display Activity Monitor Count The Activity Monitor uses a counter to determine just how active the ELM327's OBD inputs are. Every time that activity is detected, this counter is reset, while if there is no activity, the count goes up (every 0.655 seconds). This count then represents the time since activity was last detected, and may be useful when writing your own logic based on OBD activity. The counter will not increment past FF (internal logic stops it there), and stays at 00 while monitoring. |
AT AMT hh |
set the Act Mon Timeout to hh The ELM327 is capable of going to a low power ('sleep') mode if there is no OBD activity detected for a period of time. That period is adjustable with either bit 4 of PP 0F, or with the AMT hh value. If the AMT hh value is non-zero, then the time to an alarm output will be (hh+1) x 0.65536 seconds. If it is set to 00, then all low power outputs from the activity monitor are blocked (see Figure 6 on page 68). Refer to the Power Control section for more details on the Activity Monitor. |
AT AT0, AT1 and AT2 |
Adaptive Timing control When receiving responses from a vehicle, the ELM327 has traditionally waited the time set by the AT ST hh setting for a response. To ensure that the IC would work with a wide variety of vehicles, the default value was set to a conservative (slow) value. Although it was adjustable, many people did not have the equipment or experience to determine a better value. The Adaptive Timing feature automatically sets the timeout value for you, to a value that is based on the actual response times that your vehicle is responding in. As conditions such as bus loading, etc. change, the algorithm learns from them, and makes appropriate adjustments. Note that it always uses your AT ST hh setting as the maximum setting, and will never choose one which is longer. There are three adaptive timing settings that are available for use. By default, Adaptive Timing option 1 (AT1) is enabled, and is the recommended setting. AT0 is used to disable Adaptive Timing (so the timeout is always as set by AT ST), while AT2 is a more aggressive version of AT1 (the effect is more noticeable for very slow connections – you may not see much difference with faster OBD systems). The J1939 protocol does not support Adaptive Timing – it uses fixed timeouts as set in the standard. |
AT BD |
perform an OBD Buffer Dump All messages sent and received by the ELM327 are stored temporarily in a set of twelve memory storage locations called the OBD Buffer. Occasionally, it may be of use to view the contents of this buffer, perhaps to see why an initiation failed, to see the header bytes in the last message, or just to learn more of the structure of OBD messages. You can ask at any time for the contents of this buffer to be 'dumped' (ie printed) – when you do, the ELM327 sends a length byte (representing the length of the message in the buffer) followed by the contents of all twelve OBD buffer locations. For example, here's one 'dump': >AT BD 05 C1 33 F1 3E 23 C4 00 00 10 F8 00 00The 05 is the length byte - it tells us that only the first 5 bytes (ie C1 33 F1 3E and 23) are valid. The remaining bytes are likely left over from a previous operation. The length byte always represents the actual number of bytes received, whether they fit into the OBD buffer or not. This may be useful when viewing long data streams (with AT AL), as it represents the actual number of bytes received, mod 256. Note that only the first twelve bytes received are stored in the buffer. |
AT BI |
Bypass the Initialization sequence This command should be used with caution. It allows an OBD protocol to be made active without requiring any sort of initiation or handshaking to occur. The initiation process is normally used to validate the protocol, and without it, results may be difficult to predict. It should not be used for routine OBD use, and has only been provided to allow the construction of ECU simulators and training demonstrators. |
AT BRD hh |
try Baud Rate Divisor hh This command is used to change the RS232 baud rate divisor to the hex value provided by hh, while under computer control. It is not intended for casual experimenting - if you wish to change the baud rate from a terminal program, you should use PP 0C. Since some interface circuits are not able to operate at high data rates, the BRD command uses a sequence of sends and receives to test the interface, with any failure resulting in a fallback to the previous baud rate. This allows several baud rates to be tested and a reliable one chosen for the communications. The entire process is described in detail in the 'Using Higher RS232 Baud Rates' section on page 53. If successful, the actual baud rate (in kbps) will be 4000 divided by the divisor (hh). The value 00 is not valid and is not accepted by the BRD command. |
AT BRT hh |
set Baud Rate Timeout to hh This command allows the timeout used for the Baud Rate handshake (ie. AT BRD) to be varied. The time delay is given by hh x 5.0 msec, where hh is a hexadecimal value. The default value for this setting is 0F, providing 75 msec. Note that a value of 00 does not result in 0 msec - it provides the maximum time of 256 x 5.0 msec, or 1.28 seconds. |
AT D |
set all to Defaults This command is used to set the options to their default (or factory) settings, as when power is first applied. The last stored protocol will be retrieved from memory, and will become the current setting (possibly closing other protocols that are active). Any settings that the user had made for custom headers, filters, or masks will be restored to their default values, and all timer settings will also be restored to their defaults. |
AT D0 and D1 |
display of DLC off or on Standard CAN (ISO 15765-4) OBD requires that all messages have 8 data bytes, so displaying the number of data bytes (the DLC) is not normally very useful. When experimenting with other protocols, however, it may be useful to be able to see what the data lengths are. The D0 and D1 commands control the display of the DLC digit (the headers must also be on in order to see this digit). When displayed, the single DLC digit will appear between the ID (header) bytes and the data bytes. The default setting is determined by PP 29. |
AT DM1 |
monitor for DM1s The SAE J1939 Protocol broadcasts trouble codes periodically, by way of Diagnostic Mode 1 (DM1) messages. This command sets the ELM327 to continually monitor for this type of message for you, following multi-segment transport protocols as required. Note that a combination of masks and filters could be set to provide a similar output, but they would not allow multiline messages to be detected. The DM1 command adds the extra logic that is needed for multiline messages. This command is only available when a CAN Protocol (A, B, or C) has been selected for J1939 formatting. It returns an error if attempted under any other conditions. |
AT DP |
Describe the current Protocol The ELM327 automatically detects a vehicle's OBD protocol, but does not normally report what it is. The DP command is a convenient means of asking what protocol the IC is currently set to (even if it has not yet 'connected' to the vehicle). If a protocol is chosen and the automatic option is also selected, AT DP will show the word 'AUTO' before the protocol description. Note that the description shows the actual protocol names, not the numbers used by the protocol setting commands. |
AT DPN |
Describe the Protocol by Number This command is similar to the DP command, but it returns a number which represents the current protocol. If the automatic search function is also enabled, the number will be preceded with the letter 'A'. The number is the same one that is used with the set protocol and test protocol commands. |
AT E0 and E1 |
Echo off or on These commands control whether or not the characters received on the RS232 port are echoed (retransmitted) back to the host computer. Character echo can be used to confirm that the characters sent to the ELM327 were received correctly. The default is E1 (or echo on). |
AT FE |
Forget Events There are certain events which may change how the ELM327 responds from that time onwards. One of these is the occurrence of a fatal CAN error (ERR94), which blocks subsequent searching through CAN protocols if PP 2A bit 5 is '1'. Normally, an event such as this will affect all searches until the next power off and on, but it can be 'forgotten' using software, with the AT FE command. Another example is an 'LV RESET' event which will prevent searches through CAN protocols if PP 2A bit 4 is '1'. It may also be forgotten with the AT FE command. |
AT H0 and H1 |
Headers off or on These commands control whether or not the additional (header) bytes of information are shown in the responses from the vehicle. These are not normally shown by the ELM327, but may be of interest (especially if you receive multiple responses and wish to determine what modules they were from). Turning the headers on (with AT H1) actually shows more than just the header bytes – you will see the complete message as transmitted, including the check-digits and PCI bytes, and possibly the CAN data length code (DLC) if it has been enabled with PP 29 or AT D1. The current version of this IC does not display the CAN CRC code, nor the special J1850 IFR bytes (which some protocols use to acknowledge receipt of a message). |
AT I |
Identify yourself Issuing this command causes the chip to identify itself, by printing the startup product ID string (currently 'ELM327 v2.3'). Software can use this to determine exactly which integrated circuit it is talking to, without having to reset the IC. |
AT IA |
Is the protocol Active? This command provides a way to know whether the ELM327 feels that the current protocol is currently active or not. It will respond with a Y or an N in response to the request, for Yes or No. An 'active' protocol is required before the ELM327 will respond to some commands. A protocol is considered to be active once it has received correct responses to a standard query or byte handshake, or if the user bypassed that process using an AT BI command. Note that the ELM327 marks a protocol as being active initially, but does not monitor it after that, and so does know if an ECU has stopped responding at some point in the future (i.e. if the protocol is no longer active). Your software may need to periodically send a standard request (01 00 is preferred) in order to determine if the ECU is in fact still active. |
AT IB10 |
set the ISO Baud rate to 10400 This command restores the ISO 9141-2 and ISO 14230-4 (protocols 3, 4, and 5) baud rates to the default value of 10400. Note that IB10 command may be used at any time (i.e. 'on the fly'). |
AT IB12 |
set the ISO Baud rate to 12500 This command is used to change the baud rate used for the ISO 9141-2 and ISO 14230-4 protocols (numbers 3, 4, and 5) to 12500 baud. Note that IB12 command may be used at any time (i.e. 'on the fly'). |
AT IB15 |
set the ISO Baud rate to 15625 This command is used to change the baud rate used for the ISO 9141-2 and ISO 14230-4 protocols (numbers 3, 4, and 5) to 15625 baud. Note that IB15 command may be used at any time (i.e. 'on the fly'). |
AT IB48 |
set the ISO Baud rate to 4800 This command is used to change the baud rate used for the ISO 9141-2 and ISO 14230-4 protocols (numbers 3, 4, and 5) to 4800 baud. Note that IB48 command may be used at any time (i.e. 'on the fly'). |
AT IB96 |
set the ISO Baud rate to 9600 This command is used to change the baud rate used for the ISO 9141-2 and ISO 14230-4 protocols (numbers 3, 4, and 5) to 9600 baud. Note that IB96 command may be used at any time (i.e. 'on the fly'). |
AT IFR0, IFR1 and IFR2 |
IFR control - not monitoring The SAE J1850 protocol allows for an In-Frame Response (IFR) byte to be sent after each message, usually to acknowledge the correct receipt of that message. The ELM327 automatically generates and sends this byte for you, unless you are monitoring (by default, the ELM327 is always silent while monitoring). You can override this behaviour with the IFR command. The IFR0 command will disable the sending of all IFRs, no matter what the message requires. IFR2 is the opposite - it will cause an IFR byte to always be sent in response to a message, even if there are errors in it. The IFR1 setting results in the sending of an IFR if the message was received correctly, and if the value of the 'K' bit in the first header byte (for both PWM and VPW) allows it. The default setting is IFR1. |
AT IFR4, IFR5 and IFR6 |
IFR control - at all times While the original ELM327 ICs would never send an IFR if monitoring, there are some monitoring situations in which you may wish to have IFRs sent. The IFR4, IFR5, and IFR6 commands allow you to control IFR sending at all times, whether monitoring or not. They mimic the IFR0, IFR1 and IFR2 commands – an IFR4 setting results in an IFR never being sent, while IFR5 sends an IFR if there are no errors and the 'K' bit allows it, and an IFR6 setting causes an IFR to always be generated (even if there is an error). |
AT IFR H and IFR S |
IFR from Header or Source The value sent in the J1850 In-Frame Response (IFR) byte is normally the same as the value sent as the source (ie tester) address byte that was in the header of the request. There may be occasions when it is desirable to use some other value, however, and this set of commands allows for this. If you send AT IFR S, the ELM327 will use the value defined as the Source address (usually F1, but it can be changed with PP 06 or AT TA), even if another value was sent in the Header bytes. This is not what is normally required, and caution should be used when doing this. AT IFR H restores the sending of the IFR bytes to those provided in the Header, and is the default setting. |
AT IGN |
read the IgnMon input level This command reads the signal level at pin 15. It assumes that the logic level is related to the ignition voltage, so if the input is at a high level, the response will be 'ON', and a low level will report 'OFF'. This feature is most useful if you wish to perform the power control functions using your own software. If you disable the Low Power automatic response to a low input on this pin (by setting bit 2 of PP 0E to 0), then pin 15 will function as the RTS input. A low level on the input will not turn the power off, but it will interrupt any OBD activity that is in progress. All you need to do is detect the 'STOPPED' message that is sent when the ELM327 is interrupted, and then check the level at pin 15 using AT IGN. If it is found to be OFF, you can perform an orderly shutdown yourself. |
AT IIA hh |
set the ISO Init Address to hh The ISO 9141-2 and ISO 14230-4 standards state that when beginning a session with an ECU, the initiation sequence is to be directed to a specific address ($33). If you wish to experiment by directing the slow five baud sequence to another address, it is done with this command. For example, if you prefer that the initiation be performed with the ECU at address $7A, then simply send: >AT IIA 7Aand the ELM327 will use that address when called to do so (protocols 3 or 4). The full eight bit value is used exactly as provided – no changes are made to it (ie no adding of parity bits, etc.) Note that setting this value does not affect any address values used in the header bytes. The ISO init address is restored to $33 whenever the defaults, or the ELM327, are reset. |
AT L0 and L1 |
Linefeeds off or on This option controls the sending of linefeed characters after each carriage return character. For AT L1, linefeeds will be generated after every carriage return character, and for AT L0, they will be off. Users will generally wish to have this option on if using a terminal program, but off if using a custom computer interface (as the extra characters transmitted will only serve to slow the communications down). The default setting is determined by the voltage at pin 7 during power on (or reset). If the level is high, then linefeeds are on by default; otherwise they will be off. |
AT LP |
go to the Low Power mode This command causes the ELM327 to shut off all but 'essential services' in order to reduce the power consumption to a minimum. The ELM327 will respond with an 'OK' (but no carriage return) and then, one second later, will change the state of the PwrCtrl output (pin 16) and will enter the low power (standby) mode. The IC can be brought back to normal operation through a character received at the RS232 input or a rising edge at the IgnMon (pin 15) input, in addition to the usual methods of resetting the IC (power off then on, a low on pin 1, or a brownout). See the Power Control section (page 67) for more information. |
AT M0 and M1 |
Memory off or on The ELM327 has internal 'non-volatile' memory that is capable of remembering the last protocol used, even after the power is turned off. This can be convenient if the IC is often used for one particular protocol, as that will be the first one attempted when next powered on. To enable this memory function, it is necessary to either use an AT command to select the M1 option, or to have chosen 'memory on' as the default power on mode (by connecting pin 5 of the ELM327 to a high logic level). When the memory function is enabled, each time that the ELM327 finds a valid OBD protocol, that protocol will be memorized (stored) and will become the new default. If the memory function is not enabled, protocols found during a session will not be memorized, and the ELM327 will always start at power up using the same (last saved) protocol. If the ELM327 is to be used in an environment where the protocol is constantly changing, it would likely be best to turn the memory function off, and issue an AT SP 0 command once. The SP 0 command tells the ELM327 to start in an 'Automatic' protocol search mode, which is the most useful for an unknown environment. ICs come from the factory set to this mode. If, however, you have only one vehicle that you regularly connect to, storing that vehicle's protocol as the default would make the most sense. The default setting for the memory function is determined by the voltage level at pin 5 during power up (or system reset). If it is connected to a high level (VDD), then the memory function will be on by default. If pin 5 is connected to a low level, the memory saving will be off by default. |
AT NL |
Normal Length messages This command sets the ELM327 to send the normal number of data bytes as specified by the OBD standards. It is used to undo changes made with the Allow Long (AT AL) mode. Note that the ELM327 does not require a change to AL to allow longer message lengths for the KWP protocols to be received. You can simply leave the IC set to the default setting of NL, and all of the received bytes will be shown. |
AT R0 and R1 |
Responses off or on These commands control the ELM327's automatic receive (and display) of the messages returned by the vehicle. If responses have been turned off, the IC will not wait for a reply from the vehicle after sending a request, and will return immediately to wait for the next RS232 command (the ELM327 does not print anything to say that the send was successful, but you will see a message if it was not). R0 may be useful to send commands blindly when using the IC for a non-OBD network application, or when simulating an ECU in a learning environment. It is not recommended that this option used for normal OBD communications, however, as the vehicle may have difficulty if it is expecting an acknowledgement and never receives one. An R0 setting will always override any 'number of responses digit' that is provided with an OBD request. The default setting is R1, or responses on. |
AT RD |
Read the Data in the user memory The byte value stored with the SD command is retrieved with this command. There is only one memory location, so no address is required. |
AT RV |
Read the input Voltage This initiates the reading of the voltage present at pin 2, and the conversion of it to a decimal voltage. By default, it is assumed that the input is connected to the voltage to be measured through a 1:5.7 ratio voltage divider (for example, 47KΩ and 10KΩ resistors in series, with the 10KΩ connected from pin 2 to Vss) and that the ELM327 supply is a nominal 5V. This will allow for the measurement of input voltages up to about 28V (the voltage at pin 2 must not exceed Vdd), with an uncalibrated accuracy of typically about 2%. See the 'Reading the Battery Voltage' section for calibration information. |
AT S0 and S1 |
printing of Spaces off or on These commands control whether or not space characters are inserted in the ECU response. The ELM327 normally reports ECU responses as a series of hex characters that are separated by space characters (to improve readability), but messages can be transferred much more quickly if every third byte (the space) is removed. While this makes the message less readable for humans, it can provide significant improvements for computer processing of the data. By default, spaces are on (S1), and space characters are inserted in every response. |
AT SD hh |
Save Data byte hh The ELM327 is able to save one byte of information for you in a special nonvolatile memory location, which is able to retain its contents even if the power is turned off. Simply provide the byte to be stored, then retrieve it later with the read data (AT RD) command. This location is ideal for storing user preferences, unit ids, occurrence counts, or other information. |
AT WS |
Warm Start This command causes the ELM327 to perform a complete reset. It is very similar to the AT Z command, but does not include the power on LED test. Users may find this a convenient way to quickly 'start over' without having the extra delay of the AT Z command. If using variable RS232 baud rates (ie AT BRD commands), it is preferred that you reset the IC using this command rather than AT Z, as AT WS will not affect the chosen RS232 baud rate. |
AT Z |
reset all This command causes the chip to perform a complete reset as if power were cycled off and then on again. All settings are returned to their default values, and the chip will be put into the idle state, waiting for characters on the RS232 bus. Note that any baud rate that was set with the AT BRD command will be lost, and the ELM327 will return to the default baud rate setting. |
AT @1 |
display the device description This command displays the device description string. The default text is 'OBDII to RS232 Interpreter'. |
AT @3 cccccccccccc |
store the device identifier This command is used to set the device identifier code. Exactly 12 characters must be sent, and once written to memory, they can not be changed (ie you may only use the @3 command one time). The characters sent must be printable (ascii character values 0x21 to 0x5F inclusive). If you are developing software to write device identifiers, you may be interested in our ELM328 integrated circuit, as it allows multiple writes using the @3 command (but it is not capable of sending OBD messages). |
| Command | Description |
|---|---|
AT PC |
Protocol Close There may be occasions where it is desirable to stop (deactivate) a protocol. Perhaps you are not using the automatic protocol finding, and wish to manually activate and deactivate protocols. Perhaps you wish to stop the sending of idle (wakeup) messages, or have another reason. The PC command is used in these cases to force a protocol to close. |
AT SP h |
Set Protocol to h This command is used to set the ELM327 for operation using the protocol specified by 'h', and to also save it as the new default. Note that the protocol will be saved no matter what the AT M0/M1 setting is. The ELM327 supports 12 different protocols (two can be user-defined). They are: 0 - Automatic 1 - SAE J1850 PWM (41.6 kbaud) 2 - SAE J1850 VPW (10.4 kbaud) 3 - ISO 9141-2 (5 baud init, 10.4 kbaud) 4 - ISO 14230-4 KWP (5 baud init, 10.4 kbaud) 5 - ISO 14230-4 KWP (fast init, 10.4 kbaud) 6 - ISO 15765-4 CAN (11 bit ID, 500 kbaud) 7 - ISO 15765-4 CAN (29 bit ID, 500 kbaud) 8 - ISO 15765-4 CAN (11 bit ID, 250 kbaud) 9 - ISO 15765-4 CAN (29 bit ID, 250 kbaud) A - SAE J1939 CAN (29 bit ID, 250* kbaud) B - USER1 CAN (11* bit ID, 125* kbaud) C - USER2 CAN (11* bit ID, 50* kbaud) * default settings (user adjustable) The first protocol shown (0) is a convenient way of telling the ELM327 that the vehicle's protocol is not known, and that it should perform a search. It causes the ELM327 to try all protocols if necessary, looking for one that can be initiated correctly. When a valid protocol is found, and the memory function is enabled, that protocol will then be remembered, and will become the new default setting. When saved like this, the automatic mode searching will still be enabled, and the next time the ELM327 fails to connect to the saved protocol, it will again search all protocols for another valid one. Note that some vehicles respond to more than one protocol - if searching, you may see more than one type of response. ELM327 users often use the AT SP 0 command to reset the search protocol before starting (or restarting) a connection. This works well, but since it is used so often, and since writes to EEPROM result in an unnecessary delay (of about 30 msec), the AT SP0 command sets the protocol to 0, but does not perform a write to EEPROM. Similarly, the SP A0 and SP 0A commands do not perform writes to EEPROM, either. Saving this value to EEPROM would not provide any advantage (and would be very short-lived, as the ELM327 will soon be finding the vehicle's protocol and over-writing the '0' value in EEPROM). If you really want to store the value '0' in the internal EEPROM, you must use the AT SP 00 command. If another protocol (other than 0) is selected with this command (eg. AT SP 3), that protocol will become the default, and will be the only protocol used by the ELM327. Failure to initiate a connection in this situation will result in a response such as 'BUS INIT: ...ERROR', and no other protocols will be attempted. This is a useful setting if you know that your vehicle(s) only use the one protocol, but is also one that can cause a lot of problems if you do not understand it. |
AT SP 00 |
erase the Stored Protocol To speed up protocol initiation and detection, the SP 0 command sets the protocol to automatic, but does not perform a (very time-consuming) write to EEPROM. This reduces unnecessary wear on the EEPROM (which could lead to failure). There are times when it is desirable to assign the value 0 to the stored protocol, however, so we offer this command. |
AT SP Ah |
Set Protocol to Auto, h This variation of the SP command allows you to choose a starting (default) protocol, while still retaining the ability to automatically search for a valid protocol on a failure to connect. For example, if your vehicle is ISO 9141-2, but you want to occasionally use the ELM327 circuit on other vehicles, you might use the AT SP A3 command, so that the first protocol tried will then be yours (3), but it will also automatically search for other protocols. Don't forget to disable the memory function if doing this, or each new protocol detected will become your new default. SP Ah will save the protocol information even if the memory option is off (but SP A0 and SP 0A do not - if you must write 0 to the EEPROM, use command AT SP 00). Note that the 'A' can come before or after the h, so AT SP A3 can also be entered as AT SP 3A. |
AT SS |
use the Standard Sequence for searches SAE standard J1978 specifies a protocol search order that scan tools should use. It follows the number order that we have assigned to the ELM327 protocols. In order to provide a faster search, the ELM327 does not normally follow this order, but it will if you command it to with AT SS. |
AT TP h |
Try Protocol h This command is identical to the SP command, except that the protocol that you select is not immediately saved in internal EEPROM memory, so does not change the default setting. Note that if the memory function is enabled (AT M1), and this new protocol that you are trying is found to be valid, that protocol will then be stored in memory as the new default. |
AT TP Ah |
Try Protocol h with Auto This command is very similar to the AT TP command above, except that if the protocol that is tried should fail to initialize, the ELM327 will then automatically sequence through the other protocols, attempting to connect to one of them. |
| Command | Description |
|---|---|
AT C0 and C1 |
Confirmation of CAN send off or on The ELM327 has always waited after sending a CAN message to ensure that the transmission of the data had progressed correctly. If it did not, a 'CAN ERROR' message was returned. With v2.3 firmware, you may optionally turn off this confirmation, and so possibly return to the prompt state a little quicker. This might save about one message time (about 230 µsec for 500kbps), at the cost of providing no feedback for incorrect sends. We recommend that you always leave this option set to the default value (C1 - Confirmations on). |
AT CAF0 and CAF1 |
CAN Auto Formatting off or on These commands determine whether the ELM327 assists you with the formatting of the CAN data that is sent and received. With CAN Automatic Formatting enabled (CAF1), the formatting (PCI) bytes will be automatically generated for you when sending, and will be removed when receiving. This means that you can continue to issue OBD requests (01 00, etc.) as usual, without regard to the extra bytes that CAN diagnostics systems require. Also, with formatting on, any extra (unused) data bytes that are received in the frame will be removed, and any messages with invalid PCI bytes will be ignored. (When monitoring, however, messages with invalid PCI bytes are all shown, with a '<DATA ERROR' message beside them). Multi-frame responses may be returned by the vehicle with ISO 15765 and SAE J1939. To make these more readable, the Auto Formatting mode will extract the total data length and print it on one line, then show each line of data with the segment number followed by a colon (':'), and then the data bytes. You may also see the characters 'FC:' on a line (if you are experimenting). This identifies a Flow Control message that has been sent as part of the multi-line message signalling. Flow Control messages are automatically generated by the ELM327 in response to a 'First Frame' reply, as long as the CFC setting is on (it does not matter if auto formatting is on or not). Another type of message – the RTR (or 'Remote Transfer Request') – will be automatically hidden for you when in the CAF1 mode, since they contain no data. When auto formatting is off (CAF0), you will see the characters 'RTR' printed when a remote transfer request frame has been received. Turning the CAN Automatic Formatting off (CAF0), will cause the ELM327 to print all of the data bytes as received. No bytes will be hidden from you, and none will be inserted for you. Similarly, when sending data with formatting off, you must provide all of the required data bytes exactly as they are to be sent – the ELM327 will not add a PCI byte for you (but it will add some trailing 'padding' bytes to ensure that the required eight data bytes are sent). This allows the ELM327 to be used with protocols that have special formatting requirements. Note that turning the display of headers on (with AT H1) will override some of the CAF1 formatting of the received data, so that the received bytes will appear much like in the CAF0 mode (ie. as received). It is only the printing of the received data that will be affected when both CAF1 and H1 modes are enabled, though; when sending data, the PCI byte will still be created for you and padding bytes will still be added. Auto Formatting on (CAF1) is the default setting. |
AT CEA |
turn off the CAN Extended Address The CEA command is used to turn off the special features that are set with the CEA hh command. It will also restore any address set by the AT CER hh command to its default value. |
AT CEA hh |
set the CAN Extended Address to hh Some (non-OBD) CAN protocols extend the addressing fields by using the first of the eight data bytes as a target (receiver) address. This command allows the ELM327 to interact with those protocols. Sending the CEA hh command causes the ELM327 to insert the hh value as the first data byte of all CAN messages that you send. It also adds one more filtering step to received messages, only passing ones that have the Tester Address in the first byte position (in addition to requiring that ID bits match the patterns set by AT CF and CM, FT, or CRA). The AT CEA hh command can be sent at any time, and changes are effective immediately, allowing for changes of the address 'on-the-fly'. There is a more lengthy discussion of extended addressing in the 'Using CAN Extended Addresses' section on page 64. The CEA mode of operation is off by default, and is enabled by sending the CEA command with a target address. Once it is on, it can be turned off by sending AT CEA (with no address), or by restoring the chip defaults with AT D, AT Z, etc. Note that the CEA setting has no effect when J1939 formatting is on. |
AT CER hh |
set the CAN Extended Rx address to hh By default, the ELM327 receives responses to CAN extended addressing requests that have the 'tester address' in the first data byte position. The CER command allows you to choose a different receive address. Values set with this command are reset to the default value with the AT CEA command. |
AT CF hhh |
set the CAN ID Filter to hhh The CAN Filter works in conjunction with the CAN Mask to determine what information is to be accepted by the receiver. As each message is received, the incoming CAN ID bits are compared to the CAN Filter bits (when the mask bit is a '1'). If all of the relevant bits match, the message will be accepted, and processed by the ELM327, otherwise it will be discarded. This three nibble version of the CAN Filter command makes it a little easier to set filters with 11 bit ID CAN systems. Only the rightmost 11 bits of the provided nibbles are used, and the most significant bit is ignored. The data is actually stored as four bytes internally however, with this command adding leading zeros for the other bytes. See the CM command(s) for more details. Note that responses will not be predictable if using the CRA, CF or CM commands with the SAE J1939 protocol while also using either an MP command or the DM1 command. In fact, we recommend not using the CRA, CM or CF commands at all times with the J1939 protocol. If you need additional filtering with J1939, consider using the FT command. |
AT CF hh hh hh hh |
set the CAN ID Filter to hhhhhhhh This command allows all four bytes (actually 29 bits) of the CAN Filter to be set at once. The 3 most significant bits will always be ignored, and may be given any value. This command may be used to enter 11 bit ID filters as well, since they are stored in the same locations internally (entering AT CF 00 00 0h hh is exactly the same as entering the shorter AT CF hhh command). Note that responses will not be predictable if using the CRA, CF or CM commands with the SAE J1939 protocol while also using either an MP command or the DM1 command. In fact, we recommend not using the CRA, CM or CF commands at all times with the J1939 protocol. If you need additional filtering with J1939, consider using the FT command. |
AT CFC0 and CFC1 |
CAN Flow Control off or on The ISO 15765-4 CAN protocol expects a 'Flow Control' message to always be sent in response to a 'First Frame' message, and the ELM327 automatically sends these without any intervention by the user. If experimenting with a non-OBD system, it may be desirable to turn this automatic response off, and the AT CFC0 command has been provided for that purpose. As of firmware version 2.0, these commands also enable or disable the sending of J1939 TP.CM_CTS messages in response to TP.CM_RTS requests. During monitoring (AT MA, MR, or MT), there are never any Flow Controls sent no matter what the CFC option is set to. The default setting is CFC1 - Flow Controls on. |
AT CM hhh |
set the CAN ID Mask to hhh There can be a great many messages being transmitted in a CAN system at any one time. In order to limit what the ELM327 views, there needs to be a system of filtering out the relevant ones from all the others. This is accomplished by the filter, which works in conjunction with the mask. A mask is a group of bits that show the ELM327 which bits in the filter are relevant, and which ones can be ignored. A 'must match' condition is signalled by setting a mask bit to '1', while a 'don't care' is signalled by setting a bit to '0'. This three digit variation of the CM command is used to provide mask values for 11 bit ID systems (the most significant bit is always ignored). Note that a common storage location is used internally for the 29 bit and 11 bit masks, so an 11 bit mask could conceivably be assigned with the next command (CM hh hh hh hh), should you wish to do the extra typing. The values are right justified, so you would need to provide five leading zeros followed by the three mask bytes. Note that responses will not be predictable if using the CRA, CF or CM commands with the SAE J1939 protocol while also using either an MP command or the DM1 command. In fact, we recommend not using the CRA, CM or CF commands at all times with the J1939 protocol. If you need additional filtering with J1939, consider using the FT command. |
AT CM hh hh hh hh |
set the CAN ID Mask to hhhhhhhh This command is used to assign mask values for 29 bit ID systems. See the discussion under the CM hhh command as it is essentially identical, except for the length. Note that the three most significant bits that you provide in the first digit will be ignored. Please note the warning about not using it with the J1939 protocol. Note that responses will not be predictable if using the CRA, CF or CM commands with the SAE J1939 protocol while also using either an MP command or the DM1 command. In fact, we recommend not using the CRA, CM or CF commands at all times with the J1939 protocol. If you need additional filtering with J1939, consider using the FT command. |
AT CP hh |
set CAN Priority bits to hh This command provides one way to assign the five most significant bits of a 29 bit CAN ID, that is to be used for sending messages (the other 24 bits can be set with the AT SH command). Many systems use these bits to assign a priority value to messages, and to determine the message protocol. Any bits provided in excess of the five required are ignored, and not stored by the ELM327 (it only uses the five least significant bits of this byte). The default value for the CP hh value is hex 18, which can be restored at any time with the AT D command. |
AT CRA |
reset the CAN Rx Addr The AT CRA command is used to restore the CAN receive filters to their default values. Note that it does not have any arguments (ie no data). |
AT CRA hhh |
set the CAN Rx Addr to hhh Setting the CAN masks and filters can be difficult at times, so if you only want to receive information from one address (ie. one CAN ID), then this command may be very welcome. For example, if you only want to see information from 7E8, simply send AT CRA 7E8, and the ELM327 will make the necessary adjustments to both the mask and the filter for you. If you wish to allow the reception of a range of values, you can use the letter X to signify a 'don't care' condition. That is, AT CRA 7EX would allow all IDs that start with 7E to pass (7E0, 7E1, etc.). For a more specific range of IDs, you may need to assign a mask and filter. To reverse the changes made by the CRA command, simply send AT CRA or AT AR. Note that responses will not be predictable if using the CRA, CF or CM commands with the SAE J1939 protocol while also using either an MP command or the DM1 command. In fact, we recommend not using the CRA, CM or CF commands at all times with the J1939 protocol. If you need additional filtering with J1939, consider using the FT command. |
AT CRA hhhhhhhh |
set the CAN Rx Addr to hhhhhhhh This command is identical to the previous one, except that it is used with 29 bit CAN IDs. Sending either AT CRA or AT AR will also reverse any changes made by this command. Note that responses will not be predictable if using the CRA, CF or CM commands with the SAE J1939 protocol while also using either an MP command or the DM1 command. In fact, we recommend not using the CRA, CM or CF commands at all times with the J1939 protocol. If you need additional filtering with J1939, consider using the FT command. |
AT CS |
show the CAN Status counts The CAN protocol requires that statistics be kept regarding the number of transmit and receive errors detected. If there should be a significant number of errors (due to a hardware or software problem), the device will go off-line in order to not affect other data on the bus. The AT CS command lets you see both the transmitter (Tx) and the receiver (Rx) error counts, in hexadecimal. If the transmitter should be off (count >FF), you will see 'OFF' rather than a specific count. Beginning with firmware v2.2, the CS response will also show the current frequency of the signal at the CAN input. A typical response might look like: >AT CS T:00 R:00 F:250The same module that determines the frequency during protocol searches is used, and is fairly basic in operation. It provides frequency in only certain ranges, so possible responses with the current version are limited to 500, 250, <250, and 0 (no signal). A frequency measurement typically takes about 300 msec to complete, depending on the amount of activity present on the CAN data bus. |
AT CSM0 and CSM1 |
CAN Silent Monitoring off or on The ELM327 was designed to be completely silent while monitoring a CAN bus. Because of this, it is able to report exactly what it sees, without colouring the information in any way. Occasionally (when bench testing, or when connecting to a dedicated CAN port), it may be preferred that the ELM327 does not operate silently (ie generates ACK bits, etc.), and this is what the CSM command is for. CSM1 turns it on, CSM0 turns it off, and the default value is determined by PP 21. Be careful when experimenting with this. If you should choose the wrong baud rate then monitor the CAN bus with the silent monitoring off, you will disturb the flow of data. Always keep the silent monitoring on until you are certain that you have chosen the correct baud rate. |
AT CTM1 |
set the Timer Multiplier to 1 This command causes all timeouts set by AT ST to be multiplied by a factor of 1. Note that this currently only affects the CAN protocols (6 to C). CTM1 is the default setting. CTM5 [ set the Timer Multiplier to 5 ] This command causes all timeouts set by AT ST to be multiplied by a factor of 5. Note that this currently only affects the CAN protocols (6 to C). This command was originally added (as JTM5) to assist with the retrieving of some J1939 messages. We have since had several requests to allow it to affect all CAN modes, and so have modified the JTM5 code and added the new CTM1/CTM5 commands. If using CTM5, we caution that the Adaptive Timing code does not monitor changes in the setting, so we advise turning it off (with AT AT0). By default, this multiplier is off. |
AT FC SD |
Flow Control Set Data to… [1-5 bytes] The data bytes that are sent in a CAN Flow Control message may be defined with this command. One to five data bytes may be specified, with the remainder of the data bytes in the message being automatically set to the default CAN filler byte, if required by the protocol. Data provided with this command is only used when Flow Control modes 1 or 2 have been enabled. |
AT FC SH hhh |
Flow Control Set Header to… The header (or more properly 'CAN ID') bytes used for CAN Flow Control messages can be set using this command. Only the right-most 11 bits of those provided will be used - the most significant bit is always removed. This command only affects Flow Control mode 1. |
AT FC SH hhhhhhhh |
Flow Control Set Header to… This command is used to set the header (or 'CAN ID') bits for Flow Control responses with 29 bit CAN ID systems. Since the 8 nibbles define 32 bits, only the right-most 29 bits of those provided will be used - the most significant three bits are always removed. This command only affects Flow Control mode 1. |
AT FC SM h |
Flow Control Set Mode to h This command sets how the ELM327 responds to First Frame messages when automatic Flow Control responses are enabled. The single digit provided can either be '0' (the default) for fully automatic responses, '1' for completely user defined responses, or '2' for user defined data bytes in the response. Note that FC modes 1 and 2 can only be enabled if you have defined the needed data and possibly ID bytes. If you have not, you will get an error. More complete details and examples can be found in the Altering Flow Control Messages section (page 62). |
AT FT |
Filter for Transmitter off If a filter has been set for restricting the messages received, it may be disabled with the AT FT command. |
AT FT hh |
Filter for Transmitter = hh This command provides an extra level of filtering for received messages. A message will be accepted if the value provided by hh matches those of the third byte of a standard three byte header, or the least significant eight bits of a CAN ID. This is in addition to any other filtering provided by other commands. For more information, refer to the 'Filtering for a Transmitter' section. |
AT PB xx yy |
set Protocol B parameters This command allows you to change the protocol B (USER1) options and baud rate without having to change the associated Programmable Parameters (PP 2C and PP 2D). This allows for easier protocol changes while testing. To use this feature, simply set xx to the value for PP 2C, and yy to the value for PP 2D, and issue the command. The next time that the protocol is initialized it will use these values. For example, to set protocol B for use with 500kbps J1939, simply use the command: >AT PB 42 01As another example, assume that you wish to monitor a system that uses 11 bit CAN at 33.3 kbps. If you do not want any special formatting, this means a value of 11000000 or C0 hex for PP 2C, and 15 decimal or 0F hex for PP 2D. Simply send these values to the ELM327 with the command: >AT PB C0 0Fthen start monitoring with: >AT MAif you see CAN ERRORs, and realize that you wanted an 83.3 kbps baud rate, then close the protocol, and send the new values: >AT PC OK >AT PB C0 06 OK >AT MAValues passed in this way do not affect any that are stored as the 2C and 2D Programmable Parameters, and are lost if the ELM327 is reset. If you want to make your settings persist over power cycles, then you may wish to store them in the Programmable Parameter for CAN protocols USER1 or USER2. |
AT RTR |
send an RTR message This command causes a special 'Remote Frame' CAN message to be sent. This type of message has no data bytes, and has its Remote Transmission Request (RTR) bit set. The headers and filters will remain as previously set (ie the ELM327 does not make any assumptions as to what format a response may have), so adjustments may need to be made to the mask and filter. This command must be used with an active CAN protocol (one that has been sending and receiving messages), as it can not initiate a protocol search. Note that the CAF1 setting normally eliminates the display of all RTRs, so if you are monitoring messages and want to see the RTRs, you will have to turn off formatting, or else turn the headers on. The ELM327 treats an RTR just like any other message sent, and will wait for a response from the vehicle (unless AT R0 has been chosen). |
AT SH xyz |
Set the Header to 00 0x yz Entering CAN 11 bit ID words (headers) normally requires that extra leading zeros be added (eg. AT SH 00 07 DF), but this command simplifies doing so. The AT SH xyz command accepts a three digit argument, takes only the right-most 11 bits from that, adds leading zeros, and stores the result in the header storage locations for you. As an example, AT SH 7DF is a valid command, and is quite useful for working with 11 bit CAN systems. It actually results in the header bytes being stored internally as 00 07 DF. |
AT SH xx yy zz |
Set the Header to xx yy zz This command allows the user to manually control the values that are sent as the three header bytes in a message. These bytes are normally assigned values for you (and are not required to be adjusted), but there may be occasions when it is desirable to change them (particularly if experimenting with physical addressing). If experimenting, it is not necessary but may be better to set the headers after a protocol is active. That way, wakeup messages, etc. that get set on protocol activation will use the default values. The header bytes are defined with hexadecimal digits - xx will be used for the first or priority/type byte, yy will be used for the second or receiver/target byte, and zz will be used for the third or transmitter/source byte. These remain in effect until set again, or until restored to their default values with the D, WS, or Z commands. If new values for header bytes are set before the vehicle protocol has been determined, and if the search is not set for fully automatic (ie other than protocol 0), these new values will be used for the header bytes of the first request to the vehicle. If that first request should fail to obtain a response, and if the automatic search is enabled, the ELM327 will then continue to search for a protocol using default values for the header bytes. Once a valid protocol is found, the header bytes will revert to the values assigned with the AT SH command. This command is used to assign all header bytes, whether they are for a J1850, ISO 9141, ISO 14230, or a CAN system. The CAN systems will use these three bytes to fill bits 0 to 23 of the ID word (for a 29 bit ID), or will use only the rightmost 11 bits for an 11 bit CAN ID (and any extra bits assigned will be ignored). The additional 5 bits needed for a 29 bit system are set with the AT CP command. If assigning header values for the KWP protocols (4 and 5), care must be taken when setting the first header byte (xx) value. The ELM327 will always insert the number of data bytes for you, but how it is done depends on the values that you assign to this byte. If the second digit of this first header byte is anything other than 0 (zero), the ELM327 assumes that you wish to have the length value inserted in that first byte when sending. In other words, providing a length value in the first header byte tells the ELM327 that you wish to use a traditional 3 byte header, where the length is stored in the first byte of the header. If you provide a value of 0 for the second digit of the first header byte, the ELM327 will assume that you wish that value to remain as 0, and that you want to have a fourth header (length) byte inserted into the message. This is contrary to the ISO 14230-4 OBD standard, but it is in use by many KWP2000 systems for (non-OBD) data transfer, so may be useful when experimenting. |
AT SH ww xx yy zz |
Set the Header to ww xx yy zz This four byte version of the AT SH command allows setting a complete 29 bit CAN ID in one instruction. This is equivalent to using both AT CP (for the five most significant bits) and the three byte version of the AT SH command (for the other three bytes). |
AT ST hh |
Set Timeout to hh After sending a request, the ELM327 waits a preset time for a response before it can declare that there was 'NO DATA' received from the vehicle. The same timer setting may also be used after a response has been received, while waiting to see if any more is coming (but this depends on the AT AT setting). The AT ST command allows this timer to be adjusted, in increments of 4 msec (or 20 msec if in a CAN protocol, with CTM5 selected). When Adaptive Timing is enabled, the AT ST time sets the maximum time that is to be allowed, even if the adaptive algorithm determines that the setting should be longer. In most circumstances, it is best to simply leave the AT ST time at the default setting, and let the adaptive timing algorithm determine what to use for the timeout. The ST timer is set to 32 by default (giving a time of approximately 200 msec), but this default setting can be adjusted by changing PP 03. Note that a value of 00 does not result in a time of 0 msec – it will restore the timer to the default value. Also, during protocol searches, an internally set minimum time is used - you may select longer times with AT ST, but not shorter ones. |
AT V0 and V1 |
Variable data lengths off or on Many CAN protocols (ie ISO 15765-4) expect to send eight data bytes at all times. The V0 and V1 commands may be used to override this behaviour (for any CAN protocol) should you wish. Choosing V1 will cause the current CAN protocol to send variable data length messages, just as bit 6 of PP 2C and PP 2E do for protocols B and C. It does not matter what the protocol should be doing - V1 will override that. This allows experimenting with variable data length messages on demand. If you select V0 (the default setting), the forced sending of variable length CAN messages is turned off. The format of the sent messages reverts to the protocol's settings. |
| Command | Description |
|---|---|
AT FI |
perform a Fast Initiation One version of the Keyword protocol uses what is known as a 'fast initiation' sequence to begin communications. Usually, this sequence is performed when the first message needs to be sent, and then the message is sent immediately after. Some ECUs may need more time between the two however, and having a separate initiation command allows you to control this time. Simply send AT FI, wait a little, then send the message. You may need to experiment to get the right amount of delay. Another use for this command might be if you would like to perform a fast initiation with an ISO 9141 type protocol (ie 3 - CARB format). Simply follow these steps to generate a fast init, then switch to protocol 3: AT SP 5 AT FI AT SP 3 AT BIYou should then be able to communicate with the ECU. Note that a protocol close (ie AT PC) is not required in the above code, as the ELM327 automatically performs one when you switch protocols. Protocol 5 must be selected to use the AT FI command, or an error will result. |
AT KW |
display the Key Words When the ISO 9141-2 and ISO 14230-4 protocols are initialized, two special bytes (key words) are passed to the ELM327 (the values are used internally to determine whether a particular protocol variation can be supported by the ELM327). If you wish to see what the value of these bytes were, simply send the AT KW command. |
AT KW0 and KW1 |
Key Word checks off or on The ELM327 looks for specific bytes (called key words) to be sent to it by the ECU during ISO 9141-2 and ISO 14230-4 initiation sequences. If the bytes are not found, the initiation is said to have failed (and you might see 'UNABLE TO CONNECT' or perhaps 'BUS INIT: ...ERROR'). This could occur if you are trying to connect to a non-OBD compliant ECU, or perhaps to an older one. If you wish to experiment with non-standard systems, you may have to tell the ELM327 to perform the initiation sequence, but ignore the contents of the key word bytes that are received. To do this, simply send the Key Words off command: >AT KW0After turning keyword checking off, the ELM327 will still require the two key word bytes in the response, but will not look at the actual values of the bytes. It will also send an acknowledgement to the ECU, and will wait for the final response from it (but will not stop and report an error if none is received). This may allow you to make a connection in an otherwise 'impossible' situation. Normal behaviour can be restored with AT KW1, which is the default setting. |
AT SI |
perform a Slow Initiation Protocols 3 and 4 use what is sometimes called a 5 baud, or slow initiation sequence in order to begin communications. Usually, the sequence is performed when the first message needs to be sent, and then the message is sent immediately after. Some ECUs may need more time between the two however, and having a separate initiation command allows you to control this time. Simply send AT SI, wait a little, then send the message. You may need to experiment a little to get the right amount of delay. Protocol 3 or 4 must be selected to use the AT SI command, or an error will result. |
AT SW hh |
Set Wakeup to hh Once a data connection has been established, some protocols require that there be data flow every few seconds, just so that the ECU knows to maintain the communications path open. If the messages do not appear, the ECU will assume that you are finished, and will close the channel. The connection will need to be initialized again to reestablish communications. The ELM327 will automatically generate periodic messages, as required, in order to maintain a connection. Any replies to these messages are ignored by the ELM327, and are not visible to the user. (Currently, only protocols 3, 4, and 5 support these messages - nothing is available for CAN. If you require CAN periodic messages, you must use the ELM329.) The time interval between these periodic 'wakeup' messages can be adjusted in 20 msec increments using the AT SW hh command, where hh is any hexadecimal value from 00 to FF. The maximum possible time delay of just over 5 seconds results when a value of FF (decimal 255) is used. The default setting (92) provides a nominal delay of 3 seconds between messages. Note that the value 00 (zero) is special, as it will stop the periodic (wakeup) messages. This provides a control for experimenters to stop the messages while keeping the rest of the protocol functioning normally, and is not intended to be used regularly. Issuing AT SW 00 will not change a prior setting for the time between wakeup messages, if the protocol is reinitialized. Once periodic messages have been turned off with AT SW, they can only be reestablished by closing and reinitializing the protocol. |
AT WM |
set Wakeup Message to… [1 to 6 bytes] This command allows the user to override the default settings for the wakeup messages (sometimes known as the 'periodic idle' messages). Simply provide the message that you wish to have sent (typically three header bytes and one to three data bytes), and the ELM327 will add the checksum and send them as required, at the rate determined by the AT SW setting. Default settings will send the bytes 68 6A F1 01 00 for ISO 9141, and C1 33 F1 3E for KWP. |
| Command | Description |
|---|---|
AT JE |
enables the J1939 ELM data format The J1939 standard requires that PGN requests be sent with the byte order reversed from the standard 'left-to-right' order, which many of us would expect. For example, to send a request for the engine temperature (PGN 00FEEE), the data bytes are actually sent in the reverse order (ie EE FE 00), and the ELM327 would normally expect you to provide the data in that order for passing on to the vehicle. When experimenting, this constant need for byte reversals can be quite confusing, so we have defined an ELM format that reverses the bytes for you. When the J1939 ELM (JE) format is enabled, and you have a J1939 protocol selected, and you provide three data bytes to the ELM327, it will reverse the order for you before sending them to the ECU. To request the engine temperature PGN, you would send 00 FE EE (and not EE FE 00). The 'JE' type of automatic formatting is enabled by default. |
AT JHF0 and JHF1 |
J1939 Header Formatting off or on When printing responses, the ELM327 normally formats the J1939 ID (ie Header) bits in such a way as to isolate the priority bits and group all the PGN information, while keeping the source address byte separate. If you prefer to see the ID information as four separate bytes (which a lot of the J1939 software seems to do), then simply turn off the formatting with JHF0. The CAF0 command has the same effect (and overrides the JHF setting), but also affects other formatting. The default setting is JHF1. |
AT JS |
enables the J1939 SAE data format The AT JS command disables the automatic byte reordering that the JE command performs for you. If you wish to send data bytes to the J1939 vehicle without any manipulation of the byte order (ie in the order specified by the SAE documents), then select JS formatting. As an example, when sending a request for engine temperature (PGN 00FEEE) with the data format set to JS, you must present the bytes to the ELM327 as EE FE 00 (this is also known as little-endian byte ordering). The JS type of data formatting is off by default. |
AT JTM1 |
set the J1939 Timer Multiplier to 1 This command is used to set the AT ST time multiplier to x1 for the SAE J1939 protocol. As of firmware v2.1, this command now simply calls the CTM1 command. |
AT JTM5 |
set the J1939 Timer Multiplier to 5 This used to set the AT ST time multiplier to x5, for the SAE J1939 protocol. As of firmware v2.1, this command now simply calls the CTM5 command. |
AT MP hhhh |
Monitor for PGN hhhh The AT MA, MR and MT commands are quite useful for when you wish to monitor for a specific byte in the header of a typical OBD message. For the SAE J1939 Protocol, however, it is often desirable to monitor for the multi-byte Parameter Group Numbers (or PGNs), which can appear in either the header, or the data bytes. The MP command is a special J1939 only command that is used to look for responses to a particular PGN request. Note that this MP command provides no means to set the first two digits of the requested PGN, and they are always assumed to be 00. For example, the DM2 PGN has an assigned value of 00FECB (see SAE J1939-73). To monitor for DM2 messages, you would issue AT MP FECB, eliminating the 00, since the MP hhhh command always assumes that the PGN is preceded by two zeros. This command is only available when a CAN Protocol (A, B, or C) has been selected for SAE J1939 formatting. It returns an error if attempted under any other conditions. Note also that this version of the ELM327 only displays responses that match the criteria, not the requests that are asking for the PGN information. |
AT MP hhhh n |
Monitor for PGN, get n messages This is very similar to the above command, but adds the ability to set the number of messages that should be fetched before the ELM327 automatically stops monitoring and prints a prompt character. The value 'n' may be any single hex digit. |
AT MP hhhhhh |
Monitor for PGN hhhhhh This command is very similar to the MP hhhh command, but it extends the number of bytes provided by one, so that there is complete control over the PGN definition (it does not make the assumption that the Data Page bit is 0, as the MP hhhh command does). This allows for future expansion, should additional PGNs be defined with the Data Page bit set. Note that only the Data Page bit is relevant in the extra byte - the other bits are ignored. |
AT MP hhhhhh n |
Monitor for PGN, get n messages This is very similar to the previous command, but it adds the ability to set the number of messages that should be fetched before the ELM327 automatically stops monitoring and prints a prompt character. The value 'n' may be any single hex digit. |
| Command | Description |
|---|---|
AT MA |
Monitor All messages This command places the ELM327 into a bus monitoring mode, in which it continually monitors for (and displays) all messages that it sees on the OBD bus. It is a quiet monitor, not sending In Frame Responses for J1850 systems, Acknowledges for CAN systems (unless you turn silent mode off with CSM0), or Wakeup ('keep-alive') messages for the ISO 9141 and ISO 14230 protocols. Monitoring will continue until you stop it with activity on the RS232 input, or the RTS pin. To stop monitoring, simply send any single character to the ELM327, then wait for it to respond with a prompt character ('>'), or a low level output on the Busy pin. (Setting the RTS input to a low level will interrupt the device as well.) Waiting for the prompt is necessary as the response time varies depending on what the IC was doing when it was interrupted. If for instance it was in the middle of printing a line, it will first complete that line and then print 'STOPPED', before returning to the command state and sending a prompt character. If it were simply waiting for input, it would return much quicker. Note that the character which stops the monitoring will always be discarded, and will not affect subsequent commands. If this command is used with CAN protocols, and if the CAN filter and/or mask were previously set (with CF, CM or CRA), then the MA command will be affected by those settings. For example, if the receive address had been set previously with CRA 4B0, then the AT MA command would only be able to 'see' messages with an ID of 4B0. This may not be what is desired - you may want to reset the masks and filters (with AT AR or AT CRA) first. All of the monitoring commands (MA, MR and MT) operate by closing the current protocol (an AT PC is executed internally), before configuring the IC for monitoring the data. When the next OBD command is to be transmitted, the protocol will again be initialized, and you may see messages stating this. As well, 'SEARCHING...' may also be seen, depending on what changes were made while monitoring. |
AT MR hh |
Monitor for Receiver hh This command is very similar to the AT MA command except that it will only display messages that were sent to the hex address given by hh. These are messages which are found to have the value hh in the second byte of a traditional three byte OBD header, in bits 8 to 15 of a 29 bit CAN ID, or in bits 8 to 10 of an 11 bit CAN ID. Any single RS232 character aborts the monitoring, as with the MA command. Note that if this command is used with CAN protocols, and if the CAN filter and/or mask were previously set (with CF, CM or CRA), then the MR command will over-write the previous values for these bits only - the others will remain unchanged. As an example, if the receive address has been set with CRA 4B0, and then you send MR 02, the 02 will replace the 4, and the CAN masks/filters will only allow IDs that are equal to 2B0. This is often not what is desired - you may want to reset the masks and filters (with AT AR) first. As with the AT MA command, this command begins by performing an internal Protocol Close. Subsequent OBD requests may show 'SEARCHING' or 'BUS INIT', etc. messages when the protocol is reactivated. |
AT MT hh |
Monitor for Transmitter hh This command is also very similar to the AT MA command, except that it will only display messages that were sent by the transmitter with the hex address given by hh. These are messages which are found to have that value in the third byte of a traditional three byte OBD header, or in bits 0 to 7 for CAN IDs. As with the MA and MR monitoring modes, any RS232 activity (single character) aborts the monitoring. Note that if this command is used with CAN protocols, and if the CAN filter and/or mask were previously set (with CF, CM or CRA), then the MT command will over-write the previous values for these bits only - the others will remain unchanged. As an example, if the receive address has been set with CRA 4B0, and then you send MT 20, the 20 will replace the B0, and the CAN masks/filters will only allow IDs that are equal to 420. This is often not what is desired - you may want to reset the masks and filters (with AT AR) first. As with the AT MA command, this command begins by performing an internal Protocol Close. Subsequent OBD requests may show 'SEARCHING' or 'BUS INIT', etc. messages when the protocol is reactivated. |
| Command | Description |
|---|---|
AT AR |
Automatically set the Receive address Responses from the vehicle will be acknowledged and displayed by the ELM327, if the internally stored receive address matches the address that the message is being sent to. With the auto receive mode in effect, the value used for the receive address will be chosen based on the current header bytes, and will automatically be updated whenever the header bytes are changed. The value that is used for the receive address is determined by such things as the contents of the first header byte, and whether the message uses physical addressing, functional addressing, or if the user has set a value with the SR or RA commands. Auto Receive is turned on by default, and is not used by the J1939 protocol. |
AT RA hh |
set the Receive Address to hh Depending on the application, users may wish to manually set the address to which the ELM327 will respond. Issuing this command will turn off the AR mode, and force the IC to only accept responses addressed to hh. Use caution with this setting, as depending on what you set it to, you may end up accepting (ie. acknowledging with an IFR) a message that was actually meant for another module. To turn off the RA filtering, simply send AT AR. This command is not very effective for use with the CAN protocols, as it only monitors for one portion of the ID bits, and that is not likely enough for most CAN applications - the CRA command may be a better choice. Also, this command has no effect on the addresses used by the J1939 protocols, as the J1939 routines derive them from the header values, as required by the SAE standard. The RA command is exactly the same as the SR command, and can be used interchangeably. Note that CAN Extended Addressing does not use this value - it uses the one set by the AT TA command. |
AT SR hh |
Set the Receive address to hh Depending on the application, users may wish to manually set the address to which the ELM327 will respond. Issuing this command will turn off the AR mode, and force the IC to only accept responses addressed to hh. Use caution with this setting, as depending on what you set it to, you may accept a message that was actually meant for another module, possibly sending an IFR when you should not. To turn off the SR filtering, simply send AT AR. This command has limited use with CAN, as it only monitors one byte of the ID bits, and that is not likely selective enough for most CAN applications (the CRA command may be a better choice). Also, the command has no effect on the addresses used by the J1939 protocols, as the J1939 routines set their own receive addresses based on the ID bit (header) values. This SR command is exactly the same as the RA command, and can be used interchangeably with it. Note that CAN Extended Addressing does not use this value - it uses the one set by the AT TA command. |
AT TA hh |
set the Tester Address to hh This command is used to change the current tester (ie. scan tool) address that is used in the headers, periodic messages, filters, etc. The ELM327 normally uses the value that is stored in PP 06 for this, but the TA command allows you to temporarily override that value. Sending AT TA will affect all protocols, including J1939. This provides a convenient means to change the J1939 address from the default value of F9, without affecting other settings. Although this command may appear to work 'on the fly', it is not recommended that you try to change this address after a protocol is active, as the results may be unpredictable. |
| Command | Description |
|---|---|
AT PP hh OFF |
turn Prog. Parameter hh OFF This command disables Programmable Parameter number hh. Any value assigned using the PP hh SV command will no longer be used, and the factory default setting will once again be in effect. The actual time when the new value for this parameter becomes effective is determined by its type. Refer to the Programmable Parameters section (page 72) for more information on the types. Note that 'PP FF OFF' is a special command that disables all of the Programmable Parameters, as if you had entered PP OFF for every possible one. It is possible to alter some of the Programmable Parameters so that it may be difficult, or even impossible, to communicate with the ELM327. If this occurs, there is a hardware means of resetting all of the Programmable Parameters at once. Connect a jumper from circuit common to pin 28, holding it there while powering up the ELM327 circuit. Hold it in position until you see the RS232 Receive LED begin to flash (which indicates that all of the PPs have been turned off). At this point, remove the jumper to allow the IC to perform a normal startup. Note that a reset of the PPs occurs quite quickly – if you are holding the jumper on for more than a few seconds and do not see the RS232 receive light flashing, remove the jumper and try again, as there may be a problem with your connection. |
AT PP hh ON |
turn Programmable Parameter hh ON This command enables Programmable Parameter number hh. Once enabled, any value assigned using the PP hh SV command will be used where the factory default value was before. (All of the programmable parameter values are set to their default values at the factory, so enabling a programmable parameter before assigning a value to it will not cause problems.) The actual time when the value for this parameter becomes effective is determined by its type. Refer to the Programmable Parameters section (page 72) for more information on the types. Note that 'PP FF ON' is a special command that enables all of the Programmable Parameters at the same time. |
AT PP hh SV yy |
Prog. Param. hh: Set the Value to yy A value is assigned to a Programmable Parameter using this command. The system will not be able to use this new value until the Programmable Parameter has been enabled, with PP hh ON. |
AT PPS |
Programmable Parameter Summary The complete range of current Programmable Parameters are displayed with this command (even those not yet implemented). Each is shown as a PP number followed by a colon and the value that is assigned to it. This is followed by a single digit – either 'N' or 'F' to show that it is ON (enabled), or OFF (disabled), respectively. See the Programmable Parameters section for a more complete discussion. |
| Command | Description |
|---|---|
AT CV dddd |
Calibrate the Voltage to dd.dd volts The voltage reading that the ELM327 shows for an AT RV request can be calibrated with this command. The argument ('dddd') must always be provided as 4 digits, with no decimal point (it assumes that the decimal place is between the second and the third digits). To use this feature, simply use an accurate meter to read the actual input voltage, then use the CV command to change the internal calibration (scaling) factor. For example, if the ELM327 shows the voltage as 12.2V while you measure 11.99 volts, then send AT CV 1199 and the ELM327 will recalibrate itself for that voltage (it will actually read 12.0V due to digit roundoff). See page 31 for some more information on how to read voltages and perform the calibration. |
AT CV 0000 |
restore the factory Calibration Value If you are experimenting with the CV dddd command but do not have an accurate voltmeter as a reference, you may soon get into trouble. If this happens, you can always send AT CV 0000 to restore the ELM327 to the factory calibration value. |
The following pages provide a list of the currently available Programmable Parameters. The value shown in the ‘Type’ column indicates when any changes take effect. Possible values are: - I - the effect is Immediate, - D - takes effect after Defaults are restored (AT D, AT Z, AT WS, MCLR or power off/on) - R - takes effect after a Reset (AT Z, AT WS, MCLR or power off/on) - P - needs a Power off/on type reset (AT Z, MCLR, or power off/on)
Type: I — Immediate, D — after Defaults (AT D, AT Z, AT WS), R — after Reset (AT Z, AT WS), P — after Power off/on (AT Z)
| PP | Description | Values | Default | Type | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
00 |
Perform AT MA after power up or reset | 00 = ON; FF = OFF | FF(OFF) |
R | ||||||||||||||
01 |
Print header bytes (AT H default setting) | 00 = ON; FF = OFF | FF(OFF) |
D | ||||||||||||||
02 |
Allow long messages (AT AL default setting) | 00 = ON; FF = OFF | FF(OFF) |
D | ||||||||||||||
03 |
NO DATA timeout (AT ST default setting) | 00 to FF | 32(205 msec) |
D | ||||||||||||||
04 |
Default adaptive timing mode (AT AT setting) | 00 to 02 | 01 |
D | ||||||||||||||
06 |
Default tester address (Source Address) | 00 to FF | F1 |
R | ||||||||||||||
07 |
Last protocol to try during automatic searching | 01 to 0C | 09 |
I | ||||||||||||||
09 |
Character echo (AT E default setting) | 00 = ON; FF = OFF | 00 (ON) |
R | ||||||||||||||
0A |
Linefeed character | 00 to 20 | 0A |
R | ||||||||||||||
0C |
RS232 baud rate divisor when pin 6 is high (logic 1) P baud rate (in kbps) = 4000 ÷ (PP 0C value) For example, 500 kbps requires a setting of 08 (since 4000/8 = 500) Here are some example baud rates, and the divisor to be used:
Notes: - 1. The PP 0C value must be provided as hex digits only. The decimal values (listed above in brackets) are only shown for your convenience. - 2. The ELM327 can only process continuous byte receives at rates of about 600 kbps maximum. If you need to connect at a higher rate, add a delay between the bytes to maintain an average rate of 600 kbps or less. - 3. A value of 00 provides a baud rate of 9600 bps. |
00 to FF | 68 (38,4) |
P | ||||||||||||||
0D |
Carriage return character | 00 to 20 | 0D |
R | ||||||||||||||
0E |
Power Control options Each bit controls an option, as follows: b7: Master enable 0: off 1: on if 0, pins 15 and 16 perform as described for v1.0 to v1.3a (must be 1 to allow any Low Power functions) b6: Pin 16 full power level 0: low 1: high normal output level, is inverted when in low power mode b5: Auto LP control (0: disabled 1: enabled) allows low power mode if the RS232 activity stops b4: Auto LP timeout 0: 5 mins 1: 20 mins no RS232 activity timeout setting b3: Auto LP warning (0: disabled 1: enabled) if enabled, says ‘ACT ALERT’ 1 minute before RS232 timeout b2: Ignition control (0: disabled 1: enabled) allows low power mode if the IgnMon input goes low b1: Ignition delay 0: 1 sec 1: 5 sec delay after IgnMon (pin 15) returns to a high level, before normal operation resumes b0: reserved for future - leave set at 0 |
00 to FF | 9A |
R | ||||||||||||||
0F |
Activity Monitor options. Each bit controls an option, as follows: b7: monitor master control (0: disabled 1: enabled) must be 1 to allow b3 to b6 b6: allow wake from Low Power (0: no 1: yes) wakes on shift from no activity to activity b5: Auto LP control (0: disabled 1: enabled) allows low power mode if the OBD activity stops b4: Auto LP timeout 0: 30 secs 1: 150 secs no OBD activity timeout setting b3: Auto LP warning (0: disabled 1: enabled) if enabled, says ‘ACT ALERT’ on timeout b2: reserved for future - leave set at 1 b1: add exclamation mark (0: no 1: yes). if 1, sends ‘!’ before ACT ALERT and LP ALERT b0: LP LED (0: disabled 1: enabled). if 1, the OBD Tx LED flashes when in Low Power mode (one 16 msec flash repeated every 4 seconds) |
00 to FF | D5 |
D | ||||||||||||||
10 |
J1850 voltage settling time (ms) = (PP 10) × 4.096 | 00 to FF | 0D |
R | ||||||||||||||
11 |
J1850 Break signal monitoring (reports BUS ERROR when limits are exceeded) | 00 = ON; FF = OFF | 00 (ON) |
D | ||||||||||||||
12 |
J1850 Volts (pin 3) output polarity normal = Low output for 5V, High output for 8V invert = High output for 5V, Low output for 8V |
00 = invert R; FF = normal | FF (normal) |
R | ||||||||||||||
13 |
Time delay added between protocols 1 & 2 during a search setting (in msec) = 150 + (PP 13 value) x 4.096 | 00 = ON; FF = OFF | 55 (498 msec) |
I | ||||||||||||||
14 |
ISO/KWP final stop bit width (provides P4 interbyte time) setting (in µsec) = 98 + (PP 14 value) x 64 | 00 to FF | 50 (5.2 msec) |
D | ||||||||||||||
15 |
ISO/KWP maximum inter-byte time (P1), and also used for the minimum inter-message time (P2). setting (in msec) = (PP 15 value) x 2.112 | 00 to FF | 0A |
D | ||||||||||||||
16 |
Default ISO/KWP baud rate (AT IB default setting) Note: 4800, 12500, and 15625 baud can not be set as defaults |
00 = 96;FF = 10 | FF(10.4K) |
R | ||||||||||||||
17 |
ISO/KWP wakeup message rate (AT SW default setting) setting (in msec) = (PP 17 value) x 20.48 | 00 to FF | 92(3.0 sec) |
D | ||||||||||||||
18 |
ISO/KWP delay before a fast init, if a slow init has taken place setting (in msec) = 1000 + (PP 18 value) x 20.48 | 00 to FF | 31(2.0 sec) |
I | ||||||||||||||
19 |
ISO/KWP delay before a slow init, if a fast init has taken place setting (in msec) = 1000 + (PP 19 value) x 20.48 If you are having trouble connecting, increasing this time to 5 seconds (C3) may help. | 00 to FF | 4F (2.6 sec) |
I | ||||||||||||||
1A |
Protocol 5 fast initiation active time (TiniL) setting (in msec) = (PP 1A value) x 2.5 | 00 to FF | 0A(25 msec) |
D | ||||||||||||||
1B |
Protocol 5 fast initiation passive time (TiniH) setting (in msec) = (PP 1B value) x 2.5 | 00 to FF | 0A(25 msec) |
D | ||||||||||||||
1C |
ISO/KWP outputs used for initiation (b7 to b2 are not used) b1: L line (pin 22) 0: disabled 1: enabled b0: K line (pin 21) 0: disabled 1: enabled If disabled, an output will remain low during protocol initiations |
00 to FF | 03 |
D | ||||||||||||||
1D |
ISO/KWP P3 time (delay before sending requests) Ave time (in msec) = (PP 1D value - 0.5) x 4.096 | 00 to FF | 0F |
D | ||||||||||||||
1E |
ISO/KWP K line minimum quiet time before an init can begin (W5) setting (in msec) = (PP 1E value) x 4.096 | 00 to FF | 4A(303 msec) |
D | ||||||||||||||
1F |
KWP byte count includes the checksum byte? | FF = NO;00 = YES | FF(NO) |
R | ||||||||||||||
20 |
ISO/KWP 5 baud initiation W1 timer start point The minimum time, measured from the beginning of the Address byte stop bit before the Sync byte may appear. T = (PP 20 value) x 1.984 msec Note that the standards define a range for this value from 260 msec to 500 msec. |
00 to FF | 5D(185 msec) |
R | ||||||||||||||
21 |
Default CAN silent monitoring setting (AT CSM) | FF = ON; 00 = OFF | FF(ON) |
R | ||||||||||||||
24 |
CAN auto formatting (AT CAF default setting) | 00 = ON; FF = OFF | 00(ON) |
D | ||||||||||||||
25 |
CAN automatic flow control (AT CFC default setting) | 00 = ON; FF = OFF | 00(ON) |
D | ||||||||||||||
26 |
CAN fill byte (used to pad CAN messages to 8 bytes) | 00 to FF | 00 |
D | ||||||||||||||
28 |
CAN Filter settings (controls CAN sends while searching) The bits of this byte control options, as follows: b7: 500 kbps match 0: ignored 1: required b6: 250 kbps match 0: ignored 1: required b5 to b1: reserved for future - leave set to 1 b0: send if bus is quiet 0: not allowed 1: allowed |
00 to FF | FF |
D | ||||||||||||||
29 |
Print CAN Data Length (DLC) when outputting headers (AT D0/D1 default setting) | 00 = ON; FF = OFF | FF(OFF) |
D | ||||||||||||||
2A |
CAN Error Checking (applies to protocols 6 to C). Each bit of this byte controls an option, as follows: b7: ISO15765 Data Length 0: accept any 1: must be 8 bytes b6: ISO15765 PCI = 00 0: allowed 1: not allowed b5: Search after ERR94 0: normal 1: CAN is blocked b4: Search after LV RESET 0: normal 1: CAN is blocked b3: Wiring Test 0: bypass 1: perform Processing 7F xx 78’s: b2: enabled (CAN & KWP) 0: no 1: yes b1: valid Modes (xx values) 0: all 1: only 00 to 0F b0: valid CAN protocols 0: all 1: only ISO15765 |
00 to FF | 3C |
D | ||||||||||||||
2B |
Protocol A (SAE J1939) CAN baud rate divisor baud rate (in kbps) = 500 ÷ (PP 2B value). For example, setting this PP to 19 (ie. decimal 25) provides a baud rate of 500/25 = 20 kbps. | 01 to 40 | 02(250 Kbps) |
R | ||||||||||||||
2C |
Protocol B (USER1) CAN options. Each bit of this byte controls an option, as follows: b7: Transmit ID Length 0: 29 bit ID 1: 11 bit ID b6: Data Length 0: fixed 8 byte 1: variable DLC b5: Receive ID Length 0: as set by b7 1: both 11 and 29 bit b4: baud rate multiplier 0: x1 1: x 8/7 (see note 3) b3: reserved for future - leave set at 0. b2, b1, and b0 determine the data formatting options: b2 b1 b0 Data Format 0 0 0 none 0 0 1 ISO 15765-4 0 1 0 SAE J1939 Other combinations are reserved for future updates – results will be unpredictable if you should select one of them. |
00 to FF | E0 |
R | ||||||||||||||
2D |
Protocol B (USER1) baud rate divisor baud rate (in kbps) = 500 ÷ (PP 2D value). For example, setting this PP to 0A (ie. decimal 10) provides a baud rate of 500/10 = 50 kbps. | 01 to 40 | 04(125 Kbps) |
R | ||||||||||||||
2E |
Protocol C (USER2) CAN options. Each bit of this byte controls an option, as follows: b7: Transmit ID Length 0: 29 bit ID 1: 11 bit ID b6: Data Length 0: fixed 8 byte 1: variable DLC b5: Receive ID Length 0: as set by b7 1: both 11 and 29 bit b4: baud rate multiplier 0: x1 1: x 8/7 (see note 3) b3: reserved for future - leave set at 0. b2, b1, and b0 determine the data formatting options: b2 b1 b0 Data Format 0 0 0 none 0 0 1 ISO 15765-4 0 1 0 SAE J1939 Other combinations are reserved for future updates – results will be unpredictable if you should select one of them. |
00 to FF | 80 |
R | ||||||||||||||
2F |
Protocol C (USER2) baud rate divisor. baud rate (in kbps) = 500 ÷ (PP 2B value) For example, setting this PP to 19 (ie. decimal 25) provides a baud rate of 500/25 = 20 kbps. | 01 to 40 | 0A(50 Kbps) |
R |
The ScanDoc adapter extends the ELM327 protocol with support for DoIP (Diagnostics over Internet Protocol, ISO 13400). This makes it possible to perform Ethernet diagnostics of modern vehicles through the familiar ELM327 AT command interface.
Detailed description of the DoIP protocol (ISO 13400) →
The ScanDoc adapter extends the ELM327 protocol with support for BMW HSFZ (High Speed Fahrzeug Zugang). This is BMW's proprietary protocol for Ethernet diagnostics, which uses 1-byte addressing and a simplified frame format without Routing Activation.
Detailed description of the BMW HSFZ protocol →
In normal mode (without the AT prefix), commands are sent directly to the vehicle. Commands are written as hexadecimal bytes:
| Command | Description |
|---|---|
01 00 | Request supported PIDs (Mode 01) |
01 0C | Read engine RPM |
01 0D | Read vehicle speed |
03 | Read stored trouble codes (Mode 03) |
04 | Clear trouble codes (Mode 04) |
09 02 | Read VIN number (Mode 09) |
