So I found this on Reddit:

“I have finally figured out how to retrieve mode diagnostic data from my 2006 Chrysler Sebring 2.7L and it should work on all Chrysler’s that use the J1850 VPW protocol and bus. I want to share this information because it should be available to everyone not just Chrysler techs. Well… even the Chrysler techs don’t know how to do this stuff because they just use the DRBIII scanner to do it for them. Any ways lets get to the good stuff.

From my previous post I was trying to use the standard J1850 three byte header. Turns out Chrysler does it a little different for physical addresses (of course) and uses a two byte header. Normally to request mode from the ECM you could send the header 6C 10 F1 but on Chrysler vehicles they use the two byte header standard outlined in SAE 2178-3 which reads:

Post image
So from this we know we must set our header to then the module we want to request from. In my case since I want the misfire data from the ECM I use . So to put it all together and break it down this is the full message including the header you need to send (minus the CRC byte)

Transmit:

24 10 22 07 77 00

= Two byte header diagnostic request

= ID of ECM

= Mode 22

07 77 = Enhanced PID of Cylinder misfire counts

= Send response only once

Response:

26 10 62 00 2B 00 00 98

= Two byte header diagnostic response

= ID of ECM

= Report data by PID (outlined in SAE J2190)

00 2B 00 00 = Data

= CRC

Now the real trick is getting the ELM327 to set a two byte header and be able to receive the response. Since the ELM327 only allows for setting one and three byte headers we need to include our mode into the header. For example:

AT SH 24 10 22

However this is only part of the puzzle. We set our header but if we send the rest of the message 07 77 00 we get a NO DATA response. This is the part that I got stuck on for a long time. When we set the header in the ELM327 it will automatically set the receive address based on the header we set and because the receive address is always the 3rd byte in a three byte header it sets it as . Now is not our receive address according to the above SAE 2178-3 paragraph as it says the response to our request must be then the responding modules address which in our case is . So we need to manually tell the ELM327 to listen for responses on address 10. We do this with the AT SR command:

AT SR 10

So in order to send and receive mode diagnostic data from the ECM we send the following commands to the ELM327

AT SH 24 10 22

AT SR 10

07 77 00

Now its important to note that the response from a mode request is suppose to echo back the PID you originally sent (in our case 07 77) outlined in SAE J2190 but Chrysler’s doesn’t do this. They just send the data and so the bytes after is the data requested minus the last byte since that’s the CRC.

I hope this helps someone out there. I spent over a month trying to find someone who knew about this information and doing my own research but am over joyed to have solved it myself.”

So now I just need to translate this into PID settings for Torque Pro…