I’ve just read this page : http://tuning-diesels.com/Eobd/eobd2.htm

“DIY & generic tools don’t support modes higher than 9, but pro ones can send a mode 27 command. This a request by the tool for security access. The ecu then sends a seed to the tool. Using an algorithm contained within this and the ecu, both devices calculate the key from this seed. If the keys match, the ecu allows access. Clearly, the tool must have the same algorithm as the ecu or the keys won’t match and this is not in the public domain. So companies like Sykes Pickavant, Rovacom, Snap On, and remapping product manufacturers will have either purchased it from the manufacturer or reverse engineered it by monitoring the data stream and collecting seed/key pairs in the hope of deciphering the algorithm that generates one from the other.

Once access has been granted, the tool can use the other modes as required. For example: by using a Scantool interface in monitoring mode, I could see that my ACR4 was using mode 21 to request sensor data, mode 30 to test various actuators such as air con clutch, and mode 14 to clear fault codes. Modes 34, 35,36, 3B, 3C are data transfer modes used when reading and writing to the ecu (eg when remapping).”

Sounds like we need some king of auth process beetween Torque and the ECU to read mode 21 ?

What do you think about that ?

Thanks for your answer !

I spyed the serial connection and I get this :

Sent > 82 7A F1 21 A1 AF

82 = ?
7A = ECU injection address
F1 = tool (ELM) address
21 A1 = PID
AF = ?

I receive 3 paquets :

1st < 82 7A F1 21 A1 AF same as sent 2nd < 9C = ? 3rd < F1 7A 61 A1 00 00 00 00 70 0D 00 00 CA 0B 24 2F E1 FF 2C 10 03 00 00 00 00 00 00 00 00 00 CD F1 = tool (ELM) address 7A = ECU injection address 61 A1 00 00 00 = ? 00 70 = engine rpm 0D 00 = rpm setpoint 00 CA = throttle 0B 24 = watter temperature 2F E1 = battry FF 2C = rail pressure == what I want to read 10 03 = rail pressure setpoint == what I want to read 00 00 = climate control pressure 00 00 00 = fault bits 00 00 = fault bits 00 = fault bits 00 CD = ?? I think with this you could give me more idea on how to read this ? Thanks in advance

Hi

Still here – it looks like that is a valid mode 21 command, and that you’re getting data back from it.

All you’d need to do is enter the same command in torque in the equation editor (after working out the scaling for each part of the reply) so you can then create your own ‘extended’ displays that show that data

82 7A F1 is the header to use in the header part of the editor

Hi

Yes, torque will stitch the packets back together into one

The information looks correct. If the variable is R, then you’d put that into the equation and then apply any scaling required, eg:

R * 100

or

R / (9/5)

R will be a value from 0 to 255 which you will then apply the scaling to. For multibyte variable (eg: A and B) you usually have something like (A*256)+B

You would create one PID for each sensor that you want. You should be fine with multiple entries pointing at the same PID

Hi

The variables will go from A-Z then AA, AB, AC(etc), BA, BB, BC, (etc)

The 21A1 is the PID you should be using, the AF is not required on a mode 21 PID (make sure the documentation didn’t say something like 21 A1 ‘to’ AF)

A will start after the header and response (so somwhere on or just after AF in your reply)

Hi !

I tried many things… without any result

I don’t really know where I go wrong because I do not know well how OBD protocol works…

Is there a way to spy what torque sends en receive ?

Hi

Your PID should be: 21A1  (AF is a check digit – ignore it)
Your equation should use variables P and Q, but you’ll need to find out the scaling information. It could look something like: ((P*255)+Q)/10

I’m sad that didn’t work…