The diagnostics port – OBD2 in detail and manufacturer-specific PIDs

Following up from the previous post, we now know that connecting the OBD2 adapter to connect to the Myvi’s ECU isn’t as impossible as it seems. We managed to get the ECU to handshake, and it is now possible to perform basic OBD2 diagnostic functions. However to this end, there’s certainly more to it than meets the eye. Brace yourself — there’s a lot of heavy reading ahead.
As you may have expected by now, a car actually has more than a single computer within; in fact, there are several in charge of different aspects such as ABS and traction control, air-conditioning, immobilizer and many more. In newer cars, these ECUs are all interconnected via a single protocol, although some cars may have different set-ups, depending on the manufacturer. In this article, our focus is on the engine’s ECU.

Excerpt from a Lexus service manual displaying the locations of multiple ECUs within the vehicle, where each and every major functionality is controlled by a computer. Image taken from ClubLexus.
You will need a program or an app to interface with the ECU, which there are many apps for the Windows, Android or iPhone platform. I’m with the little green bot so I’m using Torque Pro and it’s worth every cent for its frequent updates and customizations, and will also serve to illustrate the examples in this article. The author, Ian Hawkins has been very helpful in diagnosing issues with the app to work with the multitude of cars around the world (even with mine!) so do support the developer if you can.
I’ve taken the liberty to list down the engine OBD2 PIDs available for the 2011 Myvi 1.3 and 1.5, so please note that this list is only specific for this model. The Alza should share the same PIDs since they also have the same engines but precaution is advised.
Engine RPM
Vacuum pressure
Coolant temperature
Intake air temperature
Intake manifold pressure
O2 sensor voltage 1 and 2 (before and after the catalytic converter)
Throttle position (at throttle pedal)
Relative throttle position (at butterfly valve)
Vehicle speed
Ignition timing advance
Battery voltage
Wait, how come there’s only so few of them? So right now let’s talk about the OBD2 standard itself.
SAEJ1979 is the standard which defines the basic list of modes and PIDs present in every vehicle. It also states that manufacturers aren’t required to implement all modes and PIDs dictated by the standard, and they are also allowed to implement their own set of modes and PIDs.
It is worthy to note that a vehicle model can be sold in different countries and regions, where the manufacturer must adhere to local stipulated rules and regulations on vehicle diagnostics. For example, vehicles in the US have a mode and PID which you can retrieve the VIN (vehicle identification number) off an ECU, whereas nothing of the sort is present in our Malaysian market. To cater for every country and region’s needs along with every model from their respective manufacturers, exorbitantly priced complete diagnostic tools certainly makes sense!

Excerpt from the sensor list of a Daihatsu Terios service manual, or also known as the Perodua Kembara. Since both engine models are the same in both Myvi and Terios models, most of the information in the manual are shared. Service manuals contain a lot of information about the underpinnings of a car and can be very useful for repairs and modifications alike.
Fortunately in the case of the Myvi, information about Toyota diagnostic systems are abundant. With a quick search, manufacturer-specific PIDs for Toyota (and their sub-marques Daihatsu and Lexus) are easily found so at least, we have an inkling on where to look for more sensor information. But how do you actually get the sensor values out from the ECU itself?
The cheaper and often used diagnostic tool uses the very common ELM327 microcontroller, which acts as an intermediary and does the interpretation between the ECU and you – commands can be sent via a command prompt (for you young ‘uns out there it looks like DOS) to the microcontroller. The ELM327 then translates and sends your intended command to the ECU, which responds back and you get a readable value. With an app or a program, things are much simpler as this communication process is made somewhat transparent to the user, with the app/program handling the bulk of the communications at the background – so when you are monitoring PIDs on your phone it’s the app that’s doing all the request work.

The OBD2 port is always located within 3 feet from the steering wheel and must be accessible without any special tools. For the 2011 Myvi the port is located just beside the bonnet switch which is easy to access, although your legs might get in the way if the tool is long enough. When looking for a tool, be sure to get one as low-profile as possible – mine provides more than enough legroom for my stubby legs.
To find more PIDs, Android users using Torque Pro have a feature named TorqueScan which queries PID addresses by bruteforce and returns values from the ECU, if any. By bruteforcing, the app thoroughly goes thru every available mode and PID and queries the ECU one by one to see if any values are returned:

As TorqueScan iterates thru every detected ECU and scans every possible PID address, this process can get a little lengthy. Depending on the ECU it may take from a few minutes to an entire night – so do prepare the necessities like a power bank for the phone and a nice cold beer for yourself (or two).
Based on our scan in the image above, we do know now we are getting more sensor values, as seen when the app queries PID addresses starting with 21. The big snag we’ve run into now – what do those values in TorqueScan even mean? From here onward, this following sections will need you to get a little geeky.
First of all, finding which PID command corresponds to which sensor is a bit of a grey area. As Toyota (and many other manufacturers) sell their proprietary PID lists to third party service centers, posting complete PIDs for their vehicles may have legal repercussions. To illustrate, let’s assume PID 21B2 (mode 21, address B2) corresponds to the amount of ignition timing cut back in degrees when the engine detects knock. When the app queries this address, the ECU returns a line of data for us to decipher.

How long the scanning process takes is also dependent on the OBD2 protocol that is used. Cars from 2010-onwards mostly use ISO 15765-4 CAN due to its robustness of its design and its capability to connect several ECUs via a single bus, which saves on manufacturing costs, time and complexity. It’s also fast, with data transmissions at 500 Kbauds a second; compare that with KWP2000 – a 1990s protocol mostly used in models from Japan – which goes at a max rate of 10.4 Kbauds per second. That’s almost 50 times slower!
Gibberish? That’s because the values are returned in hexadecimal format, which we will have to convert back to decimal. To put it simply, each byte can be simplified to a pair of hexadecimals, so since there are 4 pairings of numbers returned (61 B2 08 00) we know the ECU has returned 4 bytes of data. Now if you compare the other PIDs and their returned values, you will notice a pattern.
The initial byte values are very similar between the request and the response, and that’s because the ECU repeats the pattern and adds 40 in hexadecimal to the first byte as an acknowledgement – the ECU’s way of telling you ‘I received your request, here’s my response’. The second byte repeats the PID address, and the extra bytes returned is the car’s knock correction angle values at that current point of time. As the values are in hexadecimal, let’s convert them to decimal first (A denotes the first byte from the left, and B denotes the next byte)
A = 08 (hex) = 8 (dec)
B = 00 (hex) = 0 (dec)
Next, the values is passed thru an equation (again this is proprietary, most likely to make things a little more difficult to reverse-engineer) which every PID possesses. An example of the equation for PID 21B2 is shown below:
(A * 256 + B) * 0.03125 – 64
(8 * 256 + 0) * 0.03125 – 64
= 0, which means no retarding is present (and that’s a good thing!)
The above process applies to anyone trying to understand and reverse-engineer proprietary PIDs, with a bit of variation between other manufacturers. It’s by no means quick and simple but with a bit of effort, you can have your very own diagnostics tool for even less of a fraction of the price, while being able to use the data for other purposes.
On the next article, we will look on what else is possible when you have a diagnostics tool connected to your car, including some very cool projects that you can do to get the most out of your driving experience. Do let us know what you think in the comments!