Following up from the previous post, we now know that connecting the OBD2 adapter to connect to the Myvi’s ECU isn’t as impossible as it seems. We managed to get the ECU to handshake, and it is now possible to perform basic OBD2 diagnostic functions. However to this end, there’s certainly more to it than meets the eye. Brace yourself — there’s a lot of heavy reading ahead.
As you may have expected by now, a car actually has more than a single computer within; in fact, there are several in charge of different aspects such as ABS and traction control, air-conditioning, immobilizer and many more. In newer cars, these ECUs are all interconnected via a single protocol, although some cars may have different set-ups, depending on the manufacturer. In this article, our focus is on the engine’s ECU.
Excerpt from a Lexus service manual displaying the locations of multiple ECUs within the vehicle, where each and every major functionality is controlled by a computer. Image taken from ClubLexus.
You will need a program or an app to interface with the ECU, which there are many apps for the Windows, Android or iPhone platform. I’m with the little green bot so I’m using Torque Pro and it’s worth every cent for its frequent updates and customizations, and will also serve to illustrate the examples in this article. The author, Ian Hawkins has been very helpful in diagnosing issues with the app to work with the multitude of cars around the world (even with mine!) so do support the developer if you can.
I’ve taken the liberty to list down the engine OBD2 PIDs available for the 2011 Myvi 1.3 and 1.5, so please note that this list is only specific for this model. The Alza should share the same PIDs since they also have the same engines but precaution is advised.
Intake air temperature
Intake manifold pressure
O2 sensor voltage 1 and 2 (before and after the catalytic converter)
Throttle position (at throttle pedal)
Relative throttle position (at butterfly valve)
Ignition timing advance
Wait, how come there’s only so few of them? So right now let’s talk about the OBD2 standard itself.
SAEJ1979 is the standard which defines the basic list of modes and PIDs present in every vehicle. It also states that manufacturers aren’t required to implement all modes and PIDs dictated by the standard, and they are also allowed to implement their own set of modes and PIDs.
It is worthy to note that a vehicle model can be sold in different countries and regions, where the manufacturer must adhere to local stipulated rules and regulations on vehicle diagnostics. For example, vehicles in the US have a mode and PID which you can retrieve the VIN (vehicle identification number) off an ECU, whereas nothing of the sort is present in our Malaysian market. To cater for every country and region’s needs along with every model from their respective manufacturers, exorbitantly priced complete diagnostic tools certainly makes sense!
Excerpt from the sensor list of a Daihatsu Terios service manual, or also known as the Perodua Kembara. Since both engine models are the same in both Myvi and Terios models, most of the information in the manual are shared. Service manuals contain a lot of information about the underpinnings of a car and can be very useful for repairs and modifications alike.
Fortunately in the case of the Myvi, information about Toyota diagnostic systems are abundant. With a quick search, manufacturer-specific PIDs for Toyota (and their sub-marques Daihatsu and Lexus) are easily found so at least, we have an inkling on where to look for more sensor information. But how do you actually get the sensor values out from the ECU itself?
The cheaper and often used diagnostic tool uses the very common ELM327 microcontroller, which acts as an intermediary and does the interpretation between the ECU and you – commands can be sent via a command prompt (for you young ‘uns out there it looks like DOS) to the microcontroller. The ELM327 then translates and sends your intended command to the ECU, which responds back and you get a readable value. With an app or a program, things are much simpler as this communication process is made somewhat transparent to the user, with the app/program handling the bulk of the communications at the background – so when you are monitoring PIDs on your phone it’s the app that’s doing all the request work.
The OBD2 port is always located within 3 feet from the steering wheel and must be accessible without any special tools. For the 2011 Myvi the port is located just beside the bonnet switch which is easy to access, although your legs might get in the way if the tool is long enough. When looking for a tool, be sure to get one as low-profile as possible – mine provides more than enough legroom for my stubby legs.
To find more PIDs, Android users using Torque Pro have a feature named TorqueScan which queries PID addresses by bruteforce and returns values from the ECU, if any. By bruteforcing, the app thoroughly goes thru every available mode and PID and queries the ECU one by one to see if any values are returned:
As TorqueScan iterates thru every detected ECU and scans every possible PID address, this process can get a little lengthy. Depending on the ECU it may take from a few minutes to an entire night – so do prepare the necessities like a power bank for the phone and a nice cold beer for yourself (or two).
Based on our scan in the image above, we do know now we are getting more sensor values, as seen when the app queries PID addresses starting with 21. The big snag we’ve run into now – what do those values in TorqueScan even mean? From here onward, this following sections will need you to get a little geeky.
First of all, finding which PID command corresponds to which sensor is a bit of a grey area. As Toyota (and many other manufacturers) sell their proprietary PID lists to third party service centers, posting complete PIDs for their vehicles may have legal repercussions. To illustrate, let’s assume PID 21B2 (mode 21, address B2) corresponds to the amount of ignition timing cut back in degrees when the engine detects knock. When the app queries this address, the ECU returns a line of data for us to decipher.
How long the scanning process takes is also dependent on the OBD2 protocol that is used. Cars from 2010-onwards mostly use ISO 15765-4 CAN due to its robustness of its design and its capability to connect several ECUs via a single bus, which saves on manufacturing costs, time and complexity. It’s also fast, with data transmissions at 500 Kbauds a second; compare that with KWP2000 – a 1990s protocol mostly used in models from Japan – which goes at a max rate of 10.4 Kbauds per second. That’s almost 50 times slower!
Gibberish? That’s because the values are returned in hexadecimal format, which we will have to convert back to decimal. To put it simply, each byte can be simplified to a pair of hexadecimals, so since there are 4 pairings of numbers returned (61 B2 08 00) we know the ECU has returned 4 bytes of data. Now if you compare the other PIDs and their returned values, you will notice a pattern.
The initial byte values are very similar between the request and the response, and that’s because the ECU repeats the pattern and adds 40 in hexadecimal to the first byte as an acknowledgement – the ECU’s way of telling you ‘I received your request, here’s my response’. The second byte repeats the PID address, and the extra bytes returned is the car’s knock correction angle values at that current point of time. As the values are in hexadecimal, let’s convert them to decimal first (A denotes the first byte from the left, and B denotes the next byte)
A = 08 (hex) = 8 (dec)
B = 00 (hex) = 0 (dec)
Next, the values is passed thru an equation (again this is proprietary, most likely to make things a little more difficult to reverse-engineer) which every PID possesses. An example of the equation for PID 21B2 is shown below:
(A * 256 + B) * 0.03125 – 64
(8 * 256 + 0) * 0.03125 – 64
= 0, which means no retarding is present (and that’s a good thing!)
The above process applies to anyone trying to understand and reverse-engineer proprietary PIDs, with a bit of variation between other manufacturers. It’s by no means quick and simple but with a bit of effort, you can have your very own diagnostics tool for even less of a fraction of the price, while being able to use the data for other purposes.
On the next article, we will look on what else is possible when you have a diagnostics tool connected to your car, including some very cool projects that you can do to get the most out of your driving experience. Do let us know what you think in the comments!
Tks for the info, but how did you get the ELM to talk to the ECU? What protocol or settings in Torque Pro did you use.
Thanks in advance from a frustrated Terios owner!
Hi Rick – I assume you’re driving the second generation Terios? Try using ISO 15765-4 CAN in 11bit 500k baud?
Let me know if it works for you.
An interesting article, especially given the lack of information out there on the subject. However, I don’t understand how this allows you to reverse-engineer your PIDs. If you don’t know what a specific PID is for and exactly what value it should be returning at the moment it’s interrogated (if you knew that, why would you need a scan tool??) then how can you make use of the information you get using TorqueScan? Do I just need a few maths lessons!?Thanks
The tough part of finding the ‘meaning’ of the PIDs you’re looking for is that these PIDs, as mentioned above in the article – are manufacturer-specific and references to them are not easily found. I can’t show any specifics here (it’s an invitation to get us in trouble) but you can certainly find references to them in service manuals or by sniffing the communications between the car and the diagnostic program (Techstream, HDS, VCDS), which is what I did.
Let’s say you are aware of an oil temperature sensor PID, but you do not know the address of it. Using the official diagnostic application confirms that such a PID exists (as you can monitor the values via the application). The next step, which gets very technical – is to sniff the communications between the car and your PC, isolate the values of that PID you want then work out a formula from there. You know for a fact that your oil temps would be at ambient when the car has cooled down, so you can easily derive a value from that the responses you’re getting.
vDiag.net has a lot of information regarding sniffing car communications, however it’s in Russian which really puts your Google Translate skills to the test but there’s a wealth of information there.
HI Colin Wong
May i know the perodua myvi OBD2 communication protocol
Thank you in advance..
Hi Colin Wong,
Do you know of any ELM327 OBD2 Diagnostic Tool that can work for the 1st generation MyVi and Viva?
Am I able to hack the PIDs in order to use the ELM327 tool?
Hi, Colin, i’m from Brazil and need a help. I need to know the OBD protocol of the 1998 Terios. Thanks in advance!
I’m not sure myself either, as cars manufactured in other countries have different regulations when it comes to diagnostics. You could try looking for a known protocol of another Daihatsu car sold within that period, and test that protocol on your Terios.
No idea, sorry. The 1st gen Myvi doesn’t work with generic OBD2 tools right out the bat because it needs a specific setting in place before the tool communicates with the ECU, like in the 2nd gen Myvi.
It’s using CAN for the engine and transmission, and older protocols for the other ECUs (ABS, immobilizer, etc).
Thanks, Colin. That’s what I was trying to do. I know that a version of Daihatsu Sirion was produced with same engine of Terios (1.3/16v), but i’m not sure if the protocol of both or some of them is ISO15765-4 CANBUS. But, thank you anyway.
I need to know all pids with their descriptions and formulas, which are toyota supported. Can you tell me any source for I learn that?
The PIDs are mostly specific so there’s no one-stop reference for the descriptions and formulas – no other choice than the option of manually reverse-engineering each PID from Techstream 🙁
First, thanks for answer. Then, I have a 2016 model Toyota Corolla. Can you tell me any thing for help me about that?
i have this code PID
how adding a custom pid
i have this code PID
COMMAND —— RESPONSE
22DD04 ——— 44
22DE01 ———– 410180076161
22DE09 ———- 490105
how adding a custom pid
Hi, Colin.Thanks for great info.
mode 21 is for onboard diagnostic, ok.
which mode will be for DTC and to erase DTC?
Do you have any study on its OBD2 communication protocol to the ECU Immobiliser wiring diagram/pinout