Prepared by Alison Chaiken and offered under
OBDLink MX Protocol Commands set by STN1110 chip, supports all CAN standards
Link to user's manuals for some Bosch commercial scan-tools (H/T Alan Maldonado)
ELM327 Protocols for OBDII (doesn't support general CAN), p.23
0 - Automatic 1 - SAE J1850 PWM (41.6 kbaud) 2 - SAE J1850 VPW (10.4 kbaud) 3 - ISO 9141-2 (5 baud init, 10.4 kbaud) 4 - ISO 14230-4 KWP (5 baud init, 10.4 kbaud) 5 - ISO 14230-4 KWP (fast init, 10.4 kbaud) 6 - ISO 15765-4 CAN (11 bit ID, 500 kbaud) 7 - ISO 15765-4 CAN (29 bit ID, 500 kbaud) 8 - ISO 15765-4 CAN (11 bit ID, 250 kbaud) 9 - ISO 15765-4 CAN (29 bit ID, 250 kbaud) A - SAE J1939 CAN (29 bit ID, 250* kbaud) B - USER1 CAN (11* bit ID, 125* kbaud) C - USER2 CAN (11* bit ID, 50* kbaud)
Wikipedia Controller Area Network article
There are several CAN physical layer standards: ISO 11898-1: CAN Data Link Layer and Physical Signalling ISO 11898-2: CAN High-Speed Medium Access Unit ISO 11898-3: CAN Low-Speed, Fault-Tolerant, Medium-Dependent Interface ISO 11898-4: CAN Time-Triggered Communication ISO 11898-5: CAN High-Speed Medium Access Unit with Low-Power Mode ISO 11898-6: CAN High-speed medium access unit with selective wake-up functionality ISO 11992-1: CAN fault-tolerant for truck/trailer communication ISO 11783-2: 250 kbit/s, Agricultural Standard SAE J1939-11: 250 kbit/s, Shielded Twisted Pair (STP) SAE J1939-15: 250 kbit/s, Unshielded Twisted Pair (UTP) (reduced layer) SAE J2411: Single-wire CAN (SWC)
Scantool.net's OBDLink MX, which is based on the STN1110 interface chip, not the well-known ELM327 they used in earlier products.
Screenshot of a Windows 7 VM running on VMWare on top of Ubuntu that is reflashing the OBDLink MX's firmware (click for larger version). In order to connect, I had to click on the tiny blue Bluetooth hardware device icons circled on the lower right corner, which caused Windows to query whether I wanted to install Bluetooth drivers. Before the drivers were installed, Windows showed the icons with red X's through them. There appeared to be no other way to install the drivers, not through the "network center" or "wireless device" control panel settings. Once the drivers were installed, the larger and familiar Bluetooth connectivity icon appeared to the upper left of the Bluetooth hardware icons.
For initial tests, I used a Debian or Ubuntu laptop with the minicom program to capture output from the Bluetooth-paired OBDLink MX scantool, which Linux offers as /dev/rfcomm0, a regular soft tty. (On Ubuntu 10.10, bluetooth-agent failed to handle random password, while blueman-assistant worked on the first try.) nOBDy's genericbod2 provider plugin will log data from the OBDLink MX with no problem, but, at the moment, the underlying libobd communication library only supports the OBDII (15765-4) protocol. The OBDLink MX is a bit expensive compared to many scantools, but most don't populate pins 3 and 11 or read MS-CAN communications (see below).
Identification of pins on Mazda 3's Data Link Connector
Sample Log file from Mazda 3 raw CAN monitoring session
Compare HS-CAN and MS-CAN data from madox.net. A quick comparison shows that a lot of the same IDs appear in my MS-CAN (protocol 51) data stream (201, 265, 401, 433) and HS-CAN (protocol 31) data stream (200, 20F, 231, 433, 4B0) although it's not obvious that the behavior matches that of madox's 2006 Mazda 3. For example, in my vehicle, 20F PID appears to be a monotonically increasing counter in least-signicant byte, while madox identifies bytes 2 and 3 as speed. Pinning down an interpretation of many of the parameters is clearly possible but will require investment of some time.
080-11 DRIVE MODE[LF, L3] - Using the OBD-II drive mode, the monitoring item requested by OBD-II regulations can be easily diagnosed. - Performing the Drive Mode inspects the OBD-II system for proper operation and must be performed to ensure that no additional DTCs are present. - The OBD-II drive mode is divided into the specific drive mode and single drive mode. - For the specific drive mode, specified drive modes have been set for each individual monitoring item requested by OBD-II regulations, and they can be diagnosed individually. For the single drive mode, the entire monitoring item requested by OBD-II regulations can be diagnosed. - The following modes are in the specific drive mode. The applicable system is diagnosed by driVing in the following drive modes. PCM (Powertrain Control Module): Adaptive Memory Produce Drive Mode EGR (Exhaust Gas Recirculation): System Repair Verification Drive Mode H02S heater, H02S, and TWC Repair: Verification Drive Mode EVAP System Repair: Verification Drive Mode - The following systems are diagnosed with the single drive mode. EGR system Oxygen sensor (H02S) Oxygen sensor heater Catalytic converter (TWC) Fuel, misfire and evaporative (EVAP) system PCM Adaptive Memory Production Drive Mode 1. Start the engine and warm it up completely. 2. Verify the following conditions and correct if necessary: - All accessory loads (AlC, headlights, blower fan, rear window defroster) are off. 3. Perform no load racing at the engine speed shown in the graph, then idle the engine for more than 60 s after the cooling fan has stopped. If possible, monitor RPM PID for engine speed during this procedure.
p. 63-71, shop manual, 9-page table including and associated fault conditions.
DIAGNOSTIC MONITORING TEST RESULTS[LF, L3] The purpose of this test mode is to confirm the result of OBD-II monitor diagnostic test results. The result values stored when particular monitor is completed are displayed. If the monitor is not completed, initial value is displayed.
p. 2128:
ON-BOARD DIAGNOSTIC [ELECTRO HYDRAULIC POWER ASSIST STEERING (EHPAS)] B1238 EHPAS control module B1317 Battery power supply B1318 Battery power supply B1342 EHPAS control module B1352 Ignition power supply B2477 EHPAS control module configuration C1099 Electric power steering oil pump (motor) C1278 Steering angle sensor U0073 CAN bus communication error U0100 Lost communication with the PCM U2023 EHPAS control module B1317 DTC Fault received from other modules
p. 2129
PID Name (Definition) MTR_AMP(Pump Motor Operation Current) RPM_ACT (Actual pump motor revolution per minutes) RPM_TGT (Target pump motor revolution per minutes) ENGRPM (Engine speed signal) STEER_RATE (Steering wheel rotation rate) TEMP_BOARD (Printed circuit board temperature) VPWR (Module supply voltage) VSS (Vehicle speed)