UM-0086-A2
CANgate User’s Manual
Page 31
mode byte and the PID.
RQST 1 010C FORMAT .25; RP
In this case
ECUaddr
is not specified, so the message will be broadcast using CAN ID 0x7DF. The reply will be expected to
have a CAN identifier in the range 0x7E8-0x7EF. In this case 4 bytes will be returned: mode byte, PID and a 16-bit data value
(MSB first). CANgate knows the format of a mode 0x01 request, and will discard the first two bytes of the response and
return all remaining bytes as the data value. (This behaviour can be overridden if
startByte
and
endByte
parameters are
specified.) The data value will then by multiplied by 0.25 and returned in the default format (floating point, 2 decimal places,
CRLF).
The above is equivalent to the following, which specifies every parameter explicitly:
RQST 1 010C 3 0 256 0 FORMAT UM .25 0 "%f\n"; RP
That is:
CAN port 1
2-byte request message: 0x01, 0x0C
data field of interest starts at byte 3 and continues to the end of the reply message (0)
broadcast request to all ECUs (
ECUaddr
= 256)
sampleRate
= 0, ie. only when polled
raw data format is unsigned, Motorola byte order (MSB first)
scaling factor is 0.25, offset Is 0
output format is floating point, 2 decimal places, then CRLF.
Reading Fault Codes
OBD-II
For an OBD-II compliant vehicle, stored fault codes can be read out using a Mode 03 request, as noted in the Appendix,
.
It is useful to first determine how many fault codes are stored, which can be done by sending a Mode 01 query for PID 01, eg:
RQST 1 0101; RP
81066060
The most significant 8 bits (
81
) of the 32-bit result contains the most pertinent information. In this case b31 is set, which
indicates that the Malfunction Indicator Light (MIL) is currently on, and the next 7 bits indicate the number of fault codes,
which in this case is 1.
The request for the actual codes can now be sent:
RQST 1 03; RP
013300000000
Fault codes are returned in 6-byte packets, each of which contains three 16-bit fault codes. In this case, there is only one
fault code,
0133
so the remainder of the packet is padded with zeroes.
Referring again to the Appendix, this number 0133 decodes as fault code P0133. If you then look up this code in a list of
OBD-II DTCs you find that it means "Oxygen Sensor Circuit Slow Response (Bank 1 Sensor 1)"
J1939
A J1939 ECU will normally periodically broadcast any active fault codes using a DM1 message (PGN 65226). These
messages can be received using:
RECVJ 1 65226
The returned data consists of a 2-byte lamp status indicator, then one or more 4-byte fault code packets. Each packet
consists of:
the Suspect Parameter Number, which specifies what has failed
the Failure Mode Indicator, which specifies what is wrong with the indicated parameter (eg. over voltage)
the occurrence count, which is the number of times the fault has occurred
For more details, see SAE J1939/71
For example, the following slot definitions will return all data in hex format, then decode the MIL status plus the first two fault
code packets:
BEGIN
1 RECVJ 1 65226
2 RECVJ 1 65226 1.8 1.7 FORMAT "MIL: %x\n"
3 RECVJ 1 65226 3 4 FORMAT 8 "SPN: %d "
4 RECVJ 1 65226 5.8 5.6 FORMAT "FMI: %x "
5 RECVJ 1 65226 6.7 6.1 FORMAT "Count: %x\n"
6 RECVJ 1 65226 7 8 FORMAT 8 "SPN: %d "
