Fine, I'll bite.

I finally got around to buying a cheap ELM clone device, and Torque Pro on an android device. It "works" for the most part. What I mean is that the standard OBDII stuff can be accessed, then graphed, etc.

As reported in this thread, Torque reports that it is connected using ISO9141, the older serial protocol. As we all know, the big boys (ECM, TCM) are actually on the CAN bus. Somehow, in my mind, I would like to get this all done through CAN. After a bit of reading, the Torque "Vehicle Profile" can be edited, and a specific protocol can be chosen (instead of Auto). None of the override CAN protocols seem to make Torque happy, it all comes back to ISO9141 after some time. Is OBDII only available under ISO9141 for this car? I would think it would be available under CAN as well...

Speaking of CAN, there are several variants. Is Protocol 6 (11bit, 500kbaud) the actual implementation for a 2003 XK8?

I suppose what I mean is that the transmission temperature PID is most likely available only on CAN, so unless we somehow switch the ELM327 to read off of the CAN bus, we might never see this message.

PS: For anyone interested in some of the details behind digital diagnostic tools as they relate to cars, the ELM327 Data Sheet makes for a GREAT read.

 

It is indeed a great read.

I used the serial (USB comport) version of the elm327 which made it easy to send (AT etc) commands direct to the elm327. The BT (or wifi) ones should be the same except for the BT/wifi part.

There will be a way to talk direct (over BT/wifi) to the elm but I don't know if Torque (whether Pro or not) lets you.

I don't know that you NEED to do it but it may help debug things and figure out what to get Torque to do.

Android is basically Linux + some things - some others. A BT device like the BT elm327 may well look like a com port (in PC terminology) (i.e. a tty in Linux terminology). Which is what the USB elm327 looks like.

So we probably can if needs be figure out how to talk direct. You'd need the equivalent of what Linux often calls a "terminal emulator" (think back to the ancient days of video terminals like VT100 / VT52). On Linux, things like minicom, screen, putty, aterm, moserial, picocom (there are yet more).

The snag... I have a 2004 S-Type R. It has the ZF 6HP26 and I expect TOT (trans oil temp) is a different PID etc.

I can talk to PCM (jag say ECM) either on ISO9141 ("Serial Data Link" in the Electrical Guide's "Vehicle Multiplex Systems") or on CAN.

Your CAN might not be the same as mine but if it is then yes it's 500K 11-bit.

BTW because I can talk direct I could use a bus snoop mode - lots of data and a bit painful to figure

It's probably worth asking Cambo to look up a few things. TOT (trans oil temp) PID for your and my car (to see if they differ). If he can, the CAN addr (address) for the TCM.

As I recall from some years ago my TCM is at 7E9 (PCM is 7E8 so replies on 7EC).

I'm guessing this is the one for your car http://www.jagrepair.com/images/Auto.../jagxk2003.pdf
have I got the right one?

(Mine's a 2004 car built mostly in 2003 so any S-Type 2002.5MY-on is about right. I've never seen my TCM as it's inside the trans case.)

 

Turns out that part is easy. There are a number of Bluetooth terminal emulators available on the Android market. I have managed to connect to the ELM and send a few commands (ATI, ATDP, etc.).

At this point, I need a more thorough reading of the ELM data sheet to try and figure out a few specifics. I believe setting the ELM to CAN 11bit 500k is easy ("ATSP6"), then I need to go and do a filtered data dump of whatever is going on on the CAN bus. This would confirm the actual CAN variant. Obviously, I would need some form of filtering, and the ELM can be told what to do here. Hopefully, the specifics you sent can get me started.

Unfortunately, all this research needs to take place in the car, engine running. Like I need another time sink in my life. Fascinating stuff, really.

 

Aha, if you can send AT etc then great.

Yes ATSP6.

Then such as ATSH7E8 may be your PCM. If it is, then
0101 (without any AT)
should get you a response I think (aka mode 1, pid 1).
(I'll say mode as nearly everyone does, though SID is arguably right.)

Use ATH1 if you want to see a bit more of the replies.

Oh, I should say that nothing you can easily send should upset the car. You won't be reflashing modules or any such.

If 0101 doesn't work then try ATSH with some other addresses (hmm, guess maybe 7E0 or 7E1?) and each time try the 0101. It's OK to try non-existent addresses.

Instead of 0101 try mode 22 pids such as sending
220200
(which is the number of DTCs, if it supports that pid for mode 22)

Various modules may support that. E.g. my ABS (ATSH7EB) but on some Fords the ABS is 760 (ATSH760).

On my PCM I can get lots of mode 22 replies. (E.g. 220005 is ECT.)

I never messed with the TCM as it wasn't my interest at the time.

In case your TOT is as Cambo found, you'd need
2211BD
(or 2211bd, case is ignored)
sent to the TCM.

It _could_ be that the PCM also responds to that, I don't know.

 

Don't mean to let this die, but I am having a hard time establishing a footing, so to speak.

OBD2 is definitely available on the ISO9141 bus. We knew that, but it is nice to confirm:

"ATTP3", "ATH1", "0105" returns the coolant temp.

For CAN, there is a great write-up here: jaguar_xk8_powertrain_serial.pdf

I guess I need to poke around some more, and find a signal in this noise..."