enginerd4ni
Member
4th gen and beyond trucks have a wealth of CAN data at your fingertips. There are many tools available to access the data. I have been messing around with OBD PIDs for a few years now yet still get overwhelmed with the amount of forum posts and rumors on the internets. Here is my attempt at consolidating the info that is useful to me. YMMV, hope it helps someone!
On Board Diagnostics
I'll narrow this discussion to the 4Runner/Toyota. OBD is a way to allow regulatory entities, service technicians, DIYers to examine the health of your vehicle to determine if it is working properly and not generating worse than normal emissions. Fortunately, this standardization allows us to communicate with pretty much any car now sold in the US regardless of make or model. There is a standard set of codes used yet not all vehicles respond to all codes. There is also a means of allowing vehicle/manufacturer specific codes. But before we get into that, let's review the basics.
Controller Area Network
CAN (Controller Area Network) is an automotive bus connecting various electronic control modules on your vehicle. CAN frames are like packets of information that can tell who it is from, where it is going, what it wants, and what it offers. On 4th gen and beyond, OBD commands are sent across the CAN bus using frames. I'm not sure what capabilities exist for 3rd gen but OBD-II is supposed to be supported on all US vehicles since 1996 I think. Not sure if Toyota implemented OBD-II using the CAN bus though. For more info, check out: CAN bus - Wikipedia
CAN frames look like this:
It is likely that whatever transceiver you are using to speak CAN will take care of the overhead stuff like start bits, check sums, etc. So for what we want to do with OBD PIDs, we'll just look at the parts of the CAN frame that contain the payload.
Here is a good background of the standard set of codes, what they are, and how they are sent/received on the CAN bus. OBD-II PIDs - Wikipedia
Sending OBD over CAN frames
For the standard set of codes, it is pretty easy to query the data under command mode 01. The ECU will respond if it has the data you are seeking for a particular PID. For example, if I want to ask for the coolant temperature, I would look on the standard PID chart and submit command mode 01h + PID code 05h. (h means the number is in hexadecimal notation)
Before you send and receive a code, however, you have to know what address to send it to and what address to listen for a response. For pretty much all things I've done with my cars, I transmit on 7DF and receive on 7E8. This 3 character hex number translates to the 11 bit CAN ID header, by the way. There are other control modules with different addresses (7E0 is also used) but that is for another time.
Example 1 Coolant
So sending a CAN frame to query the coolant temp looks like this:
7DF 01 05
A response will look like this:
7E8 41 05 64
The first byte is the address you listened to for the response (7E8)
The next byte contains the command code (01h) + 40h = 41h and the PID (05). Note that the response will always add 40h to the command code.
The rest of the bytes are the payload of the frame (the data, the good stuff). In this case, 64 (hex) converts to 100 decimal and the formula for this PID is A-40 with units of degrees Celcius. A is simply saying the first data byte. In our example, there is only one data byte.
Example 2 RPM
If we wanted to query the Engine RPM:
7DF 01 0C
7E8 41 0C XX YY
where XX is the "A" byte and YY is the "B" byte and the formula is:
((A*256)+B)/4 with units of rpm.
In case it isn't clear, formulas and units for command code 01 PIDs are found in the chart on wikipedia.
Example 3 Transmission Temps
Now for the bonus round!
If you want to query the automatic transmission temperatures for a 2005 to 2009, you have to use a Toyota proprietary command code and PID and happen to know the formula. The good news is that this specific PID/forumula combo is available. However, there are very few custom Toyota PIDs and formulas available to the public without paying huge bucks and signing non-disclosure agreements.:yell:
Back to the ATF example. Let's query with:
7DF 21 D9
7E8 61 D9 00 00 00 00 62 20 61 80
Dissecting this looks like:
(7DF) transmit ID (21) Toyota custom command mode (D9) ATF Temp PID code
(7E8) listen ID (61) 21h+40h (D9) ATP Temp PID (00) A byte (00) B byte (00) C byte (00) D byte (62) E byte (20) F byte (61) G byte (80) H byte
And the formula is:
Trans Pan Temp (deg F)= ((((E*256)+F)*(7/100)-400)/10)
Torque Conv Outlet Temp (deg F) = ((((G*256)+H)*(7/100)-400)/10)
The response of the first and third example look like:
How to access your data
Now that I'm done with the 3 point sermon, I'll start talking about application.
There are many different products on the market that will communicate with the CAN bus through the OBD port underneath the steering wheel just above the parking brake. The most common on this forum it seems are:
Torque- an Android app that allows you to view the data on your smart phone or tablet when paired with a bluetooth transceiver.
The Taco forum has some good stuff on getting Torque up and running.
Basically, you are inputting the same transmit/listen ID, command code, PID, and applying the forumulas. This is by far the least expensive option if you already have an Android device. There are also other versions available for Android and iPhone.
ScanGauge- a wired display box that enables OBD functionality paired with a trip computer.
The programming of Scangauge is a bit more complicated but you get a handy display box to mount above your mirror or wherever. Also, the Scangauge site lists the relevant known custom codes here. To convert between Scangauge and Torque/Regular PID, use this writeup.
I personally use other hardware and software because I happen to work for a company that makes it and sells it to pretty much all of the big auto makers. I have spare parts lying around from old test units and access to the software for free but most DIYers probably won't be able to afford actually paying for our stuff. I wish I had access to the proprietary SEED keys to unlock the controllers (mess with timing, unlock doors, etc) but alas I will have to settle for OBD commands for now. Here is an example of some custom gauges I made for my Corvette Z06:
And then adding GPS and 3 axis accelerometer to the mix:
And finally, I would like to compile a list of custom codes that work with our 4Runners. Post or PM me if you have another code and formula and I'll add it here.
2005 to 2009 Transmission (A750E/F) Temperatures
Command Code: 21
PID: D9
Formula: Trans Pan Temp (deg F)= ((((E*256)+F)*(7/100)-400)/10)
Torque Conv Outlet Temp (deg F) = ((((G*256)+H)*(7/100)-400)/10)
2010 to + Transmission Temperatures
Command Code: 21
PID: 82
Formula: Trans Pan Temp (deg F)= ((((A*256)+B)*(7/100)-400)/10)
Torque Conv Outlet Temp (deg F) = ((((C*256)+D)*(7/100)-400)/10)
On Board Diagnostics
I'll narrow this discussion to the 4Runner/Toyota. OBD is a way to allow regulatory entities, service technicians, DIYers to examine the health of your vehicle to determine if it is working properly and not generating worse than normal emissions. Fortunately, this standardization allows us to communicate with pretty much any car now sold in the US regardless of make or model. There is a standard set of codes used yet not all vehicles respond to all codes. There is also a means of allowing vehicle/manufacturer specific codes. But before we get into that, let's review the basics.
Controller Area Network
CAN (Controller Area Network) is an automotive bus connecting various electronic control modules on your vehicle. CAN frames are like packets of information that can tell who it is from, where it is going, what it wants, and what it offers. On 4th gen and beyond, OBD commands are sent across the CAN bus using frames. I'm not sure what capabilities exist for 3rd gen but OBD-II is supposed to be supported on all US vehicles since 1996 I think. Not sure if Toyota implemented OBD-II using the CAN bus though. For more info, check out: CAN bus - Wikipedia
CAN frames look like this:
It is likely that whatever transceiver you are using to speak CAN will take care of the overhead stuff like start bits, check sums, etc. So for what we want to do with OBD PIDs, we'll just look at the parts of the CAN frame that contain the payload.
Here is a good background of the standard set of codes, what they are, and how they are sent/received on the CAN bus. OBD-II PIDs - Wikipedia
Sending OBD over CAN frames
For the standard set of codes, it is pretty easy to query the data under command mode 01. The ECU will respond if it has the data you are seeking for a particular PID. For example, if I want to ask for the coolant temperature, I would look on the standard PID chart and submit command mode 01h + PID code 05h. (h means the number is in hexadecimal notation)
Before you send and receive a code, however, you have to know what address to send it to and what address to listen for a response. For pretty much all things I've done with my cars, I transmit on 7DF and receive on 7E8. This 3 character hex number translates to the 11 bit CAN ID header, by the way. There are other control modules with different addresses (7E0 is also used) but that is for another time.
Example 1 Coolant
So sending a CAN frame to query the coolant temp looks like this:
7DF 01 05
A response will look like this:
7E8 41 05 64
The first byte is the address you listened to for the response (7E8)
The next byte contains the command code (01h) + 40h = 41h and the PID (05). Note that the response will always add 40h to the command code.
The rest of the bytes are the payload of the frame (the data, the good stuff). In this case, 64 (hex) converts to 100 decimal and the formula for this PID is A-40 with units of degrees Celcius. A is simply saying the first data byte. In our example, there is only one data byte.
Example 2 RPM
If we wanted to query the Engine RPM:
7DF 01 0C
7E8 41 0C XX YY
where XX is the "A" byte and YY is the "B" byte and the formula is:
((A*256)+B)/4 with units of rpm.
In case it isn't clear, formulas and units for command code 01 PIDs are found in the chart on wikipedia.
Example 3 Transmission Temps
Now for the bonus round!
If you want to query the automatic transmission temperatures for a 2005 to 2009, you have to use a Toyota proprietary command code and PID and happen to know the formula. The good news is that this specific PID/forumula combo is available. However, there are very few custom Toyota PIDs and formulas available to the public without paying huge bucks and signing non-disclosure agreements.:yell:
Back to the ATF example. Let's query with:
7DF 21 D9
7E8 61 D9 00 00 00 00 62 20 61 80
Dissecting this looks like:
(7DF) transmit ID (21) Toyota custom command mode (D9) ATF Temp PID code
(7E8) listen ID (61) 21h+40h (D9) ATP Temp PID (00) A byte (00) B byte (00) C byte (00) D byte (62) E byte (20) F byte (61) G byte (80) H byte
And the formula is:
Trans Pan Temp (deg F)= ((((E*256)+F)*(7/100)-400)/10)
Torque Conv Outlet Temp (deg F) = ((((G*256)+H)*(7/100)-400)/10)
The response of the first and third example look like:
How to access your data
Now that I'm done with the 3 point sermon, I'll start talking about application.
There are many different products on the market that will communicate with the CAN bus through the OBD port underneath the steering wheel just above the parking brake. The most common on this forum it seems are:
Torque- an Android app that allows you to view the data on your smart phone or tablet when paired with a bluetooth transceiver.
The Taco forum has some good stuff on getting Torque up and running.
Basically, you are inputting the same transmit/listen ID, command code, PID, and applying the forumulas. This is by far the least expensive option if you already have an Android device. There are also other versions available for Android and iPhone.
ScanGauge- a wired display box that enables OBD functionality paired with a trip computer.
The programming of Scangauge is a bit more complicated but you get a handy display box to mount above your mirror or wherever. Also, the Scangauge site lists the relevant known custom codes here. To convert between Scangauge and Torque/Regular PID, use this writeup.
I personally use other hardware and software because I happen to work for a company that makes it and sells it to pretty much all of the big auto makers. I have spare parts lying around from old test units and access to the software for free but most DIYers probably won't be able to afford actually paying for our stuff. I wish I had access to the proprietary SEED keys to unlock the controllers (mess with timing, unlock doors, etc) but alas I will have to settle for OBD commands for now. Here is an example of some custom gauges I made for my Corvette Z06:
And then adding GPS and 3 axis accelerometer to the mix:
And finally, I would like to compile a list of custom codes that work with our 4Runners. Post or PM me if you have another code and formula and I'll add it here.
2005 to 2009 Transmission (A750E/F) Temperatures
Command Code: 21
PID: D9
Formula: Trans Pan Temp (deg F)= ((((E*256)+F)*(7/100)-400)/10)
Torque Conv Outlet Temp (deg F) = ((((G*256)+H)*(7/100)-400)/10)
2010 to + Transmission Temperatures
Command Code: 21
PID: 82
Formula: Trans Pan Temp (deg F)= ((((A*256)+B)*(7/100)-400)/10)
Torque Conv Outlet Temp (deg F) = ((((C*256)+D)*(7/100)-400)/10)
