ELM320

OBD (PWM) to RS232 Interpreter

Description Features

Since the 1996 model year, North American • Low power CMOS design
automobiles have been required to provide an OBD,
• High current drive outputs
or On Board Diagnostics, port for the connection of
test equipment. Data is transferred serially between • Crystal controlled for accuracy
the vehicle and the external equipment using this
• Fully configurable using AT commands
connection, in a manner specified by the Society of
Automotive Engineers (SAE) standards. In addition • Standard ASCII character output
to operating at different voltage levels, these ports
• High speed RS232 communications
also use a data format that is not compatible with the
standard used for personal computers. • 41.6KHz J1850 PWM protocol
The ELM320 is an 8 pin integrated circuit that is
able to change the data rate and reformat the OBD
signals into easily recognized ASCII characters. This
allows virtually any personal computer to
communicate with an OBD equipped vehicle using Connection Diagram
only a standard serial port and a terminal program. PDIP and SOIC
By also enhancing it with an interface program, (top view)
hobbyists can create their own custom scan tool.
This integrated circuit was designed to provide a
cost-effective way for experimenters to work with an VDD 1 8 VSS
OBD system, so a few features such as RS232
XT1 2 7 OBDOut
handshaking, variable baud rates, etc., have not
been implemented. In addition, this device is only XT2 3 6 Tx
able to communicate using the 41.6KHz J1850 PWM
OBDIn 4 5 Rx
protocol that is commonly used in Ford Motor
Company vehicles.

Applications
• Diagnostic trouble code readers
• Automotive scan tools

3.58MHz
Block Diagram
2 3
XT1 XT2

Timing and
Control

Tx 6 4 OBDIn
RS232 OBD
Interpreter
Interface Interface
Rx 5 7 OBDOut

ELM320DSD Elm Electronics – Circuits for the Hobbyist 1 of 16

< http://www.elmelectronics.com/ >
 ELM320

Pin Descriptions
VDD (pin 1) Rx (pin 5)
This pin is the positive supply pin, and should The computer’s RS232 transmit signal can be
always be the most positive point in the circuit. directly connected to this pin from the RS232
Internal circuitry connected to this pin is used to line, as long as a current limiting resistor
provide power on reset of the microprocessor, so (typically about 47KΩ) is installed in series.
an external reset signal is not required. Refer to (Internal protection diodes will pass the input
the Electrical Characteristics section for further currents safely to the supply connections,
information. protecting the ELM320.) Internal signal inversion
and Schmitt trigger waveshaping provide the
XT1 (pin 2) and XT2 (pin 3) necessary signal conditioning.
A 3.579545 MHz NTSC television colourburst
crystal is connected between these two pins. Tx (pin 6)
Crystal loading capacitors (typically 27pF) will The RS232 data output pin. The signal level is
also normally be connected between each of the compatible with most interface ICs, and there is
pins and the circuit common (Vss). sufficient current drive to allow interfacing using
only a single PNP transistor, if desired.
OBDIn (pin 4)
OBDOut (pin 7)
The OBD data is input to this pin, with a high
logic level representing the active state (and a This is the active low output signal which is used
low, the passive). No Schmitt trigger input is to drive the OBD bus to the active state. Since
provided, so the OBD signal should be buffered the J1850 PWM standard requires a differential
to minimize transition times for the internal bus signal, the user must create the complement
CMOS circuitry. The external level shifting of this signal to drive the other bus line. See the
circuitry is usually sufficient to accomplish this – Example Application section for more details.
see the Example Application section for a typical
circuit. VSS (pin 8)
Circuit common is connected to this pin. This is
the most negative point in the circuit.

Ordering Information

These integrated circuits are available in either the 300 mil plastic DIP format, or in the 208 mil SOIC surface
mount type of package. To order, add the appropriate suffix to the part number:
300 mil Plastic DIP............................... ELM320P 208 mil SOIC..................................... ELM320SM

All rights reserved. Copyright 2001 to 2009 by Elm Electronics Inc.

Every effort is made to verify the accuracy of information provided in this document, but no representation or warranty can be
given and no liability assumed by Elm Electronics with respect to the accuracy and/or use of any products or information
described in this document. Elm Electronics will not be responsible for any patent infringements arising from the use of these
products or information, and does not authorize or warrant the use of any Elm Electronics product in life support devices and/or
systems. Elm Electronics reserves the right to make changes to the device(s) described in this document in order to improve
reliability, function, or design.

ELM320DSD Elm Electronics – Circuits for the Hobbyist 2 of 16

< http://www.elmelectronics.com/ >
 ELM320

Absolute Maximum Ratings

Storage Temperature....................... -65°C to +150°C Note:
Ambient Temperature with Stresses beyond those listed here will likely damage
Power Applied....................................-40°C to +85°C the device. These values are given as a design
guideline only. The ability to operate to these levels
Voltage on VDD with respect to VSS............ 0 to +7.5V is neither inferred nor recommended.
Voltage on any other pin with
respect to VSS........................... -0.6V to (VDD + 0.6V)

Electrical Characteristics
All values are for operation at 25°C and a 5V supply, unless otherwise noted. For further information, refer to note 1 below.

Characteristic Minimum Typical Maximum Units Conditions

Supply voltage, VDD 4.5 5.0 5.5 V

VDD rate of rise 0.05 V/ms see note 2

Average supply current, IDD 1.0 2.4 mA see note 3

Input low voltage VSS 0.15 VDD V

Input high voltage 0.85 VDD VDD V

Output low voltage 0.6 V Current (sink) = 8.7mA

Output high voltage VDD - 0.7 V Current (source) = 5.4mA

Rx pin input current -0.5 +0.5 mA see note 4

RS232 baud rate 9600 baud see note 5

Notes:
1. This integrated circuit is produced with a Microchip Technology Inc.’s PIC12C509A as the core embedded
microcontroller. For further device specifications, and possibly clarification of those given, please refer to the
appropriate Microchip documentation (available at http://www.microchip.com/).
2. This spec must be met in order to ensure that a correct power on reset occurs. It is quite easily achieved
using most common types of supplies, but may be violated if one uses a slowly varying supply voltage, as
may be obtained through direct connection to solar cells, or some charge pump circuits.
3. Device only. Does not include any load currents.
4. This specification represents the current flowing through the protection diodes when applying large voltages
to the Rx input (pin 5) through a current limiting resistance. Currents quoted are the maximum that should be
allowed to flow continuously.
5. Nominal data transfer rate when a 3.58 MHz crystal is used as the frequency reference. Data is transferred
to and from the ELM320 with 8 data bits, no parity, and 1 stop bit (8 N 1).

ELM320DSD Elm Electronics – Circuits for the Hobbyist 3 of 16

< http://www.elmelectronics.com/ >
 ELM320

Overview

The following describes how to use the ELM320 to features of this product as well.
obtain a great deal of information from your vehicle. To It is not as daunting as it first appears. Many users
many, the quantity of information will be overwhelming, will never need to issue an ‘AT’ command, adjust
and to others it is not nearly enough. timeouts or change the headers. For most, all that is
We begin by discussing just how to talk to the IC, required is a PC or a PDA with a terminal program
then how to adjust some options through the use of (such as HyperTerminal or ZTerm), and knowledge of
‘AT’ commands, and finally go on to actually talk to the one or two OBD commands, which we provide in the
vehicle, obtaining trouble codes and resetting them. following…
For the more advanced experimenters, there are also
sections on how to use some of the programmable

Communicating with the ELM320

The ELM320 relies on a standard RS232 type (hex ‘0D’) before it will be acted upon. The one
serial connection to communicate with the user. The exception is when an incomplete string is sent and no
data rate is fixed at 9600 baud, with 8 data bits, no carriage return appears. In this case, an internal timer
parity bit, 1 stop bit, and no handshaking (often will automatically abort the incomplete message after
referred to as 9600 8N1). All responses from the IC about 10 seconds, and the ELM320 will print a single
are terminated with a single carriage return character question mark to show that the input was not
and, by default, a line feed character as well. Make understood (and was ignored).
sure your software is configured properly for the mode Messages that are misunderstood by the ELM320
you have chosen. (syntax errors) will always be signalled by a single
Properly connected and powered, the ELM320 will question mark (‘?’). These include incomplete
initially display the message: messages, invalid hexadecimal digit strings, or
incorrect AT commands. It is not an indication of
ELM320 v2.0
whether or not the message was understood by the
> vehicle. (The ELM320 is a protocol interpreter that
makes no attempt to assess OBD messages for
In addition to identifying the version of the IC,
validity – it only ensures that an even number of hex
receipt of this string is a convenient way to be sure
digits were received, combined into bytes, and sent
that the computer connections and the settings are
out the OBD port, so it cannot determine if the
correct. However, at this point no communications
message sent to the vehicle is in error.)
have taken place with the vehicle, so the state of that
Incomplete or misunderstood messages can also
connection is still unknown.
occur if the controlling computer attempts to write to
The ‘>’ character displayed above is the ELM320’s
the ELM320 before it is ready to accept the next
prompt character. It indicates that the device is in its
command (as there are no handshaking signals to
idle state, ready to receive characters on the RS232
control the data flow). To avoid a data overrun, users
port. Characters sent from the computer can either be
should always wait for the prompt character (‘>’)
intended for the ELM320’s internal use, or for
before issuing the next command.
reformatting and passing on to the vehicle’s OBD bus.
Finally, a few convenience items to note. The
Commands for the ELM320 are distinguished from
ELM320 is not case-sensitive, so ‘ATZ’ is equivalent to
those to the vehicle by always beginning with the
‘atz’, and to ‘AtZ’. The device ignores space characters
characters ‘AT’ (as is common with modems), while
as well as control characters (tab, linefeed, etc.) in the
commands for the OBD bus must contain only the
input, so they can be inserted anywhere to improve
ASCII characters for hexadecimal digits (0 to 9 and A
readability and, finally, issuing only a single carriage
to F). This allows the ELM320 to quickly determine
return character will repeat the last command (making
where the received characters are to be directed.
it easier to request updates on dynamic data such as
Whether an ‘AT’ type internal command or a hex
engine rpm).
string for the OBD bus, all messages to the ELM320
must be terminated with a carriage return character

ELM320DSD Elm Electronics – Circuits for the Hobbyist 4 of 16

< http://www.elmelectronics.com/ >
 ELM320

AT Commands
Several parameters within the ELM320 can be ‘OK’ on the successful completion of a command, so
adjusted in order to modify its behaviour. These do not the user knows that it has been executed.
normally have to be changed before attempting to talk Some of the following commands allow passing
to the vehicle, but occasionally the user may wish to numbers as arguments in order to set the internal
customize the settings, for example by turning the values. These will always be hexadecimal numbers
character echo off, adjusting the timeout value, or which must be provided in pairs. The hexadecimal
changing the header addresses. In order to do this, conversion chart in the next section may prove useful
internal ‘AT’ commands must be issued. if you wish to interpret the values. Also, one should be
Those familiar with PC modems will immediately aware that for the on/off types of commands, the
recognize AT commands as a standard way in which second character is a number (1 or 0), the universal
modems are internally configured. The ELM320 uses terms for on and off, respectively.
essentially the same method, always watching the The following is a summary of all of the AT
data sent by the PC, looking for messages that begin commands that are recognized by the current version
with the character ‘A’ followed by the character ‘T’. If of the ELM320, sorted alphabetically. Users of
found, the next characters will be interpreted as previous versions of this product (v1.x) should note
internal configuration or ‘AT’ commands, and will be that their ICs will only support the E, H and Z options.
executed upon receipt of a terminating carriage return
character. The ELM320 will reply with the characters

AR [ Automatically set the Receive address ] E0 and E1 [ Echo off (0) or on(1) ]
Responses from the vehicle will be acknowledged These commands control whether or not characters
and displayed by the ELM320, if its internally stored received on the RS232 port are retransmitted (or
receive address matches the address that the echoed) back to the host computer. To reduce traffic
message is being sent to. With the auto receive on the RS232 bus, users may wish to turn echoing
mode in effect, the value used for the receive off by issuing ATE0. The default is E1 (echo on).
address will be chosen based on the current header
bytes, and will automatically be updated whenever
FD [ send Formatted Data ]
the header bytes are changed.
This command requests that all responses be
The value that is used for the receive address is
returned as standard ASCII characters which are
determined based on the contents of the first header
readable on virtually any standard terminal program.
byte. If it shows that the message uses physical
Hex digits are shown as two ASCII characters, and
addressing, the third header byte of the header is
spaces are provided between each byte as a
used for the receive address, otherwise (for
separator. Also, every line will end with a carriage
functional addressing) the second header byte,
return character and (optionally) a linefeed
increased in value by 1, will be used. Auto Receive
character, ensuring that every response appears on
is turned on by default.
a new line. This is the default mode.

D [ set all to Defaults ]

H0 and H1 [ Headers off (0) or on(1) ]
This command is used to set the E, H, L, and R
These commands control whether or not the header
options to their default (or factory) settings, as when
information is shown in the responses. All OBD
power is first applied. Additionally, the Auto Receive
messages have an initial (header) string of three
mode (AR) will be selected, data will be transmitted
bytes and a trailing check digit which are normally
in the standard formatted way (as if chosen by FD),
not displayed by the ELM320. To see this extra
the ‘NO DATA’ timeout will be set to its default value,
information, users can turn the headers on by
and the header bytes will be set to the proper values
issuing an ATH1. The default is H0 (headers off).
for the OBDII operation.

ELM320DSD Elm Electronics – Circuits for the Hobbyist 5 of 16

< http://www.elmelectronics.com/ >
 ELM320

AT Commands (continued)
I [ Identify yourself ] the MA and MR monitoring modes, any RS232
Issuing this command causes the chip to identify activity (single character) aborts the monitoring.
itself, by printing the startup product ID string (this is
currently ‘ELM320 v2.0’). Software can use this to PD [ send Packed Data ]
determine exactly which integrated circuit it is talking
This option is for those that are building a computer
to, without resorting to resetting the entire IC.
interface and want the fastest data transfer rate
possible while still operating at 9600 baud. When
L0 and L1 [ Linefeeds off (0) or on(1) ] selected, responses from the vehicle will be
Whether the ELM320 transmits a linefeed character formatted as an initial length byte followed by the
after each carriage return character is controlled by actual response bytes from the vehicle, with no
this option. If an ATL1 is issued, linefeed generation trailing carriage returns or linefeed characters. The
will be turned on, and for ATL0, it will be off. Users data will not be altered in any way, except for the
may wish to have this option on if using a terminal conversion to standard RS232 bytes.
program, but off if using a custom interface (as the Note that the length byte only represents the total
extra characters transmitted will only serve to slow number of data bytes following, and does not include
the vehicle polling down). The default setting is L1 itself. Also, if there was a data (checksum) error, the
(linefeeds on) length byte will have its most significant bit set, so
the user should always check first to see if the length
is greater than 127. (The other 7 bits still provide a
MA [ Monitor All messages ]
valid byte count if there is an error, so one need only
Using this command places the ELM320 into a bus ignore the msb, or subtract 128 from the value.)
monitoring mode, in which it displays all messages
A ‘NO DATA’ response has no data bytes, but still
as it sees them on the OBD bus. This continues
sends a length byte with value ‘0’.
indefinitely until stopped by activity on the RS232
input. To stop the monitoring, one should send any
single character then wait for the ELM320 to respond R0 and R1 [ Responses off (0) or on(1) ]
with a prompt character (‘>’). Waiting for the prompt These commands control the ELM320’s automatic
is necessary as the response time is unpredictable, display of responses. If responses have been turned
varying depending on the IC was doing when off, the IC will not wait for anything to be returned
interrupted. If for instance it is in the middle of from the vehicle after sending a request, and will
printing a line, it will first complete the line then return immediately to waiting for RS232 commands.
return to the command state, issuing the prompt This is useful if sending commands blindly when
character. If it were simply waiting for input, it would using the IC for a non-OBD network application, or
return immediately. The character which stops the simulating an ECU, in a basic learning environment.
monitoring will always be discarded, and will not It is not recommended that this option normally be
affect subsequent commands. used, however, as the vehicle may have difficulty if it
is expecting an acknowledgement byte and never
MR hh [ Monitor for Receiver hh ] receives one. The default is R1 (responses on).
This command also places the IC in a bus monitoring
mode, displaying only messages that were sent to SH xx yy zz [ Set the Header to xx yy zz ]
the hex address given by hh (i.e. messages which This command allows the user to control the values
are found to have that value in their second byte). that are sent as the three header bytes in the
Any RS232 activity (single character) aborts the message. The value of hex digits xx will be used for
monitoring, as with the MA command. the first or priority/type byte, yy will be used for the
second or target byte, and zz will be used for the
MT hh [ Monitor for Transmitter hh ] third or source byte. These remain in effect until set
again, or until restored to the default values with the
Another monitoring command, which displays only
AT D, or AT Z commands. The default header values
messages sent by Transmitter address hh. As with

ELM320DSD Elm Electronics – Circuits for the Hobbyist 6 of 16

< http://www.elmelectronics.com/ >
 ELM320

AT Commands (continued)
are 61 6A F1, as required by the SAE J1979
Diagnostic Test Modes (OBDII) standard.

SR hh [Set the Receive address to hh ]

Depending on the application, users may wish to
manually set the address to which the ELM320 will
respond. Issuing this command will turn off the AR
mode, and force the IC to only accept responses
addressed to hh. Use caution with this setting, as
depending on what you set it to, you may end up ELM320 AT Commands
accepting (acknowledging with an IFR) a message general
that was actually meant for another module. D set all to Defaults
I show the ID string
ST hh [ Set Timeout to hh ] Z reset all
After sending a request, the ELM320 waits a preset <CR> repeat last command
time before declaring that there was no response
responses
from the vehicle (the ‘NO DATA’ response).
Depending on the application (and priority of the E1/0 Echo on/off
request), users may want modify this timeout period H1/0 Headers on/off
before declaring the request a failure. The ST L1/0 Linefeeds on/off
command is used to do that. R1/0 Responses on/off
The actual time used is (approximately) 4 ms x the PD use Packed Data
byte value passed as the hexadecimal argument. FD use Formatted Data
Passing a value of FF thus results in a maximum ST hh Set Timeout (hh*4ms)
time of about 1020 ms. Values less than 08 will be
ignored and forced to a value of 8, providing a requests
minimum time of 32ms. The default value is 32 SH xx yy zz Set Header
(decimal 50) providing a timeout of 200 ms. SR hh Set Rx address
AR Auto Receive
Z [ reset all ] MA Monitor All
MR hh Monitor for Rxer hh
This command causes the chip to perform a
complete reset as if power were cycled off and then MT hh Monitor for Txer hh
on again. All settings are returned to their default
values, and the chip will be put in the idle state,
Figure 1. ELM320 AT Commands
waiting for characters on the RS232 bus.

AT Command Summary
Figure 1 (at the right) shows all of the ELM320
commands in one convenient chart. In order to help
with the understanding of these, we have grouped
the commands into three functional areas, but this
has no bearing on how the commands are to be
used, it is only for clarity. You may find this chart to
be useful when experimenting with the IC.

ELM320DSD Elm Electronics – Circuits for the Hobbyist 7 of 16

< http://www.elmelectronics.com/ >
 ELM320

OBD Commands

If the bytes received on the RS232 bus do not received, and when the third character (the carriage
begin with the letters A and T, they are assumed to be return) is received, begin to assess the other two. It
commands for the vehicle’s OBD bus. The bytes will would see that they are both valid hex digits, and
be tested to ensure that they are valid pairs of would convert them to a one byte value (with a
hexadecimal digits and, if they are, will be combined decimal value of 166). Three header bytes and a
into bytes for transmitting to the vehicle. Recall that no checksum byte would be added, so a total of five bytes
checks are made as to the validity of the OBD would be sent to the vehicle. Note that the carriage
command – data is simply retransmitted as received. return character is only a signal to the ELM320, and is
OBD commands are actually sent to the vehicle not sent on to the vehicle.
embedded in a data message. The standards require After sending a command, the ELM320 listens on
that every message begin with three header bytes and the OBD bus for any responses that are directed to it.
end with a checksum byte, which the ELM320 adds Each received byte is converted to the equivalent
automatically to every message. The ELM320 powers- hexadecimal pair of ASCII characters and transmitted
on expecting to be used for the OBDII mandated on the RS232 port for the user. Rather than send
emissions diagnostics, and sets the header bytes control characters which are unprintable on most
accordingly. If you wish to perform more advanced terminals, the digits are sent as numbers and letters
functions, these bytes may be changed through the (e.g. the hex digit ‘A’ is transmitted as decimal value
use of AT commands. To view the extra bytes that are 65, and not 10).
received with the vehicle’s messages, turn the header If there was no response from the vehicle, due to
display on by issuing an ATH1 command. no data being available, or because the command is
The command portion of most OBD messages is not supported, a ‘NO DATA’ message will be sent. See
usually only one or two bytes in length, but can the error messages section for a description of this
occasionally be longer as the standard allows for as message and others.
many as seven. The current version of the ELM320
will accept the maximum seven command bytes (or 14
hexadecimal digits) per message, while users of
previous versions (v1.x) were limited to only three Hexadecimal Decimal
command bytes. In either case, attempts to send more Number Equivalent
than the maximum number of bytes allowed will result
0 0
in a syntax error, with the entire command being
ignored and a single question mark printed. 1 1
The use of hexadecimal digits for all of the data 2 2
exchange was chosen as it is the most common data 3 3
format used in the relevant SAE standards. It is 4 4
consistent with mode request listings and is the most 5 5
frequently used format for displaying results. With a 6 6
little practice, it should not be very difficult to deal in
7 7
hex numbers, but some may initially find the table in
8 8
Figure 2 or a calculator to be invaluable. All users will
eventually be required to manipulate the results in 9 9
some way, though (combine bytes and divide by 4 to A 10
obtain rpm, divide by 2 to obtain degrees of advance, B 11
etc.), and may find a software front-end more helpful. C 12
As an example of sending a command to the D 13
vehicle, assume that A6 (or decimal 166) is the E 14
command that is required to be sent. In this case, the
F 15
user would type the letter A, then the number 6, then
would press the return key. These three characters
would be sent to the ELM320 on the RS232 bus. The Figure 2. Hex to Decimal Conversion
ELM320 would store the characters as they are

ELM320DSD Elm Electronics – Circuits for the Hobbyist 8 of 16

< http://www.elmelectronics.com/ >
 ELM320

Talking to the Vehicle

The ELM320 cannot be directly connected to a Although this information is not very useful for the
vehicle as it is, but needs support circuitry as shown in casual user, it does serve to show that you are
the Example Applications section. Once incorporated communicating with the vehicle.
into such a circuit, you only need to use a terminal Another example requests the current engine
program to send bytes to, and receive them from, the coolant temperature (ECT). This is PID 05 in mode 01,
vehicle. and is requested as follows:
SAE standards specify that command bytes sent >01 05
to the vehicle must adhere to a set format. The first
byte (known as the ‘mode’) always describes the type The response will be of the form:
of data being requested, while the second, third, etc. 41 05 7B
bytes specify the actual information required (given by
This shows a mode 1 response (41) from PID 05,
a ‘parameter identification’ or PID number). The
with value 7B. Converting the hexidecimal 7B to
modes and PIDs are described in detail in the SAE
decimal, one gets 7 x 16 + 11 = 123. This represents
standard documents J1979 and J2190, and may also
the current temperature in degrees Celsius, with the
be expanded on by the vehicle manufacturers.
zero value offset by 40 degrees to allow operation at
Normally, one is only concerned with the nine
subzero temperatures. To convert to the actual coolant
diagnostic test modes described in J1979 (although
temperature, simply subtract 40 from the value. In this
there is provision for more). Note that it is not a
case, then, the ECT is 123 - 40 = 83 degrees Celsius.
requirement for all of them to be supported. These are
the nine modes: A final example shows a request for the OBD
requirements to which this vehicle was designed. This
01 : show current data is PID 1C of mode 01, so at the prompt, type:
02 : show freeze frame data
03 : show diagnostic trouble codes >01 1C
04 : clear trouble codes and stored values A typical response would be:
05 : test results, oxygen sensors 41 1C 01
06 : test results, non-continuously monitored
07 : test results, continuously monitored The returned value (01) shows that this vehicle
08 : special control mode conforms to OBDII (California ARB) standards. The
09 : request vehicle information presently defined responses are :

Within each mode, PID 00 is normally reserved to 01 : OBDII (California ARB)

show which PIDs are supported by that mode. Mode 02 : OBD (Federal EPA)
01, PID 00 is required to be supported by all vehicles, 03 : OBD and OBDII
and can be accessed as follows… 04 : OBD I
05 : not intended to meet any OBD requirements
Ensure that the ELM320 is properly connected to 06 : EOBD (Europe)
your vehicle, and powered. Most vehicles will not Some modes may provide multi-line responses
respond without the ignition key in the ON position, so (09, if supported, can display the vehicle’s serial
turn the ignition on, but do not start the vehicle. At the number). The ELM320 will attempt to display all
prompt, issue the mode 01 PID 00 command: responses in these cases, but only if it is allowed
>01 00 sufficient time to process each. There may be
occasions when the vehicle responds too quickly to
A typical response could be as follows:
allow time for reprocessing, and lines could be lost.
41 00 BE 1F B8 10 Hopefully this has shown how typical requests
The 41 00 signifies a response (4) from a mode 1 proceed. It has not been meant to be a definitive
request with PID 00 (a mode 2, PID 00 request is source on modes and PIDs – this information can be
answered with a 42 00, etc.). The next four bytes (BE, obtained from the manufacturer of your vehicle, from
1F, B8, and 10) represent the requested data, in this the SAE (www.sae.org), ISO (www.iso.org), or from
case a bit pattern showing which of PIDs 1 through 32 various other sources on the web.
are supported by this mode (1=supported, 0=not).

ELM320DSD Elm Electronics – Circuits for the Hobbyist 9 of 16

< http://www.elmelectronics.com/ >
 ELM320

Interpreting Trouble Codes

Likely the most common use that the ELM320 will is only one trouble code here. The response has been
be put to is in obtaining the current Diagnostic Trouble padded with 00’s as is required by the standard, and
Codes or DTCs. Minimally, this requires that a mode the extra 0000’s do not represent actual trouble codes.
03 request be made, but first one should determine As was the case when requesting the number of
how many trouble codes are presently stored. This is stored codes, the most significant bits of each trouble
done with a mode 01 PID 01 request as follows: code also contain additional information. It is easiest to
use the following table to interpret the first digit of
>01 01
trouble codes as follows:
To which a typical response might be:
41 01 81 07 65 04 If the first hex digit received is this,
The 41 01 signifies a response to our request, and Replace it with these two characters
the first data byte (81) is the result that we are looking
for. Clearly there would not be 81(hex) or 129(decimal) 0 P0 Powertrain Codes - SAE defined
trouble codes if the vehicle is operational. In fact, this P1 “ “ - manufacturer defined
1
byte does double duty, with the most significant bit
being used to indicate that the malfunction indicator 2 P2 “ “ - SAE defined
lamp (MIL, or ‘Check Engine’) has been turned on by P3 “ “ - jointly defined
3
one of this module’s codes (if there are more than
one), while the other 7 bits provide the actual number 4 C0 Chassis Codes - SAE defined
of stored codes. To determine the number of stored C1 “ “ - manufacturer defined
5
codes, then, one needs to subtract 128 (or 80 hex)
from the number if it is greater than 128, and otherwise 6 C2 “ “ - manufacturer defined
simply read the number of stored codes directly. C3 “ “ - reserved for future
7
The above response then indicates that there is
one stored code, and it was the one that set the MIL or 8 B0 Body Codes - SAE defined
‘Check Engine’ lamp on. The remaining bytes in the B1 “ “ - manufacturer defined
9
response provide information on the types of tests
supported by that particular module (see SAE A B2 “ “ - manufacturer defined
document J1979 for further information). B3 “ “ - reserved for future
B
In this instance, there was only one line to the
response, but if there were codes stored in other C U0 Network Codes - SAE defined
modules, they each could have provided a line of U1 “ “ - manufacturer defined
D
response. To determine which module is reporting the
trouble code, one would have to turn the headers on E U2 “ “ - manufacturer defined
(ATH1) and then look at the third byte of the three byte U3 “ “ - reserved for future
F
header for the address of the module that sent the
information.
Taking the example trouble code (0133), the first
Having determined the number of codes stored,
digit (0) would then be replaced with P0, and the 0133
the next step is to request the actual trouble codes
reported would become P0133 (which is the code for
with a mode 03 request:
an ‘oxygen sensor circuit slow response’). As for
>03 further examples, if the response had been D016, the
A response to this could be: code would be interpreted as U1016, while 1131 would
be P1131.
43 01 33 00 00 00 00 Had there been codes stored by more than one
The ‘43’ in the above response simply indicates module, or more than three codes stored in the same
that this is a response to a mode 03 request. The other module, the above response would have consisted of
6 bytes in the response have to be read in pairs to multiple lines. To determine which module is reporting
show the trouble codes (the above would be each trouble would then require turning the headers on
interpreted as 0133, 0000, and 0000). Note that there with an ATH1 command.

ELM320DSD Elm Electronics – Circuits for the Hobbyist 10 of 16

< http://www.elmelectronics.com/ >
 ELM320

Resetting Trouble Codes

The ELM320 is quite capable of resetting the SAE specifies that scan tools must verify that a
diagnostic trouble codes, as this only requires issuing mode 04 is intended (“Are you sure?”) before actually
a mode 04 command. The consequences should sending it to the vehicle, as all trouble code
always be considered before sending it, however, as information is immediately lost when the mode is sent.
more than the MIL (or ‘Check Engine’ lamp) will be Recall, though, that the ELM320 does not monitor the
reset. In fact, issuing a mode 04 will: content of messages, so it will not know to ask for
- reset the number of trouble codes confirmation of the mode request - this would have to
be the duty of a software interface if one is written.
- erase any diagnostic trouble codes
As stated, to actually erase diagnostic trouble
- erase any stored freeze frame data codes, one need only issue a mode 04 command. A
- erase the DTC that initiated the freeze frame response of 44 from the vehicle indicates that the
- erase all oxygen sensor test data mode request has been carried out, the information
erased, and the MIL turned off. Some vehicles may
- erase mode 06 and 07 test results
require a special condition to occur (the ignition on but
Clearing of all of this information is not unique to the engine not running, etc.) before it will respond to a
the ELM320, as it occurs whenever a scan tool is used mode 04 command.
to reset your codes. Understand that the loss of this That is all there is to clearing the codes. Once
data could cause your car to run poorly for a short time again, be very careful not to inadvertently issue an 04!
while the system recalibrates itself.
To avoid inadvertently erasing stored information,

Error Messages
When hardware or data problems are <DATA ERROR
encountered, the ELM320 will respond with one of the The error check result (CRC byte) was not as
following short messages. Here is a brief description of expected, indicating a data error in the line pointed
each… to (the ELM320 still shows you what it received).
There could have been a noise burst which
BUS BUSY interfered, or a circuit problem. Try re-sending the
The ELM320 tried to send the mode command or request.
request for about 0.5 seconds without success.
Messages are all assigned priorities, which allows
NO DATA
one message to take precedence over another.
More important things may have been going on, so There was no response obtained from the vehicle
try re-issuing your request. before a timeout occurred. The mode requested may
not be supported, so the vehicle ignored you, or the
timeout value was too short, or possibly the ignition
BUS ERROR key needs to be turned to ‘on’. Try issuing a 01 00
An attempt was made to send a message, and the command to be sure that the vehicle is ready to
data bus voltage did not respond as expected. This receive commands, and if that works, try adjusting
could be because of a circuit short or open, so check the timeout to a longer value using the Set Timeout
all of your connections and try once more. AT command.

DATA ERROR ?
There was an incomplete message received, and it This is the standard response for a misunderstood
was not enough to form a meaningful response. This command received on the RS232 bus. Usually it is
may have been caused by the key being turned off, due to a typing mistake.
or a loose connection, for example. Any monitoring
that was in progress will have been aborted.

ELM320DSD Elm Electronics – Circuits for the Hobbyist 11 of 16

< http://www.elmelectronics.com/ >
 ELM320

Monitoring the Bus

Some vehicles use the OBD bus for information who is sending to whom, you will need to first turn
transfer during normal vehicle operation, passing a headers on (AT H1) before beginning to monitor (AT
great deal of information over it. A lot can be learned if MA). Either way, you may end up with an
you have the good fortune to connect to one of these overwhelming amount of information that you may
vehicles, and are able to decipher the contents of the want to filter, showing only specific messages.
messages. By the same token, you can do a lot of If, for example, you find that the engine controller’s
harm if you are careless, so be very careful. address seems to be 10, you may want to restrict the
To see how your vehicle uses the OBD bus, you data displayed to only messages from that ECU. To do
will have to enter one of the ELM320’s monitoring so, you would monitor only for messages transmitted
modes. The simplest is the “Monitor All” mode which is from address 10, by issuing AT MT 10 from your
entered into by simply sending the command AT MA terminal program. Only messages with 10 in the third
from your terminal program. Once received, the IC will byte of the header will be displayed. Similarly, you may
continually display any information it sees on the OBD wish to only see messages which are being sent to
bus, regardless of transmitter or receiver addresses. address 3B. To monitor for these, send AT MR 3B and
Monitoring modes can only be stopped by sending only messages with 3B as the second header byte will
something over the RS232 connection to the ELM320. be shown.
It is not critical what you send - any single character There are a few limitations to the current
will interrupt the processor, and return it to the monitoring modes that you should be aware of. First,
command mode waiting for an input. Note that the there is no internal buffering of OBD messages as
character you send is discarded and has no effect on data is being sent on the RS232 connection, so
any subsequent commands. The IC will always finish a information may be missed while the IC is busy. If
task in progress (printing a line, for example) before under computer control, you may want to consider the
returning to wait for input, so always wait for the ‘packed data’ mode to reduce the chance of this. The
prompt character (‘>’) before continuing to issue other second limitation is that the data being printed only
commands. extends up to the End Of Data symbol, and does not
If the headers are not currently displayed, simply include any In-Frame Response bytes that may be
typing ATMA shows only the contents of messages, present. However, for most users this will not be of
not the transmitter and receiver addresses. To show consequence.

Computer Control – Using Packed Data

If a person is simply asking a vehicle for the when in this mode – if the headers are to be displayed,
current Diagnostic Trouble Codes, speed is normally they are sent, if in monitoring mode, data is continually
not an issue, as data is displayed (essentially) as sent, etc. The only difference is in the format in which
quickly as it can be read. If interfaced to a computer, the OBD responses are returned to the controlling
however, speed may be important. computer.
The packed data mode is a convenient means to Often there is no response from the vehicle for a
effectively triple the ELM320’s data transfer rate while particular request. When in the default (formatted data)
maintaining the connection at 9600 baud. Once mode, this is shown with ‘NO DATA’ being printed, but
entered (with AT PD), all OBD messages will be while in the packed data mode you will only receive a
returned as a single length byte followed by the actual single length byte of value 0 (zero).
data bytes. There are no space characters sent While rare, errors may occasionally be detected in
between bytes, no carriage returns or linefeeds – the the vehicle’s data. Normally, a ‘<DATA ERROR’ would
data is retransmitted exactly as received from the be printed for this, but in the Packed Data mode, the
vehicle (except for the change to 9600 baud). While no checksum (CRC) errors are identified by setting the
longer readable on a terminal, computers will most significant bit of the length byte. Because of this,
understand the information just the same, and will gain one should always check the length byte for a value of
speed through both reduced transfer and conversion 128 or greater before processing the remainder of the
times. The ELM320 does not function any differently message.

ELM320DSD Elm Electronics – Circuits for the Hobbyist 12 of 16

< http://www.elmelectronics.com/ >
 ELM320

Advanced Data Retrieval – Setting the Headers

Prior to v2.0, the ELM320 used a fixed format for receive address selected stays in effect until changed
the message headers, allowing only for the retrieval of by another AT SR, or reinstatement of the automatic
the mandated diagnostic codes, not allowing the user mode.
to change them. The IC is now fully programmable, Having set the headers, all one needs to do is
however, allowing the headers to be changed and a issue the secondary ID for fluid temperature (10) at the
great deal more information to be obtained, if your prompt. If the display of headers is turned off, the
vehicle supports it. Note that only the OBDII diagnostic conversation could typically look like this:
codes have been mandated, so there is no
>10
requirement for all vehicles to support these extra
capabilities. 10 2E
The diagnostic trouble codes that most people are
The response to ID 10 is the byte 2E, in this case.
familiar with are described by SAE standard J1979
You may find that some requests, being of a low
(ISO15031-5). This is really a specific instance of the
priority, may not be answered immediately, possibly
many modes allowed by the J2178-4 standard, which
causing a ‘NO DATA’ result. In these cases, you may
allows for information transfer through what is known
want to adjust the timeout value, perhaps first trying
as ‘functional addressing’. For the OBDII mandated
the maximum (with AT ST FF).
diagnostics, requests are actually made to the
Using the physical addressing modes described
functional address 6A, with whatever processor is
by the J2190 standard involves an almost identical
responsible for this function answering the request.
process. The main difference is that you must know
Theoretically many different processors can respond
the physical address of the device which you want to
to a single functional request, each contributing their
speak to. This is always the third byte of a message
insight as to the information requested.
sent by any device, so can be determined by
To retrieve some of this extra information, the
monitoring the headers (for the above response, the
function being addressed needs to be known. For
sender’s address is 10). Knowing that you wish to talk
example, consider that you have studied the J2178
to address 10, that your physical address is F1, and
standards and want to request that the processor
that for type 1 IFR with physical addressing E4 may be
responsible for Engine Coolant provide the current
appropriate for the first byte, you would change the
Fluid Temperature. You determine that Engine Coolant
header bytes using AT SH E4 10 F1. If Auto Receive
is functional address 48, you know that your address
is enabled, the receive address will automatically be
as a scan tool is normally F1, and that since the
set to F1, your physical address (the ELM320 knows
ELM320 only supports single IFR responses (type 1),
to do this from the first byte). As before, this header
you choose A1 as the initial priority/type byte.
will remain in effect for every message sent until
Combining the above then, it is desirable to set the
changed to something else.
three header bytes to A1 48 F1. This is done with the
One caution to note with physical addressing.
Set Header command, which would be issued at the
There are modes which initiate the constant sending of
prompt as follows:
data, and if the ELM320’s timeout is set longer than
>AT SH A1 48 F1 the duration between responses, the ELM320 may
return messages forever. In these cases, just like in
The three header bytes assigned in this manner
the monitoring modes, a single character will have to
will stay in effect until changed with another AT SH
be sent to interrupt the process.
command, a reset, etc. If the default Auto Receive
Finally, please note that while we have provided
mode has been selected, the receive address will
some information on the SAE standards for the
automatically be set to 49 (the second byte plus one).
examples, Elm Electronics will only reply to requests
This is consistent with the functional pairs assigned by
for clarification on our product’s operation, and not on
J2178-4. If you decide that this is not appropriate for
the standards. It is the customer’s responsibility to
your case, you can always set the receive address to
obtain their own information on the relevant standards,
what you wish using the AT SR command. For
and on their vehicle. Requests to Elm Electronics for
example, if you wanted to obtain a response that is
this information will go unanswered.
being sent to address E2 instead, you would use AT
SR E2 to override the automatic receive mode. Any

ELM320DSD Elm Electronics – Circuits for the Hobbyist 13 of 16

< http://www.elmelectronics.com/ >
 ELM320

Quick Guide for Reading Trouble Codes

If you don’t use your ELM320 for some time, this
entire data sheet may seem like quite a bit to review if
your ‘Check Engine’ light does eventually come on.
The following provides a quick procedure which may
prove helpful in that case (note that the ‘>’ is the
ELM320’s prompt character):

Connect using HyperTerminal, ZTerm, etc.,

9600 8N1, and no handshaking

Ignition Key to ON, but vehicle not running

>ATZ
to be sure the IC is reset and responding

>0100
to be sure the car is responding

>0101
to see how many codes are present
(look at the second digit of the 3rd byte)

>03
to see the codes
Ignore the first byte and read the others in
pairs. The table on page 10 helps.

FIX THE VEHICLE!

>04
to reset the codes

ELM320DSD Elm Electronics – Circuits for the Hobbyist 14 of 16

< http://www.elmelectronics.com/ >
 ELM320

Example Application
The SAE J1962 standard dictates that all OBD negative supply. The RS232 pin connections shown
compliant vehicles must provide a standard connector are for a standard 9 pin connector. If you are using the
near the driver’s seat, the shape and pinout of which is older 25 pin style, please refer to the web site help
shown in Figure 3 below. The circuitry described here pages for the equivalent pins.
will be used to connect to this plug without modification RS232 data from the computer is directly
to your vehicle. connected to pin 5 of the ELM320 through a 47KΩ
The male J1962 connector required to mate with a current limiting resistor. This resistor allows for voltage
vehicle’s connector may be difficult to obtain in some swings in excess of the supply levels while preventing
locations, and you could be tempted to improvise by damage to the ELM320. A single 100KΩ resistor is
making your own connections to the back of your also shown in this circuit so that pin 5 is not left floating
vehicle’s connector. If doing so, we recommend that if the computer is disconnected.
you do nothing which would compromise the integrity Transmission of RS232 data is via the single PNP
of your vehicle’s OBD network. The use of any transistor connected to pin 6. This transistor allows the
connector which could easily short pins (such as an output voltage to swing between +5V and the negative
RJ11 type telephone connector) would definitely not voltage stored on the 0.1µF capacitor (which is
be recommended. charged by the computer’s TxD line). Although it is a
The circuit of Figure 4 on the next page shows simple connection, it is quite effective for this type of
how the ELM320 would typically be used. Circuit application.
power has been obtained from the vehicle (via OBD Finally, the crystal shown connected between pins
pins 16 and 5) and, after some minor filtering, is 2 and 3 is a common TV type that can be easily and
presented to a low power (100 mA) 5 volt regulator. inexpensively obtained. The 27pF crystal loading
The output of this regulator powers several points in capacitors shown are only typical, so you may have to
the circuit as well as an LED (for visual confirmation select other values depending on what is specified for
that power is present). the crystal you obtain.
The remaining two connections to the vehicle This completes the description of the circuit. While
(OBD pins 2 and 10) are for the differential data it is the minimum required to talk to an OBD equipped
system specified by the J1850 PWM standard. When vehicle (it relies on such techniques as using the
no data is being transmitted, both wires are idle with internal current limiting of the 78L05 for circuit
the transistor drivers off, and the resistive pullup and protection, for example), it is a fully functional circuit.
pulldown allow voltage levels to float to the supply As an experimenter, you may want to expand on it,
levels. Note that the PNP driver transistor and the providing more protection from faults and electrostatic
2.7KΩ pullup resistor both have series protection discharge, or providing a different interface for the
diodes to prevent backfeeds into the ELM320 circuitry. RS232 connection to the computer. Then perhaps a
The ELM320 has only one OBD data output line Basic program to make it easier to talk to the vehicle,
(pin 7). It is an active low signal, so must be used to and a method to log your findings, and…
drive the open-collector ‘Bus +’ signal via the PNP
transistor as shown. By using a portion of this same
signal to drive the NPN transistor for the ‘Bus -’ signal,
one obtains open collector differential drive.
Data is received from the OBD bus, then 1 8
converted and level-shifted by the NPN/PNP transistor
9 16
pair that are shown connected to pin 4 of the ELM320.
The NPN transistor detects the differential data signal
while allowing for the presence of common mode
voltages, and the PNP transistor provides the 0 to 5 Figure 3. Vehicle Connector
volt levels required by OBDIn (pin 4).
A very basic RS232 interface is shown connected
to pins 5 and 6 of the ELM320. This circuit ‘steals’
power from the host computer in order to provide a full
swing of the RS232 voltages without the need for a

ELM320DSD Elm Electronics – Circuits for the Hobbyist 15 of 16

< http://www.elmelectronics.com/ >
 ELM320

OBD
Interface

Notes: - NPN transistors are

16 78L05 +5V 2N3904 or similar
(Battery ‘Power On’
Positive) 750Ω - PNP transistors are
0.47µF LED
2N3906 or similar
5
(Signal - Diodes are 1N4148,
Ground) 1N4001, etc.
+5V

4.7KΩ

2
(Bus +)
4.7KΩ
10
(Bus -)
+5V
RS232
10KΩ Interface
(DB9F)
+5V

+5V 2 (RxD)
0.01µF 10KΩ
4.7KΩ

2.7KΩ 2.7KΩ 0.1µF

1 8
27pF 5 (SG)
3.58MHz
2 7

3 6

27pF 4 5 3 (TxD)
+5V
47KΩ
100KΩ
+5V
10KΩ
1 (DCD)

4.7KΩ 4 (DTR)

6 (DSR)

4.7KΩ 7 (RTS)

8 (CTS)

Figure 4. Typical OBD to RS232 Interface

ELM320DSD Elm Electronics – Circuits for the Hobbyist 16 of 16

< http://www.elmelectronics.com/ >