Diagbox telemetry

[darkjojo78]

Hi,
I had the opportunity to reverse engineer the official Diagbox telemetry protocol that is used on my 208 GTi BPS.
Using any OBD2 scantool based on the ELM327 ic, now I can read any of the data in realtime, as does the official Diagbox (e.g. measured MAF and requested MAF, measured MAP and requested MAP, oil pressure, turbo wastegate opening ratio, etc…)
If anyone is interested, I can share some info about that…

You can share info. thank you

Envoyé de mon SM-G930F en utilisant Tapatalk

[mfc]

The car ECU use the CAN bus ISO 15765-4 (11 bit ID, 500 kbit/s) to communicate.
(all the numerical data, if not specified, are in hexadecimal format)
For example, this is the raw data packet to request the engine RPM:
6A8 4 03 22 D4 00
6A8 is the ECU address
4 (byte) is the length of the message
03 22 D4 00 is the command to request the instantaneous RPM value

And the reply by the ECU is:
688 6 05 62 D4 00 05 13
688 is the ECU address modified to tell you that this is a reply from the ECU
6 (byte) is the length of the message
05 62 D4 00 is the command modified to tell you that this is the reply to the RPM command request
05 13 is the RPM value
If we convert 0513 from hexadecimal to decimal, the result is 1299 RPM

If you want to try this procedure, you need to use a terminal emulator software (I personally use TeraTerm)
From the terminal, connect to the OBD2 scantool and type the following commands:
AT Z (to reset the ELM327)
AT H1 (to enable the header visualization)
AT D1 (to enable the visualization of the data length)
AT CAF0 (to disable automatic formatting of the reply)
AT SH 6A8 (to select the ECU address)
03 22 D4 00 (to request the RPM)
And your ECU will reply with: 688 6 05 62 D4 00 xx yy
where xxyy is a 2 byte hexadecimal number with the RPM value