Toyota GR Yaris Forum banner

Reverse engineering PIDs

3 reading
73K views 149 replies 36 participants last post by  Helmut Eder  
#1 · (Edited)
Thanks to https://gr-yaris.co.uk/forum/threads/oil-pressure-and-other-info-over-obd.4379/ we now know that selecting Toyota Camry 2020 in OBDLink Android app gives us access to additional sensors.

It is relatively easy to snoop Bluetooth traffic on Android devices from bugreports or even live. So I selected a couple of sensors in OBDLink on continuous monitoring and looked into the BT traffic using Wireshark. Here is a little snippet from the quite verbose conversation:

Capture.PNG


These are ELM327 microcontroler, that runs inside OBDLink, AT protocol commands. Interesting ones here are:
* ATSH 0007D0 - sets OBD header for all subsequent OBD commands
* 2162 - queries OBD Mode 21 PID 62 and gets 7D8 05 61 62 03 00 00 0 as a response

First three hex digits in the response (7D8) is the ID of the ECU that has sent the response. Next three bytes (05 61 62) I am not sure what they are. And next three bytes (03 00 00) is the actual data that could be interesting.

So here is the short list of OBD Headers, Modes and PIDs that I was able to figure out from the first initial look and from subsequent help of other forum members below:

SensorCategoryModePIDHeaderFormulaDiag Command
This item indicates that the parking brake is "ON/OFF"Navigation System21627D0BIT(A:1)
Accelerator PositionEngine221059700(A-41) / 1.42
Engine Oil PressureEngine221074700(((A*256)+B) * 10) / 128
M/T Oil TemperatureEngine221638700A + B/256 - 40
+B VoltageCombination Meter2210217C0A/10
Fuel InputCombination Meter2210227C0???
Sub FuelCombination Meter2210237C0???
Fuel Pressure (High)Engine221F6D700???
Fuel Pressure (Low) / Fuel Pressure 2Engine221F6D700???
Intake Manifold Absolute PressureEngine221F87700???
Low Fuel Pressure SensorEngine2210CD700???
ExDID_1BE1Engine221BE1700???
ExDID_15F7Engine2215F7700???
ExDID_1F07Engine221F07700???
Tire ID 1 PressureTPM221005750B * 0.01373atcea2A
atta2A
Tire ID 2 PressureTPM221005750D * 0.01373atcea2A
atta2A
Tire ID 3 PressureTPM221005750F * 0.01373atcea2A
atta2A
Tire ID 4 PressureTPM221005750H * 0.01373atcea2A
atta2A
Tire ID 1 TemperatureTPM221004750A - 40atcea2A
atta2A
Tire ID 2 TemperatureTPM221004750B - 40atcea2A
atta2A
Tire ID 3 TemperatureTPM221004750C - 40atcea2A
atta2A
Tire ID 4 TemperatureTPM221004750D - 40atcea2A
atta2A
Tire ID 1 PositionTPM222021750LOOKUP(A::1=FL:2=FR:3=RL:4=RR)atcea2A
atta2A
Tire ID 2 PositionTPM222021750LOOKUP(B::1=FL:2=FR:3=RL:4=RR)atcea2A
atta2A
Tire ID 3 PositionTPM222021750LOOKUP(C::1=FL:2=FR:3=RL:4=RR)atcea2A
atta2A
Tire ID 4 PositionTPM222021750LOOKUP(D::1=FL:2=FR:3=RL:4=RR)atcea2A
atta2A
Steering Angle2210047B3((SIGNED(A)*256)+B)*1.5
Master Cylinder Sensor TemperatureBrake2210067B0A-80
Temperature Sensor Value in CouplingFour Wheel Drive2210267B1(A*256+B)/128
??? formulas are the tricky part

So this is not much yet, but at least I hope this is enough information for anyone of you to join into this reverse engineering party. :)

CSV file that can be imported into Torque app for the custom PIDs can be found here: https://github.com/2m/gry/blob/main/exportedPIDs.csv
 
#36 ·
Had a small €10 touch screen laying around, hooked it up to my DIY CAN board and will take it down to the car tomorrow and check that the calculation looks right (y)

Image


Printed a small housing for it. Didn't like the code library to write stuff on the screen very much but that's probably my fault not finding the smarter ways of using it yet. It supports different fonts and so on which, as you can see, I didn't get to ?

Image
 
#38 ·
On my BMW I hooked up to the CAN bus that the cluster is on and yes, tons of stuff being broadcast there. I was looking at the Toyota tech site materials trying to find a good place in the car to connect to some of the CAN buses. But plugging in the OBD2 connector is easy and will do for starters :) (y)
 
#44 · (Edited)
I think, it's time to revive this thread with some input :).

Did some experimentation today and found a formula which works for my GRY and the % of pressing the accelerator pedal. Well, this information might not be essential for driving, but it's fun to see how steady your right foot can be ;):

OBD2 Mode and PID: 221059
Long name: Accelerator Pedal
Short name: Accel Ped
Minimum value: 0
Maximum value: 100
Scale factor: x1
Unit type: %
Equation: (A-41)/1.42
OBD header: 700

After PID setup (equation should read just A) go into your car, start Torque and switch on ignition. Don't touch the accel pedal, just read out the value (in my case 41). Now edit the PID settings and correct the zero point in equation (for me it was A-41). After restaring Torque the accel pedal reading should be zero.
Now fully press the accel pedal, the reading should change to 100%. If not just adapt the multiplicator (in my case the equation now is (A-41)/1.42 ) until you reach 100%. Now you got a new working pedal indicator.

Bye for now Fred

PART 2

Today I looked after oil pressure. My attempt is to try any formula given to me, verify the output and if needed adjust the results, verify again (and so on). In case of the oil pressure it was easy, only two iterations to get it working.

NOTE: The results of any measurement are not absolute, they are valid if you compare and they are "close to reality". There are numerous factors who interfere with a good result (e.g. a calibrated sensor will cost beyond €500.-). So we have to be lucky to get results within 2% wrong readings. But I think that's good enough.

OBD2 Mode and PID: 221074
Long name: Oil Pressure
Short name: Oil-P
Minimum value: 0
Maximum value: 10
Scale factor: x1
Unit type: bar
Equation: ((A*256)+B)/1280
OBD header: 700

The results might not be accurate, because we use the same sensor as the ECU. Well, from my experience the values are valid and can be used to trigger a warning within Torque when going lower than 0.6 bar (idle with warmed up oil is around 0.9 to 1 bar).

PART 3

OBD2 Mode and PID: 221638
Long name: M/T Oil Temp
Short name: Trans-Oil
Minimum value: 0
Maximum value: 100
Scale factor: x1
Unit type: °C
Equation: A + B/256 - 40
OBD header: 700

Because I don't know where this sensor is located I can't verify the output data. At least the measured temperature after standing a night in the cold is similar to the temperature measured with my home weather station. After a smooth 30km run the displayed temperature was at 55°C (which also sounds valid).

Bye for now Fred

PS: @dvim please feel free to use any of my findings in your opening message, I'm just "a volunteer" :)
 
#45 ·
PART 4

OBD2 Mode and PID: 221021
Long name: B+ Battery
Short name: B+
Minimum value: 0
Maximum value: 20
Scale factor: x1
Unit type: V
Equation: A/10
OBD header: 7C0

Ignition on should read ~12.2 V, engine running ~14.2 V for a healthy GR :)

Bye for now Fred
 
#49 ·
It's quite tricky to get PIDs working just from the results you have as a start :). Knowing what it should be is a good start. In case of ExDID_1F07 I think it's just ignition retard, but I'm far away from sure...

If anybody has an idea how to read the fuel level in tank I'm interested (after hitting 48.6 liter = 12.8 gal when refueling...). It gives some reassurance knowing the remaining fuel level.

Bye for now Fred
 
#51 ·
Well, numerous reasons are possible. To name but a few: Program settings, OBD2-adapter not capable enough, data corrupted, ...

In my experience it's mostly the adapter. Proved are Carista, OBDlink (SX, MX) and some no-name adapters I can't remember. Go with the recommendation in Torque and it should work.

Bye for now Fred
 
#52 ·
I think, it's time to revive this thread with some input :).

Did some experimentation today and found a formula which works for my GRY and the % of pressing the accelerator pedal. Well, this information might not be essential for driving, but it's fun to see how steady your right foot can be ;):

OBD2 Mode and PID: 221059
Long name: Accelerator Pedal
Short name: Accel Ped
Minimum value: 0
Maximum value: 100
Scale factor: x1
Unit type: %
Equation: (A-41)/1.42
OBD header: 700

After PID setup (equation should read just A) go into your car, start Torque and switch on ignition. Don't touch the accel pedal, just read out the value (in my case 41). Now edit the PID settings and correct the zero point in equation (for me it was A-41). After restaring Torque the accel pedal reading should be zero.
Now fully press the accel pedal, the reading should change to 100%. If not just adapt the multiplicator (in my case the equation now is (A-41)/1.42 ) until you reach 100%. Now you got a new working pedal indicator.

Bye for now Fred

PART 2

Today I looked after oil pressure. My attempt is to try any formula given to me, verify the output and if needed adjust the results, verify again (and so on). In case of the oil pressure it was easy, only two iterations to get it working.

NOTE: The results of any measurement are not absolute, they are valid if you compare and they are "close to reality". There are numerous factors who interfere with a good result (e.g. a calibrated sensor will cost beyond €500.-). So we have to be lucky to get results within 2% wrong readings. But I think that's good enough.

OBD2 Mode and PID: 221074
Long name: Oil Pressure
Short name: Oil-P
Minimum value: 0
Maximum value: 10
Scale factor: x1
Unit type: bar
Equation: ((A*256)+B)/1280
OBD header: 700

The results might not be accurate, because we use the same sensor as the ECU. Well, from my experience the values are valid and can be used to trigger a warning within Torque when going lower than 0.6 bar (idle with warmed up oil is around 0.9 to 1 bar).

PART 3

OBD2 Mode and PID: 221638
Long name: M/T Oil Temp
Short name: Trans-Oil
Minimum value: 0
Maximum value: 100
Scale factor: x1
Unit type: °C
Equation: A + B/256 - 40
OBD header: 700

Because I don't know where this sensor is located I can't verify the output data. At least the measured temperature after standing a night in the cold is similar to the temperature measured with my home weather station. After a smooth 30km run the displayed temperature was at 55°C (which also sounds valid).

Bye for now Fred

PS: @dvim please feel free to use any of my findings in your opening message, I'm just "a volunteer" :)
Excellent! I can now get oil pressure on my my screen via OBD2AA but the odd thing is it displaying psi not bar even though that's what I have entered in Torque Pro!
 
#57 ·
OBD2 Mode and PID: 221074
Long name: Oil Pressure
Short name: Oil-P
Minimum value: 0
Maximum value: 10
Scale factor: x1
Unit type: bar
Equation: ((A*256)+B)/1280
OBD header: 700

The results might not be accurate, because we use the same sensor as the ECU. Well, from my experience the values are valid and can be used to trigger a warning within Torque when going lower than 0.6 bar (idle with warmed up oil is around 0.9 to 1 bar).
Thank you! You're a damn wizard! ?
 
#68 ·
Eddy, should be possible, if...
...you got a valid PID
...the ECU "understands" this PID
...you get the formula to extract the correct information for each sensor
...you know which OBD header has to be used
then it should be possible. Do you got a PID to test?

Bye for now Fred
 
#70 ·
Same thing.

Worked fine in the morning but no life at the evening.. Didn't even update the phone. Tried to install older version of AA (6.9x and 6.8x) and it first shows OBD2AA in the list, but if you close AA and reopen it, AA is gone again. Also same thing happened for Fermata. HUGE bummer.

Going to use Torque from the phone screen for now.