ELM327 is a text-based exchange protocol built on AT commands, originally developed for the OBD interpreter of the same name from ELM Electronics. Thanks to its simplicity, it has become the de facto standard for OBD-II diagnostics and is supported by the vast majority of diagnostic applications and libraries.
The ScanDoc adapter implements ELM327 v2.3 with an extended command set that includes support for DoIP (Diagnostics over IP) for Ethernet diagnostics of modern vehicles.
Data is exchanged over a serial interface (WLAN, BLE or USB). Commands are sent as ASCII text and terminated by a carriage return character (CR, 0x0D). The adapter replies with the result, followed by the prompt character
>.
There are two types of commands:
AT prefix).BMW vehicles use CAN extended addressing, in which the first data byte of the CAN frame contains the address of the target ECU. Below is a real diagnostic session example.
// --- Adapter initialization --- >ATZ // Full adapter reset ELM327 v2.3 >ATE0 // Turn echo off OK >ATS0 // Turn spaces off in responses OK >ATH1 // Turn headers on in responses OK >ATL0 // Turn linefeeds off OK >ATAL // Allow long messages (>7 bytes) OK >ATAT0 // Turn adaptive timing off OK >ATSTff // Maximum timeout (FF × 4 ms ≈ 1 s) OK // --- CAN protocol setup for BMW --- >ATPBC101 // Protocol B: C1 = 11-bit ID + ISO 15765, 01 = 500 kbaud OK >ATSPB // Select protocol B (USER1 CAN) OK >ATBI // Bypass initialization (BMW does not use the standard OBD init) OK >ATSH6F1 // CAN ID for sending = 0x6F1 (BMW tester address) OK // --- Flow Control and extended addressing --- >ATFCSH6F1 // Flow Control header = 0x6F1 OK >ATFCSD4030FF32 // FC data: 40=ECU address, 30=CTS, FF=no limit, 32=50 ms OK >ATFCSM1 // FC mode = 1 (fully user-defined) OK >ATCRA640 // Accept responses with CAN ID = 0x640 OK >ATCEA40 // CAN extended address = 0x40 (ECU address) OK // --- Request to the ECU at address 0x40 — no response --- >1A80 // Service 0x1A (Read ECU Identification), parameter 0x80 NO DATA >22F150 // UDS: service 0x22 (ReadDataByIdentifier), DID=F150 NO DATA // --- Switching to the ECU at address 0x10 --- >ATFCSD1030FF32 // FC data: ECU address = 0x10 OK >ATFCSM1 // FC mode = 1 OK >ATCRA610 // Accept responses with CAN ID = 0x610 OK >ATCEA10 // CAN extended address = 0x10 OK // --- Successful response --- >22F150 // UDS: ReadDataByIdentifier, DID=F150 610F10662F1500F25F0 // 610=CAN ID, F1=tester, 06=length, 62=response, F150=DID, 0F25F0=data
| Command | Description |
|---|---|
AT <CR> |
repeat the last command Sending a single carriage return character causes the ELM327 to repeat the last command that was executed. This is typically used when you want to receive value updates at the highest possible rate — for example, you can send 01 0C to obtain the engine RPM and then send only a carriage return character each time you want an update. |
AT AL |
Allow Long messages The standard OBDII protocols limit the number of data bytes in a message to seven, which the ELM327 normally does as well (for both sending and receiving). If AL is selected, the ELM327 will allow long sends (eight data bytes) and receives (an unlimited number). By default, AL is off (and NL is selected). To send 8-byte CAN messages the ELM327 does not require AL to be changed, but you should be aware that if you provide 8 CAN data bytes with CAN extended addressing or normal ISO 15765 formatting enabled, then data bytes may be lost. This is because a CAN message can only carry 8 data bytes, so if an extended address or a PCI byte must be added, fewer data bytes can be sent. |
AT AMC |
display Activity Monitor Count The Activity Monitor uses a counter to determine how active the ELM327's OBD inputs are. Each time activity is detected, this counter is reset, and if there is no activity, the counter increments (every 0.655 seconds). This counter represents the time elapsed since activity was last detected and can be useful when writing your own logic based on OBD activity. The counter will not increment past FF (internal logic stops it there) and stays at 00 during monitoring. |
AT AMT hh |
set the Act Mon Timeout to hh The ELM327 is able to enter a reduced power ("sleep") mode if no OBD activity is detected over a certain period of time. This period is adjusted either with bit 4 of PP 0F or with the AMT hh value. If the AMT hh value is non-zero, the time before the alert is triggered will be (hh+1) × 0.65536 seconds. If the value is set to 00, then all of the Activity Monitor's low power outputs are blocked (see Figure 6 on page 68). For more information about the Activity Monitor, see the "Power Control" section. |
AT AT0, AT1 and AT2 |
Adaptive Timing control When receiving a response from the vehicle, the ELM327 has traditionally waited for the reply for the time set by the AT ST hh parameter. To ensure that the chip works with a wide range of vehicles, the default value was set conservatively (slow). Despite the ability to fine-tune it, many people did not have the equipment or experience to determine the best value. The Adaptive Timing feature automatically sets the timeout value according to your vehicle's actual response time. As conditions change, such as bus loading and so on, the algorithm learns and makes the appropriate adjustment. Note that it always uses your AT ST hh value as the maximum and will never choose a longer one. There are three Adaptive Timing settings available for use. By default, Adaptive Timing option 1 (AT1) is enabled, and this is the recommended setting. AT0 is used to turn off Adaptive Timing (so the timeout is always the time set by AT ST), and AT2 is a more aggressive version of AT1 (the effect is more noticeable for very slow connections — you may not notice much difference with faster OBD systems). The J1939 protocol does not support Adaptive Timing — it uses fixed timeouts set by the standard. |
AT BD |
perform an OBD Buffer Dump All messages sent and received by the ELM327 are temporarily stored in a set of twelve memory locations called the OBD Buffer. Sometimes it is useful to view the contents of this buffer, perhaps to find the cause of a failed initiation, to see the header bytes of the last message, or simply to learn the structure of OBD messages. At any time you can ask to "dump" the contents of this buffer (that is, print it) — when you do this, the ELM327 will send a length byte (representing the length of the message in the buffer) followed by the contents of all twelve OBD Buffer locations. For example, here is one "dump": >AT BD 05 C1 33 F1 3E 23 C4 00 00 10 F8 00 00 The 05 is the length byte — it tells us that only the first 5 bytes are valid (that is, C1 33 F1 3E and 23). The remaining bytes are most likely left over from a previous operation. The length byte always represents the actual number of bytes received, whether or not they fit in the OBD Buffer. This can be useful when viewing long data streams (using AT AL), as it represents the actual number of bytes received, mod 256. Note that only the first twelve bytes received are stored in the buffer. |
AT BI |
Bypass the Initialization sequence This command should be used with caution. It allows you to make the OBD protocol active without the need for initialization or handshaking. The initialization process is normally used to verify the validity of the protocol, and without it the results may be difficult to predict. It should not be used for everyday OBD work and was provided only for creating ECU simulators and training demonstrators. |
AT BRD hh |
try Baud Rate Divisor hh This command is used to change the RS232 baud rate divisor to the hexadecimal value specified in hh, under computer control. It is not intended for casual experimentation — if you want to change the baud rate from a terminal program, you should use PP 0C. Because some interface circuits cannot operate at high baud rates, the BRD command uses a send-and-receive sequence to test the interface, with any failure resulting in a return to the previous baud rate. This allows several baud rates to be tested and a reliable one selected for communication. The whole process is described in detail in the "Using Higher RS232 Baud Rates" section on page 53. On success, the actual baud rate (in kbps) will be 4000 divided by the divisor (hh). A value of 00 is not valid and is not accepted by the BRD command. |
AT BRT hh |
set the Baud Rate Timeout to hh This command lets you change the timeout used for baud rate handshaking (that is, AT BRD). The time delay is hh × 5.0 ms, where hh is a hexadecimal value. The default for this setting is 0F, providing 75 ms. Note that a value of 00 does not give 0 ms — it provides the maximum time of 256 × 5.0 ms, or 1.28 seconds. |
AT D |
set all to Defaults This command is used to set the parameters to their default (or factory) values, as at the first power-up. The last saved protocol will be retrieved from memory and become the current setting (possibly closing other active protocols). Any user-made settings for custom headers, filters or masks will be restored to their default values, and all timer settings will also be restored to their defaults. |
AT D0 and D1 |
display of the DLC off or on The CAN (ISO 15765-4) OBD standard requires that all messages consist of 8 data bytes, so displaying the data length count (DLC) is normally not very useful. However, when experimenting with other protocols it may be useful to be able to see the data length. The D0 and D1 commands control the display of the DLC digit (to see this digit, headers must be on). When displayed, a single DLC digit appears between the ID (header) bytes and the data bytes. The default setting is determined by PP 29. |
AT DM1 |
monitor for DM1s The SAE J1939 protocol periodically transmits fault codes as Diagnostic Mode 1 (DM1) messages. This command sets the ELM327 to continuously monitor for this type of message, following the multi-segment transport protocols if necessary. Note that a combination of masks and filters can be used to obtain a similar result, but they will not allow multi-line messages to be detected. The DM1 command adds the extra logic needed for multi-line messages. This command is only available if a CAN protocol (A, B or C) has been selected for J1939 formatting. Attempting to execute it under any other conditions returns an error. |
AT DP |
Describe the current Protocol The ELM327 automatically detects the vehicle's OBD protocol but normally does not report it. The DP command is a convenient way to find out which protocol the chip is currently set to (even if it is not yet connected to a vehicle). If a protocol is selected and the automatic option is also selected, AT DP will show the word 'AUTO' before the protocol description. Note that the description gives the real protocol names, not the numbers used by the protocol setup commands. |
AT DPN |
"Describe the Protocol by Number" This command is similar to the DP command, but returns a number representing the current protocol. If the automatic search function is also enabled, the number will be preceded by the letter 'A'. This is the same number used in the "Set Protocol" and "Test Protocol" commands. |
AT E0 and E1 |
"Echo" off or on These commands control whether characters received through the RS232 port are echoed (repeated) back to the host computer. Echoing characters can be used to confirm that the characters sent to the ELM327 were received correctly. The default setting is E1 (or echo on). |
AT FE |
Forget Events There are certain events that can change how the ELM327 responds from that point on. One of them is the occurrence of a fatal CAN error (ERR94), which blocks subsequent searching of CAN protocols if bit 5 of PP 2A is '1'. Normally such an event affects all searches until the next power off and on, but it can be "forgotten" programmatically with the AT FE command. Another example is the 'LV RESET' event, which prevents searching of CAN protocols if bit 4 of PP 2A is '1'. This event can also be forgotten with the AT FE command. |
AT H0 and H1 |
"Headers" off or on These commands control whether or not to display the additional (header) bytes of information in the responses from the vehicle. They are normally not shown by the ELM327 but may be of interest (especially if you have received several responses and want to determine which modules they came from). Turning headers on (with AT H1) actually shows more than just the header bytes — you will see the complete transmitted message, including the check digits and PCI bytes, and possibly the CAN data length code (DLC) if it was enabled with PP 29 or AT D1. The current version of this chip does not display the CAN CRC code, nor the special J1850 IFR bytes (which some protocols use to confirm receipt of a message). |
AT I |
Identify yourself This command causes the chip to identify itself by printing the product identification string (currently 'ELM327 v2.3'). Software can use it to determine exactly which integrated circuit it is talking to, without needing to reset the chip. |
AT IA |
Is the protocol Active? This command lets you find out whether the ELM327 considers the current protocol to be active or not. In response to the query it will reply Y or N, that is "Yes" or "No". For the ELM327 to respond to certain commands, an "active" protocol is required. A protocol is considered active if it has received correct responses to a standard request or byte handshake, or if the user has bypassed this process with the AT BI command. Note that the ELM327 initially marks the protocol as active but does not track it afterwards, and so does not know whether the ECU has stopped responding to requests at some point in the future (that is, whether the protocol is no longer active). Your software may need to periodically send a standard request (preferably 01 00) to determine whether the ECU is in fact still active. |
AT IB10 |
set the ISO Baud rate to 10400 This command restores the ISO 9141-2 and ISO 14230-4 baud rate (protocols 3, 4 and 5) to the default value of 10400. Note that the IB10 command can be used at any time (that is, "on the fly"). |
AT IB12 |
set the ISO Baud rate to 12500 This command is used to change the baud rate used for the ISO 9141-2 and ISO 14230-4 protocols (numbers 3, 4 and 5) to 12500 baud. Note that the IB12 command can be used at any time (that is, "on the fly"). |
AT IB15 |
set the ISO Baud rate to 15625 baud This command is used to change the baud rate used for the ISO 9141-2 and ISO 14230-4 protocols (numbers 3, 4 and 5) to 15625 baud. Note that the IB15 command can be used at any time (that is, "on the fly"). |
AT IB48 |
set the ISO Baud rate to 4800 baud This command is used to change the baud rate used for the ISO 9141-2 and ISO 14230-4 protocols (numbers 3, 4 and 5) to 4800 baud. Note that the IB48 command can be used at any time (that is, "on the fly"). |
AT IB96 |
set the ISO Baud rate to 9600 baud This command is used to change the baud rate used for the ISO 9141-2 and ISO 14230-4 protocols (numbers 3, 4 and 5) to 9600 baud. Note that the IB96 command can be used at any time (that is, "on the fly"). |
AT IFR0, IFR1 and IFR2 |
IFR control - not while monitoring The SAE J1850 protocol allows an In-Frame Response (IFR) byte to be sent after each message, usually to confirm that the message was received correctly. The ELM327 automatically generates and sends this byte for you, unless you are monitoring (by default the ELM327 always stays silent while monitoring). You can override this behavior with the IFR command. The IFR0 command disables the sending of all IFRs, regardless of what a message requires. The IFR2 command does the opposite — an IFR byte will always be sent in response to a message, even if it contains errors. The IFR1 setting causes an IFR to be sent if the message was received correctly and if the value of the 'K' bit in the first header byte (for both PWM and VPW) permits it. The default is the IFR1 setting. |
AT IFR4, IFR5 and IFR6 |
IFR control - at any time Although the original ELM327 chips never sent IFRs while monitoring, there are some monitoring situations in which you may want to send an IFR. The IFR4, IFR5 and IFR6 commands allow you to control IFR sending at any time, regardless of whether monitoring is in progress or not. They mimic the IFR0, IFR1 and IFR2 commands — setting IFR4 causes an IFR to never be sent, IFR5 sends an IFR if there are no errors and the 'K' bit permits it, and setting IFR6 forces an IFR to always be generated (even if there is an error). |
AT IFR H and IFR S |
IFR from the Header or Source The value sent in the J1850 In-Frame Response (IFR) byte is normally the same as the value sent in the source address byte (that is, the tester) that was in the request header. However, there are times when it is desirable to use a different value, and this set of commands allows that. If you send AT IFR S, the ELM327 will use the value defined as the source address (usually F1, but it can be changed with PP 06 or AT TA), even if a different value was sent in the header byte. This is not normally required and should be done with caution. AT IFR H restores the sending of IFR bytes to those specified in the Header and is the default setting. |
AT IGN |
read the IgnMon input level This command reads the signal level on pin 15. It is assumed that the logic level is related to the ignition voltage, so if the input is high, the response will be 'ON', and if it is low, 'OFF'. This feature is most useful if you want to perform power control functions with your own software. If you disable the automatic Low Power response to a low level on this pin (by setting bit 2 of PP 0E to 0), then pin 15 will operate as an RTS input. A low level on this input will not turn off the power but will interrupt any current OBD activity. All you need to do is detect the 'STOPPED' message that is sent when the ELM327 is interrupted, and then check the level on pin 15 with AT IGN. If it turns out to be off, you can perform an orderly shutdown yourself. |
AT IIA hh |
set the ISO Init Address to hh The ISO 9141-2 and ISO 14230-4 standards state that when starting a session with an ECU, the initialization sequence must be directed to a specific address ($33). If you want to experiment by directing the slow five-baud sequence to a different address, this can be done with this command. For example, if you want the initiation to be performed with an ECU at address $7A, simply send: >AT IIA 7A and the ELM327 will use this address when communicating with it (protocols 3 or 4). The full eight-bit value is used exactly as given — no changes are made to it (that is, no parity bits are added, and so on). Note that setting this value does not affect the address values used in the header bytes. When the defaults are restored or the ELM327 is reset, the ISO Init Address is restored to the value $33. |
AT L0 and L1 |
Linefeeds off or on This option controls the sending of linefeed characters after each carriage return character. With AT L1, a linefeed will be generated after each carriage return character, and with AT L0 it is disabled. Users typically prefer to enable this option when working with a terminal program and to disable it when using a custom interface (the extra characters only slow down the exchange). The default setting is determined by the voltage level on pin 7 at power-up (or reset). If the level is high, linefeeds are enabled, otherwise they are disabled. |
AT LP |
go to the Low Power mode This command causes the ELM327 to shut down everything except its "core services" in order to reduce power consumption to a minimum. The ELM327 will reply with "OK" (without a carriage return), and after one second it will change the state of the PwrCtrl output (pin 16) and enter the reduced power (standby) mode. The chip can be returned to normal operation by a character on the RS232 input, a rising edge on the IgnMon input (pin 15), as well as the usual reset methods (power off/on, a low level on pin 1, or a power dropout). For details, see the "Power Control" section (page 67). |
AT M0 and M1 |
Memory off or on The ELM327 has internal non-volatile memory capable of remembering the last protocol used even after power is removed. This is convenient if the chip is frequently used for a single protocol — it will be the first one tried at the next power-up. To enable the memory function you must use the AT M1 command or connect pin 5 to a high logic level. When the memory function is enabled, each time a valid OBD protocol is detected it will be saved and become the new default. If the memory function is disabled, the protocols found are not saved, and the ELM327 always starts with the last saved protocol. If the ELM327 is used in an environment with frequently changing protocols, it is better to disable memory and run AT SP 0. If, however, you connect to a single vehicle, saving its protocol as the default will be the most sensible choice. The default setting is determined by the voltage level on pin 5 at power-up (or reset). A high level (VDD) means memory on, a low level means off. |
AT NL |
Normal Length messages This command sets the ELM327 to send the normal number of data bytes, as specified by the OBD standards. It is used to cancel the changes made by the Allow Long mode (AT AL). Note that the ELM327 does not require AL to be changed in order to allow longer messages to be received for KWP protocols. You can simply leave the IC at the default NL setting, and all received bytes will be shown. |
AT R0 and R1 |
Responses off or on These commands control whether the ELM327 automatically receives (and displays) the messages returned by the vehicle. If responses are off, then after sending a request the chip will not wait for a reply from the vehicle but will immediately return to waiting for the next RS232 command (the ELM327 will not print anything to say that the send was successful, but you will see a message if it was not). R0 can be useful for sending commands blind when using the chip in non-OBD network applications, or when simulating an ECU during training. However, it is not recommended to use this option for normal OBD communications, as the vehicle may have difficulty if it expects acknowledgement and does not receive it. The R0 setting always overrides any "number of responses digit" that is provided with an OBD request. The default is R1, or "responses on". |
AT RD |
Read the stored Data byte The byte value stored by the SD command is retrieved by this command. There is only one memory location, so no address is required. |
AT RV |
Read the input Voltage This initiates a reading of the voltage present on pin 2 and converts it to a decimal voltage. By default, it is assumed that the input is connected to the measured voltage through a voltage divider with a ratio of 1:5.7 (for example, series-connected 47KΩ and 10KΩ resistors, with the 10KΩ connected from pin 2 to Vss), and that the ELM327 supply is a nominal 5 V. This allows the input voltage to be measured up to about 28 V (the voltage on pin 2 must not exceed Vdd) with an uncalibrated accuracy that is typically around 2%. For calibration information, see the "Reading the Battery Voltage" section. |
AT S0 and S1 |
printing of Spaces off or on These commands control whether space characters are inserted into the ECU responses. The ELM327 normally outputs ECU responses as a sequence of hex characters separated by spaces (for readability), but messages can be transmitted significantly faster if every third byte (the space) is removed. Although this makes the message less readable for a human, it can significantly speed up data processing by a computer. By default, spaces are on (S1), and space characters are inserted into every response. |
AT SD hh |
Save Data byte hh The ELM327 can store one byte of information in a special non-volatile memory that retains its contents even when power is removed. Simply specify the byte to be stored, and then retrieve it with the read data command (AT RD). This location is ideal for storing custom settings, device IDs, a count of the number of restarts, or other information. |
AT WS |
Warm Start Similar to the AT Z command, but without testing the LEDs at power-up. Users may find this a convenient way to quickly "start over" without the extra delay of AT Z. When using variable RS232 baud rates (the AT BRD commands), it is recommended to reset the chip with this command rather than AT Z, since AT WS will not reset the RS232 baud rate. |
AT Z |
full reset This command causes the chip to perform a complete reset, as if the power had been turned off and on again. All settings are returned to their default values, and the chip enters a state of waiting for characters on the RS232 bus. Note that the baud rate set by the AT BRD command will be lost, and the ELM327 will revert to the default baud rate setting. |
AT @1 |
display the device description This command displays the device description string. The default text is "OBDII to RS232 Interpreter". |
AT @3 cccccccccccc |
store the device identifier This command is used to set the device identifier code. Exactly 12 characters must be sent; once written to memory they cannot be changed (the @3 command can be used only once). The characters must be printable (ASCII codes from 0x21 to 0x5F inclusive). If you are developing software to write identifiers, you may be interested in the ELM328 chip, which allows the @3 command to be used multiple times (but cannot send OBD messages). |
| Command | Description |
|---|---|
AT PC |
"Protocol Close" There are times when it is necessary to stop (deactivate) a protocol. Perhaps you are not using automatic protocol search and want to activate and deactivate protocols manually. Perhaps you want to stop sending idle (wakeup) messages, or you have some other reason. The PC command is used in such cases to forcibly close the protocol. |
AT SP h |
Set Protocol to h This command sets the ELM327 to work with the protocol specified in "h" and saves it as the new default. The protocol will be saved regardless of the AT M0/M1 setting. The ELM327 supports 12 different protocols (two of which can be user-defined): 0 — Automatic, 1 — SAE J1850 PWM (41.6 kbaud), 2 — SAE J1850 VPW (10.4 kbaud), 3 — ISO 9141-2 (5 baud, 10.4 kbaud), 4 — ISO 14230-4 KWP (5 baud, 10.4 kbaud), 5 — ISO 14230-4 KWP (fast init, 10.4 kbaud), 6 — ISO 15765-4 CAN (11 bit, 500 kbaud), 7 — ISO 15765-4 CAN (29 bit, 500 kbaud), 8 — ISO 15765-4 CAN (11 bit, 250 kbaud), 9 — ISO 15765-4 CAN (29 bit, 250 kbaud), A — SAE J1939 CAN (29 bit, 250* kbaud), B — USER1 CAN (11* bit, 125* kbaud), C — USER2 CAN (11* bit, 50* kbaud). (* — user-adjustable) Protocol 0 tells the ELM327 that the vehicle's protocol is unknown and that a search must be performed. The AT SP 0 command sets the protocol to 0 but does not write to the EEPROM (to speed things up). If a specific protocol is selected (for example, AT SP 3), it will become the default and will be the only one used. |
AT SP 00 |
erase the stored protocol To speed up protocol detection, the SP 0 command sets the automatic mode but does not perform the (time-consuming) write to EEPROM. This reduces EEPROM wear. However, sometimes it is necessary to write the value 0 to the stored protocol — the SP 00 command is intended for this. |
AT SP Ah |
Set Protocol to h with auto-search This variant of the SP command lets you select a starting (default) protocol while retaining the ability to automatically search for a valid protocol if the connection fails. For example, if your vehicle uses ISO 9141-2 but you want to occasionally use the ELM327 with other vehicles, you can use AT SP A3 — protocol 3 will be tried first, but if it fails an auto-search will be performed. Do not forget to disable the memory function, otherwise each newly detected protocol will become the default. SP Ah saves the protocol information even if memory is disabled (but SP A0 and SP 0A do not write to EEPROM). The letter "A" can come before or after h, so AT SP A3 and AT SP 3A are equivalent. |
AT SS |
use the Standard Search sequence The SAE J1978 standard defines the protocol search order that diagnostic tools must use. It follows the ELM327 protocol numbering. To speed up the search, the ELM327 normally does not follow this order, but it will follow it if you issue the AT SS command. |
AT TP h |
Test Protocol h This command is identical to SP, except that the selected protocol is not immediately saved to the internal EEPROM, that is, it does not change the default setting. Note: if the memory function is enabled (AT M1) and the new protocol turns out to be valid, it will be saved in memory as the new default. |
AT TP Ah |
Test Protocol h with auto-search This command is similar to AT TP, but if the selected protocol fails to initialize, the ELM327 automatically cycles through the remaining protocols, trying to connect to one of them. |
| Command | Description |
|---|---|
AT C0 and C1 |
CAN send acknowledgement off or on The ELM327 has always waited after sending a CAN message to make sure the data was transmitted correctly. If it was not, a 'CAN ERROR' message was returned. In firmware v2.3 you can disable this acknowledgement and possibly return to the prompt state a little faster. This can save the time of sending a single message (about 230 µsec for 500 kbps), but there will then be no feedback if a send is incorrect. We recommend always leaving this parameter at its default value (C1 - acknowledgement on). |
AT CAF0 and CAF1 |
CAN Auto Formatting off or on These commands determine whether the ELM327 helps you format the CAN data that is sent and received. With CAN automatic formatting enabled (CAF1), the formatting (PCI) bytes will be automatically generated when sending and removed when receiving. This means that you can continue to send OBD requests (01 00 and so on) as usual, without paying attention to the additional bytes that CAN diagnostic systems require. In addition, with formatting enabled, all of the extra (unused) data bytes received in a frame will be removed, and messages with invalid PCI bytes will be ignored. (When monitoring, however, all messages with invalid PCI bytes are displayed, and a ' |
AT CEA |
turn off the CAN Extended Address The CEA command is used to disable the special features set with the CEA hh command. It also restores the address set by the AT CER hh command to its default value. |
AT CEA hh |
set the CAN Extended Address to hh Some (non-OBD) CAN protocols extend the addressing fields by using the first of the eight data bytes as the target (receiver) address. This command allows the ELM327 to interact with such protocols. Sending the CEA hh command causes the ELM327 to insert the value hh as the first data byte into all CAN messages you send. It also adds another filtering step for received messages, passing only those that have the tester address in the first byte position (in addition to the requirement that the ID bits match the patterns set by AT CF and CM, FT or CRA). The AT CEA hh command can be sent at any time, and the changes take effect immediately, which allows the address to be changed "on the fly". Extended addressing is covered in more detail in the "Using CAN Extended Addresses" section on page 64. The CEA mode of operation is off by default and is enabled by sending the CEA command with a target address. Once enabled, it can be turned off by sending the AT CEA command (without an address) or by restoring the chip's default settings with AT D, AT Z, and so on. Note that the CEA setting has no effect if J1939 formatting is enabled. |
AT CER hh |
set the CAN Extended Rx address to hh By default, the ELM327 receives responses to CAN extended addressing requests that contain the "tester address" in the first data byte position. The CER command lets you select a different receive address. The values set with this command are reset to the default value with the AT CEA command. |
AT CF hhh |
set the CAN ID Filter to hhh The CAN Filter works in conjunction with the CAN Mask to determine which information will be accepted by the receiver. When each message is received, the incoming CAN ID bits are compared with the CAN Filter bits (if the mask bit is '1 '). If all the corresponding bits match, the message will be accepted and processed by the ELM327, otherwise it will be discarded. This three-bit version of the CAN Filter command makes it a little easier to set filters in CAN systems with an 11-bit ID. Only the rightmost 11 bits of the supplied nibbles are used, and the most significant bit is ignored. However, the data is actually stored as four bytes, and this command adds leading zeros for the remaining bytes. For more information, see the CM command(s). Note that responses will not be predictable if you use the CRA, CF or CM commands with the SAE J1939 protocol while also using the MP command or the DM1 command. In fact, we do not recommend using the CRA, CM or CF commands with the J1939 protocol at any time. If you need additional filtering for the J1939 protocol, consider using the FT command. |
AT CF hh hh hh hh |
set the CAN ID Filter to hhhhhhh This command lets you set all four bytes (actually 29 bits) of the CAN Filter at once. The three most significant bits will always be ignored, and they can be assigned any value. This command can also be used to enter 11-bit ID filters, since they are stored in the same locations inside the device (entering AT CF 00 00 0h hh is exactly the same as entering the shorter AT CF hhh command). Note that responses will not be predictable if you use the CRA, CF or CM commands with the SAE J1939 protocol while also using the MP command or the DM1 command. In fact, we do not recommend using the CRA, CM or CF commands with the J1939 protocol at any time. If you need additional filtering with the J1939 protocol, consider using the FT command. |
AT CFC0 and CFC1 |
CAN Flow Control off or on The ISO 15765-4 CAN protocol expects a 'Flow Control' message to always be sent in response to a 'First Frame' message, and the ELM327 automatically sends them without user intervention. When experimenting with a non-OBD system, you may need to disable this automatic response — the AT CFC0 command is intended for this. Starting with firmware v2.0, these commands also enable/disable the sending of J1939 TP.CM_CTS messages in response to TP.CM_RTS requests. When monitoring (AT MA, MR or MT), Flow Control messages are never sent, regardless of the CFC setting. The default setting is CFC1 (Flow Control on). |
AT CM hhh |
set the CAN ID Mask to hhh A large number of messages may be transmitted simultaneously on a CAN system. In order to limit the number of messages viewed by the ELM327, a system for filtering the desired ones out of all the rest is needed. For this, a filter is used that works in conjunction with a mask. The mask is a group of bits that shows the ELM327 which bits in the filter are relevant and which can be ignored. A 'must match ' condition is signaled by setting the mask bit to '1 ', and 'don 't care' is signaled by setting the bit to '0'. This three-digit variation of the CM command is used to obtain mask values for 11-bit ID systems (the most significant bit is always ignored). Note that a common storage location is used for the 29-bit and 11-bit masks, so an 11-bit mask can be assigned with the following command (CM hh hh hh hh), if you want to type extra. The values are right-aligned, so you will need to specify five leading zeros followed by the three mask bytes. Note that responses will not be predictable if you use the CRA, CF or CM commands with the SAE J1939 protocol while also using the MP command or the DM1 command. In fact, we do not recommend using the CRA, CM or CF commands with the J1939 protocol at any time. If you need additional filtering for the J1939 protocol, consider using the FT command. |
AT CM hh hh hh hh |
set the CAN ID Mask to hhhhhhhh This command is used to assign mask values for 29-bit ID systems. See the discussion of the CM hhh command, since it is practically identical except for the length. Note that the three most significant bits that you specify in the first digit will be ignored. Note the warning that it cannot be used with the J1939 protocol. Note that responses will not be predictable if you use the CRA, CF or CM commands with the SAE J1939 protocol while also using the MP command or the DM1 command. In fact, we do not recommend using the CRA, CM or CF commands with the J1939 protocol at any time. If you need additional filtering for the J1939 protocol, consider using the FT command. |
AT CP hh |
set the CAN Priority bits to hh This command provides one way to assign the five most significant bits of the 29-bit CAN ID that will be used to send messages (the remaining 24 bits can be set with the AT SH command). Many systems use these bits to assign a priority value to messages and to determine the message protocol. Any bits provided beyond the five required are ignored and not stored by the ELM327 (it uses only the five least significant bits of this byte). By default, the CP hh value is the hexadecimal value 18, which can be restored at any time with the AT D command. |
AT CRA |
reset the CAN Rx Addr The AT CRA command is used to restore the CAN receive filters to their default values. Note that it has no arguments (that is, no data). |
AT CRA hhh |
set the CAN Rx Addr to hhh Setting CAN masks and filters can sometimes be complicated, so if you want to receive information from only one address (that is, one CAN ID), then this command can be very useful. For example, if you want to see information only from address 7E8, simply send AT CRA 7E8, and the ELM327 will perform the necessary mask and filter adjustment. If you want to allow a range of values to be received, you can use the letter X to indicate a "don't care" condition. That is, AT CRA 7EX will allow all identifiers beginning with 7E to pass (7E0, 7E1, and so on). For a more specific range of identifiers, mask and filter assignment may be required. To cancel the changes made by the CRA command, simply send AT CRA or AT AR. Note that responses will not be predictable if you use the CRA, CF or CM commands with the SAE J1939 protocol while also using the MP command or the DM1 command. In fact, we do not recommend using the CRA, CM or CF commands at any time when using the J1939 protocol. If you need additional filtering for the J1939 protocol, consider using the FT command. |
AT CRA hhhhhhhh |
set the CAN Rx Addr to hhhhhhhh This command is identical to the previous one, except that it is used with 29-bit CAN identifiers. Sending AT CRA or AT AR will also cancel all changes made by this command. Note that responses will not be predictable if you use the CRA, CF or CM commands with the SAE J1939 protocol while also using the MP command or the DM1 command. In fact, we do not recommend using the CRA, CM or CF commands with the J1939 protocol at any time. If you need additional filtering for the J1939 protocol, consider using the FT command. |
AT CS |
show the CAN Status counts The CAN protocol requires statistics to be kept on the number of detected transmit and receive errors. If there are a significant number of errors (due to a hardware or software problem), the device shuts down so as not to affect other data on the bus. The AT CS command lets you see the number of transmitter (Tx) and receiver (Rx) errors in hexadecimal format. If the transmitter has to be turned off (count >FF), you will see 'OFF' rather than a specific count. Starting with firmware v2.2, the CS response will also show the current signal frequency on CAN. A typical response might look like this: ``` >AT CS |
AT CSM0 and CSM1 |
CAN Silent Monitoring off or on The ELM327 was designed to be absolutely silent while monitoring the CAN bus. Because of this, it can report exactly what it sees without coloring the information in any way. Sometimes (in bench tests or when connecting to a dedicated CAN port) it may be necessary for the ELM327 to operate non-silently (that is, to generate ACK bits, and so on), and this is exactly what the CSM command is for. CSM1 turns it on, CSM0 turns it off, and the default value is determined by PP 21. Be careful when experimenting with this. If you select the wrong baud rate and then observe the CAN bus with silent monitoring off, you will disrupt the data flow. Always keep silent monitoring on until you are sure you have selected the correct baud rate. |
AT CTM1 |
set the Timer Multiplier to 1 This command causes all timeouts set by AT ST to be multiplied by a factor of 1. Note that at present this only affects the CAN protocols (6 to C). The default is CTM1. CTM5 [ set the Timer Multiplier to 5 ] This command causes all timeouts set by AT ST to be multiplied by a factor of 5. Note that at present this only affects the CAN protocols (6 to C). Originally this command was added (as JTM5) to help with receiving certain J1939 messages. Since then we have received several requests to allow it to affect all CAN modes, and so we changed the JTM5 code and added the new CTM1/CTM5 commands. When using CTM5 we warn that the Adaptive Timing code does not track changes in the settings, so we advise turning it off (with AT AT0). By default, this multiplier is off. |
AT FC SD |
1-5 bytes This command lets you define the data bytes that are sent in a CAN Flow Control message. From one to five data bytes can be specified, with the remaining data bytes in the message automatically set to the default CAN padding byte if the protocol requires it. The data transmitted with this command is used only if Flow Control mode 1 or 2 is enabled. |
AT FC SH hhh |
Set the Flow Control Header This command lets you set the header bytes (or more correctly the "CAN ID") used for CAN Flow Control messages. Only the rightmost 11 bits will be used — the most significant bit is always removed. This command affects only Flow Control mode 1. |
AT FC SH hhhhhhhh |
Set the Flow Control Header This command is used to set the header (or 'CAN' bits) for Flow Control responses with 29-bit CAN ID systems. Since 8 nibbles define 32 bits, only the rightmost 29 bits will be used — the most significant three bits are always removed. This command affects only Flow Control mode 1. |
AT FC SM h |
Set the Flow Control Mode to h This command sets how the ELM327 responds to First Frame messages if automatic Flow Control responses are enabled. The single-digit value can be either '0' (default) for fully automatic responses, '1' for fully user-defined responses, or '2' for user-defined data bytes in the response. Note that FC modes 1 and 2 can be enabled only if you have defined the required data bytes and, possibly, the ID. Otherwise you will get an error. More information and examples can be found in the Changing the Flow Control Messages section (page 62). |
AT FT |
Filter for Transmitter off If a filter has been set to limit the messages received, it can be disabled with the AT FT command. |
AT FT hh |
Filter for Transmitter = hh This command provides an additional level of filtering for received messages. A message will be accepted if the value passed by the hh command matches the value of the third byte of the standard three-byte header or the least significant eight bits of the CAN ID. This is in addition to any other filtering provided by other commands. For more information, refer to the "Filtering for the Transmitter" section. |
AT PB xx yy |
set Protocol B parameters This command lets you change the parameters of protocol B (USER1) and the baud rate without needing to change the corresponding programmable parameters (PP 2C and PP 2D). This makes it easier to change the protocol during a test. To use this feature, simply set xx to the value for PP 2C, and yy to the value for PP 2D, and run the command. At the next protocol initialization these values will be used. For example, to set up protocol B for use with 500 kbps J1939, simply run the command: >AT PB 42 01 As another example, suppose you want to monitor a system using 11-bit CAN at 33.3 kbps. If no special formatting is required, this means a value of 11000000 or C0 hex for PP 2C, and 15 decimal or 0F hexadecimal for PP 2D. Simply send these values to the ELM327 with the command: >AT PB C0 0F then start monitoring with the command: >AT MA If you see CAN ERROR errors and realize you needed a baud rate of 83.3 kbps, close the protocol and send the new values: >AT PC OK >AT PB C0 06 OK >AT MA Values passed this way do not affect those stored in programmable parameters 2C and 2D and are lost when the ELM327 is reset. If you want your settings to persist across several power cycles, then you can store them in the programmable parameters for the USER1 or USER2 CAN protocols. |
AT RTR |
send an RTR message This command causes a special CAN 'Remote Frame' message to be sent. This type of message contains no data bytes and has the Remote Transmission Request (RTR) bit set. The headers and filters will remain as previously set (that is, the ELM327 makes no assumptions about what format the response may have), so mask and filter adjustment may be required. This command must be used with an active CAN protocol (one that sends and receives messages), since it cannot initiate a protocol search. Note that the CAF1 setting normally excludes the display of all RTRs, so if you are monitoring messages and want to see RTRs, you will have to turn off formatting or turn on headers. The ELM327 treats an RTR like any other message and waits for a response from the vehicle (unless AT R0 is selected). |
AT SH xyz |
Set the Header to 00 0x yz Entering 11-bit CAN IDs (headers) normally requires adding leading zeros (for example, AT SH 00 07 DF), but this command simplifies that. The AT SH xyz command takes a three-digit argument, uses only the rightmost 11 bits from it, adds leading zeros, and stores the result. For example, AT SH 7DF is a valid command, convenient for working with 11-bit CAN systems. The header is actually stored as 00 07 DF. |
AT SH xx yy zz |
Set the Header to xx yy zz This command lets the user manually control the values of the three header bytes of a message. These bytes are normally assigned automatically, but there are times when it is desirable to change them (especially when experimenting with physical addressing). It is recommended to set the headers after activating the protocol, so that wakeup messages and so on use the default values. The header bytes are specified as hexadecimal digits: xx — the first byte (priority/type), yy — the second (receiver), zz — the third (transmitter). They remain in effect until the next setting or until the default values are restored with the D, WS or Z commands. This command is used to assign all the header bytes — J1850, ISO 9141, ISO 14230 or CAN. CAN systems use these three bytes to fill bits 0–23 of the ID (for a 29-bit ID), or only the rightmost 11 bits for an 11-bit CAN ID. The additional 5 bits for a 29-bit system are set with the AT CP command. |
AT SH ww xx yy zz |
Set the Header to ww xx yy zz The four-byte version of the AT SH command lets you set the full 29-bit CAN ID with a single instruction. This is equivalent to using AT CP (for the five most significant bits) and the three-byte version of AT SH (for the remaining three bytes) at the same time. |
AT ST hh |
Set the Timeout to hh After sending a request, the ELM327 waits for a response for the set time, after which it may declare that "NO DATA" was received from the vehicle. This same timer setting can also be used after a response is received, while waiting to see whether another one arrives (but this depends on the AT settings). The AT ST command lets you fine-tune this timer in increments of 4 ms (or 20 ms, if CTM5 is selected in a CAN protocol). If the Adaptive Timing function is enabled, the AT ST time sets the maximum time that should be allowed, even if the adaptive algorithm determines that this value should be larger. In most cases it is better to leave the AT ST time at its default and let the Adaptive Timing algorithm decide what to use for the timeout. By default, the ST timer is set to 32 (which gives a time of about 200 ms), but this default can be adjusted by changing the value of PP 03. Note that a value of 00 will not result in a time of 0 ms — it returns the timer to its default value. In addition, an internally set minimum time is used during a protocol search — with AT ST you can select a longer time, but not a shorter one. |
AT V0 and V1 |
Variable data length off or on Many CAN protocols (for example, ISO 15765-4) expect eight data bytes to be sent. The V0 and V1 commands let you override this behavior (for any CAN protocol). Selecting V1 forces the current CAN protocol to send variable-length messages, similar to bit 6 in PP 2C and PP 2E for protocols B and C. The V0 value (default) disables forced sending of variable-length messages, and the format reverts to the protocol settings. |
| Command | Description |
|---|---|
AT FI |
perform a Fast Initiation In one version of the Keyword protocol, a so-called "fast initiation" sequence is used to begin data exchange. This sequence is normally performed when the first message needs to be sent, and the message is sent immediately after it. However, some ECUs may need more time between these two actions, and having a separate initiation command allows this time to be controlled. Simply send AT FI, wait a moment, and then send the message. You may need to experiment to get the right amount of delay. Another use of this command might be to perform a fast initiation on a protocol such as ISO 9141 (that is, 3 — the CARB format). Simply follow these steps to create a fast initiation, and then switch to protocol 3: AT SP 5 AT FI AT SP 3 AT BI After that, you will be able to communicate with the ECU. Note that closing the protocol (that is, AT PC) in the above code is not required, since the ELM327 does it automatically when switching protocols. To use the AT FI command, protocol 5 must be selected, otherwise an error occurs. |
AT KW |
display the Key Words During initialization of the ISO 9141-2 and ISO 14230-4 protocols, two special bytes (key words) are sent to the ELM327 (their values are used to determine whether the ELM327 can support a particular variant of the protocol). If you want to know the value of these bytes, simply send the AT KW command. |
AT KW0 and KW1 |
Key Word checking off or on The ELM327 looks for certain bytes (called key words) that must be sent to it by the ECU during initiation over ISO 9141-2 and ISO 14230-4. If the bytes are not found, the initiation is considered to have failed (and you may see an 'UNABLE TO CONNECT' message or perhaps 'BUS INIT: ...ERROR'). This can happen if you are trying to connect to an ECU that is not OBD-compatible, or perhaps an old ECU. If you want to experiment with non-standard systems, you may need to instruct the ELM327 to perform the initiation sequence but ignore the contents of the received key word bytes. To do this, simply send the Key Words off command: >AT KW0 After Key Word checking is disabled, the ELM327 will still require two key word bytes in the response, but it will not look at the actual byte values. It will also send acknowledgement to the ECU and wait for a final response from it (but will not stop or report an error if one is not received). This may allow you to establish a connection in an otherwise "impossible" situation. Normal behavior can be restored with AT KW1, which is the default setting. |
AT SI |
perform a Slow Initiation Protocols 3 and 4 use a so-called 5-baud (or slow) initiation sequence to begin data exchange. The sequence is normally performed when the first message is sent, after which the message is sent immediately. However, some ECUs may need more time between these actions, and having a separate initiation command allows this delay to be controlled. Simply send AT SI, wait a moment, then send the message. You may need to experiment with the amount of delay. To use the AT SI command, protocol 3 or 4 must be selected, otherwise an error occurs. |
AT SW hh |
Set the Wakeup interval to hh After a connection is established, some protocols require a periodic data exchange every few seconds so that the ECU keeps the communication channel open. If no messages arrive, the ECU assumes you are finished and closes the channel. The ELM327 automatically generates periodic messages to maintain the connection. Responses to these messages are ignored. (At present, only protocols 3, 4 and 5 support these messages — nothing is provided for CAN.) The interval between Wakeup messages is adjusted in increments of 20 ms with the AT SW hh command (hh is a hex value from 00 to FF). The maximum delay is ~5 seconds at FF. The default (92) is a nominal delay of 3 seconds. A value of 00 stops the periodic messages. After AT SW 00, they can only be restored by closing and re-initializing the protocol. |
AT WM |
1–6 bytes This command lets you override the Wakeup message settings (sometimes called "periodic idle messages"). Simply specify the message to send (usually three header bytes and one to three data bytes), and the ELM327 will add a checksum and send them according to the AT SW setting. The default values are 68 6A F1 01 00 for ISO 9141 and C1 33 F1 3E for KWP. |
| Command | Description |
|---|---|
AT JE |
use the ELM data format for J1939 The J1939 standard requires that PGN requests be sent with the byte order reversed relative to the standard "left to right" order. For example, to request the engine temperature (PGN 00FEEE), the data bytes are actually sent in reverse order (EE FE 00), and the ELM327 normally expects you to provide the data in exactly that order. When experimenting, the constant need to reverse the bytes can be confusing, so an ELM format is defined that performs the reversal for you. When the J1939 ELM format (JE) is enabled, the J1939 protocol is selected, and you provide three data bytes, the ELM327 will reverse their order before sending them to the ECU. To request the engine temperature, you send 00 FE EE (not EE FE 00). The JE format is enabled by default. |
AT JHF0 and JHF1 |
J1939 Header Formatting off or on When printing responses, the ELM327 normally formats the J1939 ID (header) bits in such a way as to isolate the priority bits, group all the PGN information, and separate the source address byte. If you prefer to see the ID information as four separate bytes (which most J1939 software does), simply turn off formatting with the JHF0 command. The CAF0 command has the same effect (and overrides the JHF setting), but also affects other formatting. The default setting is JHF1. |
AT JS |
use the SAE data format for J1939 The AT JS command disables the automatic byte reversal that the JE command performs. If you want to send data bytes to a J1939 vehicle without any byte reordering (that is, in the order specified in the SAE documents), select the JS format. For example, when sending an engine temperature request (PGN 00FEEE) with the JS format, you must transmit the bytes as EE FE 00 (this is also known as little-endian byte order). The JS format is off by default. |
AT JTM1 |
set the J1939 Timer Multiplier to 1 This command sets the AT ST time multiplier to x1 for the SAE J1939 protocol. Starting with firmware v2.1, this command simply calls CTM1. |
AT JTM5 |
set the J1939 Timer Multiplier to 5 This command sets the AT ST time multiplier to x5 for the SAE J1939 protocol. Starting with firmware v2.1, this command simply calls CTM5. |
AT MP hhhh |
Monitor for PGN hhhh The AT MA, MR and MT commands are very useful for monitoring a specific byte in the header of a typical OBD message. However, for the SAE J1939 protocol it is often necessary to monitor multi-byte Parameter Group Numbers (PGNs), which may be located either in the header or in the data bytes. The MP command is a special J1939-only command used to track responses to a request for a specific PGN. Note that this command does not allow the first two digits of the PGN to be specified — they are always assumed to be 00. For example, the DM2 PGN has the value 00FECB (see SAE J1939-73). To monitor DM2, send AT MP FECB. This command is only available when a CAN protocol (A, B or C) with SAE J1939 formatting is selected. Under other conditions an error is returned. |
AT MP hhhh n |
Monitor for PGN, get n messages This command is similar to the previous one, but adds the ability to specify the number of messages that must be received before the ELM327 automatically stops monitoring and prints the prompt character. The value "n" is a single hexadecimal digit. |
AT MP hhhhhh |
Monitor for PGN hhhhhh This command is similar to MP hhhh, but extends the number of bytes provided by one, giving full control over the PGN definition (it does not assume that the Data Page bit is 0, as the MP hhhh command does). This allows for future extensions if additional PGNs with the Data Page bit set are defined. Note that in the additional byte only the Data Page bit is significant — the remaining bits are ignored. |
AT MP hhhhhh n |
Monitor for PGN, get n messages This command is similar to the previous one, but adds the ability to specify the number of messages that must be received before the ELM327 automatically stops monitoring and prints the prompt character. The value "n" is a single hexadecimal digit. |
| Command | Description |
|---|---|
AT MA |
Monitor All messages This command places the ELM327 in a bus monitoring mode, in which it continuously watches (and displays) all the messages it sees on the OBD bus. This is a silent monitor, sending no in-frame responses for J1850 systems, no acknowledgements for CAN systems (unless you turn off silent mode with CSM0), and no Wakeup ("keep-alive") messages for the ISO 9141 and ISO 14230 protocols. Monitoring will continue until you stop it with activity on the RS232 input or the RTS pin. To stop monitoring, simply send any single character to the ELM327, then wait for the response in the form of the prompt character ('>') or a low level on the Busy pin. (Setting the RTS input low will also interrupt the device.) Waiting for the prompt is necessary, since the response time depends on what the chip was doing at the moment of the interruption. If, for example, it was in the middle of printing a line, it will first finish it and then print 'STOPPED', after which it returns to the command state and sends the prompt character. If it was simply waiting for input, it would return much faster. Note that the character that stops monitoring is always discarded and has no effect on subsequent commands. If this command is used with CAN protocols, and if a CAN filter and/or mask was set earlier (with CF, CM or CRA), then the MA command will depend on these settings. For example, if the receive address was previously set to CRA 4B0, then the MA command will only be able to "see" messages with ID 4B0. This may not be exactly what you want — perhaps the masks and filters should first be reset (with AR or CRA). All the monitoring commands (MA, MR and MT) work by closing the current protocol (a PC is performed) before configuring the chip to monitor data. When the next OBD command is sent, the protocol will be initialized again, about which you may see messages. In addition, a 'SEARCHING...' message may appear, depending on what changes were made during monitoring. |
AT MR hh |
Monitor for Receiver address hh This command is similar to AT MA, but displays only messages sent to the hexadecimal address hh. These are messages in which the value hh is in the second byte of the standard three-byte OBD header, in bits 8–15 of a 29-bit CAN ID, or in bits 8–10 of an 11-bit CAN ID. Monitoring is interrupted by any RS232 character, as with the MA command. Note: if this command is used with CAN protocols and a CAN filter/mask was previously set (with the CF, CM or CRA commands), then the MR command will overwrite only the corresponding bits — the rest will remain unchanged. You may want to reset the masks and filters first (AT AR). Like AT MA, this command begins with an internal close of the protocol. |
AT MT hh |
Monitor for Transmitter address hh This command is similar to AT MA, but displays only messages sent by a transmitter with the hexadecimal address hh. These are messages in which this value is in the third byte of the standard three-byte OBD header or in bits 0–7 of the CAN ID. As with the MA and MR modes, monitoring is interrupted by any RS232 character. Note: if a CAN filter/mask was previously set, then the MT command will overwrite only the corresponding bits. You may want to reset the masks and filters first (AT AR). Like AT MA, this command begins with an internal close of the protocol. |
| Command | Description |
|---|---|
AT AR |
Automatically set the Receive address Responses from the vehicle will be acknowledged and displayed by the ELM327 if the internal receive address matches the address to which the message is being sent. In automatic receive mode, the value used for the receive address will be selected based on the current header bytes and will be automatically updated when the header bytes change. The value used for the receive address is determined by parameters such as the contents of the first header byte, as well as whether the message uses physical addressing, functional addressing, or whether the user has set a value with the SR or RA commands. Auto Receive is on by default and is not used by the J1939 protocol. |
AT RA hh |
set the Receive Address to hh Depending on the application, users may want to manually set the address to which the ELM327 will respond. This command disables AR mode and forces the chip to accept only responses addressed to hh. Be careful with this setting — depending on the value, you may accept (and acknowledge with an IFR) a message intended for another module. To disable RA filtering, send AT AR. This command has limited use with CAN, since it monitors only part of the ID bits — the CRA command may be a better choice. The command also does not affect J1939 addresses. The RA command is identical to SR and can be used interchangeably. CAN extended addressing uses the value set by the AT TA command. |
AT SR hh |
Set the Receive address to hh Depending on the application, users may want to manually set the address to which the ELM327 will respond. This command disables AR mode and forces the chip to accept only responses addressed to hh. Be careful with this setting — depending on the value, you may accept (and acknowledge with an IFR) a message intended for another module. To disable RA filtering, send AT AR. This command has limited use with CAN, since it monitors only part of the ID bits — the CRA command may be a better choice. The command also does not affect J1939 addresses. The RA command is identical to SR and can be used interchangeably. CAN extended addressing uses the value set by the AT TA command. |
AT TA hh |
set the Tester Address to hh This command is used to change the current tester (diagnostic tool) address, which is used in headers, periodic messages, filters, and so on. The ELM327 normally uses the value from PP 06, but the TA command lets you temporarily override it. AT TA affects all protocols, including J1939, which is convenient for changing the J1939 address from the default F9. Although the command can work "on the fly", it is not recommended to change the address after activating the protocol — the results may be unpredictable. |
| Command | Description |
|---|---|
AT PP hh OFF |
turn off Programmable Parameter hh OFF This command disables the programmable parameter with number hh. Any value assigned with the PP hh SV command will no longer be used, and the factory default setting will be in effect again. The actual time at which the new value for this parameter takes effect is determined by its type. For more information about the types, see the "Programmable Parameters" section (page 72). Note that 'PP FF OFF' is a special command that disables all programmable parameters, as if you had entered PP OFF for every possible parameter. It is possible to change some programmable parameters in such a way that communication with the ELM327 becomes difficult or even impossible. If this happens, there is a hardware means of resetting all programmable parameters at once. Connect a jumper from the circuit common to pin 28, holding it in this position while applying power to the ELM327 circuit. Hold it in this position until you see the RS232 receive LED begin to flash (this means that all PPs are disabled). At this point, remove the jumper to allow the chip to perform a normal startup. Note that the PP reset happens quite quickly — if you hold the jumper on for more than a few seconds and do not see the RS232 receive LED flashing, remove the jumper and try again, as there may be a connection problem. |
AT PP hh ON |
turn on Programmable Parameter hh This command enables the programmable parameter with number hh. Once enabled, any value assigned with the PP hh SV command will be used where the factory default value was previously in effect. (All programmable values are set to defaults at the factory, so enabling a programmable parameter before assigning it a value will not cause a problem.) The actual time at which this parameter's value takes effect is determined by its type. For more information about the types, see the "Programmable Parameters" section (page 72). Note that 'PP FF ON' is a special command that enables all programmable parameters at once. |
AT PP hh SV yy |
Prog. parameter hh: Set the Value to yy This command assigns a value to a programmable parameter. The system will not be able to use this new value until the programmable parameter is enabled with the PP hh ON command. |
AT PPS |
Programmable Parameter Summary This command displays the complete set of current programmable parameters (even those that have not yet been implemented). Each one is shown as the PP number, followed by a colon and the value assigned to it. This is then followed by a single digit — 'N' or 'F' — to show that the parameter is on (enabled) or off (disabled), respectively. For a more detailed description, see the "Programmable Parameters" section. |
| Command | Description |
|---|---|
AT CV dddd |
Calibrate the Voltage to dd.dd volts The voltage reading that the ELM327 shows when AT RV is requested can be calibrated with this command. The argument ('dddd') must always be provided as 4 digits without a decimal point (the decimal place is assumed to be between the second and third digits). To use this feature, simply use an accurate meter to read the actual input voltage, and then use the CV command to change the internal calibration (scaling) factor. For example, if the ELM327 shows a voltage of 12.2 V and you measure 11.99 V, send AT CV 1199, and the ELM327 will calibrate to this voltage (it will actually read 12.0 V due to rounding of the digits). For more information on how to read the voltage and perform calibration, see page 31. |
AT CV 0000 |
restore the factory calibration value If you are experimenting with the CV dddd command but do not have an accurate voltmeter as a reference, you may soon run into trouble. In this case, you can always send AT CV 0000 to restore the ELM327's factory calibration values. |
The following pages provide a list of the currently available Programmable Parameters. The value shown in the ‘Type’ column indicates when any changes take effect. Possible values are: - I - the effect is Immediate, - D - takes effect after Defaults are restored (AT D, AT Z, AT WS, MCLR or power off/on) - R - takes effect after a Reset (AT Z, AT WS, MCLR or power off/on) - P - needs a Power off/on type reset (AT Z, MCLR, or power off/on)
Type: I — Immediate, D — after Defaults (AT D, AT Z, AT WS), R — after Reset (AT Z, AT WS), P — after Power off/on (AT Z)
| PP | Description | Values | Default | Type | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
00 |
Perform AT MA after power-up or reset | 00 = ON; FF = OFF | FF(OFF) |
R | ||||||||||||||
01 |
Print header bytes (AT H default setting) | 00 = ON; FF = OFF | FF(OFF) |
D | ||||||||||||||
02 |
Allow long messages (AT AL default setting) | 00 = ON; FF = OFF | FF(OFF) |
D | ||||||||||||||
03 |
NO DATA timeout time (AT ST default setting) | 00 to FF | 32(205 msec) |
D | ||||||||||||||
04 |
Default Adaptive Timing mode (AT AT setting) | 00 to 02 | 01 |
D | ||||||||||||||
06 |
Default tester address (Source Address) | 00 to FF | F1 |
R | ||||||||||||||
07 |
Last protocol to try during automatic search | 01 to 0C | 09 |
I | ||||||||||||||
09 |
Character echo (AT E default setting) | 00 = ON; FF = OFF | 00 (ON) |
R | ||||||||||||||
0A |
Linefeed character | 00 to 20 | 0A |
R | ||||||||||||||
0C |
RS232 baud rate divisor when pin 6 is high (logic 1) P baud rate (in kbps) = 4000 ÷ (PP 0C value) For example, 500 kbps requires a setting of 08 (since 4000/8 = 500) Here are some example baud rates, and the divisor to be used:
Notes: - 1. The PP 0C value must be provided as hex digits only. The decimal values (listed above in brackets) are only shown for your convenience. - 2. The ELM327 can only process continuous byte receives at rates of about 600 kbps maximum. If you need to connect at a higher rate, add a delay between the bytes to maintain an average rate of 600 kbps or less. - 3. A value of 00 provides a baud rate of 9600 bps. |
00 to FF | 68 (38,4) |
P | ||||||||||||||
0D |
Carriage return character | 00 to 20 | 0D |
R | ||||||||||||||
0E |
Power Control options Each bit controls an option, as follows: b7: Master enable 0: off 1: on if 0, pins 15 and 16 perform as described for v1.0 to v1.3a (must be 1 to allow any Low Power functions) b6: Pin 16 full power level 0: low 1: high normal output level, is inverted when in low power mode b5: Auto LP control (0: disabled 1: enabled) allows low power mode if the RS232 activity stops b4: Auto LP timeout 0: 5 mins 1: 20 mins no RS232 activity timeout setting b3: Auto LP warning (0: disabled 1: enabled) if enabled, says ‘ACT ALERT’ 1 minute before RS232 timeout b2: Ignition control (0: disabled 1: enabled) allows low power mode if the IgnMon input goes low b1: Ignition delay 0: 1 sec 1: 5 sec delay after IgnMon (pin 15) returns to a high level, before normal operation resumes b0: reserved for future - leave set at 0 |
00 to FF | 9A |
R | ||||||||||||||
0F |
Activity Monitor options. Each bit controls an option, as follows: b7: monitor master control (0: disabled 1: enabled) must be 1 to allow b3 to b6 b6: allow wake from Low Power (0: no 1: yes) wakes on shift from no activity to activity b5: Auto LP control (0: disabled 1: enabled) allows low power mode if the OBD activity stops b4: Auto LP timeout 0: 30 secs 1: 150 secs no OBD activity timeout setting b3: Auto LP warning (0: disabled 1: enabled) if enabled, says ‘ACT ALERT’ on timeout b2: reserved for future - leave set at 1 b1: add exclamation mark (0: no 1: yes). if 1, sends ‘!’ before ACT ALERT and LP ALERT b0: LP LED (0: disabled 1: enabled). if 1, the OBD Tx LED flashes when in Low Power mode (one 16 msec flash repeated every 4 seconds) |
00 to FF | D5 |
D | ||||||||||||||
10 |
J1850 voltage settling time (msec) = (PP 10) × 4.096 | 00 to FF | 0D |
R | ||||||||||||||
11 |
J1850 Break signal monitoring (reports BUS ERROR if limits are exceeded) | 00 = ON; FF = OFF | 00 (ON) |
D | ||||||||||||||
12 |
J1850 Volts (pin 3) output polarity normal = Low output for 5V, High output for 8V invert = High output for 5V, Low output for 8V |
00 = invert R; FF = normal | FF (normal) |
R | ||||||||||||||
13 |
Time delay added between protocols 1 & 2 during a search setting (in msec) = 150 + (PP 13 value) x 4.096 | 00 = ON; FF = OFF | 55 (498 msec) |
I | ||||||||||||||
14 |
ISO/KWP final stop bit width (provides P4 interbyte time) setting (in µsec) = 98 + (PP 14 value) x 64 | 00 to FF | 50 (5.2 msec) |
D | ||||||||||||||
15 |
ISO/KWP maximum inter-byte time (P1), and also used for the minimum inter-message time (P2). setting (in msec) = (PP 15 value) x 2.112 | 00 to FF | 0A |
D | ||||||||||||||
16 |
Default ISO/KWP baud rate (AT IB default setting) Note: 4800, 12500, and 15625 baud can not be set as defaults |
00 = 96;FF = 10 | FF(10.4K) |
R | ||||||||||||||
17 |
ISO/KWP wakeup message rate (AT SW default setting) setting (in msec) = (PP 17 value) x 20.48 | 00 to FF | 92(3.0 sec) |
D | ||||||||||||||
18 |
ISO/KWP delay before a fast init, if a slow init has taken place setting (in msec) = 1000 + (PP 18 value) x 20.48 | 00 to FF | 31(2.0 sec) |
I | ||||||||||||||
19 |
ISO/KWP delay before a slow init, if a fast init has taken place setting (in msec) = 1000 + (PP 19 value) x 20.48 If you are having trouble connecting, increasing this time to 5 seconds (C3) may help. | 00 to FF | 4F (2.6 sec) |
I | ||||||||||||||
1A |
Protocol 5 fast initiation active time (TiniL) setting (in msec) = (PP 1A value) x 2.5 | 00 to FF | 0A(25 msec) |
D | ||||||||||||||
1B |
Protocol 5 fast initiation passive time (TiniH) setting (in msec) = (PP 1B value) x 2.5 | 00 to FF | 0A(25 msec) |
D | ||||||||||||||
1C |
ISO/KWP outputs used for initiation (b7 to b2 are not used) b1: L line (pin 22) 0: disabled 1: enabled b0: K line (pin 21) 0: disabled 1: enabled If disabled, an output will remain low during protocol initiations |
00 to FF | 03 |
D | ||||||||||||||
1D |
ISO/KWP P3 time (delay before sending requests) Ave time (in msec) = (PP 1D value - 0.5) x 4.096 | 00 to FF | 0F |
D | ||||||||||||||
1E |
ISO/KWP K line minimum quiet time before an init can begin (W5) setting (in msec) = (PP 1E value) x 4.096 | 00 to FF | 4A(303 msec) |
D | ||||||||||||||
1F |
KWP byte count includes the checksum byte? | FF = NO;00 = YES | FF(NO) |
R | ||||||||||||||
20 |
ISO/KWP 5 baud initiation W1 timer start point The minimum time, measured from the beginning of the Address byte stop bit before the Sync byte may appear. T = (PP 20 value) x 1.984 msec Note that the standards define a range for this value from 260 msec to 500 msec. |
00 to FF | 5D(185 msec) |
R | ||||||||||||||
21 |
Default CAN silent monitoring setting (AT CSM) | FF = ON; 00 = OFF | FF(ON) |
R | ||||||||||||||
24 |
CAN auto formatting (AT CAF default setting) | 00 = ON; FF = OFF | 00(ON) |
D | ||||||||||||||
25 |
CAN automatic Flow Control (AT CFC default setting) | 00 = ON; FF = OFF | 00(ON) |
D | ||||||||||||||
26 |
CAN padding byte (used to pad CAN messages to 8 bytes) | 00 to FF | 00 |
D | ||||||||||||||
28 |
CAN Filter settings (controls CAN sends while searching) The bits of this byte control options, as follows: b7: 500 kbps match 0: ignored 1: required b6: 250 kbps match 0: ignored 1: required b5 to b1: reserved for future - leave set to 1 b0: send if bus is quiet 0: not allowed 1: allowed |
00 to FF | FF |
D | ||||||||||||||
29 |
Print CAN data length (DLC) when displaying headers (AT D0/D1 default setting) | 00 = ON; FF = OFF | FF(OFF) |
D | ||||||||||||||
2A |
CAN Error Checking (applies to protocols 6 to C). Each bit of this byte controls an option, as follows: b7: ISO15765 Data Length 0: accept any 1: must be 8 bytes b6: ISO15765 PCI = 00 0: allowed 1: not allowed b5: Search after ERR94 0: normal 1: CAN is blocked b4: Search after LV RESET 0: normal 1: CAN is blocked b3: Wiring Test 0: bypass 1: perform Processing 7F xx 78’s: b2: enabled (CAN & KWP) 0: no 1: yes b1: valid Modes (xx values) 0: all 1: only 00 to 0F b0: valid CAN protocols 0: all 1: only ISO15765 |
00 to FF | 3C |
D | ||||||||||||||
2B |
Protocol A (SAE J1939) CAN baud rate divisor baud rate (in kbps) = 500 ÷ (PP 2B value). For example, setting this PP to 19 (ie. decimal 25) provides a baud rate of 500/25 = 20 kbps. | 01 to 40 | 02(250 Kbps) |
R | ||||||||||||||
2C |
Protocol B (USER1) CAN options. Each bit of this byte controls an option, as follows: b7: Transmit ID Length 0: 29 bit ID 1: 11 bit ID b6: Data Length 0: fixed 8 byte 1: variable DLC b5: Receive ID Length 0: as set by b7 1: both 11 and 29 bit b4: baud rate multiplier 0: x1 1: x 8/7 (see note 3) b3: reserved for future - leave set at 0. b2, b1, and b0 determine the data formatting options: b2 b1 b0 Data Format 0 0 0 none 0 0 1 ISO 15765-4 0 1 0 SAE J1939 Other combinations are reserved for future updates – results will be unpredictable if you should select one of them. |
00 to FF | E0 |
R | ||||||||||||||
2D |
Protocol B (USER1) baud rate divisor baud rate (in kbps) = 500 ÷ (PP 2D value). For example, setting this PP to 0A (ie. decimal 10) provides a baud rate of 500/10 = 50 kbps. | 01 to 40 | 04(125 Kbps) |
R | ||||||||||||||
2E |
Protocol C (USER2) CAN options. Each bit of this byte controls an option, as follows: b7: Transmit ID Length 0: 29 bit ID 1: 11 bit ID b6: Data Length 0: fixed 8 byte 1: variable DLC b5: Receive ID Length 0: as set by b7 1: both 11 and 29 bit b4: baud rate multiplier 0: x1 1: x 8/7 (see note 3) b3: reserved for future - leave set at 0. b2, b1, and b0 determine the data formatting options: b2 b1 b0 Data Format 0 0 0 none 0 0 1 ISO 15765-4 0 1 0 SAE J1939 Other combinations are reserved for future updates – results will be unpredictable if you should select one of them. |
00 to FF | 80 |
R | ||||||||||||||
2F |
Protocol C (USER2) baud rate divisor. baud rate (in kbps) = 500 ÷ (PP 2B value) For example, setting this PP to 19 (ie. decimal 25) provides a baud rate of 500/25 = 20 kbps. | 01 to 40 | 0A(50 Kbps) |
R |
The ScanDoc adapter extends the ELM327 protocol with DoIP support (Diagnostics over Internet Protocol, ISO 13400). This makes it possible to perform Ethernet diagnostics of modern vehicles through the familiar ELM327 AT command interface.
Detailed description of the DoIP protocol (ISO 13400) →
The ScanDoc adapter extends the ELM327 protocol with BMW HSFZ support (High Speed Fahrzeug Zugang). This is BMW's proprietary protocol for Ethernet diagnostics, using 1-byte addressing and a simplified frame format without Routing Activation.
Detailed description of the BMW HSFZ protocol →
In normal mode (without the AT prefix), commands are sent directly to the vehicle. Commands are written as hexadecimal bytes:
| Command | Description |
|---|---|
01 00 | Request supported PIDs (Mode 01) |
01 0C | Read engine RPM |
01 0D | Read vehicle speed |
03 | Read stored fault codes (Mode 03) |
04 | Clear fault codes (Mode 04) |
09 02 | Read the VIN (Mode 09) |
