Sniffing OBDII on 2013 Honda Fit Sport

honda-fit-sport-2013-obd2-notes.md

Honda OBDlink SX notes 2015-08-19

My OBDLink SX data:

>AT I
ELM327 v1.3a
>ST DI (HARDWARE ID STRING)
OBDLink SX r4.2
>ST I (FIRMARE ID STRING)
STN1130 v4.0.1
>st mfr (Manufacturer)
ScanTool.net LLC
>st sn (SERIAL NUMBER)
113010745724
>

Baud rate

The OBDlink SX defaults to 115200. So:

screen /dev/tty.usbserial-00001004 115200

or, on Linux, sometimes:

screen /dev/ttyUSB0 115200

Most useful AT commands

Display commands

Linefeeds on:

AT L1

Linefeeds off:

AT L0

Print spaces on:

AT S1

Print spaces off:

AT S0

Echo on:

AT E1

Device commands

Display version info:

AT I

Reset device:

AT Z

Info commands

Read voltage on CAR END:

AT RV

ST Commands

These ST commands can get iffy. They are extended features.

Baud rate commands

You can accidently perminently change the baud rate... be careful not to lock yourself out...

Baudrate change timeout

Set how long it takes for you to reconnect on the new baudrate in milliseconds):

ST BRT 5000

Temporarily change the UART baudrate (default is 115200 I think):

ST SBR 1000000

Trying to log everything from the Honda fit

AT AT2 (turn on adaptive timing mode 2) AT H1 (turn on headers) AT AL (allow >7 byte long messages) AT SP 7 (set to protocol 7 which is ISO 15765-4 (CAN 29/500)) AT DP (Describe current protocol) 0100 (Get current data from car) 0300 (Get current trouble codes from car)

STP 34 (set the CAN protocol to ISO 15765-4 (CAN 29/500)) ST CMM1 (selecting CAN monitor mode. THIS IS UNDOCUMENTED! See below!)

ST MA (Actually start monitoring the CAN network... until it overflows the buffer.)

"The commands STCMM is for selecting CAN monitor mode. The 1 at the end of course chooses the CAN mode to monitor."

COMPLETE human readable CAN dumping!!!

Connect UART

screen /dev/ttyUSB0 115200
screen /dev/tty.usbserial-00001004 115200

Human readable

>AT L1	    (Linefeeds on)
>AT S1 		(spaces on)
>AT E1		(echo on)

Baudrate switch

>ST BRT 5000 	(Set the baud switch timeout)
>ST SBR 500000	(Set the new baudrate!)

Connect UART New baudrate (IN UNDER 5 SECONDS!)

screen /dev/ttyUSB0 500000
screen /dev/tty.usbserial-00001004 500000

Test new baud rate

>AT I 		(Get version info)

LOCK NEW BAUD RATE!

>ST WBR      (Write new baud rate to NVR

Configure data display options

>AT AT2    	(turn on adaptive timing mode 2)
>AT H1     	(turn on headers)
>AT AL     	(allow >7 byte long messages)
>AT SP 7   	(set to protocol 7 which is ISO 15765-4 (CAN 29/500))
>AT DP     	(Describe current protocol)

Test Data one more time using basic PID request

>0100      	(Get current data from car to test comms)
>0300      	(Get current trouble codes from car just for the sake of it!)

Set up the CANBUS end

>STP 34    	(set the CAN protocol to ISO 15765-4 (CAN 29/500))
>ST CMM1   	(selecting CAN monitor mode. THIS IS UNDOCUMENTED!)

Actually start logging CAN BUS messages!

>ST MA     	(Actually start monitoring the CAN network... until it overflows the buffer.)

REJOICE!!!!

Actually, hold enter down because something isn't entirely right with those settings...

Notes I posted to the fitfreak forum a while back

To get the device to spit data out in a human readable form:

AT Z reset the STN1100 
AT E1 echo on
AT L1 linefeeds on
AT S1 spaces on
AT AT2 respond faster
AT H1 show all detailed header info
AT AL allow long (>7 byte) messages
AT SP 7 force protocol ISO 15765-4 (CAN 29/500)
AT DP show current protocol

"After that, if the document jibberjabbs linked to is correct and you have the newer version of the STN1100 firmware on your device, the following commands should start logging all HS CAN traffic on the bus:"

STP 34 set the CAN protocol to ISO 15765-4 (CAN 29/500)
ST CMM1 enable CAN monitor mode (Undocumented at this time)
ST MA start logging CAN messages

Here are the commands jibberjabbs posted to the same forum that got me on the right track:

https://www.scantool.net/forum/index.php?topic=6956.0
These commands from the link above:

ATZ
STP31
STCMM1
ATH1
STMA