r/arduino • u/Fleag7 • Aug 15 '26
Look what I made! I built my own OBD2 Scanner
My wife's car had the check engine light and abs light come on, my scanners could only touch the PCM DTCs and I wondered, how hard would it be to make something that can pull DTCs from other modules?
I found out it's practically impossible due to those modules being locked behind manufacture specific commands that aren't public, but I decided to keep going to learn about how CANBUS works.
I used an STM32F103C8T6 chip on a blue pill board. I used the Arduino IDE to program it, which was amazing. I also used a SN65HVD230 CAN transceiver, a little SSD1306 I2C display, a rotary encoder, and a buck converter to take the vehicle's 12v down to 3.3v. All soldered onto an electro cookie bread board. The STM32 has a built in CAN peripheral, but it's normal logic level signals, the SN65HVD230 is used to turn those signals into the differential signal that CANBUS runs on. It can read DTCs, clear DTCs, read live vehicle data, and check the emissions monitors. I had to implement ISO-TP for the DTC scan in case the PCM has more than 3 DTCs, which wouldn't fit in a single CAN frame.
It looks goofy in this case I made for it, and I destroyed a couple boards making it happen, but it was a genuinely fun project to work on!
Finally got the github up!
8
u/kalel3000 Aug 16 '26
Wow this is really impressive!
Im curious, so this thing can read canbus traffic? Is it read only? Or can it also communicate on it? I know playing around with and mapping a canbus network must be daunting task, but it would be a cool way to maybe automate some basic features on a vehicle via home made device like this. Obviously avoiding critical systems but maybe automating like lighting/windows/radio/etc...
5
u/Fleag7 Aug 16 '26
Thank you!
This device does read bus traffic but it filters for what it's looking for. When I was building this, I had issues getting the car to respond, I ended up setting up another stm32 board to listen to everything on the bus and send it to the Arduino IDE serial monitor which was cool to see and I found out it was responding, it was that the buffer for messages on the scanner was getting filled with ambient bus traffic and it was missing the response.
But everything I'm doing with it now is just requesting and reading information, the clear dtcs function is as close to writing as I got but I don't know if it's considered writing, just a simple can bus request. I thought about the potential to make a tuner, maybe edit values in the PCM but I didn't want to mess up my car or the wife's car lol.
To gain access to change the lights, windows, radio, ect we'd have to talk to the BCM, which doesn't used standardized commands, it would be proprietary unfortunately...
5
u/CueAnon420 Aug 16 '26
Yeah - only the generic OBD2 commands are standardized because they are federally required. Everything else is up to the manufacturer and they all implement things differently. Not to mention generational changes.
I had a hacked copy of the Toyota TIS software and I thought about putting a logic analyzer on the network to see if I could reverse engineer the protocol used for the proprietary stuff, but never got around to it.
1
u/kalel3000 Aug 16 '26
I didn't mean like reprogramming modules. But if for instance you could filter and isolate the commands being sent by a specific module and interpret them, that could be pretty useful.
I know they have canbus decoders for steering wheel buttons for certain vehicles so you can install aftermarket radios. Even making your own version of something like that would be pretty useful.
But even more so if you could figure out some of these commands and resend them on the canbus network. Like to turn on interior lights, or raise windows, or adjust the radio, or small things like that but on command.
1
u/Fleag7 Aug 16 '26
Oh that's actually genius! Just listen to can bus and see what messages get sent when you do specific actions! I didn't even think of that...you could definitely do some interesting things then! That's assuming each BCM feature goes through CANBUS and not some other secondary network like LIN BUS or whatever.
1
u/kalel3000 Aug 16 '26
Yeah Im seriously considering my own version of this now to play with to experiment with it and see whats possible.
Im assuming part of the codes probably have like a prefix to distinguish where the the codes are originating from, which would help filter out alot of the background traffic.
1
7
u/AbbreviationsNo9609 Aug 16 '26
Very cool. I’m in the midst of a big OBD project myself.
6
u/Fleag7 Aug 16 '26
Ohhhh! Do tell! What you got going on?
3
u/AbbreviationsNo9609 Aug 16 '26
My Tacoma has been converted to run E fans, I’m controlling those fans by polling the ECU for engine temp and vehicle speed.
I can also adjust the set point on the fly and it runs a little OLED.I post about all my “tacoduino” projects in the Toyota Tacoma sub but r/arduino doesn’t allow cross posting and I keep my profile private. Maybe I’ll get some free time and post the write-up here.
I do need to make a post here, I need a way to emulate OBD data for bench testing.
2
u/Spirited_Release8360 Aug 19 '26
I’ve been working on an ESP32 based OBD2 project, and something I have been meaning to get around to is emulating OBD data.
My current plan is another ESP32 and a MCP2515, the build will be fairly simple, I just gotta get around to the firmware side of things.
1
u/AbbreviationsNo9609 Aug 19 '26
I’m not having very good luck with the MCP2515, it can pull a couple PID’s all day long but anything more and it’s buffer fills up and it freezes or resets or times out your program. OP mentions using the little Ti transceiver; I need to look into better hardware options.
1
u/Spirited_Release8360 Aug 19 '26
What’s the issue you’re having with the MCP2515, do you mean during normal use or trying to use it to emulate the CAN bus?
1
u/AbbreviationsNo9609 Aug 20 '26
During normal use. My project calls for engine coolant temp and speed, it runs just fine, keeps good data coming in, fan control runs flawlessly. When I try to get a third (rpm) it crashes. When I strip everything else out and just make it try to pull three pid’s and display them on the oled it can’t but again with just 2 it does so just fine.
My basic googling point me towards the buffer being so small it can only hold two pid’s and therefor you have to mess with the timing of everything to give it enough time to reset before you query it again for that third thing. Now I’m sure I could get it more functional at just adding that third pid but I have bigger needs for a future project so if I can switch to better HW now I may as well get after it.2
u/Spirited_Release8360 Aug 20 '26
Yeah the MCP2515 only has two RX buffers so it’s kinda limited in that aspect. If it receives frames faster than its reading over SPI it’ll flag and cause that freezing.
For your firmware you can just conditionally check error flags(0xC0 for RX0OVR and RX1OVR), and clear them to prevent the freezing, but it may cause bus instability. You could do sequential polling to mitigate(and probably hotfix the whole thing), and it wouldn’t be slow enough to matter for your use case.
But you may not even need that, are you polling every ECU(0x7DF) or just the engine ECU(0x7E0)? If you’re polling every ECU you’re likely getting duplicate frames from multiple ECUs, overflowing the buffer. Also make sure to mask and filter MCP input.
Something else possibly worth trying is polling all three values without the OLED, and seeing if that makes a difference. If it does, you need to boost your I2C clock(fast mode), and run your display update asynchronous from your CAN communication.
I’ve been experimenting with the MCP2515 and TJA1050 for a little bit and it works fairly well, I’m able to get live diagnostics over Bluetooth with my current setup. When I finish prototyping and testing I’ll use an upgraded SPI CAN controller, but I also prefer to use SPI in my particular application.
3
2
Aug 15 '26
[removed] — view removed comment
4
u/3DRAH33M Aug 16 '26
You need to install the STM32Duino core.
https://circuitdigest.com/microcontroller-projects/programming-stm32f103c8-board-using-usb-port
3
u/Fleag7 Aug 15 '26
It's been a while since I set it up but I'm pretty sure you can add the STM32 boards through the board manager, then i used a CP2102 USB to UART adapter to program it.
3
u/3DRAH33M Aug 16 '26
https://circuitdigest.com/microcontroller-projects/programming-stm32f103c8-board-using-usb-port
If you follow this guide, there is a bootloader you can install to directly use the USB port
3
u/Unlikely1529 Aug 16 '26
it's strange link.
stm32duinoreal landing is https://github.com/stm32duino/Arduino_Core_STM32/wiki/Getting-Started
3
u/ThrowRA_That_Owl_25 Aug 16 '26
Were you able to access all the vehicle hardware or this is just run of the mill scanner?
3
u/Fleag7 Aug 16 '26
I could only talk to the engine module, just whatever is standardized. The other modules aren't subject to the same requirements so manufacturers choose how other modules are interfaced with and its proprietary. I thought about going to a junk yard, pulling an ABS module and just poke at it at the bench and see if I could get it to sing, but that feels like a long shot...
2
1
u/juancarlospaco Aug 16 '26
They are simple electronic sensors, just in a fancy package, and they raise the price x100.
Most of them are 5VDC, only O2 sensor is 0~1VDC (0.1 poor, 1 rich), injectors are 12VDC electromagnets, ABS is just a Hall effect, IAT is just a resistor 300C + temp sensor, throttle sensor is just a variable resistor, all can be measured with a digital multimeter.
3
u/CueAnon420 Aug 16 '26
Many sensors are somewhat basic at their core, but do not underestimate the engineering and packaging needed to manufacture something that can withstand automotive environments...
Not that that justifies the cost increases.
1
u/Mechanic357 Aug 16 '26
To make it worse now they have Mac addresses and a firewall to keep others from getting access as well.
1
2
u/Its_Billy_Bitch Aug 16 '26
Girl, same! lol. You can see my OBD tab in the center (same functions under the hood, just integrated into LIVI). I used an R4 and MCP2515s. Gosh at the learning curves under there, but since I was already in the rabbit hole, I used my own private CAN to send data back and forth for parking sensors that I added, lighting that I also added, a P4 running as a dashcam/GPS, and the CAN from the Audi goes back to the Pi 5 running LIVI over the same CAN. Pi has LoRA, so I can connect from a pretty decent range and 5G as a final backup.
All that to say, has enabled this beautiful work in progress.
1
u/awue Aug 16 '26
Why screen so small
2
u/Fleag7 Aug 16 '26
Lmfao just used what I had, looks goofy as hell in that big blocky case huh? Lol
2
1
u/Technic-Eric Aug 16 '26
That's awesome. I just spent $100 on the blue driver one. Wish I thought of this!
1
1
u/coleskidmore Aug 16 '26
That buffer getting flooded by ambient traffic and eating the response is such a classic gotcha, glad you caught it with a second board sniffing everything. Curious if you ran into any timing issues with ISO-TP flow control frames or if the STM32 kept up fine
1
u/Fleag7 Aug 16 '26
I set the flow control to tell the pcm to just send everything it's got and in my simulated tests, it handled 6 DTCs just fine, but I didn't test it with anymore, not sure how it would handle that.
1
u/ScaryBacon Aug 18 '26
Random question. How would one test this without having to spend hours in your car?
1
u/Fleag7 Aug 19 '26
I set up another stm32 bluepill and canbus transceiver and connected it to my scanner and had it respond as if it were the car, like what I would expect the car to respond with.
-1
38
u/CueAnon420 Aug 15 '26
That's pretty cool. I have considered playing around with a similar project but never got around to it, Have you considered posting your code? I did some research on the ELM327 chip functions, but I'm sure there's more to it than that.
Thanks!