For tech reference bits like baud rates and pinouts, check the appendix at the end.

I’ve wanted to know about what my 2005 Saturn Ion’s computer was saying to its instrument cluster since it first flashed “Low Fuel” on the built-in text display. Was the message from the ECU, or was it build into the dash? Oh the hacking possibilities could be endless! Enter this Bluetooth enabled clone of the ELM327:

This little guy was available on Amazon.ca for $23 (before shipping cost) and I thought it would be prefect to stream all of the data from my car’s CAN bus so I could search for text on the network. I was a little uninformed though as the 327 defaults to a baud rate of 38.4kbps and most cars after 2004 clock in at 500kbps or higher. That’s an order of magnitude off, so the flood of messages was way too much and I hit “BUFFER FULL” when I tried opening the firehose to stream the communication data from the network. I’d have to get creative. That’s where today’s adventure starts.

The main problem is with the Bluetooth to serial adapter pictured above. You can’t change its baud rate from the wireless end because it is a transparent bridge. To get both to work at a higher speed, I’d have to split them in half like an avocado and configure each over serial individually.  I opted for just the ELM327 for now, and would tackle Bluetooth another day.

On the hardware front, luckily the factory building this module only applied solder to five of the 32 pads making the desoldering a breeze and I the pinout for the Beken BK3231 was quickly found on this here forum thread.

Armed with knowledge, the soldering commensed! A few wires at SkullSpace later, and I had this:

I should take a quick break to mention that the electronics bench at SkullSpace has some great wire for this tiny work and a veritable cornucopia of through-hole diodes, resistors, and all kinds of random electronic bits. If you ever need something, just ask us. It’s normally for members, but we can be persuaded.

Back to the project now. With the delicate part done, it was time to hook the car half of the equation up to my trusty Bus Pirate for 3.3 volt serial fun. I found the probes a bit too fiddly, so I used a few 0.1” pitch jumper wires.

After some time of trying to hook up the ELM327 on my inside workbench, I found that it wouldn’t boot up and accept commands successfully on my desk with only the 12v lines, so it was out to the heated garage with the laptop to play around.

Then, good news and bad news: The good news was that it was able to pull data and I was able to get all the juicy documented OBD2 endpoints. The bad news was that even after ramping the baud rate up to 115,200bps I was still not getting data fast enough:

00 00 00 00 00 01 00 00 
00 03 20 03 22 00 00 00 
40 00 0F FF 3F FF F0 00 <DATA ERROR
00 FF 00 00 00 00 00 00 
00 00 00 00 00 01 00 00 
00 03 20 03 22 00 00 00 
80 00 0F FF 3F FE EF FF <DATA ERROR
00 FF 00 00 00 00 00 00 
00 00 00 00 00 01 00 00 
00 03 20 03 22 00 00 00 
80 00 80 00 80 00 80 00 <DATA ERROR
C0 00 0F FF 3F FD EF FE <DATA ERROR
00 FF 00 00 00 00 00 00 
00 00 00 00 00 01 00 00 
00 03 20 03 22 00 00 00 
00 00 0F FF 00 00 F0 01 
00 FF 00 00 00 00 00 00 
0A 43 FF 0A 
00 3E 08 
00 00 00 00 00 01 00 00 
00 03 20 03 
BUFFER FULL

So that’s where I sit at the moment, anti-climatically. I bought an FTDI adapter that can run at up to 3Mbps and subsequently bricked it. Join me next post for the unbricking process! Likely featuring our Seleae Logic8.

Appendix:

ELM327 commands used:

• AT Z – Reset device. Make sure we start fresh.
• AT L1 – Enable line breaks. Makes reading things as a human feasible
• AT MA – Monitor everything on the CAN bus. This is what is failing due to that buffer overflow.
• AT BRD xx – Attempt a new baud rate divisor
• AT PP 0C SV xx – Set a new baud rate. Requires a commit (the next command) and restart
• AT PP 0C ON – Makes the change permanent (dangerous if set beyond what your serial device can handle)

How to calculate ELM327 baud rates:

This should be obvious to most people, but it wasn’t for me the first time I needed the correct rate. Because the device uses a PIC micro controller, you’re supplying the divisor for the serial clock which is 4MHz. To get the right value value to feed into “AT BRD” and friends, just do the following:

4,000,000 / baud = rate

Then convert that to a hex value. Example:

4,000,000 / 115,200 = 34 -> 0x22

Note that if you set the rate outside of the range that your device supports (let’s say 0x24 which it a non-standard rate) you will have bricked your device until you can get yourself a Bus Pirate or similar that supports its own arbitrary divisor.

Also noteable is that there are error slew rates with different baud rates in micro controllers. Occasionally the rate may be off by 10% and the devices can’t communicate correctly. That’s where I’m at. 🙂

Bluetooth Pinout:

The Beken BK3231 is actually a pretty capable microcontroller with some nice features. On this device it’s potential seems a little wasted as it just comes with a serial-bridge firmware flashed to it, but it does make it convenient to use. I’ve read it has a compatible pinout to the HC-05, but I’m not certain there. For your convenience I pulled an image from this thread which was mentioned above. There is some great information there.