OBDII codes

That looks like the stuff needed for the ScanGauge. I don't know how to fully program the SG and I dont have a gen 3 Prius but I'm sure someone here can do the math and get this info working.

 

I recall seeing stories of a SGII being able to cause the car to stall and have to be powered off/on. I think someone was playing with it and may have been sending requests very frequently or something like that.

What are the risks, if any, to the SGII causing damage, temporary or permanent, to the car?

 

IF you understand it, why dont you explain it to the rest of the forum?

 

So you are not willing to risk your vehicle on codes that might mess up something, and you want someone else to do if for you?

LMAO!

 

Now that makes more sense than the first post.

 

I posted this on cleanmpg.com to see if anyone there can help out.

Possible Gen 3 Prius codes for ScanGauge - CleanMPG Forums

 

hotbrass,

Many of us who have added a ScanGauge to our cars are very interested in retrieving additional information from them.

Yes, at this time there is some risk, but fortunately there are a few pioneers out there who are both financially able and/or curious enough to take those risks. And after they've worked through these initial issues then this information can benefit the rest of us.

So please don't discourage them from sharing this information with us by deriding their efforts. Remember, no one is asking you to test this on your car.

 

I too have a scangaugeII, and I too would like to see some 2010 codes work.

Anybody can post codes, so it is caveat emptor. It would have been a bit clearer and less cryptic if frenchie posted something like "These actually work on my EU 2010 Prius, would someone please try them on a NA Prius?"

 

I will be able to test these on a Canadian bought 2010 Prius soon.

 

nice work
letss see how long it wil take to hack the prius gen 3 ;-)

 

Not long, it seems.

http://priuschat.com/forums/gen-iii...06-scangaugeii-work-2010-a-5.html#post1037593

 

TPMS codes on OBDII

I've been watching the OBDII traffic while the tire pressure sensor was being set up. I'd love to post this data in a ScanGauge thread, but the current level of ScanGauge firmware just doesn't work with this traffic.

The Prius uses two data buses for OBDII traffic. The most familiar one is the CAN bus, which the ScanGauge supports. The other bus is a Toyota variant of ISO14230, otherwise known as KWP. The standard speed of the KWP bus is 10400 baud, but Toyota uses 9600 baud on KWP.

The only devices I know of that support the Toyota style of KWP are J2534 compatible units used with Techstream. The Scangauge does support 10400 baud KWP, but not the 9600 baud variant. Hopefully the Scangauge will be upgraded, and/or someone will figure out how to use an ELM interface, but for now the Techstream compatible units are the only game in town.

With that said, here are the KWP protocol messages that I've decoded for TPMS:

82 2a f0 21 06 . . . . . . . . . . . Query number of Main and 2nd Set sensors
84 f0 2a 61 06 x0 y0 . . . . . . . . Reply of the number of TPMS sensors.
. . . . . . . . . . . . . . . . . . ."x" is Main set, while "y" is 2nd Set.
. . . . . . . . . . . . . . . . . . .A value of "8" specifies 4 sensors, "A" specifies 5

84 2a f0 a5 06 x0 y0 . . . . . . . . Set number of Main and 2nd Set sensors
82 f0 2a e5 06 . . . . . . . . . . . Confirmation of set

82 2a f0 21 0a . . . . . . . . . . . Query vehicle speed
83 f0 2a 61 0a xx . . . . . . . . . .Reply of speed. Units/Scaling undetermined

82 2a f0 21 0f . . . . . . . . . . . Query sensor ID1 serial number
88 f0 2a 61 0f 00 00 xx xx xx xx . . Reply of serial number

82 2a f0 21 10 . . . . . . . . . . . Query sensor ID2 serial number
88 f0 2a 61 10 00 00 xx xx xx xx . . Reply of serial number

82 2a f0 21 11 . . . . . . . . . . . Query sensor ID3 serial number
88 f0 2a 61 11 00 00 xx xx xx xx . . Reply of serial number

82 2a f0 21 12 . . . . . . . . . . . Query sensor ID4 serial number
88 f0 2a 61 12 00 00 xx xx xx xx . . Reply of serial number

82 2a f0 21 13 . . . . . . . . . . . Query sensor ID5 serial number
88 f0 2a 61 13 00 00 xx xx xx xx . . Reply of serial number

82 2a f0 21 15 . . . . . . . . . . . Query current tire pressures
87 f0 2a 61 15 vv ww xx yy zz. . . . Pressure reply. vv to zz refer to ID1 thru ID5

82 2a f0 21 16 . . . . . . . . . . . Query current temperatures
87 f0 2a 61 16 vv ww xx yy zz. . . . Temperatures reply

82 2a f0 21 17 . . . . . . . . . . . Query sensor battery status
87 f0 2a 61 17 vv ww xx yy zz. . . . Battery condition reply (00=ok, 01=low)

82 2a f0 21 1a . . . . . . . . . . . Query warning level pressures
87 f0 2a 61 1a vv ww xx yy zz. . . . Warning level reply

There are additional messages for which the meaning is unknown. In particular, setting a new set of serial numbers has a rain dance that is, shall we say, obscure.

One thing that I can confirm is that the Prius TPMS can be configured for 5 sensors, including the spare tire. The addition of a switch to select the second set of sensor ids is probably also possible. The pinout of the TPMS ECU on a Lexus probably documents the necessary connections.

 

I am very interested in the 'dark' kwp toyota protocol and how it establishes communication.
Can you tell more about it.
TK

 

The story on KWP is still pretty much the same. The only devices that I've found that can communicate using the Toyota version of KWP are the Techstream compatible J2534 devices.

Toyota use of the KWP protocol with the Prius is limited to diagnostics only. ECUs do not talk to each other with KWP. So the TPMS ECU talks to a scantool with KWP. For communication with other ECUs, it uses BEAN on the Gen2 and LIN on the Gen3. The BEAN/LIN buses are not exposed on the OBDII connector.

I've been able to monitor Techstream/Mongoose KWP traffic with an ELM 327 device. The MA (Monitor All) mode at 9600 baud works. But the ELM cannot generate the Toyota version of Fast Init.

 

But as you say, it's possible to log the init sequency ¿no?
With Mongoose an his DLL , I have learned that it's possible to read all J2534 calls (I don't have Mongooset).
I have Tactrix openport and can be possible to log with it, but I don't exactly know how...and in their forum there isn't interest by toyotas

TK for your help

 

The FAST INIT output data recorded with Mongoose is 83 F0 2A C1 D9 8F. The reply is 81 2A F0 81. The connection is opened at 10400 baud, but reset to 9600 with a SET CONFIG before the FAST INIT.

FAST INIT consists of a pulse (50ms?), followed by the data. I tried just the data with the ELM, and got no response. Also tried an ELM FAST INIT followed by the data, also with no response. Maybe the Tactrix can do better.

 

Any passive messages decoded on gen 3?