From 0bd6aef6b5ee9dd3ba2426f970f806423e74067b Mon Sep 17 00:00:00 2001 From: patri Date: Fri, 23 Oct 2026 14:21:44 +0200 Subject: [PATCH] ELM327 BLE verified in the car: service FFF0, FFF1 notify/write, ELM327 v2.1 Scanner log saved in 11-BLE-Scanner/results; CLAUDE.md updated with the adapter's GATT layout, replies and supported PIDs 01-20. Co-Authored-By: Claude Opus 5.5 --- .../results/2026-10-23_car_test.txt | 121 ++++++++++++++++++ CLAUDE.md | 7 +- 2 files changed, 127 insertions(+), 1 deletion(-) create mode 100644 11-BLE-Scanner/results/2026-10-23_car_test.txt diff --git a/11-BLE-Scanner/results/2026-10-23_car_test.txt b/11-BLE-Scanner/results/2026-10-23_car_test.txt new file mode 100644 index 0000000..560ee59 --- /dev/null +++ b/11-BLE-Scanner/results/2026-10-23_car_test.txt @@ -0,0 +1,121 @@ +===== Inspect 61:69:aa:93:64:c9 (t=154s since boot) ===== +(no name) +connect failed, error 13 + +===== Scan list (t=9s since boot) ===== +d8:a7:77:62:cf:2b -87 dBm (no name) [not connectable] +6a:0b:59:2f:28:34 -78 dBm (no name) +02:04:bd:fc:cf:71 -88 dBm (no name) [not connectable] +1e:f4:be:9f:3b:ec -81 dBm (no name) [not connectable] +48:db:b1:48:1c:ba -92 dBm (no name) +71:e4:11:0c:69:31 -92 dBm (no name) +d7:03:e0:21:ae:2c -82 dBm (no name) [not connectable] +c8:49:09:05:72:65 -92 dBm (no name) [not connectable] +50:ed:64:42:4e:1f -93 dBm (no name) [not connectable] + +===== Inspect 71:e4:11:0c:69:31 (t=9s since boot) ===== +(no name) -92 dBm + +SVC 0x1800 + 0x2a00 [R] + 0x2a01 [R] + +SVC 0x1801 + 0x2a05 [I] + +SVC 0x180a + 0x2a29 [R] + 0x2a24 [R] + +SVC d0611e78-bbb4-4591-a5f8-487910ae4366 + 8667556c-9a37-4c91-84ed-54ee27d90049 [W N] + +SVC 9fa480e0-4967-4542-9390-d343dc5d04ae + af0badb1-5b99-43cd-917a-a77bc549e3cc [W N] + +SVC 0x180f + 0x2a19 [R N] + +SVC 0x1805 + 0x2a2b [R N] + 0x2a0f [R] + +SVC 7905f431-b5ce-4e99-a40f-4b1e122d00d0 + 69d1d8f3-45e1-49a8-9821-9bbdfdaad9d9 [W] + 9fbf120d-6301-42d9-8c58-25e699a21dbd [N] + 22eac6e9-24d6-4bb5-be44-b36ace7c7bfb [N] + +SVC 89d3502b-0f36-433a-8ef4-c502ad55f8dc + 9b3c81d8-57b1-4a8a-b8df-0e56f7ca51c2 [W N] + 2f7cabce-808d-411f-9a0c-bb92ba96c102 [W N] + c6b2f38c-23ab-46d8-a6ab-a3a870bbd5d7 [R W] + +ELM candidate: + write 8667556c-9a37-4c91-84ed-54ee27d90049 + notify 8667556c-9a37-4c91-84ed-54ee27d90049 + +===== Scan list (t=43s since boot) ===== +be:67:00:63:4a:bb -69 dBm ELK-BLEDOM0B +57:d8:bc:03:00:d2 -86 dBm (no name) +11:23:d0:d0:94:76 -87 dBm (no name) [not connectable] +b8:ab:62:f5:df:63 -74 dBm BlackVue970X-EA0D41 +58:4b:32:d8:a0:00 -59 dBm (no name) svc: 0xfd5a +5f:20:5f:9e:52:29 -97 dBm (no name) [not connectable] +5c:a0:49:f2:3d:63 -93 dBm (no name) [not connectable] +e3:8d:69:a0:80:9d -90 dBm (no name) +5c:13:59:55:ef:8e -61 dBm (no name) svc: 0xfd5a +6f:9a:f3:43:9e:69 -93 dBm (no name) +65:03:4a:ef:35:58 -59 dBm (no name) svc: 0xfd5a +c6:f4:05:9e:ef:46 -95 dBm (no name) [not connectable] +1c:a1:35:69:8d:c5 -77 dBm OBDII [OBD?] svc: 0xfff0 +74:64:f9:df:4c:8e -69 dBm (no name) svc: 0xfd69 +53:61:36:06:da:f6 -66 dBm (no name) svc: 0xfd69 + +===== Inspect 1c:a1:35:69:8d:c5 (t=43s since boot) ===== +OBDII -77 dBm + +SVC 0x1800 + 0x2a00 [R] + +SVC 0x1801 + 0x2a05 [I] + +SVC 0xfff0 + 0xfff1 [W WnR N] + 0xfff2 [W WnR] + +ELM candidate: + write 0xfff1 + notify 0xfff1 + +===== ELM test 1c:a1:35:69:8d:c5 (t=50s since boot) ===== +> ATZ (reset) +ATZ +ELM327 v2.1 +> ATE0 (echo off) +ATE0 +OK +> ATI (version) +ELM327 v2.1 +> ATRV (battery voltage) +12.9V +> 0100 (supported PIDs (needs ignition on)) +41 00 BE 3E A8 13 + +===== Scan list (saved by button) (t=54s since boot) ===== +be:67:00:63:4a:bb -69 dBm ELK-BLEDOM0B +57:d8:bc:03:00:d2 -87 dBm (no name) +11:23:d0:d0:94:76 -87 dBm (no name) [not connectable] +b8:ab:62:f5:df:63 -71 dBm BlackVue970X-EA0D41 +58:4b:32:d8:a0:00 -59 dBm (no name) svc: 0xfd5a +5f:20:5f:9e:52:29 -95 dBm (no name) [not connectable] +5c:a0:49:f2:3d:63 -93 dBm (no name) [not connectable] +e3:8d:69:a0:80:9d -90 dBm (no name) +5c:13:59:55:ef:8e -61 dBm (no name) svc: 0xfd5a +6f:9a:f3:43:9e:69 -93 dBm (no name) +65:03:4a:ef:35:58 -59 dBm (no name) svc: 0xfd5a +c6:f4:05:9e:ef:46 -95 dBm (no name) [not connectable] +1c:a1:35:69:8d:c5 -81 dBm OBDII [OBD?] svc: 0xfff0 +74:64:f9:df:4c:8e -69 dBm (no name) svc: 0xfd69 +53:61:36:06:da:f6 -66 dBm (no name) svc: 0xfd69 + diff --git a/CLAUDE.md b/CLAUDE.md index e3ebf5c..3c58422 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -95,7 +95,12 @@ Re-flash it with Flash Download Tool: ESP32-S3, `1.85_demo.bin` @ 0x0. ## OBD adapter (user's) AliExpress "ELM327 Mini V2.1 Bluetooth OBD **Dual Mode** 5.1" — dual mode = Bluetooth Classic SPP **and BLE**, so the ESP32-S3 should be able to connect directly over BLE (no bridge ESP32). -Cheap dual-mode clones typically expose BLE service `FFF0` (notify `FFF1`, write `FFF2`) — **not yet verified** on this adapter; use `11-BLE-Scanner` in the car (results in its flash log). Adapter is powered from the car's OBD port (pin 16, 12 V). +**Verified in the car (2026-10-23, `11-BLE-Scanner`, log in `11-BLE-Scanner/results/2026-10-23_car_test.txt`):** +- BLE name **`OBDII`**, MAC `1c:a1:35:69:8d:c5`, advertises service **`0xFFF0`**. Characteristics: **`FFF1` [W, WnR, Notify]**, **`FFF2` [W, WnR]**. + Working setup: subscribe to notifications on `FFF1`, write commands (`"... "`) to `FFF1` (write without response) — `FFF2` is the usual write characteristic on such clones and should work too. +- Replies: `ATZ` → `ELM327 v2.1` (echo on by default → send `ATE0`), `ATRV` → `12.9V`, `0100` → `41 00 BE 3E A8 13`. +- **Supported PIDs 01–20** (from `BE 3E A8 13`): 01 monitor status, 03 fuel system, 04 engine load, 05 coolant temp, 06/07 fuel trim B1, **0B intake manifold pressure (MAP)**, **0C RPM**, **0D speed**, 0E timing advance, 0F intake air temp, 11 throttle, 13 O2 sensors, 15 O2 sensor 2, 1C OBD standard, 1F run time, 20 → more PIDs in 21–40. **No 10 (MAF)** → speed-density engine. +- Adapter is powered from the car's OBD port (pin 16, 12 V). ## Gotchas / observations - **LVGL 8 GIF bug (patched locally, only relevant if LVGL 8 is used again):** LVGL 8.3.11 `gifdec.c` (`gd_open_gif`) filled the canvas *opaque* with the GIF's background color. GIFs with a transparent background (e.g. `loligod.gif`, bg = RGB 28,29,49) showed that dark gray except where "restore to background" frames had cleared to transparent (→ screen black). **Patched** in the vendor copy `2-Program Example/Demo_Arduino/library/lvgl/src/extra/libs/gif/gifdec.c`: initial canvas alpha 0x00 (marked `LOCAL PATCH`). Re-apply if LVGL is ever replaced/upgraded.