I have an ELM327 OBD2 BLE dongle that shows up as IOS-Vlink. To communicate with it, the service ID is: E7810A71-73AE-499D-8C15-FAA9AEF0C3F2 and both read and write is done using the characteristic BEF8D6C9-9C21-4C9E-B632-BD58C1009F9F.

Once the car (ECU) is on and the Bluetooth is connected, we need to initialize the dongle, by sending:

AT E0\r
AT L0\r
AT SP 00\r
01 00\r

AT E0 is to turn echo off. AT SP 00 searches for the right protocol to use to communicate with the ECU.

Once initialized, we can run a loop to query for the values we want:

• RPM is 01 0C\r
• Speed is 01 0D\r
• Throttle position is 01 11\r
• and so on.

This Wikipedia article has a table of PIDs that can be queried from the car and how to translate the results to human readable values.

Generally when a PID is queried (e.g. 01 0C\r), the result is something like 41 0C 0B C0 where 0C is the PID for this response and 0B C0 are the actual returned values in hex.

I often get corrupt replies from the dongle such as 41 0C 0B C, where the message is not fully received, which I ignore.

Responses end with >, so that’s something to look for. Read until you get >, split by line breaks, parse the lines.

Some PIDs take longer to get a response for than the others, so make sure you query what you want, so you can get the desired values with the highest frequency. Also note that ECUs have different speeds, some return results faster, some slower, some need waits between commands.

Back to Home