Hi,

Recently I have received a CBT and now I got arount with looking into it. First of all, i searched the forums, but couldn't really find what I was looking for.

I'm trying to send a basic OBD-II message and want to see the response, such as for example listing the available PIDs or retrieving the current engine speed. I was trying both CoolTerm as the CBT application. I can connect to my COM port, issue a debug command ("01 10 01") and also see CAN packets in both CoolTerm and CBT. Now I'm trying to send the correct OBD-II commands, but I get no response. Not actually sure how it should look like and if I for example first have to enter a specific mode for these specific OBD-II commands. For example:
"02 01 0D" gives no output.

Any help would be appreciated. Thanks!

I've set up an Adroid application doing just that through bluetooth. You can find the source code here: https://github.com/eiannone/CBT-Diagnostic (see also here: http://forum.canb.us/discussion/comment/580/#Comment_580)
I would like to port it to a desktop app using serial port. It shouldn't be too difficult.

I got all information about OBDII protocol on wikipedia page: https://en.wikipedia.org/wiki/OBD-II_PIDs
Basically you have to send a broadcast CAN request using msgId/address 07DF and then listen for responses from id 07E0 - 07E7 .
The first byte of the CAN packet data is the "command mode", the second is the PID command, and the others are command data.
For example, to get all supported OBDII PIDs you must use mode 01 - "Show current data", and then command 00 - "Show supported pids".
The CAN packet request is the following:
07DF 02 01 00 0000000000

07DF is the broadcast address
02 is the number of data bytes
01 is the OBD mode (Show current data)
00 is the command PID "Show supported PIDS"
The rest of 0s are unused data bytes

To send this command with CBT you have to send the following serial port command:
02 01 07 DF 02 01 00 00 00 00 00 00 08

On my Mazda 3 I receive this CAN response:
07E8 06 41 00 98 3B 80 11 00
07E8 is the device id
06 is the number of additional data bytes
41 is the OBD mode, same as request mode (01h) with 40h added
00 is the PID code (same as request)
98 3B 80 11 is hex string with supported PIDs encoded, which translates to PID supported: 01, 04, 05, 0B, 0C, 0D, 0F, 10, 11, 1C, 20 (see Wikipedia for decoding)

To ease dealing with OBD protocol I implemented mask filtering on firmware for CAN messages id. That's because ODB II CAN messages id are only in the range from 0x7E8 to 0x7EF.

Long story short, I'm having problems connecting the CBT to a vehicle (another story for another post). So for now I'm using a ECU simulator with ISO 15765. I Connected a scan tool, and monitored all the packets being broadcast to read live RPM data. After the scan tool asks for supported PIDs, I select RPM, then begin the stream. When I begin the stream, the scan tool sends 0636 02 01 0C 00 00 00 00 00. The response from the ECU is 0636 04 41 0C 5E 55 00 00 00 ("5E 55" being the RPM value). I know that that is the expected response, but it only works when the scan tool sends it. If I send:
0201 0636 02 01 0C 00 00 00 00 00 08 (without spaces) on the CBT serial command, this is the response I get:
0455 A0 00 00 00 00
03E2 00 00 00 00
03DA 1 64 0 0 0 0 0 0
05E2 62 0 FF FF FF FF 0 0
All four packets repeat about 10 times, and I never get an RPM packet. Anybody have any ideas? I might be doing something wrong, but I'm not sure.