Ble device protocol

Hi everyone.

Is there some documentation regarding Bluetooth Low Energy communication if I wanted to make my own "OBD-like" device? I know, that Bluetooth BR devices uses ELM 327 AT commands over the serial connection, but with BLE we have GATT characteristics and services. Are there some standard ones? I saw that RaceChrono supports at least one BLE OBD device (tonwon or something) so I assume it is technically possible to connect RaceChrono to a BLE reader. Oh and I have motorbikes in mind which do not support OBD so I wanted to start with my bike (FZ/MT 09) and maybe gradually hack some other models/brands later on.



  • There's no standard characteristics for this, every device uses it's own... I think Tonwon uses the UUIDs for it's services and charateristics from the BLE<=>Serial circuit that it uses. There is one service, and that service has two characteristics that are used. One is tx and one is rx. The tx one you listen notifications and receive 20 bytes of data at once. The rx you send 20 bytes of data at once. Tonwon is pretty cheap so maybe you can buy that and build your device to emulate it.
  • Great Idea I'll buy one of these. And thanks for the clear description of characteristics.
  • aolaol
    edited August 2018
    And use some BLE explorer app to poke around the characteristics. You will find the UUIDs etc with that took. You can try to send "ATZ" + ascii 13 to the rx charasteristic and everything will be clear :)
  • You were helpful, thanks. I'll post here when I make the device (if ever).
  • I bought some cheap OBD reader labeled "Mini OBD (iOS)". I verified It works with RaceChrono under "+Add OBD-II reader / Bluetooth OBD-II reader" menu option, and I am able to connect to it via nrfConnect as well. It advertises itself as LE only device, is LimitedDiscoverable, and has (among others) 0xfff0 service with two characteristics 0xfff1 for reading and 0xfff2 for writing (like you described earlier).

    Then I replicated everything in my device as closely as I was able to. I have even almost the same advertising flags with appearance, complete list of 16bit uuids, I have the 0xfff0 GATT service and so on. But it seems as if RaceChrono wasn't even attempting to connect to my device (I can monitor all events on a console). From nrfConnect there is no problem with my widget, it works.

    Does the "+Add OBD-II reader / Bluetooth OBD-II reader" support BLE? Maybe this cheap OBD reader has Bluetooth BR also (not LE) and somehow R.C. connects using BR? Do you have some advice maybe? Can you point me in the right direction? My experience with Android is limited to some basic examples, but maybe you could point me to some APIs you use?

  • Yeah, indeed, my OBD dongle uses YICHIP YC1021 which is a dual mode device. So it looks like R.C. connected to is using "old" bluetooth. Do you support other BLE devices than TONWON? Thanks.
  • RaceChrono connects to using BLE when used with Tonwon setting. I think you're not advertising the correct service with correct UUID, otherwise it would be visible on that list. RaceChrono searches nearby devices and filters them by service adverticed UUIDs.

    You are aware that 0xfff0 is not the full UUID right?
  • Yes, this 0xfff0 is a 16bit UUID (as opposed to full 128bit) of my Chinese dongle which advertises itself as 'OBDII'. Full 128bit UUID looks a little more fancy. I found correct UUID for the TONWON (which I am still waiting for) over the net and now RaceChrono connects and then tries to do something (or waits for something), and then disconnects, and the cycle repeats few times in the 5 minutes trial period. So some progress, but not quite there yet. Maybe R.C. needs other some services other than this magic serial service as well? Battery Service maybe? Or it waits to be notified about some data like "ELM327 v1 .3a\r"?
  • aolaol
    edited August 2018
    Actual connection needs the service and the tx and rx characteristics with correct UUIDs. If it fails to get them, it reconnects. RaceChrono also registers to tx characteristic notifications. It's done through some service UUID.
  • OK, I've got "ATZ". It seems that my phone has cached GATT information about my device, and even restart didn't helped. But when I changed public address of my device, the phone suddenly discovered all the GATT characteristics. Thanks for your help. Now I'll implement ELM compatibility.
  • Yeah just monitor what RaceChrono sends and answer accodingly. Have fun :)
  • So for different OBD2 reader need to apply different way to identify data for different protocol or the device from different manufacturers?
  • aolaol
    edited November 2019
    @sammy: Not sure if I understand the question... but basically all readers use ELM 327 compatible command set as top protocol. It is streaming protocol, so it fits nicely with "old" Bluetooth RFCOMM (serial port profile). Bluetooth LE is not streaming protocol, so there's no standard how to do this. 90% of the BLE readers implement one service that has one characteristic for transmit (TX) and one for receiving (RX). Unfortunately almost all of them use different UUIDs (1 for each service and characteristic, so 3 in total), so that needs to be configured per supported device model.

    If you're building your own BLE device, I suggest buying a "Carista" reader as reference. It works pretty well, and quite a few other ones use the same UUIDs.
Sign In or Register to comment.