Only 4 supported PIDs? When several modules answer one request

A scan tool told us a 2019 Buick Encore supported four OBD-II PIDs. That list did not even include engine speed (PID 0C). Nothing was wrong with the car. The tool had asked a question that three modules answer, kept the first answer, and threw the other two away. This note walks through that case and two more where the same shortcut produced a wrong number.

What happened on the Encore

Every OBD-II scan starts by asking which PIDs the car supports: Mode 01, PID 00. The answer is a 4-byte bitmap, one bit per PID from 01 to 20. The scan then reads live data, runs its deeper checks and records baselines from that list.

On this Encore the list came back with four entries. Live data, the deep scan and the baselines all ran on those four. Run the scan again and the count could change, because the result depended on timing.

Why: a broadcast has more than one answer

A Mode 01 request normally goes to the functional address 7DF, which is a broadcast. Every module that takes part in emissions OBD answers with its own bitmap of the PIDs it supports. On this Encore, three modules answered, from 7E8, 7EA and 7EB.

ELM327-style adapters accept an extra digit after a request that means "stop after this many replies". Sending 01 00 1 returns as soon as one frame arrives. That is a real time saver for ordinary data PIDs, where usually only the engine computer answers. On PID 00 it means you keep whichever module was quickest and discard the rest.

On this car the quickest module reported 80 00 00 01. The first bit says PID 01 is supported. The last bit says "ask me about PIDs 21 to 40 as well". Nothing else was set. That bitmap described one module, not the car.

The fix

Ask without the limit, collect every reply, and combine them. A PID counts as supported if any module supports it, so the bitmaps are OR'd together, including the bit that points to the next range. That is what Lane Pilot does now.

One exception, on purpose: when the tool talks to a single module by its own address (as it does over DoIP), only one module can answer, and one bitmap is the right answer.

The same race, two more places

Readiness monitors (PID 01)

The same day, two Hondas showed 1/1 monitors complete. That was almost certainly the transmission module answering first: a single supported monitor is the usual shape of a transmission computer's reply, which typically supports only the comprehensive components check. On the Buick, the reply that won reported eight supported monitors, which points to the engine computer, and the scan read 8/8.

Readiness has to be combined across modules, with one extra step:

• Supported: OR across modules.
• Incomplete: OR across modules, but only for monitors that module says it supports. Some modules set the incomplete bit for monitors they do not run at all, and an unmasked OR would report a finished monitor as unfinished.
• MIL: on if any module says on.
• Stored code count: the sum.

This is the one that costs a customer money. A readiness number that is too small looks like a car ready for an emissions test, and a car sent in on that basis could fail at the station.

A counter that jumped: 2022 Genesis GV70

PID 31 is distance traveled since codes were cleared. On this GV70, two modules advertise it. One holds the real distance:

41 31 26 BF   ->  0x26BF = 9,919 km

The other answers FF FF, which reads as 65,535 km. The same car showed both 9,919 km and 65,535 km on reads two and a half minutes apart, depending on which module answered first.

The tempting fix is to ignore every FF FF. That is wrong too: 65,535 km is the counter's legitimate maximum, and a car that has gone that far since a clear really does report it. What Lane Pilot does instead: when the first answer is all FF, it asks once more without the limit and prefers a module that gave a real value. If every module says FF FF, that answer stands.

What to look for in your own tool

• A supported-PID count far below what the car should have, or one that changes from scan to scan.
• A readiness count that looks too small for the vehicle, especially one that reads complete.
• A counter that flips between two values on back-to-back reads.

On an ELM327 you can check by turning headers on (AT H1) and sending 01 00. If more than one ID comes back, every broadcast that matters on that car needs all of the replies, not the first one.