94-95 ABS Actuation via ALDL?

[NomakeWan]

Hey everybody,

Little side topic since it’s not directly engine-related, but lately I’ve been reading spec sheets and manuals and noticed that one thing a Tech I can do that (as far as I know) no PC software can is talk to the ABS unit and get it to actuate. This is recommended as part of a full brake system bleed procedure. It’s just another message over ALDL so I’m not sure why this doesn’t seem to be possible. All the research I’ve done shows that people either buy a Tech I, take it to a dealer with a Tech I, or do it sketchy by driving down gravel and forcing the ABS to come on.

So, anyone know what “magic” the Tech I is doing on the ALDL for its ABS bleed procedure?

[kur4o]

It is a matter of sending a command via ALDL. You can also log data. A definition needs to be add to eehack to enable logging.

The commands might differ from abs to abs module. I have sniffed the commands for 94-95 f-body abs. Finding it is another matter.

Tech2 and mdi also work for some of the 91-on vehicles. Somehow mdi have trouble connecting to some of the ALDL modules. So it is hit or miss there.

[Terminal_Crazy]

Hi
Gary Dougs excellent 9495Scan software can communicate & control ABS on 94-95 F bodies as well as other engine controls (fans etc.)

I wrote software to communicate with the ABS and SIR system about 15 years ago to access the stored fault codes & clear ABS History.
It was fairly basic but worked.
It used similar ALDL control messages to the PCM.

Steveo's EEHack can send and receive messages to 94-95 LT1 PCM's (not sure what else it can communicate with ( possibly anything that communicates at the 8192 baud? rate)).
If you know the message to send, you can decode the reply easy enough.
The 160 & 8192 baud message streams are available on the internet.

HTH
Mitch

[Terminal_Crazy]

IThe commands might differ from abs to abs module. I have sniffed the commands for 94-95 f-body abs. Finding it is another matter.


The message streams are floating around the 'Net.
I have them saved away.

I also acquired a GM factory 1993 F Body ABS suppliment which has lots of info.It also mentions the Tech 1 and 6 test modes.

Mitch

[steveo]

eehack is ready to request and log any device on the bus, that's why i made it support external definition files, but nobody has actually done any work to support the ABS controller or anything else yet, and i wont do it without a vehicle

as far as actuation goes, if you have the commands, you can use the RAW COMMAND thing in eehack. it'll do the checksum and length bytes for you, you supply the rest. just make sure the thing is actually connected to the datastream when you use raw command as it sometimes has a total freakout if it isn't.....

i did try scan9495 one time and never made it work.

personally when i bleed the brakes on an ABS equipped car, i just pull the ABS fuses out and hammer the brakes a bunch of times. it's always worked for me to release whatever hydraulic device is trapping the air.

[NomakeWan]

Thanks all. It occurs to me I forgot to mention in the first post that my cars are both Y-bodies. I've slapped a signature on now so this won't be a problem going forward. As such Scan9495 never worked properly, since it was designed to talk to an F-body, not a Y-body. EEhack of course works perfectly.

Terminal_Crazy, since you seem to have the 'secret sauce' in your possession, and this being a hacking and reverse-engineering forum, would you mind just sharing said information? I don't mind doing manual commands or adding definitions, I had to do that back in my Subaru days when I was helping figure out communication with the Subaru SVX's various computers. But I'm relatively new to GM, so I wouldn't really know where to look or what magic search terms to use to get what I want. Any assistance you can provide would be appreciated.

EDIT: If by "definitions" you mean the ones from this very website, I did already have those, but they only contain commands to read data from the ABS/ASR computer, not to force it to actually perform tasks. The relevant definitions to my vehicles are here:

1992/1993/1994 Y-body Bosch ABS/ASR: http://gearhead-efi.com/gearhead-efi/def/aldl/A175.DS
1995 Y-body Bosch ABS/ASR: http://gearhead-efi.com/gearhead-efi/def/aldl/A288.DS

But yeah, if someone knows the proper commands to tell the ABS computer to actually do something like the Tech 1 does, I'm all ears.

[Terminal_Crazy]

Thanks all. It occurs to me I forgot to mention in the first post that my cars are both Y-bodies. I've slapped a signature on now so this won't be a problem going forward. As such Scan9495 never worked properly, since it was designed to talk to an F-body, not a Y-body. EEhack of course works perfectly.

Terminal_Crazy, since you seem to have the 'secret sauce' in your possession, and this being a hacking and reverse-engineering forum, would you mind just sharing said information? I don't mind doing manual commands or adding definitions, I had to do that back in my Subaru days when I was helping figure out communication with the Subaru SVX's various computers. But I'm relatively new to GM, so I wouldn't really know where to look or what magic search terms to use to get what I want. Any assistance you can provide would be appreciated.

EDIT: If by "definitions" you mean the ones from this very website, I did already have those, but they only contain commands to read data from the ABS/ASR computer, not to force it to actually perform tasks. The relevant definitions to my vehicles are here:

1992/1993/1994 Y-body Bosch ABS/ASR: http://gearhead-efi.com/gearhead-efi/def/aldl/A175.DS
1995 Y-body Bosch ABS/ASR: http://gearhead-efi.com/gearhead-efi/def/aldl/A288.DS

But yeah, if someone knows the proper commands to tell the ABS computer to actually do something like the Tech 1 does, I'm all ears.

Hi
I guess you have all those data streams.
That's what I had long before I read anything about anyone talking to the PCM. I think TunerCats was it at the time.
I was only looking to access the ABS fault codes which are listed in the streams (F body anyway)
Since I had Tunercats & could access the engine info I didn't see a need to access any more. I also didn't get to decode their raw output for other filtering software.
It was Steveo's EEHack that rekindled my interest as I could access the log data.

I'll mention Gary Doug again. His Scan 94-95 software accesses the 94-95 F Body pcm's.
He can also actuate the ABS motors.
I think he had a Tech 1 that he has reversed engineered (read the output code commands) to do this.

He is on lots of Fbody sites, www.CamaroZ28.com www.Ls1Tech.com .

Either contact him or see if anyone else has decoded a Tech 1.
It was always my intention to get one but the genuine ones were dear.
I think you can get a chinese copy for a couple of hundred $$.
It would be good if we could get a full list of control commands, Anybody interested?

Another thought:
Have you tried shutting up the babble on the other units on the bus or as I've read here pulling fuses for other modules on the bus that aren't required.
Can EEHack issue multiple commands?
I recall having to send a couple of "quiet" commands before asking for data or I got corrupted replies.

Mitch

[NomakeWan]

Thanks for the response! The issue with Scan9495 is that the bus addresses are actually different between the F-body and Y-body; so an F-body "shut up" command isn't the same as the Y-body "shut up" command and such. That being said it should be possible to fire up the program and just monitor the commands it's trying to send and see what those are doing, then try them on the Y-body with the appropriate address.

Also, I had a look through my 94-95 service manuals and some documentation on the Bosch ABS/ASR system with the Tech 1, and it appears that the ability to automatically bleed the system was actually only available in the '95, when they switched to the Bosch 5 ABS/ASR unit. The Bosch 2U in the 94 doesn't have an Auto Bleed description in the Tech I, nor does the '94 FSM have a section about auto bleed (only a manual bleed for the pilot feed line). So it looks like it's just the '95 that would have this.

[Terminal_Crazy]

I have a '95 F body and haven't had any issues bleeding the brakes.

I've used a vacuum unit that you fit onto each brake nipple & pull the fluid through.
I generally do it the old fashioned way, pump up the brakes and hold, then release & shut the bleeder valve.
There are also bleed nipples on the ABS unit at the front.

Mitch

[NomakeWan]

The ‘95 F-body did not have the Bosch 5 ABS/ASR unit, and these being non-integral you can’t bleed them using normal methods because if the ABS is not operating, then it is not connected to the brake hydraulic system whatsoever. The only way to bleed the ABS is to actually have it actuate its solenoids to connect it to the brake lines, at which point conventional bleeding methods are used.

[kur4o]

Isn`t there any manual way of opening the valves. On f-body there is procedures to start the engine for xx seconds twice and then shut off and start bleeding.

On vettes you have to shut up the ccm module. It is the standard mode 08 command but the ID is F1 [ecm id is F4]. When the ccm gets quiet you can poll any module on the bus. One of things to do is to rip off mode4 commands for f-body ecbm. I doubt they will be the same for the ybody module, but you never know.

[NomakeWan]

If there is a manual way, it is not detailed in any of the manuals I have access to. The unit is non-integral so it is totally separate hydraulically until activated for an ABS event. The only method detailed to make this connection for bleeding purposes is connecting a Tech 1 and following the Auto Bleed procedure. I was kind of hoping someone here just happened to know what commands it was sending already, but I’ll start by seeing what the F-body says and hope GM decided not to stray too far.

[kur4o]

You can start experimenting. I bet the command will be mode 4 request. You have to find the ID of module. In the ds file it is defined as $F9.
First send f1 xx 08 message to get the ccm quiet. You can dump the bus until a response is received.
You will likely need to resend that every 2 seconds.

That you can start sending
F9 xx 04 [...] messages.

First figure the length of [...] It can be 6,8,10 or 12 or ?? bytes. If it is shorter than needed it will be a problem. A longer message will be accepted without issues. The extra part will be ignored.
Sending [....] filled with zeroes is also safe. That way you can check if the length is correct and the message is accepted. Than you can start sending random data like 01s, 02s, 04s, 08s, 10s, 20s, 40s, 80s and listen for unusual activity at the solenoids, lamps actuation and so on. Write A map with the discovered info for reference. Mode 4 is used as follow. 2 consecutive bytes. 1st byte sets bit $04 means enable control of XX solenoid, second byte bit $04 means switch on or off the solenoid.

A sample message will be
00 00 04 04 00 00 00 00 00 00
or
04 04 00 00 00 00 00 00 00 00
And so on until you found some actuation.
Be prepared to turn off ignition if something unusual occurs. It will clear the commands and reset the ebcm.

[kur4o]

I got some free time and ripped some of the abs communication of 94 f-body. Here are the commands.

[NomakeWan]

Thanks for that! Though the system is completely different (the Bosch 5 is a 4-channel unit which emulates a 3-channel in software) there is a chance that GM had enough influence on its design that the serial data commands may be very similar. I’ll have time to mess with it this Friday.

[S.O.B.B.]

I am a licensed brake tech with abs experience but have been out of the biz more than 20 years.I've tried to stay familiar with systems and such. I am unfamiliar with the exact system u have but had this question.what exactly do u want to do and have done so far.do u just want to replace all the fluid as a maintenance job or was the system opened and got air in it.sometimes it's possible to mechanically trick the system.any difference in speed sensor values with brake pedal applied just enough for the brake switch it should trigger an event making the accumulater dump and charge just like an abs activation. I've never tried it with a vehicle raised and apply brake switch and spin just one wheel.the system sees zero speed and suddenly sees speed on one wheel while the brake switch says brakes are on it should trigger an event.I could be all wrong but hoped to help.

[NomakeWan]

Thanks for the response. The idea is to be able to perform the “auto bleed” function outlined in the 1995 Corvette FSM and 1995 TECH I manual, which energized individual solenoids to connect each ABS circuit to its associated corner in sequence so that the ABS system can be bled. This is because the Bosch 5 is a non-integrated system which is completely disconnected from the main brake hydraulics when inactive. As such, if air gets into the ABS circuit or one wants to flush old fluid out after 25 years, a certain procedure must be followed since there are no bleeder valves on the ABS unit itself.

In addition, there is a “relearn TPS zero position” command for the Bosch 2U and Bosch 5 ABS units which must be performed after replacing or altering the throttle body or TPS. These active commands are not provided in the GM serial datastream specifications, so I thought it would be a good idea to discover what the appropriate commands are and detail them for everyone’s benefit.

[NomakeWan]

Sorry for the delay in updating, but I had an opportunity to get my hands on both a Tech 2 and a protocol analyzer the other day and fumbled through using both to try to get some answers. The good news is I got a lot of good data out of it, but the bad news is that the EBCM is far dumber than I anticipated, and so I will need to go back and perform these tests again now that I know what I'm looking for. Not to mention I forgot to probe the command for relearning the TPS. D'oh!

First, the commands to initialize ABS communication are the same as the F-body--or rather, sending any command directly to the ABS once will initialize communication with it. Then any command sent after will actually be operated on by the EBCM. The Tech 2 just sends F9 57 01 00 repeatedly to make sure it's still communicating with the ABS. The rest of the Mode 01 commands are outlined in the DataStream definition files available on this very website, so I won't review them here. However, what I learned is that the EBCM is "dumb," or to be more accurate, it has no ability to run "programs" on request. It does not contain any code to perform an automatic bleed of the ABS. It does not have the ability to perform a self-test on demand; only when the vehicle speed exceeds 3.6 MPH and no other way. So, this being the case, how does the scan tool perform these tasks?

In the case of the automatic self-test, it actually sends a program to the EBCM, followed by a command to execute the program. Considering how small said program is, I imagine that all it's actually doing is creating a new interrupt vector that forces the EBCM to backtrack and perform its internal test on command. I'm not sure why they wouldn't have just programmed it to do that to begin with, but whatever. In any event, this is a Mode 06 command followed by a Mode 04. The command is as follows:

F9 79 06 04 00 00 12 1D 06 0E 00 EF 88 1C 71 BF 36 07 40 B0 14 7C B3 01 B1 20 14 EF 6F 1C B0 7C 14 F0 91 40 36 F0 87 ;Upload automatic test program
F9 56 04 AD ;Execute automatic test program

In the case of the automatic bleed, unfortunately the Tech 2 is in fact doing all the heavy lifting while the EBCM just responds to basic commands. The Tech 2 is sending Mode 04 commands to actuate specific solenoids and relays in a specific sequence at specific times in order to facilitate the bleeding of the system. This is disappointing as you can't just send a single command and be done, and also because my analysis of the communication is incomplete. My netbook couldn't keep up with the signal analyzer I was using, and had a nasty habit of dropping out when attempting to record for longer than a few minutes. The entire auto-bleed process can take several minutes per corner, so I don't have a complete dump of the process just yet. I will need to get access to both the Tech 2 and the analyzer (and a better computer) again so I can dump the commands and timestamps to know how to replicate this process on free software. In addition, I need to get the command to run the TPS relearn process.

I'll also try to get the commands for the '94 and earlier cars. While they don't have an auto-bleed, they do have an automatic self-test and a TPS relearn procedure, so it would be good to know those as well.

I'll update again once I have another opportunity, but it may not be for a few weeks.

EDIT: After further testing, I can't figure out what exactly the code above actually is. Nor does the code I received from my attempts to bleed the brakes make any sense. I have clear logs of three out of the four corners of the car, with the only missing log being the first corner (left rear). Yet attempting to send the commands to the EBCM results in nothing whatsoever happening. Sending the above Mode 06 command does receive the "acknowledgement mode 06" response, but after that the only thing that happens is that the ABS motor flicks on for a moment if you send any Mode 04 command (regardless of the content). It will still respond normally to a Mode 01 command, and of course will reset properly after being issued a Mode 00 command. This leads me to believe that my analysis missed out on some other piece of code that was transmitted earlier in the sequence, perhaps even once ABS was selected in the Tech 2.

As before, it just means I have more work to do. I'll update as soon as I have a chance to do more analysis with the tools.