High Speed GMLAN and IP Packets

Hi all,

I recently finished up our Holley EFI to N2k gateways for the performance boat guys. Now starting work on a firmware to do HS GMLAN to J1939 and N2k protocol gauge output. Since I don't have a LS vehicle handy, I borrowed a customers 08 Duramax to capture some high speed data packets. Jacked into the engine harness bus where it enters the body control module, and then after starting, unplugged the BCM to isolate the ECM/TCM data.

As many of you may know the BCM acts as the gateway between ECM and IP cluster which runs over the low speed LAN. I was guessing that GM streamed the gauge info out of the ECM all the time. Then the BCM would translate to the low speed protocol used by the gauge cluster. My testing so far doesn't back up this theory... Look like the BCM requests the data several times per second.

While capturing raw engine packets I also Tee'd in a couple scanners, Torque and EFIlive. I was able to request all the normal gauge PID's like oil press, temps, MAP, TPS and such using OBD-II without the BCM in play. However OBD request always have some lag to them. So my question is, has anyone taken the time to reverse engineer much of the high speed GMLAN packets?

Before I dive into this, figured would be worth asking what others have accomplished on it. If we have to use OBD-II pids to request the data, then we will. But I guessing there's a smoother way this could be accomplished. The goal is to get stuff like boost and tach data into our gateway at 10hz or quicker, then process into a industry standard output with least delay.

-K

Update on project. I've been able to nail down some of the ArbID's and data values contained in certain byte positions. I was specifically after IC gauge data, so here a list from 2007 and newer GM trucks. Some of these likely carry over into the cars, but I haven't tried to verify any of them there. I found most of what we needed for the gateway project using some simple CAN tools and a couple nodes in a bench setup.

Name	ArbID	Byte #	Scaling	Description
GMLAN Broadcasts				Messages Streaming
ECM - RPM	0x000000c9	B2 B3	(B2B3*.25) or (B2*256)+B3)/4	IE: 0b3c = 2876 Rpm
ECM - Oil Pressure	0x000004d1	B3	(B3*0.766) = PSI	Scaling is in PSI [0x29 = open circuit]
ECM - Fuel Level	0x000004d1	B6	(B6*100/255) = %	Level is 0-100 % [0x26 = open circuit]
ECM - Throttle Position	0x000003d1	B2	(B2*100/255) = %	Range 0-100 %
ECM – Engine Temp	0x000004c1	B3	(B3-40) = Temp C	Scaling is Celsius [0x16 = open circuit]
ECM - Speedometer	0x000003e9	B5 B6	(B5B6/100) = MPH	Speed [0x80 0x00 = open circuit]
TCM - Gear Position	0x000001f5	B4	ASCII Values 1 thru 9	1=P, 2=R, 3=N, 4=D/M6 to 9=1/M1

I also isolated some of the GM specific dynamic pids used by OBD scan tools like the TechII to setup streaming of requested parameters. These are assigned a memory allocation area within FA-FE range, a broadcast speed, and are continuously sent with a specific ArbID so long as the OBD "tester present" command is received by the node. Speeds up the data flow and lessens the load on the bus compaired to the standard OBD "request pid / receive reply" way of doing things.

I'd love to work on learning more of the ArbID and byte positions for things like torque limiting requests if anyone is interested. Guessing someone with experience reading late model bin files could search by known ID's and possibly associate some of these commands used between nodes.

Cheers

-K

Is this not just CANBUS protocol? If so, this has already been hashed out for direct connections, just not for the GM protocol. The process would be the same though.

Yes it's all CANbus protocol. Details listed above are from the 500Kbps "High Speed" GMLAN they switched to in like 2006. While typical OBD-II commands are still usable, the ones I'm focused on are arbitrary ID messages between powertrain nodes. ECM talking to BCM, TCM to ECM, and such. Proprietary packets not included under OBD.

Example; When you turn the ignition to On or Start now, the BCM verifies your key is correct over the "low speed" bus. If the key or key fob passes security, the BCM sends a request to the ECM over high speed bus to start the engine. This is how ONSTAR performs a remote start function without a key.

Knowing those specific GM commands could allow you to start your car using any USB/WiFI/Bluetooth CANbus device connected to the high speed network.. No longer is the starter connected to an ignition switch. And the old Class 2 data feeding the IC is a thing of the past. Everything is CANbus now, with multiple networks per vehicle.

What I verified above is some ECM and TCM packets constantly being broadcast on the HS LAN. There is plenty more interesting data in there depending on specific model. Mapping all this "unlisted" data provides a new meaning to "drive by wire."

BTW: It's actually legal to hack your cars ECU's now... :happy:

This is pretty sweet since I was trying to track down how my 07 cluster gets oil pressure. Can you verify that it's getting a buffered value? Because it's real slow to react to changes where my live feed shows much more accurate data. I wanted to try to command actual oil pressure and trans temp to the DIC readout someday if I learn more.

For some reason GM buffered the oil pressure out of the ECM. At least on 2007.5 and up LMM Duramax. I tested the other day on a 2006 LBZ and noticed it was also buffered, but the open circuit value was actually zero rather than 30psi like the LMM.

If you read the oil pressure by a GM/OBD pid, it responds real time to input changes. My guess is GM decided to buffer it so the gauge did jump all over the place on acceleration / deceleration.

As for your DIC readout, Palmer industries has a programmable "DashLogic" unit out that does just that...
http://www.palmerperformance.com/sto...products_id=76

Found your post via Google. I am doing something similar. I am transplanting the engine from a 2009 silverado into a 1999 jimmy. In order to get the gauges to work, I need to translate packets from the GMLAN and inject them into the Class 2 serial data bus.

Quote:

---

Originally Posted by Keshka

Found your post via Google. I am doing something similar. I am transplanting the engine from a 2009 silverado into a 1999 jimmy. In order to get the gauges to work, I need to translate packets from the GMLAN and inject them into the Class 2 serial data bus.

---

Have our CANbus gateways converting HS GMLAN protocol into other languages on high speed networks. So getting the info needed from the 09 ECM is easy. Issue then is converting HS LAN down to class 2 data. What's needed is a two wire CANbus to single wire Class 2 converter. Bet an Arduino board guru could do it given the right information.

Other option might be look at factory BCM's. Right off I don't know of any particular GM BCM's that had HS LAN and Class 2 features, but it's possible some split year model did. If so, I know someone who can reprogram the BCM's to do what ya need.

Please let us know what ya find.

-K

I found this thread via google as well. I've got something a little different in mind.

I'm doing a bit of a retromod in a squarebody, and I am essentially trying to figure out how to use later model GM components in my project.

Questions I have been searching for answers too:

- Can the BCM run as a stand alone piece of hardware? I won't be running a GM ECU with this, so I don't know what if anything can function without one.
- How much of my legacy hardware could be adapted to work with a BCM? Cruise, turn signal lamps, HVAC, etc
- If I can't use a BCM, can I use some of GM controls independently? Example: If I fit this truck with a column from a 2008+ Sierra Denali, is there any way to make use of ignition, turn signals, wiper controls, steering wheel buttons?
- Is there existing hardware that does what I am looking for? Example: I know Axxess makes a variety of controls to retain steering wheel controls, but I don't think anything beyond that.
- Could this be something I could use Raspberry Pi or an Arduino for? Interpret signals from these controls and then activate a bank of relays to do something like activate a turn signal or something

I'm having a hard time finding information about GMLAN in general. Lots of people tapping into it in existing vehicles, but not too many using it the way I am thinking.

The 08 BCM will work in stand alone mode. Just need to look at the pinout list and see what all it normally controls. It uses two CAN networks, a high speed that communicates with the ECM/TCM, and low speed that communicates with everything else like radio, hvac, and door modules.

In your case pulling the steering column and other modules from same truck would probably do everything you need. No need for a HSLAN network. But you would need to rewire the key to start without the HSLAN. Currently the BCM sends a signal to ECM over HSLAN to crank engine when you turn the key. So it would not be able to do that unless you had something converting the language. Easy way, is just go straight to the PCM relay from the key crank wire and problem solved. Just use low speed network and will have 90% of what is normally used in the truck.

Hope that helps.

-K

I am planning to bypass TCM in Camaro ZL1 with a RPU running custom developed tansmission control software.
To be able to do this, I need to identify some specific GMLAN high speed ArbIDs and signals (Byte positions) in them. (Things like torque limiting requests that you have mentioned)

I am guessing what you have done for Trucks could be useful.
Would you be able to help?

I don't yet have all the specific TCM related messages mapped, but can certainly help you locate them. What's the ECM model, year, and OS version are your using?

Reason I ask, just recently discovered there are actually two different HS-GMLAN ArbID sets out there. From bench testing, one looks to be specific to LS powered Corvette, then another for everything else. So first thing is verify which version of GMLAN we are dealing with.

If you'd like,shoot me a PM on here with your contact details. Or reach me thru http://marinemods.us

-K

Hi KidTurbo, Great stuff. Some of the ARBID messages you posted at the beginning I didin't have. I have a few that are slightly different. Would you be interested in comparing notes?

Are you (or anyone) still working on this? I've done some with the GM lan in the past but have more experience with CAN bus from BMW. I can help analyze data or whatever. Currently I'd like to find the message that triggers the check engine light on and off. I can check it via OBDII PID's but I prefer to just listen to the message that has to already be sent :-)

Thaniel

Quote:

---

Originally Posted by Keshka

Found your post via Google. I am doing something similar. I am transplanting the engine from a 2009 silverado into a 1999 jimmy. In order to get the gauges to work, I need to translate packets from the GMLAN and inject them into the Class 2 serial data bus.

---

Quote:

---

Originally Posted by KidTurbo

Have our CANbus gateways converting HS GMLAN protocol into other languages on high speed networks. So getting the info needed from the 09 ECM is easy. Issue then is converting HS LAN down to class 2 data. What's needed is a two wire CANbus to single wire Class 2 converter. Bet an Arduino board guru could do it given the right information.

Other option might be look at factory BCM's. Right off I don't know of any particular GM BCM's that had HS LAN and Class 2 features, but it's possible some split year model did. If so, I know someone who can reprogram the BCM's to do what ya need.

Please let us know what ya find.

-K

---

Yes with the right information i could program one of the modules I make to do it. Not sure about linking so I won't. Currently I make some modules for engine conversion swaps. Mostly LS1 or LSx engines into BMW. Taking the Class2Serial data or the GM Lan CAN bus data (depending on the engine) and converting the messages to BMW CAN Bus. Converting to GM lan to Class2Serial would simply be a matter of changing the program. Trick is having all the messages know for what to send when. RPM, temp, throttle position and a few others, no problem. But not everything is known. Perhaps together we could find some more? :-)

Quote:

---

Originally Posted by Thaniel

Hi KidTurbo, Great stuff. Some of the ARBID messages you posted at the beginning I didin't have. I have a few that are slightly different. Would you be interested in comparing notes?

---

Yeah I'd be happy to share notes one the GM stuff. I recently only discovered that all OS in the Corvettes, and possibly a couple others LS, used a completely different ArbID structure. So I've been working on that protocol the past couple months. Think I have a check engine light byte identified for it, but not yet for protocol above..

Sending you a PM with my contact info. Think I've stumbled across your work on the BMW swaps before.

Cheers

-K

Quote:

---

Originally Posted by KidTurbo

Yeah I'd be happy to share notes one the GM stuff. I recently only discovered that all OS in the Corvettes, and possibly a couple others LS, used a completely different ArbID structure. So I've been working on that protocol the past couple months. Think I have a check engine light byte identified for it, but not yet for protocol above..

Sending you a PM with my contact info. Think I've stumbled across your work on the BMW swaps before.

Cheers

-K

---

E-mail sent.

Yah the alternate ARBID's are weird. Seen that too.

Yup. BMW CAN bus is my main thing. But I've collected and found a bit of GM stuff to help with GM engines swapped into BMW's. I don't mind sharing what I have. Haven't posted what I have mostly due to just getting to doing it :-)

Thaniel

Hi

Just been looking at your post from a few years back.
Just wondering if you got any further with arb high speed GMLan IDs?
Would it be possible to get what you’ve managed to decode so far?

I am working on a project where we are using a Holden (Chev) Cruiz engine to drive a
Hydraulic pump. Some of your IDs seem to match. Eg 16xC9 eng rpm.
The Cruz doesn’t have a oil pressure sender but just a switch.
Can’t seem to see any obvious change in arb data stream while disconnecting switch?

Any help would be greatly appreciated