Bringing TBI and Multi Port Fuel Injection to a New Level.     EFI Conversions and Tuning! Seattle to Portland! E-mail Tuning Consultant!
Results 1 to 12 of 12

Thread: High Speed GMLAN and IP Packets

Hybrid View

  1. #1
    Fuel Injected! KidTurbo's Avatar
    Join Date
    May 2014
    Age
    50
    Posts
    25

    High Speed GMLAN and IP Packets

    Hi all,

    I recently finished up our Holley EFI to N2k gateways for the performance boat guys. Now starting work on a firmware to do HS GMLAN to J1939 and N2k protocol gauge output. Since I don't have a LS vehicle handy, I borrowed a customers 08 Duramax to capture some high speed data packets. Jacked into the engine harness bus where it enters the body control module, and then after starting, unplugged the BCM to isolate the ECM/TCM data.

    As many of you may know the BCM acts as the gateway between ECM and IP cluster which runs over the low speed LAN. I was guessing that GM streamed the gauge info out of the ECM all the time. Then the BCM would translate to the low speed protocol used by the gauge cluster. My testing so far doesn't back up this theory... Look like the BCM requests the data several times per second.

    While capturing raw engine packets I also Tee'd in a couple scanners, Torque and EFIlive. I was able to request all the normal gauge PID's like oil press, temps, MAP, TPS and such using OBD-II without the BCM in play. However OBD request always have some lag to them. So my question is, has anyone taken the time to reverse engineer much of the high speed GMLAN packets?

    Before I dive into this, figured would be worth asking what others have accomplished on it. If we have to use OBD-II pids to request the data, then we will. But I guessing there's a smoother way this could be accomplished. The goal is to get stuff like boost and tach data into our gateway at 10hz or quicker, then process into a industry standard output with least delay.

    -K

  2. #2
    Fuel Injected! KidTurbo's Avatar
    Join Date
    May 2014
    Age
    50
    Posts
    25
    Update on project. I've been able to nail down some of the ArbID's and data values contained in certain byte positions. I was specifically after IC gauge data, so here a list from 2007 and newer GM trucks. Some of these likely carry over into the cars, but I haven't tried to verify any of them there. I found most of what we needed for the gateway project using some simple CAN tools and a couple nodes in a bench setup.

    Name ArbID Byte # Scaling Description
    GMLAN Broadcasts


    Messages Streaming
    ECM - RPM 0x000000c9 B2 B3 (B2B3*.25) or (B2*256)+B3)/4 IE: 0b3c = 2876 Rpm
    ECM - Oil Pressure 0x000004d1 B3 (B3*0.766) = PSI Scaling is in PSI [0x29 = open circuit]
    ECM - Fuel Level 0x000004d1 B6 (B6*100/255) = % Level is 0-100 % [0x26 = open circuit]
    ECM - Throttle Position 0x000003d1 B2 (B2*100/255) = % Range 0-100 %
    ECM – Engine Temp 0x000004c1 B3 (B3-40) = Temp C Scaling is Celsius [0x16 = open circuit]
    ECM - Speedometer 0x000003e9 B5 B6 (B5B6/100) = MPH Speed [0x80 0x00 = open circuit]
    TCM - Gear Position 0x000001f5 B4 ASCII Values 1 thru 9 1=P, 2=R, 3=N, 4=D/M6 to 9=1/M1

    I also isolated some of the GM specific dynamic pids used by OBD scan tools like the TechII to setup streaming of requested parameters. These are assigned a memory allocation area within FA-FE range, a broadcast speed, and are continuously sent with a specific ArbID so long as the OBD "tester present" command is received by the node. Speeds up the data flow and lessens the load on the bus compaired to the standard OBD "request pid / receive reply" way of doing things.

    I'd love to work on learning more of the ArbID and byte positions for things like torque limiting requests if anyone is interested. Guessing someone with experience reading late model bin files could search by known ID's and possibly associate some of these commands used between nodes.

    Cheers

    -K

  3. #3
    Fuel Injected!
    Join Date
    Jun 2015
    Age
    29
    Posts
    287
    Is this not just CANBUS protocol? If so, this has already been hashed out for direct connections, just not for the GM protocol. The process would be the same though.

  4. #4
    Fuel Injected! KidTurbo's Avatar
    Join Date
    May 2014
    Age
    50
    Posts
    25
    Yes it's all CANbus protocol. Details listed above are from the 500Kbps "High Speed" GMLAN they switched to in like 2006. While typical OBD-II commands are still usable, the ones I'm focused on are arbitrary ID messages between powertrain nodes. ECM talking to BCM, TCM to ECM, and such. Proprietary packets not included under OBD.

    Example; When you turn the ignition to On or Start now, the BCM verifies your key is correct over the "low speed" bus. If the key or key fob passes security, the BCM sends a request to the ECM over high speed bus to start the engine. This is how ONSTAR performs a remote start function without a key.

    Knowing those specific GM commands could allow you to start your car using any USB/WiFI/Bluetooth CANbus device connected to the high speed network.. No longer is the starter connected to an ignition switch. And the old Class 2 data feeding the IC is a thing of the past. Everything is CANbus now, with multiple networks per vehicle.

    What I verified above is some ECM and TCM packets constantly being broadcast on the HS LAN. There is plenty more interesting data in there depending on specific model. Mapping all this "unlisted" data provides a new meaning to "drive by wire."

    BTW: It's actually legal to hack your cars ECU's now...

  5. #5
    Carb and Points!
    Join Date
    Sep 2012
    Posts
    7
    This is pretty sweet since I was trying to track down how my 07 cluster gets oil pressure. Can you verify that it's getting a buffered value? Because it's real slow to react to changes where my live feed shows much more accurate data. I wanted to try to command actual oil pressure and trans temp to the DIC readout someday if I learn more.

  6. #6
    Fuel Injected! KidTurbo's Avatar
    Join Date
    May 2014
    Age
    50
    Posts
    25
    For some reason GM buffered the oil pressure out of the ECM. At least on 2007.5 and up LMM Duramax. I tested the other day on a 2006 LBZ and noticed it was also buffered, but the open circuit value was actually zero rather than 30psi like the LMM.

    If you read the oil pressure by a GM/OBD pid, it responds real time to input changes. My guess is GM decided to buffer it so the gauge did jump all over the place on acceleration / deceleration.

    As for your DIC readout, Palmer industries has a programmable "DashLogic" unit out that does just that...
    http://www.palmerperformance.com/sto...products_id=76

  7. #7
    Carb and Points!
    Join Date
    Nov 2017
    Age
    35
    Posts
    1
    I am planning to bypass TCM in Camaro ZL1 with a RPU running custom developed tansmission control software.
    To be able to do this, I need to identify some specific GMLAN high speed ArbIDs and signals (Byte positions) in them. (Things like torque limiting requests that you have mentioned)

    I am guessing what you have done for Trucks could be useful.
    Would you be able to help?

  8. #8
    Fuel Injected! KidTurbo's Avatar
    Join Date
    May 2014
    Age
    50
    Posts
    25
    I don't yet have all the specific TCM related messages mapped, but can certainly help you locate them. What's the ECM model, year, and OS version are your using?

    Reason I ask, just recently discovered there are actually two different HS-GMLAN ArbID sets out there. From bench testing, one looks to be specific to LS powered Corvette, then another for everything else. So first thing is verify which version of GMLAN we are dealing with.

    If you'd like,shoot me a PM on here with your contact details. Or reach me thru http://marinemods.us

    -K

Similar Threads

  1. High int, but 128 blm. What does that mean?
    By f85gtron in forum TunerPro Tuning Talk
    Replies: 14
    Last Post: 08-09-2015, 03:56 PM
  2. Replies: 53
    Last Post: 08-04-2013, 07:52 AM
  3. Replies: 3
    Last Post: 09-19-2012, 05:09 PM
  4. High idle speed
    By CDeeZ in forum GM EFI Systems
    Replies: 27
    Last Post: 07-05-2012, 03:35 PM
  5. high map on hwy
    By PJG1173 in forum GM EFI Systems
    Replies: 39
    Last Post: 03-14-2012, 09:33 AM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •