High Speed GMLAN and IP Packets

[KidTurbo]

Update on project. I've been able to nail down some of the ArbID's and data values contained in certain byte positions. I was specifically after IC gauge data, so here a list from 2007 and newer GM trucks. Some of these likely carry over into the cars, but I haven't tried to verify any of them there. I found most of what we needed for the gateway project using some simple CAN tools and a couple nodes in a bench setup.

Name	ArbID	Byte #	Scaling	Description
GMLAN Broadcasts				Messages Streaming
ECM - RPM	0x000000c9	B2 B3	(B2B3*.25) or (B2*256)+B3)/4	IE: 0b3c = 2876 Rpm
ECM - Oil Pressure	0x000004d1	B3	(B3*0.766) = PSI	Scaling is in PSI [0x29 = open circuit]
ECM - Fuel Level	0x000004d1	B6	(B6*100/255) = %	Level is 0-100 % [0x26 = open circuit]
ECM - Throttle Position	0x000003d1	B2	(B2*100/255) = %	Range 0-100 %
ECM – Engine Temp	0x000004c1	B3	(B3-40) = Temp C	Scaling is Celsius [0x16 = open circuit]
ECM - Speedometer	0x000003e9	B5 B6	(B5B6/100) = MPH	Speed [0x80 0x00 = open circuit]
TCM - Gear Position	0x000001f5	B4	ASCII Values 1 thru 9	1=P, 2=R, 3=N, 4=D/M6 to 9=1/M1

I also isolated some of the GM specific dynamic pids used by OBD scan tools like the TechII to setup streaming of requested parameters. These are assigned a memory allocation area within FA-FE range, a broadcast speed, and are continuously sent with a specific ArbID so long as the OBD "tester present" command is received by the node. Speeds up the data flow and lessens the load on the bus compaired to the standard OBD "request pid / receive reply" way of doing things.

I'd love to work on learning more of the ArbID and byte positions for things like torque limiting requests if anyone is interested. Guessing someone with experience reading late model bin files could search by known ID's and possibly associate some of these commands used between nodes.

Cheers

-K

[Xnke]

Is this not just CANBUS protocol? If so, this has already been hashed out for direct connections, just not for the GM protocol. The process would be the same though.

[KidTurbo]

Yes it's all CANbus protocol. Details listed above are from the 500Kbps "High Speed" GMLAN they switched to in like 2006. While typical OBD-II commands are still usable, the ones I'm focused on are arbitrary ID messages between powertrain nodes. ECM talking to BCM, TCM to ECM, and such. Proprietary packets not included under OBD.

Example; When you turn the ignition to On or Start now, the BCM verifies your key is correct over the "low speed" bus. If the key or key fob passes security, the BCM sends a request to the ECM over high speed bus to start the engine. This is how ONSTAR performs a remote start function without a key.

Knowing those specific GM commands could allow you to start your car using any USB/WiFI/Bluetooth CANbus device connected to the high speed network.. No longer is the starter connected to an ignition switch. And the old Class 2 data feeding the IC is a thing of the past. Everything is CANbus now, with multiple networks per vehicle.

What I verified above is some ECM and TCM packets constantly being broadcast on the HS LAN. There is plenty more interesting data in there depending on specific model. Mapping all this "unlisted" data provides a new meaning to "drive by wire."

BTW: It's actually legal to hack your cars ECU's now...

[quadstar87]

This is pretty sweet since I was trying to track down how my 07 cluster gets oil pressure. Can you verify that it's getting a buffered value? Because it's real slow to react to changes where my live feed shows much more accurate data. I wanted to try to command actual oil pressure and trans temp to the DIC readout someday if I learn more.

[KidTurbo]

For some reason GM buffered the oil pressure out of the ECM. At least on 2007.5 and up LMM Duramax. I tested the other day on a 2006 LBZ and noticed it was also buffered, but the open circuit value was actually zero rather than 30psi like the LMM.

If you read the oil pressure by a GM/OBD pid, it responds real time to input changes. My guess is GM decided to buffer it so the gauge did jump all over the place on acceleration / deceleration.

As for your DIC readout, Palmer industries has a programmable "DashLogic" unit out that does just that...
http://www.palmerperformance.com/sto...products_id=76

[Keshka]

Found your post via Google. I am doing something similar. I am transplanting the engine from a 2009 silverado into a 1999 jimmy. In order to get the gauges to work, I need to translate packets from the GMLAN and inject them into the Class 2 serial data bus.

[KidTurbo]

Found your post via Google. I am doing something similar. I am transplanting the engine from a 2009 silverado into a 1999 jimmy. In order to get the gauges to work, I need to translate packets from the GMLAN and inject them into the Class 2 serial data bus.

Have our CANbus gateways converting HS GMLAN protocol into other languages on high speed networks. So getting the info needed from the 09 ECM is easy. Issue then is converting HS LAN down to class 2 data. What's needed is a two wire CANbus to single wire Class 2 converter. Bet an Arduino board guru could do it given the right information.

Other option might be look at factory BCM's. Right off I don't know of any particular GM BCM's that had HS LAN and Class 2 features, but it's possible some split year model did. If so, I know someone who can reprogram the BCM's to do what ya need.

Please let us know what ya find.

-K

[nitin]

I am planning to bypass TCM in Camaro ZL1 with a RPU running custom developed tansmission control software.
To be able to do this, I need to identify some specific GMLAN high speed ArbIDs and signals (Byte positions) in them. (Things like torque limiting requests that you have mentioned)

I am guessing what you have done for Trucks could be useful.
Would you be able to help?

[KidTurbo]

I don't yet have all the specific TCM related messages mapped, but can certainly help you locate them. What's the ECM model, year, and OS version are your using?

Reason I ask, just recently discovered there are actually two different HS-GMLAN ArbID sets out there. From bench testing, one looks to be specific to LS powered Corvette, then another for everything else. So first thing is verify which version of GMLAN we are dealing with.

If you'd like,shoot me a PM on here with your contact details. Or reach me thru http://marinemods.us

-K

[Thaniel]

Hi KidTurbo, Great stuff. Some of the ARBID messages you posted at the beginning I didin't have. I have a few that are slightly different. Would you be interested in comparing notes?

Are you (or anyone) still working on this? I've done some with the GM lan in the past but have more experience with CAN bus from BMW. I can help analyze data or whatever. Currently I'd like to find the message that triggers the check engine light on and off. I can check it via OBDII PID's but I prefer to just listen to the message that has to already be sent :-)

Thaniel

[KidTurbo]

Hi KidTurbo, Great stuff. Some of the ARBID messages you posted at the beginning I didin't have. I have a few that are slightly different. Would you be interested in comparing notes?

Yeah I'd be happy to share notes one the GM stuff. I recently only discovered that all OS in the Corvettes, and possibly a couple others LS, used a completely different ArbID structure. So I've been working on that protocol the past couple months. Think I have a check engine light byte identified for it, but not yet for protocol above..

Sending you a PM with my contact info. Think I've stumbled across your work on the BMW swaps before.

Cheers

-K

[Thaniel]

Yeah I'd be happy to share notes one the GM stuff. I recently only discovered that all OS in the Corvettes, and possibly a couple others LS, used a completely different ArbID structure. So I've been working on that protocol the past couple months. Think I have a check engine light byte identified for it, but not yet for protocol above..

Sending you a PM with my contact info. Think I've stumbled across your work on the BMW swaps before.

Cheers

-K

E-mail sent.

Yah the alternate ARBID's are weird. Seen that too.

Yup. BMW CAN bus is my main thing. But I've collected and found a bit of GM stuff to help with GM engines swapped into BMW's. I don't mind sharing what I have. Haven't posted what I have mostly due to just getting to doing it :-)

Thaniel

[Automation]

Hi

Just been looking at your post from a few years back.
Just wondering if you got any further with arb high speed GMLan IDs?
Would it be possible to get what you’ve managed to decode so far?

I am working on a project where we are using a Holden (Chev) Cruiz engine to drive a
Hydraulic pump. Some of your IDs seem to match. Eg 16xC9 eng rpm.
The Cruz doesn’t have a oil pressure sender but just a switch.
Can’t seem to see any obvious change in arb data stream while disconnecting switch?

Any help would be greatly appreciated