GMLan Bible updates

[foxdie]

Introduction

Hi folks,

this thread will be used to notify of updates to the GMLan Bible, a publicly-accessible Google Drive spreadsheet with both technical information and handy tools to assist in making use of GMs network.

GMLan Bible is curated by CarModder.com administrators and accumulates any knowledge put into the public domain (tech blogs etc) plus our own research from our own vehicles, technical papers etc.

Although its primary focus right now is LSCAN (Low Speed single-wire CAN Bus), it will over time expand out to HSCAN (High Speed two-wire CAN Bus) as well.

You can find the GMLan Bible here:

http://is.gd/gmlanbible

Changelog

Code: Select all

Revision    Date        Information
V1.0        4/9/2012    Initial Publication by TMK (tekolody)
V1.1        4/11/2012   Added On&tar turn by turn packets (ArbID 182, 148 and augmented 185)
v1.2        4/11/2012   Confirmed On Star packets and added pictures / icons.
V1.2.1      4/20/2012   185 added some detail
v1.3        5/13/2012   Added 142, 4 and detailed control bytes on 148..
v1.4        2/5/2013    Added foxdie (jasongaunt) as a editor to this bible
v1.4.1      2/6/2013    Cleaned up document, fixing broken links and expanded on disclaimer
v1.4.2      2/6/2013    Added tool to assist in deciphering arbitration data packets
v1.4.3      2/7/2013    Added 0x64 breakdown
v1.4.4      2/9/2013    Added 0x71 to ArbIDs and subsequent breakdown
v1.4.5      2/13/2013   Added 0x75 to ArbIDs and subsequent breakdown
v1.4.6      2/14/2013   Added 0x73 and 0x74 to ArbIDs and subsequent breakdowns
v1.4.7      2/19/2013   Converted all ArbIDs to upper case with underscore whitespace for portability
v1.5.0      2/22/2013   Added CarModder.com branding as this doc is administered by its admins
v1.5.1      2/27/2013   Added 0x1FFF to ArbIDs and tagged various sheets as 29Bit where applicable
v1.5.2      2/28/2013   Added tool to assist in deciphering 11Bit Headers
v1.6.0      3/4/2013    Added known list of 11Bit Request IDs, ECU-specific IDs found by team


Final word and further reading

Please note this thread is for update notifications only, subscribe to it but please only reply if you spot an error or would like specific information adding to it

Discussion threads for more information:
GM Lan Single Wire CAN Bus Sniffing

[koryenger]

I have been researching on the web for the format of the CAN message for telling what gear the GM 6 speed automatic transmission is in ( ie. Park, neutral, reverse, Drive, Drive 2 , Drive 1). I have found some info on the web but nothing definite. The question is what is the Message ID ( also known as the arbitration ID) and the data for the transmission gear selection message?

[ZerOne]

0x25 is what you are after. (For VE models that is, unsure of other models)

Have a look at the link to the gm man bible, and click on the arb ids tab page for a full list of what is available.

Cheers

[tek1229]

I can verify that ARB 25 is also used for 2013 silverado chassis 6 speeds as well..

[McJ]

Hi,

Some extra bits for the spreadsheet from my own testing for completeness:

Radio Selected Source: ARBID 0x174, length 2 bytes
102E8080 04 02 AM
102E8080 06 02 FM1
102E8080 08 02 FM2
102E8080 14 02 CD

Ignition Key State ARBID 0x001, length 4 bytes
10002040 00 00 74 77 Key Out
10002040 00 01 74 77 Key In
10002040 09 01 74 77 Key Acc
10002040 0A 01 74 77 Key Run
10002040 0B 01 74 77 Key Crank
10002040 08 01 74 77 Key Off
10002040 08 00 74 77 Key Out (08 = Driver still present? or maybe just a time delay)
10002040 00 00 74 77 Timeout after approx 40 seconds with no key

Remote ARBID 0x004, Length 2 bytes
080080B0 
06 01 Remote Lock
080080B0  06 02 Remote Unlock (drivers door only on 2 stage unlock)
080080B0  06 03 Remote Unlock Repeat (All Doors on 2 stage unlock)
080080B0  06 0E Remote Panic Button (short press)


Unknown? ARBID 0x002, Length 1 Byte
10004060 FF Start Engine
Even if the key isn't in the run position, the engine still turns over, but cuts out after 500ms, presumably when the ignition position message gets sent again. If key is in, on run, but engine off, then engine keeps running. that happened on an Auto, in Park - not sure what would happen if it was in gear, or if there was no key in?
I found this by spamming 0xFF, usually its only 0x00 or 0x02. Entirely unexpected since the ECU address was the same as the steering wheel buttons and it scared me straight! Not sure which of the 8 bits is actually responsible engine start.
This may be a way forward to remote start which seems elusive still from what I've read on here.

Steering Wheel Control ARBID 068 4 Bytes
100D0060 20 00 00 00 Mute Button

This is all from my '06 VE SSV Auto

I've also got an exhaustive list of GM powertrain data including the fully defined data structures. I believe it's HS-CAN though since I haven't seen any of it on the SWCAN. I haven't tried/figured out how to get the BCM to gateway select HS data onto the SW bus, which apparently is possible?

Anyway, Bon Appetit! I look forward to learning and sharing more!

[TazzI]

Remote ARBID 0x004, Length 2 bytes
080080B0 
06 01 Remote Lock
080080B0  06 02 Remote Unlock (drivers door only on 2 stage unlock)
080080B0  06 03 Remote Unlock Repeat (All Doors on 2 stage unlock)
080080B0  06 0E Remote Panic Button (short press)

Thats cool!. That one could have some interesting usages. IE detect key lock presses 3 times under 4-5seconds and wind all windows up. Did you record this when locking/unlocking? Or did you find this through trial and error?

Also what is your current setup for communicating over CAN? Arduino plus CAN shield? or something a little more homebrew?

[McJ]

Hi Tazzi,

I recorded it when locking/unlocking from the remote, then replayed it and got the same behaviour.

My setup is all homebrew, though I'm working on v2.0 now which is still homebrew but moar powerrrr.

Attached a pic of v1 for the curious!

Sent from Tapatalk

[jezzab]

Remote ARBID 0x004, Length 2 bytes
080080B0 
06 01 Remote Lock
080080B0  06 02 Remote Unlock (drivers door only on 2 stage unlock)
080080B0  06 03 Remote Unlock Repeat (All Doors on 2 stage unlock)
080080B0  06 0E Remote Panic Button (short press)

Thats cool!. That one could have some interesting usages. IE detect key lock presses 3 times under 4-5seconds and wind all windows up. Did you record this when locking/unlocking? Or did you find this through trial and error?

Also what is your current setup for communicating over CAN? Arduino plus CAN shield? or something a little more homebrew?

Thought the same thing two years ago and tried to do it but the windows are not able to be controlled via CAN. Switch goes straight to BCM. You can't even do it with the Functional Tests on the Tech2

[TazzI]

Thought the same thing two years ago and tried to do it but the windows are not able to be controlled via CAN. Switch goes straight to BCM. You can't even do it with the Functional Tests on the Tech2

Yeah I remember that. Pitty. But I was more thinking of hooking into the main windows switch wiring directly.. and just trigging the "up" from there. Not 100% CAN, but better than nothing

Hi Tazzi,

I recorded it when locking/unlocking from the remote, then replayed it and got the same behaviour.

My setup is all homebrew, though I'm working on v2.0 now which is still homebrew but moar powerrrr.

Attached a pic of v1 for the curious!

Sent from Tapatalk

Nice!

[odysseyjr]

I messed with a L99/6L80 combination on HSCAN with Arduino Uno and CAN Shiled by Seeeduino and found the following for current Gear, I believe Gear state of Park, Reverse, and Neutral is a different number which I haven't found yet because I'm focused on gear on the HSCAN right now.

1312.0.254.4.0.0.0 is Gear 1 The number changes in increments of 4
1312.0.254.8.0.0.0 is Gear 2
1312.0.254.12.0.0.0 is Gear 3
1312.0.254.16.0.0.0 is Gear 4
1312.0.254.20.0.0.0 is Gear 5
1312.0.254.24.0.0.0 is Gear 6