GM Lan Single Wire CAN Bus Sniffing

[ZerOne]

I have ordered a Single Wire CAN Bus adaptor from GTOSoft LLC...
This adaptor is a modified ELM327 OBDII Adaptor, to work with the GM Slow LAN Can Bus.
http://www.gtosoft.com/?p=81

I know the information on how to make one of these yourself is up on the website page that I linked to,
to be honest, the price that these units sell for, I don't think its worth the time to try and source the parts,
and trying to build one yourself...

Anyway, this thread is to try and work out a couple of things,

1) Work out what the Sat-Nav GM Lan Gateway module sends on the Bus, to enable the Colour LCD VGA Input.
This is the highest priority hack that we are trying to work out at this point in time.

2) Work out what other information the Sat Nav system sends on the BUS (Street Name, Direction Arrows, etc).
This is kind of Meh, as I dont think any aftermarket Sat Nav systems send this information out on a serial port, or any other data port which could be integrated in to the VE models like the Factory Sat Nav units.
However, this could be handy for in car PC stuff ????

3) Work out the Park Assist data (How to enable the Park Assist screen on the Colour LCD Screen).
Again, kind of Meh, as once we have this data, we might be able to do a proper park assist project with an arduino using factory Ultrasonic sensors, or via an in car PC ????

4) Work out anything else that might seem funky at the time.
Maybe some iPod, iPad, iPhone media support ???

Here is the location of the OBDII Connector if anyone is interested..

[ZerOne]

Lifted from the GTOSoft website,
www.gtosoft.com

the ELM327 can be finagled into 33.3k mode for SWCAN communications by using the USER B protocol.
Here’s the list of commands from my notes that I use when typing directly to the ELM327 which has been attached to an 8055/8056 chip:

Code: Select all

AT WS
AT L1
AT H1
AT PP 2C SV 40
AT PP 2C ON
AT PP 2D SV 0F
AT PP 2D ON
AT PP 2A OFF
AT WS
AT SP B
AT R0
AT CAF 0
AT L1
AT H1
ATMA (monitor the bus)

Some other notes that I use from time to time (my SWCAN bus supports 11 and 29-bit communications so this is used to observe/transmit it):

* To transmit in 29-bit mode
AT PP 2C SV 40
* To transmit in 11-bit mode, receive in 11-bit
AT PP 2C SV C0
* Transmit in 11-bit, receive 11 and 29 (seems to receive lots of false readings).
AT PP 2C SV A0

[ZerOne]

The following Modules are connected to the GM Lan Slow CAN Bus

1) Digital Radio Receiver (XM Radio - US Models)
2) Digital Video Disc (DVD) Control Module (Rear Seat DVD Player System)
3) Instrument Panel Cluster (IPC)
4) Driver Information Center (DIC)
5) HVAC Control Module (HCE)
6) Radio
7) Bluetooth Connector
8) Telematics Module (Onstar)
9) Theft Deterent Module (TDM)
10) Body Control Module (BCM)
11) Inflatable Restraint front passenger presence system (PPS) Module
12) Vehicle Communication Interface Module (VCIM)
13) Seat Interface Module
14) Remote Control Door Lock Receiver (RCDLR)
15) Object Alarm Module
16) Inflatable Restraint Sensing and Diagnostic Module

[ZerOne]

More of the same, just different wording....

The data link connector (DLC) allows a scan tool to communicate with the low speed GMLAN serial data circuit. The serial data is transmitted over a single wire to the appropriate control modules. Under normal vehicle operating conditions, the speed of the buss is 33.33 Kb/s. This protocol produces a simple pulse train sent out over the GMLAN low speed serial data bus. When a module pulls the buss high, 5 volts, this creates a logic state of 0 on the buss. When the buss is pulled low, 0 volts, it is translated as a logic state of 1. To wake the control modules connected to the GMLAN low speed serial data buss, a high voltage wake up pulse is sent out over the buss, the voltage level of the pulse is +10 volts. Modules connected to the GMLAN low speed buss can be part of a virtual network as described in GMLAN High Speed Circuit Description above. The modules on the GMLAN low speed serial data buss are connected to the buss using several splice or "star" connectors separating groups of modules. Refer to Data Communication Schematics for specific schematics information.

The following lists state the splices and modules connected to the low speed serial data circuits:

I/P Splice
• BCM
• Driver Information Display
• Instrument panel cluster (IPC)
• Inflatable Restraint Sensing and Diagnostic Module (SDM)
• Theft deterrent module (TDM)
• Radio/HVAC control - integrated radio chassis (IRC)
• Heating ventilation and cooling (HVAC) control module
• Remote function actuator (RFA)
• Rear seat entertainment (RSE) control module
• Navigation interface module (NIM)
• Seat interface module (SIM)
• Object detection module - ultrasonic park assist (UPA)
• Telematics control module

[jezzab]

Great minds think alike :p This was my next project when I get around to it. Too many bloody projects!!

[ZerOne]

The pinouts for this are for the connector on the vehicle.


GM OBDII Connector Pinout
GM cars produced in 2003-2006 use J1850-VPW interface or CAN BUS

Code: Select all

Pin 1 - SW-LS-CAN (33kB) or DW-FT-CAN (+) (<125kB)
Pin 2 - J1850
Pin 3 - MS-CAN (+) (95kB)
Pin 4 - Battery - (Chassis Ground)
Pin 5 - Signal Ground
Pin 6 - ISO 15765 HS-CAN (+) (500kB)
Pin 7 - K-Line
Pin 8 -
Pin 9 - DW-FT-CAN (-) (<125kB)
Pin 10 - PWM
Pin 11 - MS-CAN (-) (95kB)
Pin 12 - K-Line (KW82 Prot.)
Pin 13 - Reserved
Pin 14 - ISO 15765 HS-CAN (-) (500kB)
Pin 15 - L-Line
Pin 16 - Battery + (Constant 12V Power)


[TazzI]

Hi Zero
Noticed that you have 2003 to 2006 GM OBII sorted out in the above post.

But what about for 2002 VY commodores, they use OBII port but speak OBDI if I'm not mistaken.

So any knowledge if that "ELM327 OBDII Adaptor" will work with a VY?

[ZerOne]

I need to have a look at the workshop manual for VY models to know what exactly they use, and how they are configured. (I have the VT-VX Workshop manual, so hopefully there isnt too HUGE of a change in wiring to the VY).

The above Pinout was to help me test the Bluetooth adapter I have on the bench.
(I dont have a garage, and Sydney weather is pretty poor at the moment).


Th GTOSoft Adaptor I mentioned in the first post is a hacked ELM327 adapter, that connects directly to Pin 1
(SW CAN), which is used on VZ, and VE models for all the non critical functions.
Its one of those pain in the bum things that we need to work out stuff for the VZ and VE,
(The SW CAN adapters are expensive, hard to get, rare, and only work on very late model GM vehicles)

The software that I am writing doesnt really care about what OBD Bus/CAN it is connected to, as long as it supports som of the ELM327 AT commands, so it might be a case of working out what OBD BUS/CAN/LAN is of interest with these models (VT-VY), and finding and adapter that supports that, and testing / slightly modding the software to support those adapters.

Also, the reason for rolling my own software is so that,

1) It will be open source, so the plan is to allow people to hack or modify the software (Including myself) to suit their needs. (Open source OBD stuff is kinda scarce out there)

2) I am writing the code in MonoDevelop, which is a free opensource C# developer environment, which is very similar to MS Visual Studio. The benefit with C# is that the software can run on Windows, Mac, and Linux (Which I use most of the time), as well as a lot of the core C# code can also run on Andriod (MonoDroid), and iOS (MonoTouch).
I have done a fair bit of MonoTouch development, so I know my way around a bit there, so the hope was to get software working for iPhone/iPad. Unfortunately the bluetooth support is a bit so/so.... Hopefully this will improve...

3) Hopefully the software can be modded to suit other vehicles as well (Not just Cmmodores, but Falcons, and other makes and models as well. The plan is to build a good, user friendly base, and build up from there)....

Cheers
Matti

[doubledip]

VZ doesnt use PIN 1 Lo speed CAN... only VE onwards in the commodore

[jezzab]

Dusted off my Arduino and picked up a CAN shield for it. Apparently it will do SWCAN. Let the fun begin