Announcement

Collapse
No announcement yet.

GMLAN SW-CAN Message woes

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • GMLAN SW-CAN Message woes

    I'm trying to send a lock/unlock door command to the Single Wire CAN bus and I'm not getting the results I expect. I suspect that perhaps the scantool is inserting characters that I don't know about (possibly trying to add a header).

    Here's my log:

    Code:
    >atz
    ELM 1.3 Compatible
    >atspb (29bit user mode)
    Ok
    >atcaf0
    Ok
    >ath1
    Ok
    >athv1 (high voltage wakeup on)
    atma shows I'm getting data:
    Code:
    Code:
    >atma
    10 02 80 40 1F 00 00 00 B1 00 00 03
    10 01 80 C0 00 00 00
    10 02 80 40 1F 00 00 00 B1 00 00 03
    0F FF E0 B0
    0F FF E0 89
    10 02 80 40 1F 00 00 00 B1 00 00 03
    10 02 80 40 1F 00 00 00 B1 00 00 03
    0F FF E0 A9

    blah blah blah...

    When hitting the door lock/unlock buttons I can see:
    10 05 60 40 00 01 7F 01
    and
    10 05 60 40 00 00 FF 01

    I copied and pasted those codes back into my terminal and I get no response (I also tried the same message without spaces just for good measure).

    I'm probably doing something braindead stupid so please forgive my n00bish ways.

    Any ideas what I'm doing wrong?

    Thanks!
    Former author of LinuxICE, nghost, nobdy.
    Current author of Automotive Message Broker (AMB).
    Works on Tizen IVI. Does not represent anyone or anything but himself.

  • #2
    I would do it in this way:
    at sh 10 05 60 40
    to set the correct ARBID

    then
    00 01 7F 01
    to send actual data.

    Just my 2 cents

    Comment


    • #3
      Originally posted by ma_jk View Post
      I would do it in this way:
      at sh 10 05 60 40
      to set the correct ARBID

      then
      00 01 7F 01
      to send actual data.

      Just my 2 cents
      thanks! I'll give it a try.
      Former author of LinuxICE, nghost, nobdy.
      Current author of Automotive Message Broker (AMB).
      Works on Tizen IVI. Does not represent anyone or anything but himself.

      Comment


      • #4
        at sh only takes 3 bytes for the header but it seems that the arbitration id's are 4 bytes? Here's a log what I've tried. I about out of ideas on what I'm doing wrong. I know there's a couple people in this forum who've had success with this and I hope they chime in:

        Code:
        ELM327 v1.3 compatible
        >atspc
        OK
        >atcaf0
        OK
        >ath1
        OK
        >athv1
        OK
        >atsh 10 05 60
        OK
        >40 00 01
        NO DATA
        >40 00 01 7F
        NO DATA
        >atsh 100560
        OK
        >400001
        NO DATA
        >4000017F
        NO DATA
        >4000017F01
        NO DATA
        >atsh 10056040
        ?
        >atma
        621 00 7F 00 00 00 00 00 00 
        621 00 7F 00 00 00 00 00 00 
        621 00 7F 00 00 00 00 00 00 
        621 00 7F 00 00 00 00 00 00 
        621 00 7F 00 00 00 00 00 00 
        621 00 7F 00 00 00 00 00 00 
        621 00 7F 00 00 00 00 00 00 
        621 00 7F 00 00 00 00 00 00 
        621 00 7F 00 00 00 00 00 00 
        040 00 00 00 00 
        ELM327 v1.3 compatible
        >atspb
        OK
        >atcaf0
        OK
        >ath1
        OK
        >athv1
        OK
        >atsh 100560
        OK
        >400001
        NO DATA
        >4000017F
        NO DATA
        >4000017F01
        NO DATA
        >0100
        NO DATA
        >ELM327 v1.3 compatible
        Former author of LinuxICE, nghost, nobdy.
        Current author of Automotive Message Broker (AMB).
        Works on Tizen IVI. Does not represent anyone or anything but himself.

        Comment


        • #5
          Originally posted by tripzero View Post
          Code:
          >atspc
          OK
          So you are using user defined protocol. Did you set it up correctly on PP 2E bit7 for 29bit CAN?

          As far as i can see,
          Code:
          621 00 7F 00 00 00 00 00 00 
          621 00 7F 00 00 00 00 00 00
          you are receiving only 11 bit IDs (receive both 29&11bits by setting bit5 of PP 2E)
          I made a mistake about AT SH command, you must specify the lower 24 bits, because the other 5 are just priority bits and are addressed with AT CP command.

          Comment


          • #6
            Originally posted by ma_jk View Post
            So you are using user defined protocol. Did you set it up correctly on PP 2E bit7 for 29bit CAN?
            you are receiving only 11 bit IDs (receive both 29&11bits by setting bit5 of PP 2E)
            I was trying out 11bit mode to see if it would work. I've been told that gmlan is 11bit but I see evidence that my vehicle (08 impala) is 29bit. atspb, which i use later in the log is 29bit and should be set up how you describe (I hope). Is there any way to tell?

            I made a mistake about AT SH command, you must specify the lower 24 bits, because the other 5 are just priority bits and are addressed with AT CP command.
            Am I setting up the lower 24 bits correctly with the at sh command? I'll look up the AT CP command because I'm not familiar with it yet.

            Thanks!
            Former author of LinuxICE, nghost, nobdy.
            Current author of Automotive Message Broker (AMB).
            Works on Tizen IVI. Does not represent anyone or anything but himself.

            Comment


            • #7
              first put the right value on PP 2E to receive 11&29 and transmit 29 bit on iso 15765-4
              Code:
              at pp 2e sv 61
              then enable the PP

              Code:
              at pp 2e on
              now you are ready for
              Code:
              atspc
              Next step is to set the priority bits. Take your id, isolate the leftmost 5 bits... so
              Code:
              at cp 10
              and the rest of the id with
              Code:
              at sh 05 60 40
              Finally you can send you data... and cross your finger for the doors opening

              Hope this helps

              Comment


              • #8
                Here it is...

                Here goes about 70 hours of banging my head sitting in the car late at night while the neighbors thought I was crazy ;-)

                Your car's lock/unlock differed from mine so I adapted the commands to match what you showed having sniffed on your network.

                Type the AT commands in the order shown below. Ignore the code formatting.

                Code:
                ATCommands = new String[] {     
                "ATPP 2D SV 0F",    // baud rate to 33.3kbps
                "ATPP 2C SV 40",    // send in 29-bit address mode, receive both(0x60) just 29 (0x40)  
                "ATPP 2D ON",       // activate baud rate PP. 
                "ATPP 2C ON",       // activate addressing pp.
                "ATPP 2A OFF",      // turn off the CAN ERROR checking flags used by wakeUp()
                "ATWS",             // reset chip so changes take effect
                "ATCAF1",           // CAN auto-formatting on
                "ATSPB",            // set protocol to B (user defined 1)
                "ATH1",             // show headers
                "ATR0"              // responses off - we don't expect responses to what we're sending.
                };

                Set up your header to be 10 05 60 40:

                AT CP 10
                AT SH 05 60 40

                Now with the ELM chip programmed, just type the data portion of the packet. The ELM will then produce a CAN packet with our header and data and send it out.

                to Lock, type:
                00 01 7F 01

                to Unlock type:
                00 00 FF 01

                As always, if this causes your car to sprout a satellite and launch a nuke, it's not my fault

                Please return the favor by posting new fun things you discover

                Comment


                • #9
                  ImpalaSS keyfob commands.

                  FTR here are my car's lock/unlock commands.

                  Code:
                  Header	Tested?	Command/Info	Data	Source	Short Description
                  08 00 80 B0	works	command	02 01	TPM	FOB:Lock
                  08 00 80 B0	works	command	02 02	TPM	FOB:unlock

                  Comment


                  • #10
                    A little progress...

                    I'm glad you posted the codes for your lock/unlock. I see the exact same thing when I use the keyfob. The codes I am trying are found when you use the lock buttons on the doors. I actually got them off of gmhack.blogspot.com's observations from his G8.

                    Still, no go on the locking. Here's my log:

                    Code:
                    ELM327 v1.3 compatible
                    >atpp 2d sv of
                    OK
                    >atpp 2D SV 0F
                    OK
                    >atpp 2C SV 40
                    OK
                    >atpp 2D on
                    OK
                    >atpp 2C on
                    OK
                    >atws
                    >atcaf0
                    OK
                    >atspb
                    OK
                    >ath1
                    OK
                    >atr0
                    OK
                    >atcp 10
                    OK
                    >at sh 05 60 40
                    OK
                    >00 01 7F 01
                    >atcp 08 
                    OK
                    >atsh 00  8 0 B0 
                    OK
                    >0 20 1
                    I'll keep hacking...
                    Former author of LinuxICE, nghost, nobdy.
                    Current author of Automotive Message Broker (AMB).
                    Works on Tizen IVI. Does not represent anyone or anything but himself.

                    Comment


                    • #11
                      Use the fob codes. The ones ur using may be secondary for status or something.

                      Comment


                      • #12
                        hmm... i don't know what i did, but *something* started happening. I was trying your keyfob lock command and it unlocked my driver door! The odd thing was, both 0201 and 0202 unlocked it... odd. I also found in my lock when using my keyfob 08 00 80 B0 04 01 in the log. Unfortunatly, I can't reproduce the "unlocking phenomena" . Now I get nothing but CAN ERRORs when I try stuff. Well, time to go in... I will continue this later.

                        Oh, I did a athv1, tried the 0201, it didn't work. than i did the athv0 and tried 0201 and it did the unlocking thing. "athv1" is supposed to set the high volt state. But again, I can't reproduce it at the moment so...
                        Former author of LinuxICE, nghost, nobdy.
                        Current author of Automotive Message Broker (AMB).
                        Works on Tizen IVI. Does not represent anyone or anything but himself.

                        Comment


                        • #13
                          What obd tool are u using?

                          The hv signal wakes up the nodes but there are predefined wait times before sending commands after a wakeup. Also after a wakeup u get 8 seconds to send a command before nodes can start going back to sleep due to inactivity

                          Can errors mean no nodes were awake/reachable to acknowledge your message. Try perfecting your command with key on first then add the wake-up element.

                          Comment


                          • #14
                            Originally posted by regulatre View Post
                            What obd tool are u using?

                            The hv signal wakes up the nodes but there are predefined wait times before sending commands after a wakeup. Also after a wakeup u get 8 seconds to send a command before nodes can start going back to sleep due to inactivity

                            Can errors mean no nodes were awake/reachable to acknowledge your message. Try perfecting your command with key on first then add the wake-up element.
                            Using a mod'd obdpro.

                            Do you use a hv signal? I'll have to hack around and figure out how to use it properly. The following commands now work with the key in/engine on:

                            08 00 80 B0 01 02 - Unlock driver door
                            08 00 80 B0 01 03 - Unlock all doors
                            08 00 80 B0 01 04 - Open trunk
                            I found all these by accident -all except the 02 01, which IIRC is the one you use to lock/unlock. Strangely, 02 02, 03 02, 04 02, all do the same thing as the 0X 01 command. Not sure why, or if they are actually valid commands. Maybe I'm just successfully confusing a module into doing stuff.

                            Locking still eludes me, but I've written a simple log analyzer app to help me find the commands. I'll try to get the code up in a public repo for those future hackers who may find it useful.

                            Edit: I had the above commands wrong. Now fixed.
                            Last edited by tripzero; 01-15-2012, 01:46 AM.
                            Former author of LinuxICE, nghost, nobdy.
                            Current author of Automotive Message Broker (AMB).
                            Works on Tizen IVI. Does not represent anyone or anything but himself.

                            Comment


                            • #15
                              I've added the command info to my wiki page for future reference. If you can confirm them on your imp, regulatre, that'd be awesome.
                              Former author of LinuxICE, nghost, nobdy.
                              Current author of Automotive Message Broker (AMB).
                              Works on Tizen IVI. Does not represent anyone or anything but himself.

                              Comment

                              Working...
                              X