Modern GMLAN

Ideas and discussion of what to do with the CAN Bus ( i.e. XMDirect, iPod, Carputer, etc... )
Post Reply
seishuku
How the heck did I end up here?
Posts: 9
Joined: 2015 Oct 10 11:47

Modern GMLAN

Post by seishuku » 2017 Mar 08 23:33

Looking for and to spread more information on newer GMLAN vehicles (2010+), mainly the 29bit messages.

These are from my 2011 Camaro:
The IDs here are the arbitration ID from the 29bit message ID.

0x106 - dash indicators?, 5 bytes:
(bits are left to right)
byte1:
bit0 - ?
bit1 - headlight dash indicator
bit2 - highbeam dash indicator
bit3 - ?
bit4 - tigger auto headlight on message
bit5 - tigger auto headlight off message
bit6 - fog light dash indicator
bit7 - ?

0x120 - Steering column status?, 8 bytes, byte4+byte5 steering angle
0x121 - Key status, 1 byte (0x00 key off, 0x01 key acc, 0x02 key run)
0x165 - Engine status, 8 bytes, byte2+byte3 RPM, byte4 oil pressure?, byte5 throttle position
0x170 - Engine status2, 8 bytes, byte5 oil temp, byte6 trans temp, byte7 coolant temp
0x200 - Blinkers?, 5 bytes, needs more testing
0x20A - interior lock/lock button status?, 4 bytes, byte1 lock button stat (0x00 unlocked pressed, 0x01 locked pressed)
0x220 - Steering wheel buttons, 1 byte, (vol up = 0x01, vol down = 0x02, up = 0x03, down = 0x04, src= 0x05, pick up = 0x06, hang up = 0x07)
0x325 - windows, 2 bytes, byte0 driver, byte1 passanger, seems to be something with window positioning
0x360 - Odo related?, 5 bytes, overrides odo display on cluster (0x00 0x2c 0x04 0xb8 0x00, with odo at 28008 miles, maybe is coded in kms?)
0x392 - Seat warmer button status, 1 byte, byte0 (0x01 = driver, 0x08 = passanger, 0x09 = both?)
0x40A - fan/climate, 2 bytes, byte1 fan speed (0x00 to 0xE0), doesn't respond to message injection, status only?
0x425 - US/metric setting from cluster, 1 byte, byte0 (0x00 = metric, 0x05 = US)

OnStar module generated messages (running on bench, format unknown):
Module ID: 0x097
0x102A8097 (0x154) - 00 00 00 20 40 40
0x102AA097 (0x155) - 40 00 00 00 80 00 00 00
0x102AC097 (0x156) - 00 00 1D F4 00 E0 86 A0
0x106E0097 (0x370) - 0E 00
0x10704097 (0x382) - 04 01 00 00
0x10AC0097 (0x560) - 00 00 11 02
0x10ACA097 (0x565) - 00 00 5B 97 98

I have a little more on my PC (posting this on my phone), I'll update later.

Also, I know of the GMLAN Bible, but it's very out of date and has nothing in common with my Camaro, other than the 29bit format, none of the arb IDs are even close.

seishuku
How the heck did I end up here?
Posts: 9
Joined: 2015 Oct 10 11:47

Re: Modern GMLAN

Post by seishuku » 2017 Mar 09 19:22

This might be a little easier to manage:
https://docs.google.com/spreadsheets/d/ ... sp=sharing

seishuku
How the heck did I end up here?
Posts: 9
Joined: 2015 Oct 10 11:47

Re: Modern GMLAN

Post by seishuku » 2017 Mar 11 15:17

Added TPMS, battery voltage, and some conversion values.

AndersJ
How the heck did I end up here?
Posts: 2
Joined: 2017 Aug 28 11:32

Re: Modern GMLAN

Post by AndersJ » 2017 Aug 28 12:05

seishuku wrote:
2017 Mar 11 15:17
Added TPMS, battery voltage, and some conversion values.
Hello Seishuku.

Have you made any progress on this recently? I might be able to assist you.

seishuku
How the heck did I end up here?
Posts: 9
Joined: 2015 Oct 10 11:47

Re: Modern GMLAN

Post by seishuku » 2017 Aug 29 13:19

I haven't played with it in a few months, but I'm glad to see that someone else is interested in this!

I do have some IDs in my notes that I haven't added to the list yet, mainly because they're for options that my car doesn't have (park assist, sliding doors, front/rear camera, forward sonar, etc), and I don't have a good way to decode what bytes do what.

The one big message set that I've been after are DIC navigation messages, which I haven't been able to do on my own since my OnStar doesn't work and I have no indash nav.

AndersJ
How the heck did I end up here?
Posts: 2
Joined: 2017 Aug 28 11:32

Re: Modern GMLAN

Post by AndersJ » 2017 Aug 30 14:05

Well, I have log data from a car with inbuilt GPS but I haven't dived into it yet but if you're interested you could have a look. I´ve built up a small experimental desktop with double Instrument clusters, head up displays e.t.c so I can check their response to incoming CAN-messages.

I´m a bit intersted in seeing the IDs you mention and what they would do in my setup. The CAN-database I have contains currently around 87 CAN IDs for the new GM vehicles.

seishuku
How the heck did I end up here?
Posts: 9
Joined: 2015 Oct 10 11:47

Re: Modern GMLAN

Post by seishuku » 2017 Aug 30 23:07

Yeah, more data is always nice!

Now that I think of it, these IDs may not be 100% accurate, when I was spamming the bus I was trying to watch which ID it was on, but they should be close.
The only one I was able to kind of get to do anything was the front radar, it display a graph in the DIC that changes with one of the byte values, but I recall that it had a really odd scaling, it wasn't something simple like 0x00-0xFF.

0x110 - forward collision alart off message
0x115 - hill assist active message
0x127 - trigger alarm?
0x130 - motion sensor?
0x134 - eco mode?
0x144 - insert new remote message?
0x166 - speed limiter message?
0x168 - diesel engine shutdown soon message
0x172 - power sliding door message
0x1A9? - vents changing
0x1C2 - check lamps messages
0x1C4 - auto highbeam
0x1D0 - park assist messages
0x1E8 - front radar messages
0x1EE - tpms related
0x214 - rain sense message
0x284 - blocked front camera message
0x2D0 - power lift gate message
0x358 - trigger convertable top message
0x36B - steering column is locked message
0x396 - sonar system messages
0x3AF - convertable top close trigger? rolled up windows half way and displayed a message
0x3C0 - clutch to start message
0x3C2 - service soon message
0x3C4 - oil too hot message
0x3C9 - service keyless start message
0x403 - fuel mode unavil message
0x48x? - stoped chime

These were found by spamming all 8 bytes with 0xFF, it's a really bad idea, but on my Camaro the only thing bad that can happen is the alarm gets set off. I don't have OnStar, nor a factory radio, so I wasn't worried about accidentally triggering the crash signal (which I have done, unlocks the doors and sets hazards).

I attached a zip with brief logs from my 2011 Camaro and a co-workers 2012 Malibu, I do have a few more logs from my car, but they're pretty boring (just used them for comparison).
Attachments
logs.zip
(67.87 KiB) Downloaded 43 times

seishuku
How the heck did I end up here?
Posts: 9
Joined: 2015 Oct 10 11:47

Re: Modern GMLAN

Post by seishuku » 2017 Sep 04 12:09

Front sonar graph: 0x1D2, byte 0 = 0x10 (active), byte 1 = 0 (?), byte 2 = graph value (0-9)
https://youtu.be/3pthJhO-wUc

seishuku
How the heck did I end up here?
Posts: 9
Joined: 2015 Oct 10 11:47

Re: Modern GMLAN

Post by seishuku » 2017 Sep 04 21:47

Some success on getting DIC nav text!
https://goo.gl/photos/udhg64N9teJtwebB6

0x57B, 4, 0x00, 0x04, 0x16, 0x00

0x592, 8, 0x10 (1st packet), 18 (total packet length), 0x02 (?), 0x01 (?), 0x16 (?), 0x02 (?), 0x00 (?), 'H'
0x592, 8, 0x21 (2nd packet), 'e', 'l', 'l', 'o', ' ', 'W', 'o'
0x592, 8, 0x22 (3rd packet), 'r', 'l', 'd', '!', 0x00, 0x00, 0x00

0x57B seems to control the display of text, also if you change byte 1 it will display different things ("Routing", "Off Route", "Routing failure!").
0x592 is the packet formatted text message, seems to be a lot like a typical ISO-TP packet.

Needs a lot more experimenting, but it's a start! :D

Edit:
0x57B doesn't seem to need to be set to get text, so maybe special case use?
0x572 and 0x579 appear to be related as well, but I need to do more testing.

I did get a bar graph to display, but wasn't able to change it... Also no turn icons yet.

seishuku
How the heck did I end up here?
Posts: 9
Joined: 2015 Oct 10 11:47

Re: Modern GMLAN

Post by seishuku » 2017 Sep 07 21:25

This will allow turn direction icons and bargraph:
0x575:
byte 0 = ? (nothing?)
byte 1 = modifier? (affects display and scaling, 0x06 for icons, 0x04 for bargraph and distance)
byte 2 = display destination? (0x16)
byte 3 = 1 (direction icons), 2 (unnamed road?), 5 (display text distance, in cluster's set units), 8 (bar graph)
byte 4 = paramater 3
byte 5 = parameter 2
byte 6 = parameter 1
byte 7 = parameter 0 (bar graph = 0-100, distance KM = value*4, nav icons = 0-79)

https://youtu.be/ju4KtTxcKQA

After more testing, 0x572 and 0x579 didn't do anything that I can tell. I could be wrong, but I'll keep playing around with it.

User avatar
codekey
CAN? Tin or aluminum?
Posts: 34
Joined: 2005 Jul 26 05:14
Location: Irvine, CA

Re: Modern GMLAN

Post by codekey » 2018 May 10 18:06

GM's infotainment system uses 29 bit id's. Below is defines and structure of the data bytes for the 1st generation GMLAN.

Code: Select all

#define	ONSTAR_ID 0x1031C097L

// Audio Source Type
#define AUDIO_SUPERVISOR 0
#define TELEVISION_TUNER 1
#define AUX_DEVICE 8
#define REMOTE_DIGITAL_VIDEO_DISK 12
#define REMOTE_CD_CHANGER 16
#define DIGITAL_AUDIO_BROADCAST 20
#define SATELLITE_DIGITAL_AUDIO_RECEIVER 24
#define PHONE 28


// Audio Source Status
#define AUDIO_SOURCE_DEVICE_PRESENT 0
#define AUDIO_SOURCE_AUDIO_AVAILABLE 1
#define AUDIO_SOURCE_AUDIO_NOT_AVAILABLE 2
#define AUDIO_SOURCE_RESERVED 3
#define AUDIO_SOURCE_PRODUCING_SILENCE 4
#define AUDIO_SOURCE_PRODUCING_AUDIO 5

// Audio Channel type
#define NO_CHANNEL 0
#define MONO 1
#define STEREO 2
#define MIXED 3


typedef union AudioSourceStatus
{
	struct{
		unsigned char byte1;
		unsigned char byte0;
	}Bytes;
	struct{
		unsigned statusCode:4;
		unsigned channelType:3;
		unsigned sourceType:5;
		unsigned :4;
	}Status;
}AudioSourceStatus;



// OnStar AudioSourceStatus
void ServiceAudioSourceStatusOnStar(unsigned char *data) {
	AudioSourceStatus audioSourceStatus;
	AudioMasterArbitrationCommand audioMasterArbitrationCommand;
	audioSourceStatus.Bytes.byte0 = data[0];
	audioSourceStatus.Bytes.byte1 = data[1];
	if(audioSourceStatus.Status.sourceType == PHONE) {
		audioMasterArbitrationCommand.Status.channelType = MONO;
		audioMasterArbitrationCommand.Status.sourceType = PHONE;
		switch(audioSourceStatus.Status.statusCode) {
			case AUDIO_SOURCE_AUDIO_AVAILABLE:			
				audioMasterArbitrationCommand.Status.command = AUDIO_MASTER_ARB_CONNECT;
				SendAudioMasterArbitrationCommandCAN2(&audioMasterArbitrationCommand);
			break;
			case AUDIO_SOURCE_AUDIO_NOT_AVAILABLE:
				audioMasterArbitrationCommand.Status.command = AUDIO_MASTER_ARB_DISCONNECT;
				SendAudioMasterArbitrationCommandCAN2(&audioMasterArbitrationCommand);
			break;
			case AUDIO_SOURCE_PRODUCING_SILENCE:
				audioMasterArbitrationCommand.Status.command = AUDIO_MASTER_ARB_CONNECTION_COMPLETE;
				SendAudioMasterArbitrationCommandCAN2(&audioMasterArbitrationCommand);
			break;
			case AUDIO_SOURCE_PRODUCING_AUDIO:
				
			break;
			case AUDIO_SOURCE_DEVICE_PRESENT:
				
			break;
		}
	} 
}
Karl Yamashita
Sr. Electrical Engineer
Crux Interfacing

derchris
How the heck did I end up here?
Posts: 1
Joined: 2018 Jun 02 15:39

Re: Modern GMLAN

Post by derchris » 2018 Jun 02 15:41

Is anybody using MCP2515 for sending CAN messages?
I use two different libs. One is only running on AVRs and it works, the other more modern lib runs anywhere, but only reading works, not writing

Post Reply