GM Can info & knowledge share

[Tre-Cool]

Couldn't think of a decent subject title, but there is obviously a lot of smart people around here so if people are happy to share knowledge it might help out others in building up some skills. I know im no guru, but sometimes i'll be working on something for a bit & some1 drops a bit of info and it'll click in my brain that it might be related to something i'm been tinkering with. haha

So, I'll start with the following info. CAN modules all have their own address on the bus, in these modules they can be setup to listen/monitor or send data on relevant tags, at least ECU/TCM does.

So starting with E38 OS 12609099/12612381 also. These are located in the OS portion if looking for them in Ghidra. They are a 16 bit value so proceeded with a 0 before the 3 digit address. for example - 00C9.

TX - "0C9,0F1,0F9,110,120,124,128,131,140,170,191,1A1,1C1,1C3,1E9,1ED,1F1,1F5,280,285,289,2C3,2C5,2D1,2F0,300,308,320,348,380,3C1,3D1,3E9,3F9,3FB,410,480,490,4C1,4C9,4D1,4E1,4E9,4F1,510,520,772"
RX - "0C1,0C5,0F1,0F9,128,130,131,140,144,150,151,199,19D,1C7,1C9,1CB,1E1,1E9,1EB,1F1,1F5,1F9,280,299,2C9,2D1,2E0,2F0,2F9,320,380,3C9,3F1,3FD,420,488,4C9,4D9,4E1,4E9,520"

OS 12639249
TX - "0C9,0F1,0F9,110,120,170,191,1A1,1C1,1C3,1E9,1ED,1EF,1F1,1F5,280,285,289,2C3,2C5,2D1,2D3,300,308,320,348,3C1,3D1,3E9,3F9,3FB,410,480,490,4C1,4C9,4D1,4E1,4E9,4F1,510,520,772"
RX - "0C1,0C5,0F1,0F9,128,130,131,140,199,19D,1C7,1C8,1C9,1CB,1E1,1E9,1EB,1F1,1F5,1F9,280,299,2C9,2D1,2E0,2F0,2F9,380,3C9,3C9,3ED,3F1,3FD,420,488,4C9,4D9,4E1,4E9"

Trans - 24256125 (Compatible with the above ecu os as is 24256025, so likely hood these are the same)
TX - "0C7,0F9,189,197,199,19D,1A6,1AF,1F5,320,4C9,520,77F"
RX - "0BE,0C1,0C5,0C9,OF1,128,131,140,186,18E,191,1A1,1A5,1BA,1CB,1E9,1F1,1F1,1F3,1F9,280,285,2C9,2D1,2F0,2F9,380,3D1,3E9,410,4C1,4E1,4E9,4F1,589"

In both the ecu/tcm calibration portion there is additional tables for monitoring the source of transmission module & i suspect it then plays into DTC codes for loss of comms faults, there are tables for how many fails need to happen before error & the how many good samples to clear an error.

There are additional tables to set how many bits make up the data length of the TX/RX monitored transmissions, However this could also be a specific data bit to monitor & not the total. I haven't gone that far into this yet.

Now for the table thats linked to the module that is being monitored, using the early 12609099 as example it uses the following for it's options;
"0=ECM,1=TCM,2=TCCM,3=ABS,4=BCM,5=PTO,6=ACC,7=HVAC,8=FSCM,9=NumOfRxDevices,10=InvalidRxDevice"
Taking a look at what Efilive have mapped for DTC's it's very similar;

Efilive-dtc.png (57.26 KiB) Viewed 201 times

Typically on a conversion etc if no bcm/fscm is used you just mask out the error and be on your way, but now it should be possible to stop monitoring the module in the first place.

I have also found that as the newer oses got released there was obviously more devices being monitored & the list above started to grow, I do not know yet if the module names to numbers changed or if they just added onto the existing data set. nor do i know if it's something to be found in the binary files or of it's just a number tied to a arbitrary name.

Further example - 12639249 has:
"0=ECM,1=TCM,2=TCCM,3=ABS,4=BCM,5=PTO,6=ACC,7=HVAC,8=FSCM,9=NumOfRxDevices,10=Unknown1,11=Unknown2,12=InvalidRxDevice"

24256125 has -
"0=ECM,1=TCM,2=TCCM,3=ABS,4=BCM,5=PTO,6=ACC,7=HVAC,8=FSCM,9=NumOfRxDevices,10=Unknown1,11=Unknown2,12=Unknown3,13=Unknown4,14=InvalidRxDevice"

[kur4o]

9:BSCM,10:HBP,11:CGM,12:VDCM,13:BECM_A

Here is some more to add to the list,
I am sure there is correlation between number and ID on some GMW document, or they just got added on demand.
No matter how long is the list last 2 are always.NumOfRxDevices and InvalidRxDevice , they always takes last 2 numbers from the list.

ON newer stuff it gets even more complicated by adding more than one CAN bus, up to 5-6 buses can be assigned.