pcmhacking.net

We all know its a noisy bus but even without an ABS or SRS module lots of chatter happens! Here is some chatter logs from just a BCM, PCM and instrument cluster connected.
We can see how the data is scheduled on the bus, there is a burst of activity for 128mS followed by 128mS of nothing. To signal that this inactivity is about to happen a heartbeat frame is sent ($08,$55,$A3). Have also started to try and ID what is going on with each packet. Some of the requests would be possibly be going to other devices I dont have connected (ABS, SRS). In the VT the BCM can switch the primary and aux data bus together, not sure when this happens but the PCM certainly looks for SRS data - it cuts the fuel pump if airbags are deployed.


This is the BCM requesting (ID 40) the PCM (ID 41) to fire off the instrument cluster data packet. This happens every 128mS.
08:01.481: (08:01.481)$40,$58,$FF,$FF,$FF,$6B
08:01.513: (08:01.485)$41,$63,$00,$00,$00,$14,$41,$00,$12,$01,$28,$C5,$00,$00,$10,$07,$F0


This is the BCM sending (ID 21) some data to the PCM about service info....
08:01.545: (08:01.532)$21,$58,$30,$4B,$46,$C6


This message (ID 11) is for A/C request and also low speed fan status...
08:01.609: (08:01.597)$11,$5C,$FF,$01,$44,$00,$00,$00,$00,$4F


This message is sent by the BCM destined for the SRS module, it would reply with a mssage ID of A1. The PCM looks for a bit in the reply message to check the airbag has not been deployed ...
08:01.880: (08:01.880)$A0,$55,$0B


This message is sent by the BCM to the traction control system, it will reply with a message using ID 91...
08:01.864: (08:01.864)$90,$55,$1B

so wheres the bcm dash adx ??

nice work! ill be looking at how to improve ose plugins chatter handling at startup real soon now and this is some good help. an entirely passive dash data adx sounds possible too.

Attached is a log of chatter on my VT Berlina using efilive
* ABS (no Traction Control)
* Driver & Passenger airbags
* Electronic Climate Control - Single Zone
* 4 door power windows
* Triple info instruments
* Factory LPG & Memcal - info from PCM tells dash which fuel is running
* Electric aerial (not sure if direct radio or via bcm control)

The log is ignition off for a bit, followed be vehicle start and idling, then turned off. Will try and have a play with the BCM adx and see what I can identify.

yoda69

nice work VL, maybe time to update to VT400?

Thanks for the data log yoda


Climate Control, the A8 is from the BCM, A9 from the ECC module...
05:02.733: (05:02.730)$A8,$55,$03
05:02.740: (05:02.737)$A9,$57,$00,$00,$00
The first $00 has the A/C Request as bit 0


Unknown but looks like no response in your Berlina...
05:02.768: (05:02.766)$D8,$55,$D3


Must still be the ABS replying to the request as this should be traction control status in the $04 byte...
05:02.785: (05:02.783)$90,$55,$1B
05:02.794: (05:02.790)$91,$58,$04,$00,$00,$13

OK, have had bit more of a play.
Hopefully attached zip file makes some sense.
Have updated ADX so as I can watch all bytes using the BCM list view.
Have then recorded my findings in the rtf file.
Will try a few more things tomorrow. yoda69

ive only used tunerpro for memcal editing, but is a adx like a xdf but to read aldl commands rather then hex values or something? Nice work btw, im trying to do the same with the vs.

Yes, that is correct, the ADX is used to interpret the serial data and convert it into something meaningful. it is also used to define a dashboard, history tables and monitoring charts similar to in efilive.

Added a few flags from yoda's findings and will add more when I get a chance - cant test the flags so hopefully they do something! The 20-122 might be dash illumination control, so maybe can try adjusting the dash brightness to see if it changes.

Have also tried a mode 2 read of the BCM and dash in the hope of getting some code. The BCM you get a bit of data at 0-300 (have attached it) but from then on its all zeros, the dash gives no response to mode 2.