Medium Duty CAN bus Protocol

kidturbo

Piston Tester
Jul 21, 2010
2,540
1,378
113
Somewhere On The Ohio
www.marinemods.us
Trying to clarify what protocol the 2006 and up medium duty ECU's are running? J1939 or GMLAN

I know they switched to GMLAN in 06 on light duty, but J1939 is pretty much industry standard in medium and heavy duty industrial.

Tks.
 

kidturbo

Piston Tester
Jul 21, 2010
2,540
1,378
113
Somewhere On The Ohio
www.marinemods.us
Thanks. Do ya know of any specific J1939 versions released after 05?

Reason I ask, for the marine setups I'm working on your typical gauges and plotters run either NMEA 2000 or J1939. Both identical 250k broadcast protocols, but PGN sets are the difference. One person I know attempted an OBD-II to J1939 gateway, connected into a J1939 to N2k gateway. Didn't work out. Even my 05 LLY setup suffered from PGN mismatch issues with GM's fuel level and oil pressures values not being SAE.

I have a new programable gateway we developed for the Holley EFI guys that does a great job converting faster baud rate bus and sensor parameters into 1939 or N2k. Since I haven't looked into the raw data broadcasts from an 06 or up yet, anyone know the Hz rate of tach and other values they broadcast over the bus?

Requesting pids as in data logging adds load and lag. So I'm guessing all the normal dash gauge values are streaming, along with TPS and those used by the TCM and other nodes. I can program our unit to do the conversion if needed, but if an existing industrial ECU is out there, no need.

-K
 

duratothemax

<--- slippery roads
Aug 28, 2006
7,139
10
0
Wyoming
Thanks. Do ya know of any specific J1939 versions released after 05?

No, all 6.6 Dmax ECM's have used either 250k J1939 (01-05) or 500k GMLAN (06+) only...there is no 2006+ 6.6 Duramax ECM that is configured for J1939.

I have a new programable gateway we developed for the Holley EFI guys that does a great job converting faster baud rate bus and sensor parameters into 1939 or N2k. Since I haven't looked into the raw data broadcasts from an 06 or up yet, anyone know the Hz rate of tach and other values they broadcast over the bus?

Requesting pids as in data logging adds load and lag. So I'm guessing all the normal dash gauge values are streaming, along with TPS and those used by the TCM and other nodes. I can program our unit to do the conversion if needed, but if an existing industrial ECU is out there, no need.

-K

On the 06-07 LBZ ECM, it was configured to use both Class 2 (J1850 VPW) and high speed GMLAN. The high speed GMLAN aspect on the 06-07 Dmax was for scan tool diagnostics, module reprogramming, and internal ECM <--> TCM <--> GPCM communications only. It was a hybrid of Class 2 and GMLAN use.

Class 2 data is/was used for communication with the rest of the Silverado body (instrument cluster readings, communications with ABS module, transfer case module, body control module, etc)...because the 2003-2007 GMT-800 electrical architecture and interior/chassis modules never supported GMLAN.

So you should be able to pick up basic PIDs such as trans temp, speedo, tach, gear display, fuel level, oil pressure, coolant temp, etc over the J1850VPW Class 2 bus, and not even need to mess around with GMLAN.

Also, on 2006-2007 LBZ, speedo and tach have discrete PWM outputs on the ECM...so really you dont even need anything fancy for speedo/tach...just use any aftermarket speedo/tach that you would use for an LSx gasser swap.

Obviously 2007.5+ GMT-900 LMM went to 100% high speed GMLAN, no more discrete inputs/outputs (like for speedo/tach/cruise control) used on the ECM, and no more Class 2 comms.

Basic SAE-supported PIDs info on GMLAN/CAN should be publicly available, as any generic CAN-capable scan tool will work on any 06+ Duramax.

On your converter module...do you have any more info on that? The link appears to be dead...could it possibly to GMLAN to Class 2 translation?

Ben
 

kidturbo

Piston Tester
Jul 21, 2010
2,540
1,378
113
Somewhere On The Ohio
www.marinemods.us
Thanks for the update. I knew LBZ was a mid year mix and actually looking to skip it and focus on LMM and up. Fixed the link also.

Basically the gateway will do anything CAN on either side. HEFI runs a 1Mbps bus and proprietary PGN broadcast set at 10hz. So we capture the main gauges (tach, temps, pressures) reformat and send out the other side with lower 1939 speed to make everyone happy. Firewall both side, keeps the HEFI bus happy too. So doing the same on GMLAN is not an issue.

Looks like I need to grab a running LMM and hook into the main ECU bus and listen...

:thumb:
 

SmokeShow

Well-known member
Nov 30, 2006
6,818
34
48
43
Lawrenceburg, KY
Man, you two teamed up could be insane! :eek:

Not the slightest idea what 1/3 of this conversation means but its neat seeing it anyway. :thumb:
 

TheBac

Why do I keep doing this?
Staff member
Apr 19, 2008
15,615
1,872
113
Mid Michigan
When I read kidturbo say he had that gateway, my first thought was, "Ben is gonna LOVE that!"

Yes, those two would make a very interesting team.
 

kidturbo

Piston Tester
Jul 21, 2010
2,540
1,378
113
Somewhere On The Ohio
www.marinemods.us
What does the 7.8 duramax use?

Good question... I'd bet SAE J1939. However question then is ECU tuning capabilities. :confused:

To Ben's point about the LBZ and class2 data. I've looked into this briefly on another request. Holley EFI to GM class 2 output setup. It can be done easy enough, but with a different gateway setup than ours. Because it's single wire low speed, the transceivers we use now probably wouldn't care for it.

But I'm completely comfortable jumping on the high speed bus project. There is several online groups and handy tools for dirt cheap now that will let ya capture and transmit hex/dec on any automotive CAN networks. Ya see those guys take over the Jeep from a laptop in a living room? They started by hacking the JEEPs CAN bus to learn the commands, then moved to the LTE modem in the head unit. Found a shared link and was doing interviews on CNN a week later.. lol
 

duratothemax

<--- slippery roads
Aug 28, 2006
7,139
10
0
Wyoming
Holley EFI to GM class 2 output setup.

Any extra info about this?

handy tools for dirt cheap now that will let ya capture and transmit hex/dec on any automotive CAN networks.

The ELM-327 based tools are the only affordable ones Ive found...is there another tool that has a bigger data buffer and doesnt cost thousands? Its difficult to reverse engineer GMLAN with an ELM327 because you have to know a lot about individual ID's and message filtering...you cant just "monitor all" because the buffer on it fills up within a couple seconds. :(

Ive reverse engineered most of the GM Class 2 bus stuff and bi-directional commands, but CAN is more difficult unless you have $$$$ bus analyzing tools. Im sure the basic ELM327 could be used if you had years of experience with CAN and could tell it exactly what to look at and filter...but for a noob, not so much.

Ben
 

kidturbo

Piston Tester
Jul 21, 2010
2,540
1,378
113
Somewhere On The Ohio
www.marinemods.us
Grab ya one of these. https://www.canb.us/
It's cheap, Ardunio based, and has some OK software with it. I have it setup with Wireshark, a software used to analyze IP traffic packets.

That allows ya to capture and sort all the CAN packets by node ID. So for example, when pressing the cruise control buttons, it will see the BCM forward the command to the ECM as binary bits. PC software converts it, and displays as hex / Dec you can read. Then it's just filtering for what nodes data your going after, and reverse engineer as you did for Class2. If ya have say a tech2, cuts time way down by capturing commands as the tool send them.

This device can also be wired in the middle (say between the dash and main bus) and with a little coding skills, turned into a gateway. So you can capture a bus packet headed for the DIC that reads "power reduction mode" and change it to read "freaking trans limped again.." :roflmao: Could even be programmed to block or clear that limp mode command the moment it occurs.

It's a handy little tool, being used to hack all the manufactures, like Jeep... Also the CAN link behind this super cool Castrol Edge video. Hence the reason I skipped Class2, but I'll dig up that serial gateway part# for ya I was looking at usings.
 

duratothemax

<--- slippery roads
Aug 28, 2006
7,139
10
0
Wyoming
Grab ya one of these. https://www.canb.us/
It's cheap, Ardunio based, and has some OK software with it. I have it setup with Wireshark, a software used to analyze IP traffic packets.

Awesome, thanks! Thats exactly what I was looking for. I just ordered one. I wonder if I can modify it to do single-wire CAN (ie, low speed GMLAN, 33.33k)?


That allows ya to capture and sort all the CAN packets by node ID. So for example, when pressing the cruise control buttons, it will see the BCM forward the command to the ECM as binary bits. PC software converts it, and displays as hex / Dec you can read.

Yeah, the tricky part is finding out the ID's of the nodes though...

Ill have to do a lot more learning about CAN and what knowledge of Class 2 I can use, and what new stuff Ill have to learn. The functional/physical nodes/addressing, etc. And of course things go much much much faster so its difficult to grab a message and say "ok yeah that ID is obviously the ECM's address".

Then it's just filtering for what nodes data your going after, and reverse engineer as you did for Class2. If ya have say a tech2, cuts time way down by capturing commands as the tool send them.

Yeah a Tech 2 makes it much easier. There is stuff that has to be reverse engineered the old fashioned way (for example, sweeping individual gauges or instrument cluster lights...with a Tech 2 you can only turn all the lights on or off, or sweep all the gauges at once...not single items), but a Tech 2 does help narrow down the commands and device controls.


This device can also be wired in the middle (say between the dash and main bus) and with a little coding skills, turned into a gateway. So you can capture a bus packet headed for the DIC that reads "power reduction mode" and change it to read "freaking trans limped again.." :roflmao:

Haha yeah, I already know how to send ASCII text to the DIC to make it show messages and characters. In a factory application, the cluster is low speed GMLAN (single wire CAN), and the ECM is high speed GMLAN...the BCM acts as the gateway...so realistically you'd have to do it on the low speed bus. Grab the message and instead of forwarding it, make it send a ASCII text message to the DIC.

Hence the reason I skipped Class2, but I'll dig up that serial gateway part# for ya I was looking at usings.

Yeah, Class 2 is easy to start on because its slow (10.4k) compared to both high speed and low speed GMLAN, but hopefully some aspects/knowledge can be shared.

Ben
 

kidturbo

Piston Tester
Jul 21, 2010
2,540
1,378
113
Somewhere On The Ohio
www.marinemods.us
I believe the CBT has the added ability to do K-line, which being single wire might help. I know it supports 10k bus speeds on CAN, but default config is two wire. You can read up on the MCP2515 CAN transceiver and see if anyone has written the code for using single wire.

Only issue I have with the CBT is I'm not a big Ardunio user. If someone has experience writing those type scripts, it will do about anything you can imagine. For our gateway setup, I went with high end galvanic isolated transceivers and a better CPU. Got lucky and found someone experienced in designing automotive CANbus hardware for Delphi in the EU. So I just give him the PGN sets or PID, and he writes the firmware we need to do the translation on our device.

Things to keep in mind when using that CBT, first look up the CAN network wiring for what ever vehicle your connecting to. In my 04 Powerstroke the OBD-II plug is directly connected to the single bus. While my 05 Mecedes uses a gateway to firewall all OBD-II plug traffic from the actual "CAN C" & "CAN B" bus lines. So I had to plug into the actual CAN harnesses behind the dash to get live data. I haven't looked in the GMC setups much yet, but know there is a comb connector that links all the modules together behind the dash. Unplugging it gives you a place to connect directly into each module.

If you have a Duramax harness and ECU with sensors in a bench setup, that's another good option. Removes all the other traffic and lets you monitor CAN for single senor value changes. That's my goal for now, determine the primary sensors and multiplier equations they use to convert from Hex to Asci and back.

SmokeShow, it's similar to how EFIlive was developed... Just gotta learn to speak 01100010 01101001 01101110 01100001 01110010 01111001

-K
 

kidturbo

Piston Tester
Jul 21, 2010
2,540
1,378
113
Somewhere On The Ohio
www.marinemods.us
That's pretty good Josh...

Deciphering high speed CAN messages is about like in "The Matrix" when they are watching the screens of binary data streaming while someone was jacked in. CAN messages looks identical to that in raw form. If you stare at the screen long enough, you'll swear ya can see the crankshaft spinning. LOL

a0010670_5511f1cee007a.jpg


Luckily handy PC software converts that Matrix format to HEX for us, which makes it slightly easier to detect changes in parts of a message. Then you convert those HEX values to ABC/123, and hopefully it resembles something a gear head will recognize. Like engine temp or a DIC message. Repeat these steps for each 8 data bit message, sent under a certain node ID, and you've reverse engineered the whole deal. EASY!!! :spit:

Makes for a good team sport. So let me know when you get your new tool Ben and we can start a thread on it. The CBT forum has some decent tips, but is not very helpful relating to specific models and decoding the data.

-K
 

kidturbo

Piston Tester
Jul 21, 2010
2,540
1,378
113
Somewhere On The Ohio
www.marinemods.us
Receive your CBT yet Ben?

I've been reading up on GMLAN, there is 2 different bus layouts in a LMM truck. Here is a few notes to get you started. According to the 08 LMM schematics, you can access both the high speed and low speed bus directly from the DLC plug. Low speeds a single wire as noted below. The CBT can also connect to it, with some modified code listed on their forum. A basic GMLAN description is found here. http://www.fastfieros.com/tech/why_the_gmlan.htm

Using the CAN protocol, GMLAN has two different communication links with different data baud rates available -- low speed and high speed.

It uses a single wire (also referred to as single wire CAN or SWCAN).


--

More detailed info about connecting to GMLAN on the MP3 car site at: http://www.mp3car.com/engine-manage...ics-etc/139533-low-speed-gmlan-interface.html

GM’s “Low Speed GMLAN” is a Single Wire CAN operating at 33.33kps.
It conforms to SAE standard J2411 & GM standard GMW3089.
Its Higher Layer protocol is OSEK.


--

Most stuff anyone would be looking to tap into, such as steering wheel buttons, OnStar, security, DIC, and IPC all talk over the low speed bus.. The ECM, TCM, and BCM talk on the high speed bus at 500k.

The BCM also acts as the gateway between LS & HS bus lines. For my study, the gauge cluster (IPC) gets it's data directly from the BCM only. Which means the ECM and TCM likely "streams" all the gauge related data via the HS bus into the BCM, who's job it is to translates this for our IPC, DIC, and other nodes.

So far I've verified the above by GM diagrams, and helping a friend who's only running an 08 ECM & A50 TCM combo. Also wired up a single 120ohm resistor and DLC plug on the HS bus. He data logs fine with EFIlive, but it gets funky when a second OBD-II type display is added to the HS line while EFI is recording. Weird stuff, like doubles his tach RPM being displayed and more. That's where translating away from GMLAN using a J1939 gateway could be the trick for many engine swaps.

I'll try to jump into capturing some HS data later in the week.

-K
 

duratothemax

<--- slippery roads
Aug 28, 2006
7,139
10
0
Wyoming
Receive your CBT yet Ben?

Yeah I got it, played around with an LBZ ECM on the bench and it works really well. No more buffer-full errors and the software the comes with it is great...makes it much easier to filter by message ID, etc.


I've been reading up on GMLAN, there is 2 different bus layouts in a LMM truck. Here is a few notes to get you started. According to the 08 LMM schematics, you can access both the high speed and low speed bus directly from the DLC plug. Low speeds a single wire as noted below. The CBT can also connect to it, with some modified code listed on their forum.

Yeah, 2007.5, Low speed GMLAN (single wire CAN) replaced Class 2 for entertainment/comfort/interior stuff. Its faster than Class 2 (10.4k) but slower than HS GMLAN, LS GMLAN works at 33.3(3333333k, divisor/factor of slowed down 500k high speed GMLAN/CAN).

I was looking around at how to make the CBT work with LS GMLAN...at first I was going to take apart the CBT and remove one of the high-speed CAN transceivers and fab in a SWCAN transceiver chip...but I wasnt sure if the CBT would autodetect 33.33k, because its not listed in the drop down menu. I did some quick looking around but wasnt able to find out if anyone had successfully done any mods to get it to force 33.33k SWCAN. It looks like its all potted inside, so there goes that idea of taking it apart. But maybe with some filtering or passive components I can make it work by tying the "CAN LO" wire of one of the CAN channels to ground, and then tie the CAN-HI wire to the LS GMLAN wire at the OBD port (pin 2).

I dont have a full 2007.5+ truck here to mess with, but I have an instrument cluster and BCM from a GMT-900 that I could play with.



More detailed info about connecting to GMLAN on the MP3 car site at: http://www.mp3car.com/engine-manage...ics-etc/139533-low-speed-gmlan-interface.html

Most stuff anyone would be looking to tap into, such as steering wheel buttons, OnStar, security, DIC, and IPC all talk over the low speed bus.. The ECM, TCM, and BCM talk on the high speed bus at 500k.

Yeah, the only stuff on HS GMLAN/2-wire-CAN is the ECM, TCM, GPCM (glow plug), TBC (trailer brake control), EBCM (ABS module), VCIM (onstar), TCSM (transfer case shift module), and BCM. All of those above listed modules communicate ONLY on HS GMLAN.

And then there is a secondary isolated HS GMLAN bus for 2009+ Duramax trucks that have stability control, for the steering wheel position sensor and yaw rate/lat-accel sensor...but that is just between the EBCM, yaw sensor, and steering angle sensor.....that bus is not available at the OBD port or for scan tool usage. The EBCM acts as the gateway for that.

Everything else is on LS GMLAN. The BCM is the only module that communicates on both HS and LS GMLAN, and it is the gateway, as you said. The VCIM might communicate on both too, Ill have to check the schematics. But the BCM is the gateway.

Instrument cluster is LS GMLAN only; BCM receives gauges/warning light info from the ECM, TCM, EBCM, etc via HS GMLAN messages, translates them to LS GMLAN messages, and forwards them to the cluster and anything else on the LS-only bus that needs it (theft deterrent module/immobilizer, door locks, etc)


Im actually more interested in the low-speed GMLAN messages; for sending text to the cluster, spoofing the theft deterrent module (no im not a car thief, its for 2011+ LML standalone applications because no one has figured out how to fully disable the starter relay diagnostic and immobilizer in the LML ECM, so its pretty much impossible to do a standalone LML, unless you swap pretty much everything (BCM, TDM, ignition switch, etc) into the new vehicle.

Also, to keep tap-shift and cruise control functional on 2007.5+ standalone swaps.

If you have links to info of how people have made their CBT work on LS GMLAN, that would be great! :)

Ben