I'm going to try to update RealTerm before my next post; I'd like to get to the point where Tom can just send me a txt file to pump into the interface and then send the capture file back to him, so we can test his read and write routines.
I'm going to try to update RealTerm before my next post; I'd like to get to the point where Tom can just send me a txt file to pump into the interface and then send the capture file back to him, so we can test his read and write routines.
You can also check AVT-hex terminal. I am not sure it will work with x-pro but you can give it a try. It have a source code available and can process some simple scripts.
I noticed the mode 27 response difference as well. Edit: in both this session and the previous sessions, the I had only made those two mode 27 requests. So you are seeing the 'first' and 'second' attempts after these particular Key-Ons. There has been no battery disconnects or DTC resets in between.
Hex Plus Space:
No DX PT1:Code:41 54 20 53 50 32 0D 0A 4F 4B 0D 0A 3E 41 54 20 48 31 0D 0A 4F 4B 0D 0A 3E 41 54 20 53 31 0D 0A 4F 4B 0D 0A 3E 44 58 20 50 54 31 0D 0A 4F 4B 0D 0A 3E 44 58 20 53 44 20 34 43 20 31 30 20 46 30 20 32 38 20 30 30 0D 0A 34 43 20 46 30 20 31 30 20 36 38 20 30 30 20 35 45 0D 0A 3E 44 58 20 53 44 20 34 43 20 31 30 20 46 30 20 32 37 20 30 31 0D 0A 34 43 20 46 30 20 31 30 20 36 37 20 30 31 20 37 42 20 33 38 20 45 46 0D 0A 3E 44 58 20 53 44 20 34 43 20 31 30 20 46 30 20 32 37 20 30 32 20 39 31 20 39 34 0D 0A 34 43 20 46 30 20 31 30 20 36 37 20 30 32 20 33 35 20 37 45 0D 0A 3E
Code:41 54 20 53 50 32 0D 0A 4F 4B 0D 0A 3E 41 54 20 48 31 0D 0A 4F 4B 0D 0A 3E 41 54 20 53 31 0D 0A 4F 4B 0D 0A 3E 44 58 20 53 44 20 34 43 20 31 30 20 46 30 20 32 38 20 30 30 0D 0A 34 43 20 46 30 20 31 30 20 36 38 20 30 30 20 35 45 0D 0A 3E 44 58 20 53 44 20 34 43 20 31 30 20 46 30 20 32 37 20 30 31 0D 0A 34 43 20 46 30 20 31 30 20 36 37 20 30 31 20 37 42 20 33 38 20 45 46 0D 0A 3E 44 58 20 53 44 20 34 43 20 31 30 20 46 30 20 32 37 20 30 32 20 39 31 20 39 34 0D 0A 34 43 20 46 30 20 31 30 20 36 37 20 30 32 20 33 35 20 37 45 0D 0A 3E
Last edited by sherlock9c1; 11-01-2021 at 04:07 PM.
Following up with results of my testing with OBDX Pro - I was able to run tests in both ELM and DVI modes.
The test configuration and commands in ELM mode:
AT SP2
AT H1
AT S1
DX SD 4C 10 F0 28 00
DX SD 4C 10 F0 27 01
DX SD 4C 10 F0 27 02 91 94
My ELM mode results are consistent with those provided by Sherlock other than a few data bytes. As an additional case, I reran the commands with ATE0 which eliminates the input echo so that only the command responses are sent back. This lightens the data load coming back from the adapter. Similarly, ATS0 is beneficial by eliminating the spaces in the command responses.
Here are my results - for ELM the input echo and space flags were on (ATE1,ATS1) therefore the requests are echoed and spaces are placed in the command responses. For ATE0, the DX commands are not echoed and the response immediately follows in-line with the ">" prompt. With ATS0, the explicit spaces in the command responses are also eliminated.
ELM Mode Output (ATE1,ATS1) - ASCII Display:
DX SD 4C 10 F0 28 00
4C F0 10 68 00 5E
>DX SD 4C 10 F0 27 01
4C F0 10 67 01 13 57 05
>DX SD 4C 10 F0 27 02 91 94
4C F0 10 67 02 35 7E
>
ELM Mode Output (ATE1,ATS1) - Hex+Space Display (line breaks manually added):
44 58 20 53 44 20 34 43 20 31 30 20 46 30 20 32 38 20 30 30 0D 0A
34 43 20 46 30 20 31 30 20 36 38 20 30 30 20 35 45 0D 0A
3E 44 58 20 53 44 20 34 43 20 31 30 20 46 30 20 32 37 20 30 31 0D 0A
34 43 20 46 30 20 31 30 20 36 37 20 30 31 20 31 33 20 35 37 20 30 35 0D 0A
3E 44 58 20 53 44 20 34 43 20 31 30 20 46 30 20 32 37 20 30 32 20 39 31 20 39 34 0D 0A
34 43 20 46 30 20 31 30 20 36 37 20 30 32 20 33 35 20 37 45 0D 0A
3E
DVI Mode Output - Hex+Space Display (line breaks manually added):
20 01 00 DE
08 05 4C F0 10 68 00 3E
20 01 00 DE
08 07 4C F0 10 67 01 13 57 D2
20 01 00 DE
08 06 4C F0 10 67 02 35 07
The ELM protocol's ASCII basis is apparent in the above. In ELM mode, each hex byte is converted to two ASCII character bytes and the ASCII character bytes are then sent as the reply. This adds data overhead (essentially doubling message size) and can create something of a translation burden when working with the raw data vs a terminal display. This ASCII basis was pointed out earlier by kur4o.
The DVI mode responds with hex directly. The above shows the adapter's confirmation response to the $10 command ($20 xx ... ) and the network/vehicle response ($08 xx ...). The DVI commands sent were:
10 05 4C 10 F0 28 00 76
10 05 4C 10 F0 27 01 76
10 07 4C 10 F0 27 02 91 94 4E
The basic DVI configuration was straight from the documentation. I didn't need to set a filter. I just entered DVI mode, verified VPW protocol (was already set), opened the network, and sent the $10 commands. To clean up, I just closed the network and exited DVI mode.
Hope the above helps shed some light on the various modes and their behaviors.
Jim
1995 Caprice 9C1 LT1 - 4.10s, Dynomax Catback, K&N Cold Air Kit, Other Little Stuff
1996 Caprice 9C1 LT1 - 3.73s, Stock
Continuing with details of mode commands that are physically addressed:
Mode $19: Request Diagnostic Trouble Codes by Status
!Note: This mode is not covered in the document "SAE J2190 Issued JUN93" that I am working from. It "Looks" a lot like mode $18 and the disassembly confirms this. I have not found why this difference exists and can only speculate that the regulators found that GM did not comply in some way with the mode $18 and gave them their own mode $19 to cover the difference. In any case this is what I have found.
Code:Status as follows: Bit 7 Warning lamp illuminated for this code Bit 6 Warning lamp pending for this code, not illuminate but malfunction was detected Bit 5 Warning lamp was previously illuminated for this code, malfunction not currently detected, code not yet erased Bit 4 Stored trouble code Bit 3 Manufacturer specific status Bit2 Manufacturer specific status Bit 1 Current code - present at time of request Bit 0 Maturing/intermittent code Group: FF is all Request type: FF=count, 00= status of each dtc Reply comes in multiple frames on my bench where most terminals are open at the moment Header: Mode: DTC: Status for this DTC \B 4C 10 F0 19 FF FF 00 83 \E Request for dtc status \B 4C F0 10 59 01 00 25 9C \E 1 \B 4C F0 10 59 01 01 25 D0 \E 2 \B 4C F0 10 59 01 02 25 04 \E 3 \B 4C F0 10 59 01 03 25 48 \E 4 \B 4C F0 10 59 01 07 6F A4 \E 5 \B 4C F0 10 59 01 08 25 C6 \E 6 \B 4C F0 10 59 01 12 25 B0 \E 7 \B 4C F0 10 59 01 13 25 FC \E 8 \B 4C F0 10 59 01 17 25 D1 \E 9 \B 4C F0 10 59 01 18 25 72 \E 10 \B 4C F0 10 59 01 21 25 A5 \E 11 \B 4C F0 10 59 01 22 01 82 \E 12 \B 4C F0 10 59 01 23 01 CE \E 13 \B 4C F0 10 59 01 31 25 11 \E 14 \B 4C F0 10 59 01 32 25 C5 \E 15 \B 4C F0 10 59 01 34 25 70 \E 16 \B 4C F0 10 59 01 35 25 3C \E 17 \B 4C F0 10 59 01 37 25 A4 \E 18 \B 4C F0 10 59 01 38 25 07 \E 19 \B 4C F0 10 59 01 40 25 76 \E 20 \B 4C F0 10 59 01 41 25 3A \E 21 \B 4C F0 10 59 01 51 25 8E \E 22 \B 4C F0 10 59 01 52 25 5A \E 23 \B 4C F0 10 59 01 54 25 EF \E 24 \B 4C F0 10 59 01 55 25 A3 \E 25 \B 4C F0 10 59 01 57 25 3B \E 26 \B 4C F0 10 59 01 58 25 98 \E 27 \B 4C F0 10 59 01 60 25 03 \E 28 \B 4C F0 10 59 01 61 25 4F \E 29 \B 4C F0 10 59 01 71 25 FB \E 30 \B 4C F0 10 59 01 72 25 2F \E 31 \B 4C F0 10 59 01 74 25 9A \E 32 \B 4C F0 10 59 01 75 01 25 \E 33 \B 4C F0 10 59 02 00 25 10 \E 34 \B 4C F0 10 59 03 00 25 9F \E 35 \B 4C F0 10 59 03 23 25 3E \E 36 \B 4C F0 10 59 03 25 25 8B \E 37 \B 4C F0 10 59 03 32 25 C6 \E 38 \B 4C F0 10 59 03 35 25 3F \E 39 \B 4C F0 10 59 03 36 25 EB \E 40 \B 4C F0 10 59 03 72 25 2C \E 41 \B 4C F0 10 59 04 00 25 15 \E 42 \B 4C F0 10 59 04 03 25 C1 \E 43 \B 4C F0 10 59 04 41 25 B3 \E 44 \B 4C F0 10 59 04 43 25 2B \E 45 \B 4C F0 10 59 05 00 25 9A \E 46 \B 4C F0 10 59 05 06 25 2F \E 47 \B 4C F0 10 59 05 07 25 63 \E 48 \B 4C F0 10 59 05 30 25 5B \E 49 \B 4C F0 10 59 05 31 25 17 \E 50 \B 4C F0 10 59 05 62 25 9D \E 51 \B 4C F0 10 59 05 63 01 22 \E 52 \B 4C F0 10 59 06 01 01 A9 \E 53 \B 4C F0 10 59 06 02 25 8E \E 54 \B 4C F0 10 59 11 07 7F 71 \E 55 \B 4C F0 10 59 11 11 25 7C \E 56 \B 4C F0 10 59 11 12 25 A8 \E 57 \B 4C F0 10 59 11 14 25 1D \E 58 \B 4C F0 10 59 11 15 25 51 \E 59 \B 4C F0 10 59 11 21 01 4E \E 60 \B 4C F0 10 59 11 22 01 9A \E 61 \B 4C F0 10 59 11 33 25 91 \E 62 \B 4C F0 10 59 11 53 25 0E \E 63 \B 4C F0 10 59 11 71 25 E3 \E 64 \B 4C F0 10 59 12 22 25 E5 \E 65 \B 4C F0 10 59 13 51 25 95 \E 66 \B 4C F0 10 59 13 61 25 54 \E 67 \B 4C F0 10 59 13 71 01 13 \E 68 \B 4C F0 10 59 13 80 25 4E \E 69 \B 4C F0 10 59 13 81 25 02 \E 70 \B 4C F0 10 59 14 41 25 AB \E 71 \B 4C F0 10 59 15 08 25 D8 \E 72 \B 4C F0 10 59 15 09 25 94 \E 73 \B 4C F0 10 59 15 32 25 DB \E 74 \B 4C F0 10 59 15 33 25 97 \E 75 \B 4C F0 10 59 15 39 25 55 \E 76 \B 4C F0 10 59 15 43 25 BC \E 77 \B 4C F0 10 59 15 45 25 09 \E 78 \B 4C F0 10 59 15 46 25 DD \E 79 \B 4C F0 10 59 16 26 25 CE \E 80 \B 4C F0 10 59 16 41 25 A8 \E 81 \B 4C F0 10 59 16 42 25 7C \E 82 \B 4C F0 10 59 16 43 25 30 \E 83 \B 4C F0 10 59 16 52 25 C8 \E 84 \B 4C F0 10 59 16 61 25 DD \E 85 \B 4C F0 10 59 16 67 25 68 \E 86 \B 4C F0 10 59 00 00 00 FD \E 87 \B 4C 10 F0 19 FF FF FF 47 \E Request for DTC count \B 4C F0 10 59 FF 56 35 \E
Continuing with details of mode commands that are physically addressed:
Mode $20: Return to Normal Operation
Code:Mode $20 Return to Normal Operation Sets the communications with external devices back to normal Clears test modes if set 4C 10 F0 20 62 Request 4C F0 10 60 B7 Positive acknowledgement
Mode $22: Request Diagnostic Data By PID
This request is composed of header, mode, PID, rate
Mode is $22
PID is one of the supported PIDs
Rate: only a value of $01 is supported (single response)
The example shown requests the value of PID $0005 which is ECT
\B 4C 10 F0 22 00 05 01 F9 \E
\B 4C F0 10 62 00 05 00 D5 \E
Mode $23: Request Diagnostic Data By Memory Address
This request is composed of header, mode, memory_address, rate
Mode is $23
Memory address is a three byte address. Address can only be in Tside bank 0, thus the first address byte is always $00
Memory address is checked for bounds. EEPROM (with the security password) is out of range, Portions of the FLASH (the calibration area) can be accessed.
Rate: only a value of $01 is supported (single response)
Reply is Mode|0x40, two bytes address only (two lsbytes), four bytes of data incrementing from the addrress selected.
\B 4C 10 F0 23 00 00 00 01 03 \E
\B 4C F0 10 63 00 00 80 63 A0 00 17 \E
Should I start a new thread for the reflashing then as well?
Yes please. -Tom
Hi Tom
Did you manage to decipher the config byte meaning and how to use it on dynamic pd setup mode 2A
For example we have
6C 10 F1 2C FC [4C] 11 A1 12 55 F2
6C F1 10 6C FC 4C 1D
6C 10 F1 2C FC [6A] 12 5B FF FF 71
6C F1 10 6C FC 6A D4
6C 10 F1 2C FB [4B] 11 44 12 50 46
6C F1 10 6C FB 4B B7
6C 10 F1 2C FB [63] 12 32 12 5A D5
6C F1 10 6C FB 63 D8
6C 10 F1 2C FA [4A] 11 02 11 04 71
6C F1 10 6C FA 4A E6
The byte in bracket is some config byte and if not set up correctly you get 7f reject. It looks like bit encoded but still have no clue about the meaning.
Hi,
I *thought* this all was figured, that is until I saw your post. I might need to look at this again unless the following solves your Q
In the cases you suggest...Code:Data byte 2 Binary aaXX XXXX aa is type of entry aa =00 Define by offset aa=01 Define by PID 01XX XXXX aa=02 Define by address aa=03 MFG defined XXbb bXXX bbb is starting byte bbb = 000 invalid bbb = 001 GM case 01001XXX bbb = 010 bbb = 011 bbb = 100 bbb = 101 bbb = 110 bbb = 111 invalid XXX Xccc ccc is number of data bytes for this param ccc + bbb must be <= 6 ccc = 000 ccc = 001 ccc = 010 PID DFINED 01001010 <-- This is supported ccc = 011 ccc = 100 ccc = 101 ccc = 110 ccc = 111
------------------------------------------------------------
4C 01 001 100
6A 01 101 010
4B 01 001 011
63 01 100 011
4A 01 001 010
01 <------------- PID defined
XX 001 <------- 1st position in the responding frames
XX 100 <------- 4th position in the responding frames
XX XXX 010 <-- Two bytes
XX XXX 011 <-- Three bytes
XX XXX 100 <-- Four bytes
As I remember things, Only pid defined is supported. The result can be placed in the responding frames as needed But the starting position and length need to be considered not to exceed the max frame length (this is a J1850 thing).
The PCM will kick out any request where the number of bytes does not match the reply byte count of the PID. This value is given in the PID look up table if you want to find a specific PID. That or just request the value of the pid in question and count the bytes it returns
Let me know if this makes any sense/solves your issue
-Tom
Posting Permissions
Reply With Quote
Bookmarks