Corvette CCM Reverse Engineering Anyone?

[NomakeWan]

Did some experimentation and it seems like the mode 9 resumes broadcasts according to what I would assume is a "default" scheduling program. My assumption is that it does not assume bus master role in this situation, but haven't been able to investigate further.

I've got a lot more work to do here but I think it's progress. My logger wasn't sending a bus master / heartbeat message before, and once I added that the ccm shut the f up for a whopping 5 seconds before it sent a self-resume announcement, so I think there are things we can learn from this info.

7745:41 67 02 F1 00 4B 4C 01 00 83 C6 06 E3 00 3D FF FF 00 FF FF 62
7748[F1 56 08 B1]
7867:F0 56 F1 C9
7869[F1 56 08 B1]
7880:F1 56 08 B1
7881[F1 56 F0 C9]
13939:F1 56 00 B9
13963:10 59 08 4B 02 00 42
13990:40 57 FF FF 6B
14163:10 59 00 4B 02 00 4A
14191:40 57 FF FF 6B
14363:10 59 00 4B 02 00 4A
14391:40 57 FF FF 6B
14563:10 59 00 4B 02 00 4A
14590:40 57 FF FF 6B
14764:10 59 00 4B 02 00 4A
14791:40 57 FF FF 6B

I'll keep plugging away at it when possible. I got a couple hours to experiment tonight, but probably wont see more time with the car until early Tuesday.

What is an F0 mode? An undocumented feature of the CCM?

Also why is your logger attempting to send a Mode 8 request before the CCM sends an F0 external device poll?

[spfautsch]

What is an F0 mode? An undocumented feature of the CCM?

That's the tester announcing it's bus master? May not be needed since wasn't used for the log I made two days ago.

Also why is your logger attempting to send a Mode 8 request before the CCM sends an F0 external device poll?

That was me doing a stupid in the message pump "logic".

steveo you must not have had enough tequila when you were testing the mode 7 stuff. Works just as expected for me with ccm silenced.

138337[F4 57 01 00 B4]
F4 92 01 00 00 00 00 00 00 00 00 7C 3E 00 04 06 40 00 02 2F 0B C5 0D 4C 27 5E 83 4D 28 20 4F 19 00 8F F1 DC D8 65 A8 10 86 88 80 80 00 A0 00 A4 05 8A 00 38 14 1A 00 04 CD FF 00 00 00 00 6B 43
138434[F1 57 07 10 A1]
10 59 00 5E 27 00 12
138452[F1 57 07 40 71]
40 57 FF FF 6B
41 67 27 51 00 5E 4D 01 04 05 DC BF E3 00 3F FF FF 00 FF FF 72
138497138499[F1 56 F0 C9]
F4 57 01 00 B4
138509[F4 57 01 00 B4]
F4 92 01 00 00 00 00 00 00 00 00 7C 3E 00 04 06 40 00 02 57 0B 8E 0D 4C 28 5E 83 4D 28 20 53 19 00 8F F1 DE D8 65 A9 10 86 88 80 80 00 A2 00 A5 05 85 00 38 14 19 00 04 CD FF 00 00 00 00 6C 4C

Gauges were updating and average fuel consumption started dropping while it was idling so I think this will work great. Just need to fine tune things and make it handle when the PCM shuts down gracefully, loss of sync, etc.

[NomakeWan]

That's the tester announcing it's bus master? May not be needed since wasn't used for the log I made two days ago.

You are correct, it's unnecessary. The F0 poll is not "announcing bus master," it is "CCM is seeking external devices who wish to become bus master." It is not a mode, it is a unique device ID only used for this single poll (similar to the $10, $40, and $41 polls).

That was me doing a stupid in the message pump "logic".

Fair enough. A lot of ADS/ADX files do the same thing; just blast the bus with Mode 8 rather than wait for the F0 and reply to that directly. Easy enough fix.

steveo you must not have had enough tequila when you were testing the mode 7 stuff. Works just as expected for me with ccm silenced.

138337[F4 57 01 00 B4]
F4 92 01 00 00 00 00 00 00 00 00 7C 3E 00 04 06 40 00 02 2F 0B C5 0D 4C 27 5E 83 4D 28 20 4F 19 00 8F F1 DC D8 65 A8 10 86 88 80 80 00 A0 00 A4 05 8A 00 38 14 1A 00 04 CD FF 00 00 00 00 6B 43
138434[F1 57 07 10 A1]
10 59 00 5E 27 00 12
138452[F1 57 07 40 71]
40 57 FF FF 6B
41 67 27 51 00 5E 4D 01 04 05 DC BF E3 00 3F FF FF 00 FF FF 72
138497138499[F1 56 F0 C9]
F4 57 01 00 B4
138509[F4 57 01 00 B4]
F4 92 01 00 00 00 00 00 00 00 00 7C 3E 00 04 06 40 00 02 57 0B 8E 0D 4C 28 5E 83 4D 28 20 53 19 00 8F F1 DE D8 65 A9 10 86 88 80 80 00 A2 00 A5 05 85 00 38 14 19 00 04 CD FF 00 00 00 00 6C 4C

Gauges were updating and average fuel consumption started dropping while it was idling so I think this will work great. Just need to fine tune things and make it handle when the PCM shuts down gracefully, loss of sync, etc.

Sweet! Just as an experiment, try sending this message to the bus after silencing the CCM and see what happens. I'm not sure if it will work, but if it does it'll save one message frame.

F4570741AE

If this works, it'll skip the step of asking the CCM to send the $40 poll and just tell the PCM to send the $41 response directly. I don't know if the PCM will actually honor the Mode 7 request, and if it does, I don't know if the CCM will actually accept the resulting $41 poll when it wasn't the one that solicited it. But it's worth a shot!

[spfautsch]

Fair enough. A lot of ADS/ADX files do the same thing; just blast the bus with Mode 8

My intention was to try sending a mode 8 after seeing the 41 message from the PCM that was initiated by mode 9. But I didn't have the message pump accounting for whether it had silenced the CCM or sent a mode 9 yet. Didn't work either way. Apparently the CCM will only honor a mode 8 request for a short time after sending the f0f1 heartbeat.

F4570741AE

Wouldn't that be F4 57 07 41 6D? And no luck either way.

This should work nicely. I can separate the 10 and 40 requests between six or eight logging messages so the 07/40/41 exchange isn't adjacent and thus lose slightly less time logging.

[steveo]

steveo you must not have had enough tequila when you were testing the mode 7 stuff. Works just as expected for me with ccm silenced

you're right
flashhack is too strict
it was rejecting the reply as the request/reply first byte has to match in flashhack land
makes sense if idle traffic isn't present but otherwise not

[NomakeWan]

Wouldn't that be F4 57 07 41 6D? And no luck either way.

This should work nicely. I can separate the 10 and 40 requests between six or eight logging messages so the 07/40/41 exchange isn't adjacent and thus lose slightly less time logging.

You are correct, it's 6D. I'm not sure what my calculator was doing. I must've fat-fingered one of the bytes while doing the addition step. Good catch, and thanks for running the experiment! Looking forward to seeing what your logging comes up with. Being able to log data from the PCM without messing up the dash and the ABS/ASR would be very nice indeed.

[spfautsch]

I've found eehack's raw cmd function great for this - saved me from finding / building something on my own. No need to be connected to the ALDL to send / see the checksum byte.

Today's logging was off a good bit on avg mpg. 23.0 actual / 24.3 by the dic (including 60 miles w/o logging) and then 25.8 actual / 22.1 by dic on the return trip (only 60 miles).

I'll have to do some more test-drives with different ratios of PCM polling to CCM traffic. That'll be a tall order with the time change and winter coming. I hate driving this thing at night because the deer-infested winding back-roads will be calling out to me to avoid the mind-numbing monotony of sitting in interstate gridlock.

Whatever the case, the dic-based fuel consumption stuff isn't all that terribly important to me. The gauges work and everything else does so I'm happy with it given that I can make logging to a SD card works. Ordered a logging shield with RTC today, hope to have it in a couple.

I'll need to figure out handling when the ASR / ABS barges into ALDL communications and gracefully reconnecting. Beyond that it should be completely unnoticeable.

Have the VIN / patch / auto trans / maf discovery figured out for the most part. Though I might just remove the e-side / maf check altogether since it's not really relevant to passive logging and doesn't work with the engine running anyway.

[NomakeWan]

I'm actually not entirely sure how the ABS/ASR thing works, so good luck. I know that it freaks out and throws a Code 72 when you connect a scan tool like a Tech 2 or EEHack, but I'm not entirely sure why since you shouldn't actually be telling it to shut up and it isn't supposed to talk unless spoken to (by the CCM). I haven't done any raw idle logging while driving, however, so it's entirely possible that's why I haven't seen any traffic from it. I will point out however that the GM definition I have states it's not supposed to actually talk on the bus unless the CCM specifically requests it to.

So hey, another mystery to solve!