CAN Messaging in Hexadecimal

[NPD]

Good evening,

I am wondering if anyone has experience with sending and receiving CAN messages on the CAN bus for the Gen IV ECMs, like the E38? In particular, I am looking for a person or resource on how to send hexadecimal instructions to the ECM to make the engine react, like increase the throttle and RPM. The GM Tech 2 is limited in what it can do, and I want to go beyond 2,000 rpm for testing on the dyno.

Thank you!

[tek1229]

I have done some playing around with a canbus tool, mimicking the dod message required to keep my truck in 8 cyl mode..

Having said that, the easiest way to try what your doing is to buy an elm327 device and an OBD2 splitter.. once you figure out how to read the messages being sent from the tech2 using can id identifiers you can then use the tech2 to see what the command is.. I don't know if offhand, and I'm buried with remodeling the house at the moment.. You might find it googling, there are some forums dedicated to canbus cracking and reverse engineering..

Once you know the commands you can probably correlate the hex value with the rpm commanded and modify the command for a higher RPM.. There may be a safetly built into the E38 ecm to only go so high? I don't know the answer to that..

One you know the command you'll have to send that, along with a scan tool present message(0x3E) every 3 or 4 seconds or else it will release control and come back to idle..

P.S. The device control service is gonna start with 0xAE

[NPD]

Thank you for the quick reply! I have done basically what you have said except with the use of a PCAN adapter. I was able to read the RPM increase CAN message from the Tech 2 and resend, but could only get the engine to 2,050 RPM. Maybe there is an RPM limit in the ECM, as you mentioned. I certainly hope not or would like to figure out how to remove it. And thank you for the tip on resending. The engine did exactly what you said it would do after about 4 seconds.

[tek1229]

What messages were you sending to change the RPM? Did you modify the message to try and go higher? or just copy them exactly?

[NPD]

All my notes are at work, but what I remember is sending the request on 7E0 with Bit 5 set to FF (max). This produced a near immediate increase from idle to 2,050 RPM. Changes made in other Bits made no difference. Maybe there is more to this instruction but I'm not sure what the next step is.

[Chris@HPTuners]

the max limit of the idle speed control command is 2048 RPM.

[NPD]

Thank you! So I've been thinking about how to send a cruise control acceleration command instead to the ECM. I realize the ECM will need a vehicle speed, which I would need to simulate. Any thoughts?

The purpose behind all of this is to remove the linear actuator for the throttle control that moves the accelerator pedal and use CAN bus to run the engine on the dyno. Viewing all the engine sensors is easy with CAN but it would be very helpful on the dyno to remove the accelerator pedal actuator for a precision CAN bus control. We dyno about 2,000 4.8L Gen IV engines per year so this would also save time.

[Chris@HPTuners]

I think it would be easier to get your dyno software supplier to simulate the appropriate pedal voltages to control the throttle.

[NPD]

OK, thank you. That option was brought up, and the dyno software has the capability of producing two inverted or disproportionate analog signals for the APPS.

However, it would be very interesting to figure out the CAN bus side of it at some point.

[AutoWiz]

NPD, you need to go and start this thread over at http://www.mp3car.com/ they will have all hardware you will or might need, and more savvy people in this area. they do this regularly over there and for a lot bigger things than idle speed or cruise up and down. just look here: http://www.mp3car.com/engine-managem...agnostics-etc/ this is a tuning forum. people here are experts in tuning. mp3car.com is the people doing this for touchscreen control of a/c or power windows, or to implant an rfid chip in your hand so your car just unlocks when you walk by it. etc. and so on.

[NPD]

Thank you AutoWiz. Since I bought the HP Tuners VCM Pro package I figured this forum would be a great place to start. The members here have been helpful, even with my non-tuning questions. I will check out the website you provided.

[NPD]

tek1229 -

If you don't mind me asking, what software did you use to determine the CAN messaging and send the packets for your DoD tuning? For curiosity's sake I bought an ELM327 for testing. I'm not finding much available for the ELM327 except Terminal or obd2spy, which are both very cumbersome to use and don't have the features I need. The ELM manual has a lot of good tips for CAN messaging and how to build the packets but doesn't go deeper into what I need.

Thank you!

[tek1229]

For sniffing I just used a serial terminal.. You can use the elm327 data sheet and command list to filter and learn the commands your looking for..

I like termite, it's simple and I can program function keys to rest the elm,turn headers on,change header, change CAN receive filters,etc.. Trying to simply use atma has too much data and usually ends up in a buffer full message.. Using that connected to just an ECM and a tech2 does help though...

[Wnts2Go10O]

opcorn: i would like this info for suspension reasons >_>