VT/VX 41 Broadcast Frame

160 And 8192 Baud Aldl
Posts: 74
Joined: Sun Aug 26, 2012 9:47 pm
Location: Brisbane

VT/VX 41 Broadcast Frame

Postby megajuz3003 » Thu Jul 02, 2020 10:57 am

I am slowly working on breaking down the 41 broadcast frame from the ECU/PIM (for my PIM project), posting up what i have so far to help others out if they need it but also to get some input as i am still missing a couple of things

according to the documentation the frame contains flags for Throttle Failure, Engine Type, Commanded Gear (other than PRNDL), Chime and Map failure, these ones i cant really work out and if Barometric Pressure is where i think it is i still have to work out the maths for it :roll: but its getting there

pim 41.pdf
(130.41 KiB) Downloaded 37 times

This is what i've been using to determine what data is in the fame


VTVX 41.pdf
(555.54 KiB) Downloaded 44 times

and here it is so far (its messy but thats ok :lol: )

Posts: 407
Joined: Thu May 03, 2012 10:50 pm
Location: Castlemaine, Vic

Re: VT/VX 41 Broadcast Frame

Postby pman92 » Thu Jul 02, 2020 9:36 pm

Unfortunately I don't have much more to offer other than the 3 unknown bytes in the message 40 request from the BCM are to do with VATS. They will all be FF until a valid key is read, and then they will be the 3 bytes known by the PCM (from when the BCM/PCM were linked). Those 3 bytes never change and are unique to each BCM (so they only change if you replace the BCM).

Edit: thats for V6, in LS1 case PCM means PIM. They will be the 3 bytes known by the PIM from when BCM/PIM were linked.
VR-VY Holden BCM Simulator: LINK
Ford Smartlock Bypass Module: LINK

Posts: 74
Joined: Sun Aug 26, 2012 9:47 pm
Location: Brisbane

Re: VT/VX 41 Broadcast Frame

Postby megajuz3003 » Thu Jul 02, 2020 10:18 pm

pman92 wrote:Unfortunately I don't have much more to offer other than the 3 unknown bytes in the message 40 request from the BCM are to do with VATS. They will all be FF until a valid key is read, and then they will be the 3 bytes known by the PCM (from when the BCM/PCM were linked). Those 3 bytes never change and are unique to each BCM (so they only change if you replace the BCM).

Edit: thats for V6, in LS1 case PCM means PIM. They will be the 3 bytes known by the PIM from when BCM/PIM were linked.



Thanks for that, that does help a bit, at least i know what those bytes are :thumbup: .. i dont think i can do much with it maybe i could flag a vats fail to the bcm unless a valid key is found, but i dont think that would be very useful

Posts: 407
Joined: Thu May 03, 2012 10:50 pm
Location: Castlemaine, Vic

Re: VT/VX 41 Broadcast Frame

Postby pman92 » Fri Jul 03, 2020 10:22 pm

Yeah would be pointless. And I think the BCM keeps the main and secondary ALDL buses separated until the VATS is done (or until it times out), so if you flag it failed it might actually create issues
VR-VY Holden BCM Simulator: LINK
Ford Smartlock Bypass Module: LINK

User avatar
Posts: 331
Joined: Sun Jan 25, 2015 4:21 pm
Location: Sydney

Re: VT/VX 41 Broadcast Frame

Postby j_ds_au » Sat Jul 04, 2020 1:12 am

pman92 wrote:Edit: thats for V6, in LS1 case PCM means PIM. They will be the 3 bytes known by the PIM from when BCM/PIM were linked.

So the PIM pairs with the BCM and learns the 3 secret bytes, or is it just a protocol translator for the PCM, and it's still the PCM that does the actual pairing?

Joe.

Posts: 74
Joined: Sun Aug 26, 2012 9:47 pm
Location: Brisbane

Re: VT/VX 41 Broadcast Frame

Postby megajuz3003 » Sat Jul 04, 2020 10:06 am

j_ds_au wrote:
pman92 wrote:Edit: thats for V6, in LS1 case PCM means PIM. They will be the 3 bytes known by the PIM from when BCM/PIM were linked.

So the PIM pairs with the BCM and learns the 3 secret bytes, or is it just a protocol translator for the PCM, and it's still the PCM that does the actual pairing?

Joe.



i havent put alot of work into the security system, but from what i can work out, the BCM 40 Frame will change from FF,FF,FF to the 3 byte secret once a valid key is detected(thanks pman92), the pim reads this and if its secret key is the same it will check with the PCM (not sure on this but), if that is the same the VATs flag in the 41 frame is set to PASS then its all good to go.. but if i remember correctly the PIM is paired with the BCM and the PCM is paired with the PIM

the PIM doesnt really just translate protocol data. it looks like it actually polls the PCM for data to generate data for the 41 Frame, plus reading the other ALDL frame for data that is meant to go to the PCM, from what i have read it even has its own DTCs

Posts: 407
Joined: Thu May 03, 2012 10:50 pm
Location: Castlemaine, Vic

Re: VT/VX 41 Broadcast Frame

Postby pman92 » Sat Jul 04, 2020 9:31 pm

The PIM is paired with the BCM and learns the 3 secret bytes when it is linked with a scan tool.
Once the PIM sees the secret bytes it handles the VATS on the VPW side which works differently. The PIM and PCM are also linked separately over VPW.

As far as the rest of the car is concerned the PIM is a PCM for normal mode data. The BCM or any other module have no idea it's a PIM instead of a PCM sending message 41. They don't care. All they see is "41 = powertrain data" and use it. You can send your own 41 messages from a tool of your choice and the cluster will use it.
VR-VY Holden BCM Simulator: LINK
Ford Smartlock Bypass Module: LINK

User avatar
Posts: 331
Joined: Sun Jan 25, 2015 4:21 pm
Location: Sydney

Re: VT/VX 41 Broadcast Frame

Postby j_ds_au » Sun Jul 05, 2020 2:50 am

Thanks for the explanations about the PIM, guys. So effectively, there's three devices that together need to pair up for VATS to operate (versus just two devices for my VS).

Joe.

Return to ALDL, OBDII Logging and Scanning

Who is online

Users browsing this forum: No registered users and 2 guests