VT/VX 41 Broadcast Frame

160 And 8192 Baud Aldl
Post Reply
megajuz3003
Posts: 74
Joined: Sun Aug 26, 2012 9:47 pm
cars: 2001 VU SS
Location: Brisbane

VT/VX 41 Broadcast Frame

Post by megajuz3003 »

I am slowly working on breaking down the 41 broadcast frame from the ECU/PIM (for my PIM project), posting up what i have so far to help others out if they need it but also to get some input as i am still missing a couple of things

according to the documentation the frame contains flags for Throttle Failure, Engine Type, Commanded Gear (other than PRNDL), Chime and Map failure, these ones i cant really work out and if Barometric Pressure is where i think it is i still have to work out the maths for it :roll: but its getting there
pim 41.pdf
(130.41 KiB) Downloaded 290 times
This is what i've been using to determine what data is in the fame

VTVX 41.pdf
(555.54 KiB) Downloaded 334 times
and here it is so far (its messy but thats ok :lol: )
pman92
Posts: 464
Joined: Thu May 03, 2012 10:50 pm
cars: HZ One Tonner
VE Ute
Location: Castlemaine, Vic

Re: VT/VX 41 Broadcast Frame

Post by pman92 »

Unfortunately I don't have much more to offer other than the 3 unknown bytes in the message 40 request from the BCM are to do with VATS. They will all be FF until a valid key is read, and then they will be the 3 bytes known by the PCM (from when the BCM/PCM were linked). Those 3 bytes never change and are unique to each BCM (so they only change if you replace the BCM).

Edit: thats for V6, in LS1 case PCM means PIM. They will be the 3 bytes known by the PIM from when BCM/PIM were linked.
VR-VY Holden BCM Simulator: View Post
MrModule.com.au
megajuz3003
Posts: 74
Joined: Sun Aug 26, 2012 9:47 pm
cars: 2001 VU SS
Location: Brisbane

Re: VT/VX 41 Broadcast Frame

Post by megajuz3003 »

pman92 wrote:Unfortunately I don't have much more to offer other than the 3 unknown bytes in the message 40 request from the BCM are to do with VATS. They will all be FF until a valid key is read, and then they will be the 3 bytes known by the PCM (from when the BCM/PCM were linked). Those 3 bytes never change and are unique to each BCM (so they only change if you replace the BCM).

Edit: thats for V6, in LS1 case PCM means PIM. They will be the 3 bytes known by the PIM from when BCM/PIM were linked.

Thanks for that, that does help a bit, at least i know what those bytes are :thumbup: .. i dont think i can do much with it maybe i could flag a vats fail to the bcm unless a valid key is found, but i dont think that would be very useful
pman92
Posts: 464
Joined: Thu May 03, 2012 10:50 pm
cars: HZ One Tonner
VE Ute
Location: Castlemaine, Vic

Re: VT/VX 41 Broadcast Frame

Post by pman92 »

Yeah would be pointless. And I think the BCM keeps the main and secondary ALDL buses separated until the VATS is done (or until it times out), so if you flag it failed it might actually create issues
VR-VY Holden BCM Simulator: View Post
MrModule.com.au
User avatar
j_ds_au
Posts: 384
Joined: Sun Jan 25, 2015 4:21 pm
Location: Sydney

Re: VT/VX 41 Broadcast Frame

Post by j_ds_au »

pman92 wrote: Edit: thats for V6, in LS1 case PCM means PIM. They will be the 3 bytes known by the PIM from when BCM/PIM were linked.
So the PIM pairs with the BCM and learns the 3 secret bytes, or is it just a protocol translator for the PCM, and it's still the PCM that does the actual pairing?

Joe.
megajuz3003
Posts: 74
Joined: Sun Aug 26, 2012 9:47 pm
cars: 2001 VU SS
Location: Brisbane

Re: VT/VX 41 Broadcast Frame

Post by megajuz3003 »

j_ds_au wrote:
pman92 wrote: Edit: thats for V6, in LS1 case PCM means PIM. They will be the 3 bytes known by the PIM from when BCM/PIM were linked.
So the PIM pairs with the BCM and learns the 3 secret bytes, or is it just a protocol translator for the PCM, and it's still the PCM that does the actual pairing?

Joe.

i havent put alot of work into the security system, but from what i can work out, the BCM 40 Frame will change from FF,FF,FF to the 3 byte secret once a valid key is detected(thanks pman92), the pim reads this and if its secret key is the same it will check with the PCM (not sure on this but), if that is the same the VATs flag in the 41 frame is set to PASS then its all good to go.. but if i remember correctly the PIM is paired with the BCM and the PCM is paired with the PIM

the PIM doesnt really just translate protocol data. it looks like it actually polls the PCM for data to generate data for the 41 Frame, plus reading the other ALDL frame for data that is meant to go to the PCM, from what i have read it even has its own DTCs
pman92
Posts: 464
Joined: Thu May 03, 2012 10:50 pm
cars: HZ One Tonner
VE Ute
Location: Castlemaine, Vic

Re: VT/VX 41 Broadcast Frame

Post by pman92 »

The PIM is paired with the BCM and learns the 3 secret bytes when it is linked with a scan tool.
Once the PIM sees the secret bytes it handles the VATS on the VPW side which works differently. The PIM and PCM are also linked separately over VPW.

As far as the rest of the car is concerned the PIM is a PCM for normal mode data. The BCM or any other module have no idea it's a PIM instead of a PCM sending message 41. They don't care. All they see is "41 = powertrain data" and use it. You can send your own 41 messages from a tool of your choice and the cluster will use it.
VR-VY Holden BCM Simulator: View Post
MrModule.com.au
User avatar
j_ds_au
Posts: 384
Joined: Sun Jan 25, 2015 4:21 pm
Location: Sydney

Re: VT/VX 41 Broadcast Frame

Post by j_ds_au »

Thanks for the explanations about the PIM, guys. So effectively, there's three devices that together need to pair up for VATS to operate (versus just two devices for my VS).

Joe.
Madchuska
Posts: 10
Joined: Sun Feb 07, 2021 11:20 pm
cars: Holden

Re: VT/VX 41 Broadcast Frame

Post by Madchuska »

Thanks for the table showing the breakdowns of the bytes and bits.

Im trying in a Vx HSV (lux bcm) to trigger the low speed fan via the bcm and have tried to inject the below using ose tool.

TEST TX- 41,63,11,11,40,90,19,50,10,76,DB,90,11,11,5B,11, CHECKSUM


(Note: POST EDITED)
All things are working as expected, and the low speed fan is turned on.
I have attached my workings of the above.
Attachments
tx test ls fan bcm.png
Post Reply