E92A - 8HP

[tonn0297]

Hey guys, doing an 8HP70 swap into my L83 car keeping the E92A ECU. im posting here as most other places do not have the technical skills,
Or dont want to share it unless you use their service to program it..
MAXXecu is running the 8HP so the 6L80E TCM is gone, but the ECU still needs to see one on
the bus for torque reduction and blips to work. I've been capturing CAN data and
cross-referencing factory DBC files trying to figure out what the TCM actually
sends. Think I've got most of it but wanted to post here in case anyone has done
something similar and can spot if im wrong about some of the data.

This is for E92A (L83 etc). From what I can tell E38 guys (C6, early
CTS-V) use 0x199 instead of 0x189 and 0x191 instead of 0x18E -- would be good
if someone could confirm that too.

---

WHAT I THINK NEEDS TO BE SENT (500 kbit/s GMLAN)

0x0C7 80Hz 00 00 00 00 (4 bytes, always zeros in my log)
0x0F9 80Hz output shaft speed + torque ratio
0x189 80Hz torque reduction request
0x19D 40Hz throttle blip / RPM target
0x1A6 40Hz 04 00 00 00 (constant in my log)
0x1AF 40Hz 00 00 00 11 00 00 00 FF (constant in my log)
0x1F5 40Hz PRNDL gear position
0x4C9 2Hz trans oil temp + DTC flags
0x77F 1Hz 00 00 00 00 00 00 00 (7 bytes, looks like a node alive)

From the actual TCM firmware message table (OS 24270599) 0x197 and 0x199 are
marked IllegalTransMsgObj so I'm not sending those. No heartbeat needed as far
as I can tell -- can anyone confirm?

---

PROTECTION ALGORITHM (this is the part I'd most like someone to double check)

Both 0x189 and 0x19D have what looks like a rolling checksum. I cracked it as:

protection = (0x4000 - combined - RC) & 0x3FFF

RC is a 2-bit counter in B0[7:6], increments every frame 0->1->2->3->0.
Separate counters per message ID.

For 0x19D: combined = ((B0 & 0x3F) << 8) | B1
B2[5:0] = protection >> 8, B3 = protection & 0xFF

For 0x189: combined = (B2 << 8) | B3 (build payload first, then calc)
B4 = protection >> 8, B5 = protection & 0xFF

I verified this against 16 frame combinations from my log and they all match, but
I'd feel better if someone else could run their own frames through it.

---

0x189 TORQUE REDUCTION

B0[7:6] rolling counter
B0[4] intervention active
B0[3:0] + B1 short-term torque limit (12-bit, raw = (Nm + 848) * 2, inactive = 0xFFF)
B2[5:4] realization suggestion: 0=none, 1=shift, 2=stability/TCS
B2[3:0] + B3 long-term torque limit (12-bit, same encoding)
B4, B5 protection checksum
B6 0xFF
B7 0x8C -- I originally thought this was a CRC but it's actually the
top speed limit signal (0x8C * 2 = 280 kph). Hardcode it.

Inactive frames from my log:
RC=0: 0F FF 0F FF 30 01 FF 8C
RC=1: 4F FF 0F FF 30 00 FF 8C
RC=2: 8F FF 0F FF 2F FF FF 8C
RC=3: CF FF 0F FF 2F FE FF 8C

---

0x19D THROTTLE BLIP

B0[7:6] rolling counter
B0[5:4] intervention type (1 = requesting blip)
B0[1:0] + B1 RPM target (10-bit, value = RPM / 8)
B2[5:0], B3 protection checksum
B4[0] Garage_Shift_Active
B5, B6 turbine speed (rpm * 4, big-endian)
B7 0xFF

One thing I'm pretty sure about -- Garage_Shift_Active (B4 bit 0) has to be set
ONE frame before the blip starts, not at the same time. When I look at 0x18E
B2[7] (Transmission_Engine_Speed_Request_Failed) it looks like missing this pre-
arm is what kills the request. Anyone had experience with this?

4000 RPM blip from my log:
RC=0: 11 F4 2E 0C 01 xx xx FF
RC=1: 51 F4 2E 0B 01 xx xx FF
RC=2: 91 F4 2E 0A 01 xx xx FF
RC=3: D1 F4 2E 09 01 xx xx FF

---

PRNDL (0x1F5)

Park: 0F 0F 00 01 00 00 03 00
Reverse: 0F 0F 00 02 00 00 03 00
Neutral: 0F 0F 00 03 00 00 03 00
Drive: 0F 0F 00 04 00 00 03 00

---

ECM FEEDBACK (0x18E)

B0[7] = 1 means 0x189 torque request was rejected
B2[7] = 1 means 0x19D blip request was rejected

Planning to use these to confirm it's actually working once I get it on a car.

---

Has anyone done something like this before or know if the algorithm is right?
Main thing I'm unsure about is whether omitting 0x0C7, 0x1A6, and 0x1AF will
cause any DTCs -- I can't find anything definitive on those three.

[tonn0297]

i was contemplating putting it in the Can knowlge share, but i did not wanna contaminate the thread with possibly trash data

[antus]

What is the protection algorithm? I don't want to discuss breaking copy protection on this site. If its to do with drivetrain protection, thats ok.

[tonn0297]

yea sorry, its a checksum / counter on the CAN from the 6L80E TCM to the E92A ECU. not a copy protection, just a replay preventive messure i guess

[VESenator8HP]

I was also tackling a similar project with a Dodge 8HP70 into a VE Senator with e38 ecu, using the Maxxecu mini as a dedicated TCU.

We got it running but due to a can ID conflict between e38 and the Maxxecu mini which wouldn’t enable me to get the car out of Park, I’ve chosen to upgrade to the Maxxecu Gen 2 Race to run both engine and the gearbox - hopefully that eliminates the can conflict issue now!

Sorry I don’t have any answers to your questions but I am interested in the can stream data and how to go about deciphering it…very interesting!

Let me know how your conversion gets on, hopefully mine is less than a week or two away!

[Gatecrasher]

If you get a copy of GMW8772, it'll explain exactly how those protection values are calculated. There's a really old version readily available with a basic Google search.

[Tre-Cool]

I was also tackling a similar project with a Dodge 8HP70 into a VE Senator with e38 ecu, using the Maxxecu mini as a dedicated TCU.

We got it running but due to a can ID conflict between e38 and the Maxxecu mini which wouldn’t enable me to get the car out of Park, I’ve chosen to upgrade to the Maxxecu Gen 2 Race to run both engine and the gearbox - hopefully that eliminates the can conflict issue now!

Sorry I don’t have any answers to your questions but I am interested in the can stream data and how to go about deciphering it…very interesting!

Let me know how your conversion gets on, hopefully mine is less than a week or two away!

What was the can ID confict? It's entirely possible to turn off the broascast of an ID in the ecu/tcm, Just hope its not got a knock on affect from something else.

[tonn0297]

I was also tackling a similar project with a Dodge 8HP70 into a VE Senator with e38 ecu, using the Maxxecu mini as a dedicated TCU.

We got it running but due to a can ID conflict between e38 and the Maxxecu mini which wouldn’t enable me to get the car out of Park, I’ve chosen to upgrade to the Maxxecu Gen 2 Race to run both engine and the gearbox - hopefully that eliminates the can conflict issue now!

Sorry I don’t have any answers to your questions but I am interested in the can stream data and how to go about deciphering it…very interesting!

Let me know how your conversion gets on, hopefully mine is less than a week or two away!

What was the can ID confict? It's entirely possible to turn off the broascast of an ID in the ecu/tcm, Just hope its not got a knock on affect from something else.

The Can list seems to have the E38 on it quite a few times, think thats the issues. so
120,128,130,140,144,170,180,280,2F0,300,320,330,348
380,390,410,420,510,520,670

https://www.maxxecu.com/webhelp/can-id_list.html

[tonn0297]

So i got further, thanks for the pointers guys.
The E92A is generating CAN conflicts, on id: 0x3D1 0x3E9 and 0x4C9.

0x3D1 is engine general status, Speed limiter warning, coast fuel cut active, cruise speed limiter, throttle position (may be possible to remove)
0X3E9 is vehicle speed and distance, containing driven speed, distance counter and so on. (may be possible to remove)
0X4C9 is TCM status, trans temp, autograde braking and alike. (may be possible to remove)

so this means to use the MAXXECU mini you have to have a gateway or hope the 3 CAN id's are not used for much in the ECU.

Protection. its calculated like this:
"protection value(PV) = (-(Can Packet + ARC)) Mod 2^n"
the ARC is (prev+1) Mod 4 so roling counter 0-3 updated on every new msg.

All this means if the maxxexu mini do not support scripting, you have to go to a Gen2 race ecu. OR create a CAN gateway to split the 2 CAN bus from eachother.
I think i will go that route as i only have HPT so no ability to load custum BIN's in the ECU.
if any have inputs i wuld love to hear them.

[Tre-Cool]

whats your e92 os your testing with?

i know the e38 it transmits throttle & accelerator pedal on a few different id's.

I dont think there would be an issue removing the first 2.
for the 4C9 id, if thats got Trans temp, then it is coming from the TCM then. so the ecu would be RX only.