pcmhacking.net

Have some questions about actually connecting to the CAN bus on one of these things. Its two-wire CAN and the data rate with just the thing on the bench harness looks to be 83.3kbaud from the scope. The snap-on hooks up to it without issue, so the problems are on my end configuring the AVT-852 I have to make it go.

I tried connecting using the standard 2-wire CAN with 11-bit ID's, and so far haven't gotten any data reported back from the PCM. I have the data rate set to 83.3 rather than 500 since thats what the PCM appears to be running at. I have the GM LAN standard, but that's some light reading for another day. Right now all I want to see is just data returned back from the network.

Any tips on hooking up to these? Helluva lot more complicated than ALDL or J1850, thats for sure...

I havent tried connecting to an E38 yet, but I can tell you I have used tunercats to flash an E38 with my AVT. maybe a bus sniff during that operation will help?
I managed to connect to a v6 alloytec pcm (bosch) CAN data at 500k and get data. im even almost finished making an SAE can ADX based on it. the filters are a mind bend compared to the VPW stuff..... ive got them mostly figured out now.

dimented24x7 wrote:Have some questions about actually connecting to the CAN bus on one of these things. Its two-wire CAN and the data rate with just the thing on the bench harness looks to be 83.3kbaud from the scope. The snap-on hooks up to it without issue, so the problems are on my end configuring the AVT-852 I have to make it go.

I tried connecting using the standard 2-wire CAN with 11-bit ID's, and so far haven't gotten any data reported back from the PCM. I have the data rate set to 83.3 rather than 500 since thats what the PCM appears to be running at. I have the GM LAN standard, but that's some light reading for another day. Right now all I want to see is just data returned back from the network.

Any tips on hooking up to these? Helluva lot more complicated than ALDL or J1850, thats for sure...

Definitely CAN 500kb/s 11bit for the E38 ecus. Ahhhh.. think there was a thread or post I saw before of someone showing what they exactly sent to get it setup correctly on the AVT. Ill have to search back through. Might have been in the SOE thread as I think it was you Jayme trying to get connected up correctly for the VZ V6?

yeah I posted up a basic example of opening up CAN0 at 500k and listening to chatter here: http://pcmhacking.net/forums/viewtopic. ... 506#p43506

Ah ok thanks guys. Yeah that and thubming thru the GM LAN standards shows its more involved than just connecting, setting the address, and watching the network. The 500kBaud sort of makes sense as well since it looks like I will need to specify that when going onto the network. I guess the 83.3kBaud is just local comms the PCM does with the rest of the stuff on the bus.

Looks like actual comms will have to wait until I can whip up something in C#. Just for yucks tried the advanced mode in my LS1 Flash app to enable it but forgot that it does some background processing specific to the VPW. Got to see the AVT do some really weird things that aren't in the manual when I tried to send a frame, but no reponse from the PCM.

On a plus side the GM LAN standard is really nice. Gives a step by step flowchart for how to reflash the PCM along with frame examples. On a HUGE minus side the dreaded mode $34 is listed as the next step after mod $27, security access granted. I really hope it doesn't need an entire RAM resident kernel just to get data off the flash...

the bosch alloytec pcm is fantastic in that regard.... you just do security access and then download the calibration area directly. when you reflash, you just request an upload to the memory area and the pcm handles the erasing and programming itself. you just feed it bytes

GM actually does include all the needed code in some of the PCMs to do full reflashing. Its used for the "blackbox" recorder that takes a snapshot of the vehicle telemetry in the event of a crash (good thing to get rid of if you plan on breaking the law! )

But, I suspect the download requirement is an added layer of security. The key is the easy part, the actual rubber meets the road when you want to download/upload, and man I hate writing those things. No way to debug. All you can do is send some test code and hope the thing manages to call back.

dimented24x7 wrote:GM actually does include all the needed code in some of the PCMs to do full reflashing. Its used for the "blackbox" recorder that takes a snapshot of the vehicle telemetry in the event of a crash (good thing to get rid of if you plan on breaking the law! )

But, I suspect the download requirement is an added layer of security. The key is the easy part, the actual rubber meets the road when you want to download/upload, and man I hate writing those things. No way to debug. All you can do is send some test code and hope the thing manages to call back.

So when you attempt a new bootloader.. it really is a "Brick and miss"

hahaha, well, not really brick since your running from ram and the pcm will either reboot back to the stock OS, or if your code is stuck in a loop which is satisfying the watchdog timer then it'll just appear to stop. Normally though code should be designed so that this cant happen - keep the loop execution short and the watchdog resets outside of the loop so the watchdog will reset the pcm if the loop isnt exited in the expected time. The only time you might not want this is during flash memory erase or write, but if that takes longer than expected you probably have a problem anyway.