pcmhacking.net

I am slowly working on breaking down the 41 broadcast frame from the ECU/PIM (for my PIM project), posting up what i have so far to help others out if they need it but also to get some input as i am still missing a couple of things

according to the documentation the frame contains flags for Throttle Failure, Engine Type, Commanded Gear (other than PRNDL), Chime and Map failure, these ones i cant really work out and if Barometric Pressure is where i think it is i still have to work out the maths for it but its getting there
This is what i've been using to determine what data is in the fame

and here it is so far (its messy but thats ok )

Unfortunately I don't have much more to offer other than the 3 unknown bytes in the message 40 request from the BCM are to do with VATS. They will all be FF until a valid key is read, and then they will be the 3 bytes known by the PCM (from when the BCM/PCM were linked). Those 3 bytes never change and are unique to each BCM (so they only change if you replace the BCM).

Edit: thats for V6, in LS1 case PCM means PIM. They will be the 3 bytes known by the PIM from when BCM/PIM were linked.

pman92 wrote:Unfortunately I don't have much more to offer other than the 3 unknown bytes in the message 40 request from the BCM are to do with VATS. They will all be FF until a valid key is read, and then they will be the 3 bytes known by the PCM (from when the BCM/PCM were linked). Those 3 bytes never change and are unique to each BCM (so they only change if you replace the BCM).

Edit: thats for V6, in LS1 case PCM means PIM. They will be the 3 bytes known by the PIM from when BCM/PIM were linked.

Thanks for that, that does help a bit, at least i know what those bytes are .. i dont think i can do much with it maybe i could flag a vats fail to the bcm unless a valid key is found, but i dont think that would be very useful

Yeah would be pointless. And I think the BCM keeps the main and secondary ALDL buses separated until the VATS is done (or until it times out), so if you flag it failed it might actually create issues

pman92 wrote: Edit: thats for V6, in LS1 case PCM means PIM. They will be the 3 bytes known by the PIM from when BCM/PIM were linked.

So the PIM pairs with the BCM and learns the 3 secret bytes, or is it just a protocol translator for the PCM, and it's still the PCM that does the actual pairing?

Joe.

j_ds_au wrote:

pman92 wrote: Edit: thats for V6, in LS1 case PCM means PIM. They will be the 3 bytes known by the PIM from when BCM/PIM were linked.

So the PIM pairs with the BCM and learns the 3 secret bytes, or is it just a protocol translator for the PCM, and it's still the PCM that does the actual pairing?

Joe.

i havent put alot of work into the security system, but from what i can work out, the BCM 40 Frame will change from FF,FF,FF to the 3 byte secret once a valid key is detected(thanks pman92), the pim reads this and if its secret key is the same it will check with the PCM (not sure on this but), if that is the same the VATs flag in the 41 frame is set to PASS then its all good to go.. but if i remember correctly the PIM is paired with the BCM and the PCM is paired with the PIM

the PIM doesnt really just translate protocol data. it looks like it actually polls the PCM for data to generate data for the 41 Frame, plus reading the other ALDL frame for data that is meant to go to the PCM, from what i have read it even has its own DTCs

The PIM is paired with the BCM and learns the 3 secret bytes when it is linked with a scan tool.
Once the PIM sees the secret bytes it handles the VATS on the VPW side which works differently. The PIM and PCM are also linked separately over VPW.

As far as the rest of the car is concerned the PIM is a PCM for normal mode data. The BCM or any other module have no idea it's a PIM instead of a PCM sending message 41. They don't care. All they see is "41 = powertrain data" and use it. You can send your own 41 messages from a tool of your choice and the cluster will use it.

Thanks for the explanations about the PIM, guys. So effectively, there's three devices that together need to pair up for VATS to operate (versus just two devices for my VS).

Joe.

Thanks for the table showing the breakdowns of the bytes and bits.

Im trying in a Vx HSV (lux bcm) to trigger the low speed fan via the bcm and have tried to inject the below using ose tool.

TEST TX- 41,63,11,11,40,90,19,50,10,76,DB,90,11,11,5B,11, CHECKSUM


(Note: POST EDITED)
All things are working as expected, and the low speed fan is turned on.
I have attached my workings of the above.