Untested clarification of the Pontiac G8 DIC text API

Had some spare time, did some digging into some of the DIC text control packets.

The following is just observation based. I have yet to code up something to test the observations.

Arbitration ID 0x183 : Arb_Text_Display_Status
Packet Size: 4 bytes
29bit CAN header

Frames DIC text packets.
Sent from ECU 0x060 at priority 4 (DIC?)

Need to experiment to see if DIC sends as response to  a 0x185 packet.

CAN Header: 0x10306060

Header Framing Packet:
0x00 0x91 0x00 0x01
Tail Framing Packet:
0x00 0x91 0x00 0x07

Byte 2 composition:

1001 0xxx

xxx is the message sequence number. Maps to 0x185 Disp parameter sequence. Valid values from 001 to 111

Other packets observed:

0x01 0x00 0x00 0x00 <-  Unknown function, seen near power down
0x00 0xC0 0x00 0x00 <- Unknown function
0x00 0x80 0x00 0x00 <- Unknown function
0x00 0x93 0x00 0x09 <- Seen early. Unknown 0x09 in byte 4.


Arbitration ID 0x185 : Arb_Text_Req_Set_Disp_Parameters
Packet Size: 6 bytes
29bit CAN header

Precedes DIC text packets to control display parameters.
Send from ECU 0x080 at priority 4 (Radio?)

Only scroll arrow control has been isolated at this time.

CAN Header: 0x1030A080

Packet formatting

0x00 0x04 0x49 0x40 0x00 0x03

Byte 3-4
0100 1001 0100 0000

Scroll Arrow Enable Bit - Mutually exclusive of No Scroll Arrow bit
No Scroll Arrow Bit - Mutually exclusive of Scroll Arrow Enable bit

Sequence Number. Sets sequence for 0x183 display status header and footer. Must match.

Byte 1: Unknown Function. Seen the following bytes (0x00, 0x02, 0x03, 0xC2, 0x28)
     0x00 used in transmitting arrow parameter packets
Byte 2: Always observed as 0x00
Byte 3-4: As above.
Byte 5: Always observed as 0x00
Byte 6: Always observed as 0x03


Arbitration ID 0x186: Arb_Text_Req_Set_Display_Text
Packet Size: 8 bytes.
29bit CAN header

Sent from ECU 0x080 at priority 4 (RADIO?)

Transmits packets to DIC for display. Framed by 0x183 framing packets and format controlled with 0x185 packet.

Text is ASCII encoded. Text is terminated by 0x04. Remainder of packet is null filled. (0x00)

1-3 packets can form the DIC text update.  Length of string will determine packet count. 14 bytes is practical limit.

CAN Header:

Format for Packet 1: 0x1030C080

0x45 0xYY 0xZZ Data Data Data Data Data

YY = Packet count. 0x01 for 1 text packet. 0x02 for 2 packet text. 0x03 for 3 packet text.
ZZ = Scroll arrow to display (0x01 is both up/down, others TBD) If control parameter No scroll arrow bit set, ZZ will be first ASCII encoded packet.
Data = ASCII encoded text string. Terminate by 0x04 and null pad packet to 8 bytes.

Format for Packet 2:

0x44 0x02 DATA DATA DATA DATA DATA
Data = ASCII encoded text string. Terminate by 0x04 and null pad packet to 8 bytes.

Format for Packet 3:

0x44 0x03 DATA DATA DATA DATA DATA
Data = ASCII encoded text string. Terminate by 0x04 and null pad packet to 8 bytes.


Example SequencesHEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 91 00 01   
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 45 02 00 4D 50 33 20 54
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 44 02 72 6B 34 04 00 00
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 91 00 07   
HEADER:0x1030A080 Pri:4 Arb:185 Dest:80 | 00 04 48 80 00 03 
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 92 00 01   
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 45 02 00 4D 50 33 20 54
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 44 02 72 6B 34 04 00 00
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 92 00 07   
HEADER:0x1030A080 Pri:4 Arb:185 Dest:80 | C2 04 48 C0 00 03 
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 93 00 01   
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 45 02 00 4D 50 33 20 54
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 44 02 72 6B 35 04 00 00
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 93 00 07   
HEADER:0x1030A080 Pri:4 Arb:185 Dest:80 | C2 04 49 00 00 03 
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 94 00 01   
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 45 02 00 4D 50 33 20 54
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 44 02 72 6B 36 04 00 00
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 94 00 07   
HEADER:0x1030A080 Pri:4 Arb:185 Dest:80 | 28 04 49 40 00 03 
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 95 00 01   
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 45 02 00 4D 50 33 20 54
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 44 02 72 6B 37 04 00 00
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 95 00 07   
HEADER:0x1030A080 Pri:4 Arb:185 Dest:80 | C2 04 49 80 00 03 
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 96 00 01   
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 45 02 00 4D 50 33 20 54
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 44 02 72 6B 38 04 00 00
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 96 00 07   

HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 91 00 01   
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 45 02 00 4D 50 33 20 54
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 44 02 72 6B 34 04 00 00
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 91 00 07   
HEADER:0x1030A080 Pri:4 Arb:185 Dest:80 | 00 04 48 80 00 03 
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 92 00 01   
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 45 02 00 4D 50 33 20 54
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 44 02 72 6B 34 04 00 00
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 92 00 07   
HEADER:0x1030A080 Pri:4 Arb:185 Dest:80 | C2 04 48 C0 00 03 
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 93 00 01   
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 45 02 00 4D 50 33 20 54
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 44 02 72 6B 35 04 00 00
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 93 00 07   
HEADER:0x1030A080 Pri:4 Arb:185 Dest:80 | C2 04 49 00 00 03 
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 94 00 01   
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 45 02 00 4D 50 33 20 54
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 44 02 72 6B 36 04 00 00
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 94 00 07   
HEADER:0x1030A080 Pri:4 Arb:185 Dest:80 | 28 04 49 40 00 03 
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 95 00 01   
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 45 02 00 4D 50 33 20 54
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 44 02 72 6B 37 04 00 00
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 95 00 07   
HEADER:0x1030A080 Pri:4 Arb:185 Dest:80 | C2 04 49 80 00 03 
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 96 00 01   
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 45 02 00 4D 50 33 20 54
HEADER:0x1030C080 Pri:4 Arb:186 Dest:80 | 44 02 72 6B 38 04 00 00
HEADER:0x10306060 Pri:4 Arb:183 Dest:60 | 00 96 00 07   

1997 F Body Manual Enhanced PIDs

If you are interested in them, I have em. Email me.

And I have the Arduino talking nicely to the Camaro. Project is going quicker then I thought.

VPW Progress

Got J1850 VPW running native on the arduino. And let's just say it wasn't easy, mostly self inflicted!

More to come soon.

New (Old) Project..

Well.. Ipod stuff works 99% and I am going to shift gears a little.

Time to learn VPW and build a OBD interface for my 1997 Camaro!

Will post details and stuff when I figure out what I really want to do.

V0.3 Software

Release Notes:

- uses eeprom to remember last track
- with iPod disconnected holding left button down for 10 seconds puts gmPod into GMLAN scantool mode. Use 115200 baud on the USB serial port to see stream.
- album repeat mode now set
- small bugfixes. 

 Bugs:
- Something is still causing the iPod to hang once in a while. Working on that.. 
- Didn't detect iPod this morning. Will try and duplicate

gmPod-100706a_V0.3.zip

V0.2 Hardware and firmware

Finally got around to fixing the board.. Again, this isn't tested and won't run with the posted firmware (Added software mode control to the CAN transceiver, will need to add control of that to the sketch.)

Board:
CAN_Shield_V0.2.zip

Latest mostly working firmware:
gmPod-100510a.zip

There are still a few small bugs in the firmware I am working on but this is 95% working and working well.

Proof!

Got the display glitches working. Needed a 30ms delay between packets in multi packet DIC messages.

Here is gmPOD hardware that I have working:

And some videos.. Taken with my phone. So the quality is nasty bad..

Video 1  Video 2 Video 3


It really works!

gmPOD success!

Folks,

With the pin 8 ground wire mod in place, the PCB as posted works great! The Alpha software was up and running today!

I still owe you a V0.2 board. And a few pictures!

Hardware is done. Now onto the software!

Found a bug in the gmPOD sheild..

The gerbers I posted have a bug. Pin 8 on the AU5790 is NOT grounded. Will revise tonight. Oh well, I will have a mod wire!

Boards have shipped

Been a while. And no.. I have not forgotten this project.

My PCBs have shipped, and I have the 16 pin connector to mate to the connector behind the glove box. So, this weekend it will be game on again!

Will keep you all posted.

Alpha Boards and Schematics

Got two alpha level boards ready for batchpcb. Attached are the eagle files, gerbers, and schematics.

This is the arduino sheild. Single wire, MCP2515 based. Again, I have no idea if the boards are good yet, just have to wait for the fab shop to get them back to me. This one is iPod centric and has 3.3V RS232 out and 12V for charging the ipod. I will do more of a pure single wire CAN board later if this works.

*** LINK REMOVED *** - FOUND A BUG IN V0.1

This is the ELM327 scanner I was using to hack all the CAN messages. Meant to hook up to a FTDI TTL to RS232 converter on the 6 pin header.
ELM327 Scanner Board

****************
WARNING
****************

These are alpha boards and may (will probably) have bugs. USE the boards at your own risk or let me debug them first ;)

Success!

Finally have the hardware and software together... And I can report a successful test of the ipod adapter!

Other then small bug fixes and a multi CAN packet display driver, everything is working as expected. I hope to finish the hardware this week and get the Tyco connectors so I can wire the thing into the factory nav connector behind the glove box.

I will also post video soon. And Source. And schematics. (When I get time!)

Any interest in getting a single wire CAN arduino shield fabbed up? I will probably get one done with batch PC. Would be willing to get a couple more for anybody interested.

Revised Arb ID info

Header information - Arbitration IDs

? - Not confirmed

Both 29 and 11 bit IDs observed on the bus.

Byte 1 - ?

Byte 2 - ?

Byte 3 - To address

Byte 4 - From Address

0x00 - Broadcast?
0x40 - ? ECU or BCM
0x0D - Wheel Buttons
0x60 - Wheel Buttons
0x80 - Radio
0x97 - Onstar
0xA0 - ? Never sends data. Could be the bridge to HS CAN
0xB0 - ? Tire Pressure Subsystem
0xC0 - DIC / Instrument Cluster

Detailed info on specific Arbitration IDs

1040C040 - ECM to DIC
8 bytes
Byte 1,2,3,4 - ?
Byte 5,6 - ? Throttle position
Byte 7,8 - Distance traveled. Wraps around every once in a while.

1000A0B0 - TPMS to gateway?
8 bytes - Slow repeat time
10 0 A0 B0
24 24 3C 3C 3B 3C 0 FF

Byte 1,2 - ?
Byte 3 - Tire 1 (Units TBD)
Byte 4 - Tire 2 (Units TBD)
Byte 5 - Tire 3 (Units TBD)
Byte 6 - Tire 4 (Units TBD)
Byte 7,8 - ?



0C050040 - Speed and RPM from ECM
8 bytes
Byte 1 - ?
Byte 2,3 - Speed / 10
Byte 4,5 - RPM / 4
Byte 6,7,8 - ?

10056040 - ECM to Buttons - Power Locks
4 Bytes
00 00 FF 01 - Unlock
00 01 7F 01 - Lock

102E8080 - Radio Status Update (Updated with right ARBID)
2 Bytes
Sent twice after a mode change

04 02 - AM
06 02 - FM 1 (NO ASM)
08 02 - FM 2
14 02 - CD
1C 02 - Front Aux
1E 02 - Rear Aux
20 02 - ASM 1
22 02 - ASM 2
20 01 - Odometer Mode. Turns off all other DIC text

100D0060 - Wheel Buttons to broadcast
8 bytes

xx - For up motion is count, for down it is 0x20-count
Depending on mode 0x60 will update 0x80 (Radio, like when volume changes). These nodes communicate a lot.

Select up
10 0D 00 60 00 00 xx 00 - Event Start
10 0D 00 60 00 00 00 00 - Event Release

Enter
10 0D 00 60 01 00 00 00 - Event Start
10 0D 00 60 00 00 00 00 - Event Release

Volume up
10 0D 00 60 00 00 00 xx - Event Start
10 0D 00 60 00 00 00 00 - Event Release

Volulme Enter
10 0D 00 60 20 00 00 00 - Event Start
10 0D 00 60 00 00 00 00

Source Button
10 0D 00 60 02 00 00 00 - Event Start
10 0D 00 60 00 00 00 00 - Event Release

Road Button
10 0D 00 60 03 00 00 00 - Event Start
10 0D 00 60 00 00 00 00 - Event Release

Phone Talk
10 0D 00 60 10 00 00 00 - Event Start
10 0D 00 60 00 00 00 00 - Event Release

Hang up
10 0D 00 60 40 00 00 00 - Event Start
10 0D 00 60 00 00 00 00 - Event Release

1030C0xx - DIC Text
8 byte multipart
(Seen sent from 0x80, 0x97 from bluestar, 0x81 was tested manually)

First byte of first message is 0x45
Next byte is count of multi part. ie: 0x02. 0x03. 0x01 works
Next byte is arrow indication. Sometimes. Still figuring this out.
01 - Both up and down arrow
81 - Up only arrow
41 - Down only arrow

Remaining data bytes are ASCII.

Sequence is terminated by 0x04. Then null filled with 0x00 to fill 8 byte packet.

Second and subsequent messages start with 0x44. Then Sequence number. Then data.

(Two examples from 0x80 to 0xC0)
10 30 C0 80 8 45 02 52 65 61 72 20 41
10 30 C0 80 8 44 02 75 78 04 00 00 00

10 30 C0 80 8 45 03 01 31 30 35 2E 33
10 30 C0 80 8 44 02 20 46 4D 20 41 53
10 30 C0 80 8 44 03 4D 04 00 00 00 00

100AA097 - Onstar to Gateway
http://sites.google.com/site/radioetcetera/home/onstar-gps

Need new definitions..

Found a few typos in the lists of Arb IDs.. Will post some updates tonight.

More progress

This morning I was able to test the CAN filtering and messaging. I forgot the ARBID for mode change, and will code up the interface management section tonight.

Should be able to have iPod and CAN code merged tomorrow. Hopefully a demo of this coming soon!

Update on what I have been doing.

Nothing GMLAN like.. But I have been working on my iPod interface. I have it working on a breadboard. I need to integrate the MCP2515 code to it and plug it in and see what happens.

Stay tuned.

Wheel Controls mapped and DIC text kinda works

Steering Wheel Controls

ArbID: 10 0D 00 60

Select up
10 0D 00 60 00 00 01 00
10 0D 00 60 00 00 00 00

select down
10 0D 00 60 00 00 1F 00
10 0D 00 60 00 00 00 00

Enter
10 0D 00 60 01 00 00 00
10 0D 00 60 00 00 00 00

Volume up
10 0D 00 60 00 00 00 01
10 0D 00 60 00 00 00 00

Volume down
10 0D 00 60 00 00 00 1F
10 0D 00 60 00 00 00 00

Volulme Enter
10 0D 00 60 20 00 00 00
10 0D 00 60 00 00 00 00

Source Button
10 0D 00 60 02 00 00 00
10 0D 00 60 00 00 00 00

Road Button
10 0D 00 60 03 00 00 00
10 0D 00 60 00 00 00 00

Phone Talk
10 0D 00 60 10 00 00 00
10 0D 00 60 00 00 00 00

Hang up
10 0D 00 60 40 00 00 00
10 0D 00 60 00 00 00 00

And I almost have the top line of the DIC figured out.. (Says Pwne, I was going for Pwned.. Something isn't quite right yet)

We are talking!

Got the logging interface working today. (ELM327 and AU5970 SW CAN transceiver) The ELM needs to be running at 115Kbaud to log with headers and not overflow the buffer.

Logged two files, one with no steering wheel controls one with.

No wheel controls
Wheel controls activated

Possible Arbitration IDs for the wheel controls:

10 0D 00 60
10 2E 80 80 *
10 30 60 60 ? Incremental data ? Could be volume string to headunit.
10 30 A0 80
10 31 00 80 1 byte..

Need some filter enabled logging to see what is what.. Progress anyways!

Got everything. Time for the breadboard and iron..

All parts have arrived.

Ii hope to have the ELM327 wired up to a SWCAN transceiver this weekend. Will post my first log file as soon as I get one!

First round of parts has arrived!

Digikey order came today. Might start playing with the Arduino and get SPI talking to the MCP2515.

Welcome

Folks...

I want to document my progress in hacking GMLAN and building an iPod interface for my Pontiac G8.

Plan on doing it very openly for the good of all.

Where am I..

Parts ordered:
ELM327
MCP2515 CAN Controller
MCP2551 CAN Transceiver
AU5790D CAN SW Tranciever
OBD plugs for the car

More to come when the parts get in. Welcome to my blog.