Much of what I do is simply mimicing existing messages I capture. Then modify that message to suit my needs. Sometimes I even know how it works!!
Here is a captured priority 6, type 11 message, an extended request from the IPC to the Primary ID of the tires requesting the front tire pressures.
Substituting F1 (scantool) for the source address, and '10' for the tire temps instead of 11 for pressures I would try...
'$CB $E4 $F1 $10 $10'
Might work. Just never send a message that claims to be from the ECM, BCM, or some other existing address. You risk running afoul of message arbitration and cause a message collision.
I succesfully got my tire pressures from my Yukon. The Yukon uses a different means of broadcasting tire pressures.
The example above from the Corvette uses an extended address message type and then requests the address value for 'all front' tires. It does so by the use of the Extended Address '10' as the final byte in the example above (previous post). Extended Address for front left wheel is $11, front right is $17. The rears are $31 LR and $37 RR so using a value of $30 in the request would return all rear tire pressures.
On the Yukon, instead of addressing tires individually or even front vs rear they are all reported in a single type 8 status report message periodically broadcast. Maybe an attempt to reduce message traffic on the bus?? Who knows but that is what I found.
So I constructed a low priority, type 9 'Status Request' message addressed to the Primary ID of $E4 (tires), and the same Secondary ID I had seen in the tire pressure broadcasts, $21.
1st byte is priority and message type. Priority is determined by bits 7,6,5. 0 is high priority and 7 low. So in the example above the first byte is $C9. Expressed as binary that is 11001001. Take bits 7,6,5 and convert that '110' to decimal and we have a priority 6 message.
There are 16 message types defined for the system GM is using on these trucks and for various reasons only types 8 through 11 are used. So we only need to concern ourselves to bits 3,2,1,0 for our message type. Take those bits from our $C9 example here and we have binary 1001 which is decimal 9. A type 9 message.
Second byte is target address, in the case here a 'Functional Address' of $E4 which is one of the 'Primary ID' pair assigned to 'Tires'. It seems that requests are sent to the lower of the pair, in this case $E4 and replies come back on the higher, $E5 in this case. (we see this when we request trouble codes on $6A and the replies come back on $6B)
Third byte is the source address and I am using the default value for scantools, $F1. This is a Physical Address on the network and must be unique. (I have 'spoofed' messages claiming to be the liftgate module for the purpose of unlocking doors though)
That completes the header section of the message. If I am using my elm327 to send such a message I must first set this header with the command 'AT SH C9 E4 F1'. That command doesn't go out to the vehicle network immediately, it just sets the header in the elm327 and then later when you do send out a message to the vehicle this is the header that will be sent with your message.
Byte 4 here is the 'Secondary ID' I saw in captured class 2 data from this Yukon. The Secodary ID further defines the Primary ID. It represents a parameter, so with Primary ($E4) + Secondary ($21) we have Tires/All Pressures. This completes my status request.
The ELM327 takes care of appending our '$21' to the header we previously set with the 'AT SH' command as well as the required checksum so all that needs to be done to send this message using our elm327 is to type out '21' and hit send.
A response came from the passenger door module to Primary ID $E5, Secondary ID $21, with all the tire pressures, including a null value for the spare for which I have no sensor installed.
The first 4 bytes are header and the secondary ID of $21.
Bytes 5 through 10 are the data and byte 11 is the checksum. Bytes 5,6,7,8 are my tire pressures in hexadecimal and Byte 9 would be the soare if I had a sensor there. I think byte 10 is just padding.
So my pressures of $24, $27, $24, $28 convert to 36, 39, 36, 40. Need to make an adjustment there it would appear.
I didn't delve into just what makes THIS message I sent a status request as opposed to a status report or a message acknowledgement. That will have to be another post.
