ELM327 & Class 2 Serial Data
- Thread starter TJBaker57
- Start date
@TJBaker57 Sorry for the wait but...
...Paydirt:
>AT SH CB E4 F1
OK
>1111
AA E5 C1 11 11 34 37
>1117
AA E5 C1 11 17 34 82
>1131
AA E5 C1 11 31 35 5F
>1137
AA E5 C1 11 37 35 EA
>2011
AA E5 C1 20 11 00 33 51
>2017
AA E5 C1 20 17 00 35 1A
>2031
AA E5 C1 20 31 00 34 32
>2037
AA E5 C1 20 37 00 34 37
...Paydirt:
>AT SH CB E4 F1
OK
>1111
AA E5 C1 11 11 34 37
>1117
AA E5 C1 11 17 34 82
>1131
AA E5 C1 11 31 35 5F
>1137
AA E5 C1 11 37 35 EA
>2011
AA E5 C1 20 11 00 33 51
>2017
AA E5 C1 20 17 00 35 1A
>2031
AA E5 C1 20 31 00 34 32
>2037
AA E5 C1 20 37 00 34 37
Curious that GM chose to return 2 bytes for the temp but only use the 2nd byte. I suppose that is also why they used a secondary ID of $20 for that parameter as the SAE designated temp ($10) only returns a single byte.
Have you got the equation for the temp? A common equation for temps is an offset of -40 then convert to Farenheit if desired. But that would put your 0x33 at just 51.8 F. That sounds a might cold for the date.
Crap, you know what? I don't think that's temperature. The numbers from last night match what I had from the 90+ degree day where I had driven around already. Last night the car was cold and the values are the same. Maybe temperature is hidden somewhere but I don't think that's it. I'm 99% we have the pressure, though.
I'm curious what we have there then.
Try substituting $10 for $20 in your status request message. $10 is supposed to be temperature according to SAE J2178_4.
Have you tried taking this reading in motion vs at rest? I am wondering what could this value be since it appears not to be a temperature. What else can a tire sensor report.... Battery level.... Maybe some rotational force??
Puzzled.
Maybe its hardware ID? Doing some programming now on the application. I'll be going out in a little bit to test it. I'll try 10 instead of 20 then.
But 2 of them are the same value... Seems unlikely. Is tire temperature something you know is being read by the sensors, like it shows elsewhere in the vehicle display?
I thought I could get it. Someone who had a van (Express) from 2008 said they found temps. I guess I was wrong.
But I do have this. I'm a dope and didn't take a picture of the actual GUI.
Attachments
Remember now, the last byte is only a checksum and has no value to you as data. Your data values from the picture are;
FL 0x34 = dec 52*4*.145038=30.167904 PSI
FR same as front left
lR 0x35 = dec 53*4*.145038=30.748056 PSI
RR same as left rear.
Got it, thanks. I'll fix my formula now. It's a bit of a hassle going in and out of the house each time I update the program and load it to the RPi in the car. It's time consuming.
@TJBaker57 Hey, sorry.. I've been trying to figure out if I'm doing this right. For ECT, I think I do ATSH ??49F1 hit enter, type 10, then enter again. But I don't know the ?? values. And same for oil.
Recalling that bits 7, 6, and 5 of the first byte assign message priority with 0 = high and 7 = low it can be seen that the '89' in the command 'AT SH 89...' could also be A9, C9, or E9 for a lower priority, or 69 or 49, 29, or even 09 for a higher priority message, however I would avoid sending high priority messages. The other values of 19, 39, 59 and so on are not an option due to our requirement of bit 4 to be low as bit 4 denotes a 3 byte header form as GM uses. A high bit 4 would denote a single byte header form used by other manufacturers.
Gotcha. Just got in from trying that and trying the oil temp. Success. Thanks again
iddqd
Member
Hey guys!
I am very into this topic
I've got a 2005 Escalade EXT. I am building an overlanding rig/pleasant daily.
I have a couple of projects I am working on that will involve GM Class 2 decyphering.
#1. Fold/unfold mirrors with an alarm. On 03+ you can press and hold mirror out button to fold the mirrors. I want the alarm to fold and unfold them for me. It's a little bit complicated to use just a realy since inside the DMM I'd have to connect directly to the legs of an IC, which are very tiny. I think it's better to use Class2 to send a message to fold/unfold both mirrors. Plus, once this works, I can utilize other functions, like to move the driver seat into position without pressing memory buttons or other cool stuff. I have collected Class 2 messages that spitted out when mirrors are folded/unfolded with a button, and now trying to understand what they actually mean. This thread has been SUPER helpful.
The second project is to implant a Hummer H2 transfer case. It has a diff lock inside, and a low gear. The Escalade TC lacks both. Mechanically it's a bolt on swap, but I need to make an H2 TCCM work with escalade. The TCCM needs PRNDL from PCM and VSS from ABS (according to Factory manual). It's a bit strange, cuz ABS knows wheel speeds, but not VSS. VSS is supplied by PCM.
Anyway, I connected all according to wiring digramm and I have no codes and I can control TC shift motor via Tech2, but when I use the buttons, it doesn't work. Again, accoring to manual, if the light on the button is flalshing for 15 seconds, it means that TCCM does not receive required input from other modules.
I suspect that H2 ABS module has a different phisical address or maybe something else doesn't match. H2 ABS is a bit different (it's not an Active Brake/JL4). I will have to collect network traffic between TCCM and the other modules to figure out what's missing.
I will post my finigs into this thread, cuz I don't think there's another place where people intrested in this.
I am very into this topic
I've got a 2005 Escalade EXT. I am building an overlanding rig/pleasant daily.
I have a couple of projects I am working on that will involve GM Class 2 decyphering.
#1. Fold/unfold mirrors with an alarm. On 03+ you can press and hold mirror out button to fold the mirrors. I want the alarm to fold and unfold them for me. It's a little bit complicated to use just a realy since inside the DMM I'd have to connect directly to the legs of an IC, which are very tiny. I think it's better to use Class2 to send a message to fold/unfold both mirrors. Plus, once this works, I can utilize other functions, like to move the driver seat into position without pressing memory buttons or other cool stuff. I have collected Class 2 messages that spitted out when mirrors are folded/unfolded with a button, and now trying to understand what they actually mean. This thread has been SUPER helpful.
The second project is to implant a Hummer H2 transfer case. It has a diff lock inside, and a low gear. The Escalade TC lacks both. Mechanically it's a bolt on swap, but I need to make an H2 TCCM work with escalade. The TCCM needs PRNDL from PCM and VSS from ABS (according to Factory manual). It's a bit strange, cuz ABS knows wheel speeds, but not VSS. VSS is supplied by PCM.
Anyway, I connected all according to wiring digramm and I have no codes and I can control TC shift motor via Tech2, but when I use the buttons, it doesn't work. Again, accoring to manual, if the light on the button is flalshing for 15 seconds, it means that TCCM does not receive required input from other modules.
I suspect that H2 ABS module has a different phisical address or maybe something else doesn't match. H2 ABS is a bit different (it's not an Active Brake/JL4). I will have to collect network traffic between TCCM and the other modules to figure out what's missing.
I will post my finigs into this thread, cuz I don't think there's another place where people intrested in this.
@iddqd
I have an 05 Yukon with the folding mirrors as well. I'll have a look at any class 2 that looks related.
Regarding the physical address of the EBCM/TCCM... You may have already dicovered that overwhelmingly the data passed through class 2 during normal operations uses functional addressing. Rarely is physical addressing seen outside of scantool use.
What means are you using for gathering the serial data for study, and what formatting? From this thread you can see my setup and while the spreadsheet is a bit of a hack it does make sifting through the data easier. And being a google docs makes it ever so easy to share.
I have an 05 Yukon with the folding mirrors as well. I'll have a look at any class 2 that looks related.
Regarding the physical address of the EBCM/TCCM... You may have already dicovered that overwhelmingly the data passed through class 2 during normal operations uses functional addressing. Rarely is physical addressing seen outside of scantool use.
What means are you using for gathering the serial data for study, and what formatting? From this thread you can see my setup and while the spreadsheet is a bit of a hack it does make sifting through the data easier. And being a google docs makes it ever so easy to share.
iddqd
Member
Thanks mate. I actually spent last night (literally till 4am) and decyphered mirror folding. I will write a post on this with explanations. It will be a long post
. The most important documents that helped me were these:SAE J2178-1
SAE J2178-4
Basically, I was able to fold/unfold a passanger mirror with a Class 2 message and I suspect there's no way to fold/unfold a driver mirror via Class2, cuz DDM connects to it phisically and does not need a network command and no other modules (and neither tech2) can command to fold/unfold mirrors. But I might be wrong. Any input is very welcome.
If u want to try it urself, send this message:
6A C2 A0 85 00 33 (33 is CRC, not needed if using telnet or putty).
C2 is a functional address of mirrors for command, defined in J2178
A0 is message source, in our case DDM, ,defined in J2178
85 is probably an action, this byte is MF specific
00 means both sides, defined in J2178
you will receive this:
8A C3 A1 85 1E 37 (37 is CRC)
C3 is a functional address of mirrors for status, defined in J2178
A1 is message source, in our case PDM, defined in J2178
85 is probably an action, this byte is MF specific
1E means PASS side
So, PDM confirms that the PASS mirror is folded or a command accepted (I didn't figure that out yet).
I attached the entire network traffic for folding to this message for reference.
I'd like to warn people that those SAE standartds are NOT Harry Potter and are NOT an easy read. People who can easiliy read and comprehend SAE standards usually don't have friends
It took me some time to get an understanding of what's actually going on. I will write a detailed post soon with network messages, my analysys steps etc so people can follow.I will give TCCM a try over the weekend and will report back.
PS. My setup: Win10, BAFX Bluetooth, putty. I do have a Chineese MDI knock off and Tech2Win, as well as ACDelco subscription for SPS for 1 VIN ($40 for 2 years), but it's not requred for this particular exercise.
Peace, Pavel
Google Sheet
Attachments
Last edited:
Thanks mate. I actually spent last night (literally till 4am) and decyphered mirror folding. I will write a post on this with explanations. It will be a long post
SAE J2178-1
SAE J2178-4
Basically, I was able to fold/unfold a passanger mirror with a Class 2 message and I suspect there's no way to fold/unfold a driver mirror via Class2, cuz DDM connects to it phisically and does not need a network command and no other modules (and neither tech2) can command to fold/unfold mirrors. But I might be wrong. Any input is very welcome.
If u want to try it urself, send this message:
6A C2 A0 85 00 33 (33 is CRC, not needed if using telnet or putty).
C2 is a functional address of mirrors for command, defined in J2178
A0 is message source, in our case DDM, ,defined in J2178
85 is probably an action, this byte is MF specific
00 means both sides, defined in J2178
you will receive this:
8A C3 A1 85 1E 37 (37 is CRC)
C3 is a functional address of mirrors for status, defined in J2178
A1 is message source, in our case PDM, defined in J2178
85 is probably an action, this byte is MF specific
1E means PASS side
So, PDM confirms that the PASS mirror is folded or a command accepted (I didn't figure that out yet).
I attached the entire network traffic for folding to this message for reference.
I'd like to warn people that those SAE standartds are NOT Harry Potter and are NOT an easy read. People who can easiliy read and comprehend SAE standards usually don't have friends
I will give TCCM a try over the weekend and will report back.
PS. My setup: Win10, BAFX Bluetooth, putty. I do have a Chineese MDI knock off and Tech2Win, as well as ACDelco subscription for SPS for 1 VIN ($40 for 2 years), but it's not requred for this particular exercise.
Peace, Pavel
Google Sheet
Thats close to what I sent.
I sent a Priority 3, type 10, message operation = "Load Command Extended" message to Primary ID "Mirrors", Command ID: $C2, from source F1. The secondary ID was 05 (see table 32, 2178-4), with the Q bit high that becomes 85. The extended address I sent was 00 for "all" (see table 55, 2178-4).
This folded both mirrors for me but as expected only the PDM responds with a "report status extended" message.
I suspect you only folded the passenger mirror due to using the the source address of the DDM. One could hardly expect a module to act upon a command message sent by itself!
iddqd
Member
Amazing!
I found a caveat.
You need to wake up the bus first, that is what FF 02 command is for or press buttons on devices conected to Class 2 to wake up the bus "manually". Without it other modules are not accepting commands, they sleep. I was wondering last night why sometimes my commands worked and sometimes they did not.
I didn't figure out last night that 05 plus high Q bit equals 85. It makes total sence now. Secondary ID is only 6 bit and it completely escaped me.
Now, if you noticed, when you fold mirrors from the button, they first go to the most down position and then fold. When you unfold them, they also go from the most down position to some stored position. I suspect that position is stored in BCM (as Driver 1/2 settings or maybe just last mirror position), so modules need to request that info from BCM. I will try tonight to find that peace of communication and report back.
Anyway, I am extremly happy as this is my first dive into a Class 2 universe and I can't wait to do more cool stuff. Thanks for chiming in and helping me
I have noted that sending a message twice can also "wake up" a module but it is true, there is a method defined in 2178 for bus wake up, an 02 sent to Primary ID "Network Control", Status ID $FF.
Do you already have the other two volumes of 2178?
There is a message related to mirrors I have not figured out yet. Look at the spreadsheet image I posted of your "fold.txt" doc. Lines 2, 23 and 24. On line 2 the DDM sends a load command extended message to the mirrors Primary ID/Command ID $C2, the secondary ID is "12" and the extended address "00" (all). The data byte 1 is "40".
On line 23 the PDM reports an extended status of this parameter (12,00,40).
Line 24 has the DDM acknowledging this status report extended from the PDM.
I see this exchange repeatedly, before and during my data recording of moving my mirrors using the trucks native controls.
Do you already have the other two volumes of 2178?
There is a message related to mirrors I have not figured out yet. Look at the spreadsheet image I posted of your "fold.txt" doc. Lines 2, 23 and 24. On line 2 the DDM sends a load command extended message to the mirrors Primary ID/Command ID $C2, the secondary ID is "12" and the extended address "00" (all). The data byte 1 is "40".
On line 23 the PDM reports an extended status of this parameter (12,00,40).
Line 24 has the DDM acknowledging this status report extended from the PDM.
I see this exchange repeatedly, before and during my data recording of moving my mirrors using the trucks native controls.
iddqd
Member
Yup, I found all 4 parts of 2178 on the Internet. Just replace -1 with -2 or -3 or -4 in those links I provided earler. It's dated 1999 but I'm not in the mood to pay to get the latest version, I suspect not much has changed since then in Class2 communications. I am slowly trying to comprehend this J2178. I am a software engineer by day, but it's still very intence for me.
I am heading to the gym now, I will look into this later tonight
Pavel
I do pretty much everything on my android phones. For data acquisition and testing commands etc. I use an android app "Bluetooth Serial Terminal" by Kai Morich. Has macro support so it's easy to store frequently used commands and strings there. And it's super convenient to need only a phone and a Bluetooth serial adapter.
Have 4 mini Bluetooth serial adapters, a couple OBD2 port splitters, OBD2 pigtail harnesses for tapping in and experiments. Just to prove to myself it would work I once locked my TrailBlazer up, popped open the hood with a screwdriver, used 3 jumper wires to hook up a bluetooth adapter and commanded the door(s) open!
Also have a Tech 2 clone.
iddqd
Member
I was actually going to ask about this. Putty has not the most user friendly UI, and it's a bit annoying. I will try to use the app u'r referring to.
I also installed an alram with GPS and GSM module, so I can lock/unlock/start/u name it the car from my phone from anywhere in world, so locking myself out of the vehicle by an accident is pretty much impossible.
Last edited:
iddqd
Member
Let's recap what we know so far (Line by line):
#1: DDM wakes the network up
#2: ???????
#3: ??????
#4, 5: DDM & PDM report state of respective ajar switches. 21 means Ajar switch not active (Table 34, Q=0, C=0, SecID=21) and 26 and 22 front driver and front passanger (Table 56)
#6, 15: BCM ack information from lines 4 & 5. 26 means 21 ack (Q=0, C=1, SecID=21), 26 and 22 same as above
#25, 26: Ovbiously, the last 8 digits of my VIN (I checked )
#31, 32: A command to fold the mirrors and an ack from PDM that this command is received on PASS side.
#33, 34: A bit confusing to me. DDM tells mirrors do not fold, and PDM reports that it didn't fold them???? What does this mean? Or maybe it means Load the state of the mirrors and PDM responds that the stae is folded. (Q=0, C=0). 31-34 are still a liltle bit confusing to me. Are we ack a receiving of the command or an execution of the command. Looks like we ack the receiving and DDM than requests the status to make sure that the mirror is folded
#1: DDM wakes the network up
#2: ???????
#3: ??????
#4, 5: DDM & PDM report state of respective ajar switches. 21 means Ajar switch not active (Table 34, Q=0, C=0, SecID=21) and 26 and 22 front driver and front passanger (Table 56)
#6, 15: BCM ack information from lines 4 & 5. 26 means 21 ack (Q=0, C=1, SecID=21), 26 and 22 same as above
#25, 26: Ovbiously, the last 8 digits of my VIN (I checked
)#31, 32: A command to fold the mirrors and an ack from PDM that this command is received on PASS side.
#33, 34: A bit confusing to me. DDM tells mirrors do not fold, and PDM reports that it didn't fold them???? What does this mean? Or maybe it means Load the state of the mirrors and PDM responds that the stae is folded. (Q=0, C=0). 31-34 are still a liltle bit confusing to me. Are we ack a receiving of the command or an execution of the command. Looks like we ack the receiving and DDM than requests the status to make sure that the mirror is folded
Last edited:
iddqd
Member
I think I figure out exactly Lines 31-34. In 31 DDM is commanding to START folding (literally it commands to load Q=1 (which is Enable) into the state of the command fold, ie starting the execution of the command. In 32 PDM ack that the state of the command fold is now Enabled. The mirror is folding now. I'm sure there's a overcurrent protection in the circuitry of DDM and PDM, however, in 33 DDM is commanding to load Q=0 into the state of the command fold, ie commanding to disable folding. and in 34 PDM ack that the state od the command fold is now 0, ie the mirror has stopped folding.
What it means that if we maybe can fold the mirror part way, if we give the command to stop folding soon enough. I am going to verify my hypothesis on the car and report back tomorrow.
update: part way folding didn't work, once the mirrors started folding, they will continue untill they fully folded.
another update
Line #2: moves PASS mirror down or up. The same command moves it down first, but if issued again, the mirror moves up to the previous position. I'm not sure what it means
Pavel
What it means that if we maybe can fold the mirror part way, if we give the command to stop folding soon enough. I am going to verify my hypothesis on the car and report back tomorrow.
update: part way folding didn't work, once the mirrors started folding, they will continue untill they fully folded.
another update
Line #2: moves PASS mirror down or up. The same command moves it down first, but if issued again, the mirror moves up to the previous position. I'm not sure what it means
Pavel
Last edited:
I can fill in some of the other informations as I have been breaking them down for months. You may have noticed the color coding in the image, Q bit and C bit values are highlighted as well as any extended addresses. Makes it a little easier to pick out events.
Line 3: BCM reports status of Network Control. My thought is that the 3 data bytes returned are bitmapped representing various states of the vehicle system. In the first byte here we have "03" From my observations I will say your key was not in the ignition. Other values I have seen are 04-key in ignition, 06-key at accy position, 07-key in run position, 08-key in crank position. I have also seen these values altered as other bits of the byte are set, but this is what I have seen most frequently.
Lines 8 and 9: the BCM sends load command extended to the IPC to set the headlight high beam indicator (91) and the security indicator (9E) off.
Line 11: another indicator (D8) is set by a load command extended from the BCM, I have not yet tested what indicator this is.
Line 10 &12: The IPC reports the status of the headlight high beam and security indicators set by the BCM previously.
Line 3: BCM reports status of Network Control. My thought is that the 3 data bytes returned are bitmapped representing various states of the vehicle system. In the first byte here we have "03" From my observations I will say your key was not in the ignition. Other values I have seen are 04-key in ignition, 06-key at accy position, 07-key in run position, 08-key in crank position. I have also seen these values altered as other bits of the byte are set, but this is what I have seen most frequently.
Lines 8 and 9: the BCM sends load command extended to the IPC to set the headlight high beam indicator (91) and the security indicator (9E) off.
Line 11: another indicator (D8) is set by a load command extended from the BCM, I have not yet tested what indicator this is.
Line 10 &12: The IPC reports the status of the headlight high beam and security indicators set by the BCM previously.
In the past sometime I saw a value for current flow of a folding mirror. I think it was using my tech 2. Anyway, my data has timestamps and it can be seen there is about a 4 seconds timespan between these messages. I am thinking the DDM and PDM monitor the current draw of the folding motors amd issue the stop command when it is determined the action is complete.
Last edited:
Testing shows this to not be so. The "6A C2 A0 05 00 FA" occurs while mirrors are still in motion.
iddqd
Member
I tried to issue this command immediately after 85. My mirrors kept folding. Can you try it on ur Yukon?
Already did that. Appears to have no effect. Also tried to request the extended status of the 05 and 06 parameters but it appears that such status requests are not supported for the mirrors. I know my message structure is correct because I can succesfully request the status of door ajar switch status' by querying 'external status' $C6.
Any chance you could make a public version of the spreadsheet? I love the idea, but I have no idea what I'm doing when it comes to making spreadsheets like that
iddqd
Member
Btw, how did you add timestamps? I could't find this option nether in putty, nor in some other more fancy terminals
The thought has merit. At present there are no instructions. That isn't a big obstacle as I could write up the basic steps to generate and load a log file in and view the results. However, at present the spreadsheet is tailored to work with a log file of a specific format and will fail if presented with a different format. An example would be the log uploaded by @iddqd , had no timestamp. So I had to concatenate something in there. Easy enough for me but might be daunting for another.
The sheet has been made to work with my specific vehicles. It's a work in progress and constantly evolving. Things pop up and are addressed as I get information. For example I have a module address in my Yukon I have not yet identified. All I see are the "node awake" and a request for throttle position from it. If some vehicle data is loaded and it has an unknown node address it may get misrepresented in the deciphering.
There are also a lot of somewhat hidden things going on in various pages of the sheet that are easy to run afoul of.
All that aside,,, won't know till it's tried. So here is a link to a copy set aside for this purpose... There is a sample logfile from my 2002 TrailBlazer during a sort of slow motion startup sequence where I paused between each action... I'll see about putting together a basic how-to
GMTN_OBD2_Class2_Breakout
Output A,1,2004,select * Report_Acknowledge,Transfer Case,Transmission / Transaxle / PRNDL Decoded Results of Data from this sheet, Beginning at column AW Line Num,Timestamp,Msg Priority ,Msg Type,'W' bit,'Q' bit,'C' bit,Message Operation,Source Module Name,Target Name,Target Address,Source Add...
My logs are gathered with Android App "Bluetooth Serial Terminal" by Kai Morich in the Google Playstore. Timestamp is an available option there.
iddqd
Member
The thought has merit. At present there are no instructions. That isn't a big obstacle as I could write up the basic steps to generate and load a log file in and view the results. However, at present the spreadsheet is tailored to work with a log file of a specific format and will fail if presented with a different format. An example would be the log uploaded by @iddqd , had no timestamp. So I had to concatenate something in there. Easy enough for me but might be daunting for another.
The sheet has been made to work with my specific vehicles. It's a work in progress and constantly evolving. Things pop up and are addressed as I get information. For example I have a module address in my Yukon I have not yet identified. All I see are the "node awake" and a request for throttle position from it. If some vehicle data is loaded and it has an unknown node address it may get misrepresented in the deciphering.
There are also a lot of somewhat hidden things going on in various pages of the sheet that are easy to run afoul of.
All that aside,,, won't know till it's tried. So here is a link to a copy set aside for this purpose... There is a sample logfile from my 2002 TrailBlazer during a sort of slow motion startup sequence where I paused between each action... I'll see about putting together a basic how-to
GMTN_OBD2_Class2_Breakout
Output A,1,2004,select * Report_Acknowledge,Transfer Case,Transmission / Transaxle / PRNDL Decoded Results of Data from this sheet, Beginning at column AW Line Num,Timestamp,Msg Priority ,Msg Type,'W' bit,'Q' bit,'C' bit,Message Operation,Source Module Name,Target Name,Target Address,Source Add...docs.google.com
Hey, mate!
I've got a couple of logs for TCCM. Would you mind if I use ur spreadsheet to parse it? I added the timestamps, so this should not be a problem. Or I can attach 2 text files and you can run them yourself?
I was experimenting with TCCM. Basically, there are 2 VERY similar TC: BW 4484 (Hummer H2) & BW 4484 (03-05 GMT800 trucks & SUVs with RPO code NR4). Both are AllWheelDrive, with 2.64 low range, a neutural and a lock. 80% parts are interchangable, including both case halves, an encoder motor, a chain with sprockets. Also, 4482 is less than half the price (from $300+ on eBay vs $700+ for 4484)However, the disadvantage of 4482 is that only 2 modes: AWD, 4WD Low Locked.
4484 gives you AWD, 4WD Hi Locked, 4WD Low Locked. Also, 4484 module can control rear diff lock (Eaton E-locker), which I already bought and will install soon. If I use 4482 control module, I would have to have a separate switch for that or modify rear diff lock button on 4WD switch to be completely separated from the rest of the circuitry.
Anyway, I tried to install both TCCMs in the car and see how they behave. 4482 module works and drives the encoder motor. The car sees low gear!!! The only problem is that Stability System Disabled Message is ON, THOUGH Tech 2 actually shows that Stability System is Enabled. Stability disable button on the 4WD switch doesn't do anything, but factory Stability disable button actually disables it (as shown by Tech2). But the message ramains on IPC. I might need to disconnect battery to reset IPC or, reflash ABS with the calibration from Yukon (p/n for hardware are the same for both Escalade and Yukon, so it's gotta be calibration). So, if I choose this route, and solve the stability disable message problem, I will lack 4WD Hi Locked range and will have to do some modification to the 4WD switch (this part I don't mind actually.)
Now, 4484 module (from H2) doesn't work at all. It shows no error codes, but it does not turn on the motor either. The light is flashing, indicating that the module is missing a required input.
I collected logs from both modules last night and wana run it through ur amazing spreadsheet to get a clearer picture. From I can see right now, both modules send 03 message to network control (Node alive), and many modules respond. Onc of them is 29 (ABS) sending messages to Fuctional Address Wheels, and I can see it reports speed of all wheels. It happens in both cases, but for some reasons, 4484 module is not happy with those responces. Ideally, I'd need to run this logger on Hummer and see what's actually happening there, but I dont have access to Hummer unfortunately.
Well I just a moment ago realized I had not properly set permissions for that linked copy of the spreadsheet! Just corrected that.
We could do both... Post your log files here and I'll load em up and you should be able to grab a copy of the spreadsheet (I think?) And have a go as well.
When working with the spreadsheet give it time, it's slow.
Most straighforward way is to open sheet1, select the entire column A and clear it. Don't delete it! Just clear it. Post your log file (as text, not separate columns) into that column A and save that.
If the format of the text is correct then Sheet2 will split it out into the needed columns. This process removes the 03 node alive messages but if you want to see them I can tell you how to eliminate that filtering.
The 'Output' sheet should have the decoded results. It also displays the raw data waaay over to the right starting at column AV.
If you want to pick out certain data quickly for review, on the 'Output' sheet, cells H2, I2, and J2 are references used with conditional formatting rules for those columns. Copy/paste in a value from that column into the appropriate #2 cell and matching values below will highlight.
Now if all that works and you want to load both data logs put the second log in another column in Sheet1, like column B for example. Now back on the 'Output' sheet go to cell A1 where it currently reads 'A'. Change that to 'B' and it will load the data log in column B of Sheet1.
The spreadsheet is not fast, at least in my experience. Takes some time for it to work through all the layers. Best to work with small data logs.