How To Guide: Reading TCCM Codes

blurry

Original poster
Member
Sep 7, 2012
22
Last year I spent a lot of time trying to pull TCCM codes from an 02 trailblazer. At the end I was able to access them manually via the command line. Below is the writeup on it. Hopefully this helps some folks diagnose their own 4WD issues :smile: There is a lot of info below, if you are looking for a quick answer read up to the quick example which will provide the command and show you how to decode it. enjoy!

----------------------------------------

Good news You can pull TCCM codes with a fairly inexpensive scanner.

NOTE that this works on our trailblazer. From all the reading i did this should work for anyone. As all with the internet, proceed at your own devices!

If you do this or expand on it (reading values from sensors etc) please let everyone know!

To do this you need a scanner which lets you send a message by manually typing in the message. There are several of these out there, no idea which is better, worse, or the same. if you have the scantool, you need software to control it. There are free versions out there, though i opted to pay to get something which works with less hassle. The scantool.net scanner with Scan XL pro SW is on sale for $149 (not sure how often they run sales, or if this is an all the time price)

I went with the ODBLink Scan Tool from scantool.net with the scanXL Pro SW with the GM package add on since we have 3 GM vehicles.

so in summary you need a computer based scanner and software that lets you send messages manually (sometimes called terminal mode)

I figured out the messages to send to get codes from the TCCM on an 02 trailblazer, should be the same for all years.

this seems complicated, though just about anyone can do this. quite frankly you can just send the messages I listed and not delve into the details of what it all means

the messages are in Hexadecimal, don't let that scare you

I started to tool, selected ODB-II->connect and followed the instructions, then selected the "tool" tab and clicked on "ODB-II terminal", select "custom send tab", check the box "enable ODB-II terminal" in the top left. now you are ready to send messages!

quick example:

with the 4WD service light on:
send message: 6C 1A F1 19 C2 ff 00
Received: $6C $F1 $1A $59 $43 $79 $93 $6A

the $43 $79 is the code, and the $93 is the status indicating the code is turning on the 4WD service light

code list:
$43 $00 = C0300
$43 $05 = C0 305
$43 $06 = C0306
$43 $21 = C0321
$43 $27 = C0327
$43 $59 = C0359
$43 $74 = C0374
$43 $79 = C0379 ***** the code indicated in the message above
$45 $50 = C0550
$87 $70 = B0770
$87 $75 = B0775
$87 $80 = B0780
$87 $85 = B0785
$87 $90 = B0790
$A7 $25 = B2725
$D3 $01 = U1301

here are the messages I figured out that seem useful:

message: 6C 1A F1 14 - turn off 4WD service light (clears codes)
message: 6C 1A F1 19 D2 ff 00 - return current and pending codes
message: 6C 1A F1 19 c2 ff 00 - returns current code
message: 6C 1A F1 19 ff ff 00 - return all code status (what I prefer)

you can stop here or get into the details:

each group of 2 below is what is called a "byte"

the address of the TCCCM is 1A
the address of the scantool is F1

$6C $1A $F1 $19 $C2 $FF $00
$GG $HH $JJ $KK $LL $MM $NN <- use these to look through the list
GG - 6C = node to node GM message
HH - 1A = address of scanner
JJ - F1 = address of TCCM
KK - 19 = what kind of request (19) Request Diagnostic Trouble Codes
by Status (14) to clear codes
LL - C2 = what data you want to get. (C2) return current codes (D2)
return current and pending codes (FF) everything
MM - FF = (FF) send to all groups (not sure why 40 chassis doesn't
work)
NN - 00 = extra padding, leave at 00

The response should be formatted as follows:
Byte1 Byte2 byte3 Byte4 Byte5 Byte6 Byte7 Byte8

sample response:
$6C $F1 $1A $59 $43 $79 $93 $6A
$PP $QQ $RR $SS $XZ $ZZ $YY $VV <- use these to look through the list
below

Byte1 - PP - 6C - same as the first byte you sent
Byte2 - QQ - F1 - address of the scan tool (indicates the recipient)
Byte3 - RR - 1A - address of the TCCM module (indicates the originator)
Byte4 - SS - 59 - will be the byte4 you sent with 40 added to it
Byte5 - XZ - 43 - first part of code
Byte6 - ZZ - 79 - second part of code
Byte7 - YY - 93 - status (01) good, no issue (93) current code causing service light to illuminate (11) not sure, seemed to be associated to the last code raised, though I'm not sure
Byte8 - VV - 6A - check sum (ignore this, it is used to make sure the message made it without loosing data)

so bytes 4 and 5 have the code, to decipher:

$43 $79 <- from recceived message
$XZ $ZZ <- use this to decode based on the list below

the X is the first part of the code
4 = C0
8 = B0
A = B2
D = U1

ZZZ = code

for complete code put together XZZZ

so the $43 $79 is:

4 = C0
ZZZ = 379

code = C0379

if you get 00 00 for a code, then it is the end of the list - 00 00 is not a code, but an indicator teh end of the code list.

the status of this code (YY) in the example is 93 which seems to indicate the current fault. if you see 01 then that code is not currently active

examples:

no 4WD service light:
send message: 6C 1A F1 19 c2 ff 00 - returns current code
response: $6C $F1 $1A $59 >>$00 $00<< $93 $BB 00 00 means no code

after turning on the 4WD service light response:
send message: 6C 1A F1 19 c2 ff 00 - returns current code
Received: $6C $F1 $1A $59 $43 $79 $93 $6A 93 -- indicates current code (43 79) with a status of 93 which seems to be the current code lighting the 4WD service light
Received : $6C $F1 $1A $59 $00 $00 $93 $BB -- 00 00 indicates end of list

send message 6C 1A F1 19 ff ff 00 - return all code status - 01 in before last means all is well. in this example the before last byte is 01 for all the entries except the last which has code 00 00 indicating the end of the list, therefor there are no codes present.

as a neat aside - I believe these to be every possible code that can be generated!

Received OBD-II message: $6C $F1 $1A $59 $43 $00 $01 $86
Received OBD-II message: $6C $F1 $1A $59 $43 $05 $01 $E7
Received OBD-II message: $6C $F1 $1A $59 $43 $06 $01 $33
Received OBD-II message: $6C $F1 $1A $59 $43 $21 $01 $BF
Received OBD-II message: $6C $F1 $1A $59 $43 $27 $01 $0A
Received OBD-II message: $6C $F1 $1A $59 $43 $59 $01 $CE
Received OBD-II message: $6C $F1 $1A $59 $43 $74 $01 $80
Received OBD-II message: $6C $F1 $1A $59 $43 $79 $01 $BB
Received OBD-II message: $6C $F1 $1A $59 $45 $50 $01 $DD
Received OBD-II message: $6C $F1 $1A $59 $87 $70 $01 $0B
Received OBD-II message: $6C $F1 $1A $59 $87 $75 $01 $6A
Received OBD-II message: $6C $F1 $1A $59 $87 $80 $01 $E9
Received OBD-II message: $6C $F1 $1A $59 $87 $85 $01 $88
Received OBD-II message: $6C $F1 $1A $59 $87 $90 $01 $5D
Received OBD-II message: $6C $F1 $1A $59 $A7 $25 $01 $04
Received OBD-II message: $6C $F1 $1A $59 $D3 $01 $01 $12
Received OBD-II message: $6C $F1 $1A $59 $00 $00 $93 $BB

- - - Updated - - -

Some of the hardware from scantool.net:

$49 ODBLink SX - the catch with this is that they charge more for the SW, the next step up seemed like a better deal: http://www.scantool.net/scan-tools/p...bdlink-sx.html

$99 ODBLink Scan Tool: http://www.scantool.net/scan-tools/p...d/obdlink.html there are also bluetooth and wireless versions.

there is a special running to get the Pro SW with the $99 tool (and wireless/blue version) for a $149

I bought the wireless, though it is probably a waste of money as i use the USB cable, so the $99 would probably be a wiser choice. the wireless and bluetooth are for using a phone, though i since learned that required additional SW and is considerably limited compared to the ScanXL SW for the windows laptop.

Software - You need software which lets you send custom messages. If you are computer savy you can use hyperterminal. Since I wanted a fully featured scanner I purchased the ScanXL Pro with the GM add on. the PRO version lets you send custom message (terminal mode), the regular version does NOT - so if you go this route get ScanXL Pro

comparison: http://www.scantool.net/ppe-software-comparison.html
 
  • Like
Reactions: GMArchMan

blurry

Original poster
Member
Sep 7, 2012
22
One of the GMT forum members IMd me some questions - best to share with everyone:

Glad it helps. any scanner with SW allowing for a command line interface should be fine. I purchased the ScanXL Pro SW ($120 or so) which I used for the writeup. The pro SW has no instructions (doh!), once you figure it out it is pretty handy. Yesterday I spent the day with a friend on an avalanche which was misfiring and the ScanXLPro is what allowed us to isolate the issues.

Strangely, I can NOT get the command line interface working for the included ODBwiz (included with some of the scantool.net scanners) - there is an interface there, might be worth asking on the palmer forum. I found the ODBWiz tool to pretty pretty lame without access to what I wanted.

As far as hyperterm this video implies it works with the odblink scanners: I don't have hyperterm on my windows 7 machine and am a bit short on time to play today.

For what the difference is between the ODBLink and ODBlink SX - I'm guessing detaching cables and looks. I got the wifi so i could leave the unit installed and put extra gauges up in my diesel (which I never did, though probably will over the winter). The SX is going to stick out while plugged in, if that is not an issue it is likely a more cost effective choice:

reference:
https://www.scantool.net/forum/index.php?topic=6150.0)
Activity Stream - MP3Car.com

What exactly is the difference between the OBDLink SX & the original OBDLink (i.e. what features are or are not included).
- OBDLink SX has one status LED, instead of five
- OBDLink SX doesn't have an onboard 5V regulator, it is powered solely from the USB port.
- OBDLink SX comes in "one piece": you don't get separate OBD and USB cables
- OBDLink SX automatically enters low power mode when the host computer is shut down or suspended

as far as a list of all the codes - I usually Google the codes I get along with the vehicle name. I believe there are standard codes and manufacturer specific codes. this site has a lot of the codes: OBD-II Check Engine Light Trouble Codes

enjoy
 

SAR85

Member
Jan 31, 2012
74
That may be useful information down the road for me (and others who don't want to pay a dealer to read codes with their high-end scan tool). It is also possible using a terminal program with OBD2 interface to check ABS codes. I will post more information when I have access to it later this week.

Also, there is freeware online that has OBD2 terminal functionality and can be used with a Bluetooth OBD2 adapter. I will post more information about this with the above info later.
 

The_Roadie

Lifetime VIP Donor
Member
Nov 19, 2011
9,957
Portland, OR
Blurry, I really appreciate the technical details. I've got the shop manual and can post what the codes mean and how one should troubleshoot further.

I have not thought about the term "hyperterminal" since my DOS days that included Xmodem, 8" floppies, and "ATDT".

+++ ATH

:rotfl:
 

plaen

Member
Dec 4, 2011
55
the roadie said:
Blurry, I really appreciate the technical details. I've got the shop manual and can post what the codes mean and how one should troubleshoot further.

I have not thought about the term "hyperterminal" since my DOS days that included Xmodem, 8" floppies, and "ATDT".

+++ ATH

:rotfl:

This got me thinking, since torque has a plugin that allows direct access to send commands, I'll have to give it a try and see if I get responses back.

Oh the days of DOS, seems like a lost art now a days.
 

McGMT

Member
Jun 17, 2012
621
plaen said:
This got me thinking, since torque has a plugin that allows direct access to send commands, I'll have to give it a try and see if I get responses back.

Oh the days of DOS, seems like a lost art now a days.

10 Do you miss BASIC?
20 So do I...
30 END
 

McGMT

Member
Jun 17, 2012
621
the roadie said:
Blurry, I really appreciate the technical details. I've got the shop manual and can post what the codes mean and how one should troubleshoot further.

I have not thought about the term "hyperterminal" since my DOS days that included Xmodem, 8" floppies, and "ATDT".

+++ ATH

:rotfl:

I can remember speeding up the tone dial on my modem, played around with it till it was too fast for ma bell to understand ... Cannot remember the command for that anymore...
 

The_Roadie

Lifetime VIP Donor
Member
Nov 19, 2011
9,957
Portland, OR
HAYES(DEV) Devices HAYES(DEV)

NAME
hayes - The hayes modems

DESCRIPTION

MISCELLANEOUS
-------------
a/ - redo last command
+++ - return to modem cmd mode from live connection

-------------------------------
--- DIALING
-------------------------------

DIAL COMMAND
------------
atdt[tele#]
ats11=75 - speed of tone dialing (in miliseconds. minimum 50)

AUTO-DIAL PHONE NUMBERS
-----------------------
at&z0[tele#] -stores a tele# in memory #0
at&z1[tele#] -stores a tele# in memory #1, etc
atd\0 - dial tele# in memory #0


SHOW ALL SETTINGS
-----------------
at&v - show all hayes command settings

-------------------------------
--- ENTER/EXIT CONNECTION STATE
-------------------------------

ANSWER/ORIGINATE MODES
----------------------
ata - manual answer incoming call
atd - originate connection. Assumes number already
dialed, remote has picked up
ONLINE RETURN
-------------
ato - go back online from +++
ato1 - return to online state and retrain baud sync

HANGUP
------
ath0 - hang up if modem off hook (esp. after a +++)
ath1 - pick up, but do nothing

RESET
-----
atz - reset modem to config profile 0
at&f - return all settings to factory settings
at&w - save current settings in non-volatile mem (?not sure)

BREAK
-----
at\b - send break
at\b3 - send a 300ms break (number is x100ms)

-------------------------------
--- SPEAKER
-------------------------------
LOUDNESS (SPEAKER)
------------------
atl1 - low speaker volume
--> atl2 - medium speaker volume
atl3 - loud speaker volume

MONITOR (SPEAKER)
-----------------
atm - speaker off
--> atm1 - speaker on until carrier detected
atm2 - speaker always on
atm3 - spkr on until carrier detected except during dialing

-------------------------------
--- MODEM RESPONSES
-------------------------------
QUIET
-----
--> atq0 - quiet off (enable messages)
atq1 - quiet on (disable messages)

VERBAL
------
atv0 - verbal off (numeric messages)
--> atv1 - verbal on (word messages)

CONNECT CODES
-------------
atx[01234] - various levels of word messages (default atx4)

ECHO
----
ate0 - no local echo
--> ate1 - local echo

-------------------------------
--- HARDWARE LINES
-------------------------------

CTS/RTS
-------
at&r0 - ignore RTS in command mode, CTS follows RTS in data mode
at&r1 - force CTS active

DCD ASSERT
----------
at&c0 - force DCD high always
at&c1 - modem asserts DCD when carrier detected

DSR ASSERT
----------
at&s0 - force DSR high always
at&s1 - modem asserts DSR (when connection established?)

DTR
---
at&d0 - ignores DTR line from computer
at&d1 - goto AT command state on DTR on->off change, (no hangup)
at&d2 - modem resets itself on DTR on->off change

-------------------------------
--- FLOW CONTROL
-------------------------------

XON/XOFF FLOW CONTROL
---------------------
at&k0 - disable local flow control
at&k1 - ?
at&k2 - ?
at&k3 - RTS/CTS bi-directional hardware flow control
at&k4 - XON/XOFF bidirectional software flow control
at&k5 - uni-directional XON/XOFF flow control

-------------------------------
--- AUTO ANSWER
-------------------------------

ats0=0 - no auto answer
ats0=1 - auto-answer on first ring

-------------------------------
--- CARRIER
-------------------------------

ats7=30 - time to wait for carrier detect before giving up
ats9=6 - recognize carrier by .6 seconds of carrier tone
ats10=10 - hangup after 1 second without carrier tone

S REGISTERS
-----------
ats0=0 - no auto answer
ats0=1 - auto-answer on first ring

ats7=30 - time to wait for carrier detect before giving up

ats9=6 - recognize carrier by .6 seconds of carrier tone

ats10=10 - hangup after 1 second without carrier tone

ats11=75 - speed of tone dialing (in miliseconds. minimum 50)

DIAL MODIFIERS
--------------
, - pause for 2 seconds (value of S7 register)
; - return to command state after dialing
! - flash the hook for 1/2 second
R - reverse to 'answer' mode after dial (@ end of tele#)
W - wait up to 30 secs for 1 sec continuous dial tone
@ - modem waits 30 secs for one or more ringbacks


RECOMMENDED SETTINGS

FOR UNIX DIALUP MODEM WITH UUGETTY
----------------------------------
at&f - return to factory settings
ats0=1 - auto answer on first ring
ats2=127 - disable +++ escape (allows binary file xmission)
atl3 - loud spkr volume
atm1 - spkr on until carrier detect
ate0 - echo off
atq1 - no messages
at&c1 - DCD active on carrier detect, inactive on hangup
at&d2 - modem resets when DTR dropped
at&s1 - DSR active (when??)
at&k0 - disable XON/XOFF flow control
at&r0 - ignore RTS in cmd mode, CTS follows RTS in data mode
at&w - save these settings

FOR UNIX DIALOUT
----------------
at&f
ats0=1 - auto answer on first ring
ats2=127 - disable +++ escape (allows binary file xmission)
atl3 - loud spkr volume
atm1 - spkr on until carrier detect
ate1 - echo on
atq0v1 - disable quiet/enable verbose messages
at&c1 - DCD active on carrier detect, inactive on hangup
at&s1 - DSR active (when??)
at&d2 - modem resets when DTR dropped
at&k0 - disable XON/XOFF flow control
at&r0 - ignore RTS in cmd mode, CTS follows RTS in data mode
at&w - save these settings

SEE ALSO
HAYES.COM - I think they have all models of modem settings
available online.

ORIGIN
Gregory Ercolano, Los Feliz California 08/28/93
 

McGMT

Member
Jun 17, 2012
621
HA! :hijack: That brings back memories...
 

dkvasnicka

Member
Jul 24, 2015
366
Czech republic, Europe
Has anyone ever got some TCCM codes from a newer GMT360, using the info here. I just tried it on a 2006 9-7X and "NO DATA".

EDIT: Any iOS app that is know to be able to read TCCM codes?
 

Mooseman

Moderator
Dec 4, 2011
25,310
Ottawa, ON
You do realize you're replying to a 4+ year old dead thread.

And no, the 9-7x uses the exact same network as the other GMT360's. The AWD system and TCCM are the same as the Bravada and Rainier.
 

TJBaker57

Member
Aug 16, 2015
2,900
Colorado
These instructions however will only work for the single wire class 2 SAE J1850 data. Later models with CANBUS use different message formats as well
 
  • Like
Reactions: GMArchMan

TJBaker57

Member
Aug 16, 2015
2,900
Colorado
I thought I might update this thread making suggestions for tools & smartphone apps available today. One no longer needs to spend anywhere close to what Blurry did so many years ago.

To begin with I use a very inexpensive clone of the ELM327 with Bluetooth connectivity. My latest purchase was $12 for this unit...


I have read, but not experienced any DOA, non-functioning examples of these mostly chinese copies. I currently have 4, the oldest being about 8 years.

Granted these are not full featured devices that do all the magic for you, they just handle the communications between you and the vehicle network. I am going to leave it at that and concentrate on the reading of codes here.

Once you have the hardware you need some software to handle the serial communications between your phone, tablet or whatever. For Android I recommend "Bluetooth Serial Terminal" a free app by Kai Morich.


I tried a host of apps before finding this one and a key feature is the support of macros. With this feature a series of commands can be saved to be replayed as needed. Secondly, the data session can be saved which allows one to have a record of what you read and when. Additionally, having saved data logs makes it possible to use a spreadsheet to decode the serial data from the vehicle in order to more easily to get to the actual DTC.

For setup of the serial terminal app I set the following values;
Send/Line Delay 1000ms
Send/Character Delay 5ms
Terminal/Timestamp ON
Terminal/Buffer Size Unlimited
Terminal/Display Mode Terminal
Receive/Newline CR


Blurry already covered the commands he used to request DTCs. I will simply put together here a string of commands that will request all codes of any status from all modules available. Below you will see how you can edit one line here and request only the code status' you desire. This can be typed manually as well, but I simply put them in a macro in the terminal app. Instead of showing a screenshot I will type them out such that anyone wishing to can simply copy/paste them. All the lines that begin with 'AT' are commands to the bluetooth obd adapter only and not sent to the vehicle network.

AT Z
AT D
AT S1
AT H1
AT AL
AT SH 6C FE F1
19 FF FF 00

Before posting another screenshot I will review/update information Blurry posted above. Blurry talks of a status byte and comments that $93 means current code and that $01 means all good. Well,,,,sort of. There is a status byte indeed and the mode of our request is named "request DTC by status". There are 8 values of status byte and it the SUM of these values (in hexadecimal format) that is displayed along with the DTC.

Here are the status, in hexadecimal;

$80 = MIL
$40 = Pending
$20 = Old
$10 = History with Freeze Frame
$08 = Manufacturer
$04 = Manufacturer
$02 = Current Code
$01 = Immature

So when Blurry got a status of $93 for the code he was working with as an example that meant that code had the following status bits set...

$80 (MIL) +
$10 (History) +
$02 (Current) +
$01 (Immature) =
$93

So on to the screenshot. Here I am requesting ALL the DTC codes that have any level of status bit set. As such, there will be a lot of returns.


Screenshot_20200715-135855_Serial Bluetooth Terminal.jpg

At this point you have all the codes in the vehicle for which some level of status is active. However, as Blurry explained there is a small level of decoding required. The DTCs are shown in the 5th and 6th column of data returned but the very first character needs to decoded. I'll grab a screenshot from the ELM327 datasheet that displays what is needed to decode the values....

Screenshot_20200715-163841~01.png

One of the DTCs in my screenshot above is an 'A6 10' with a status byte of '11'. (The status byte is in the 7th column in the screenshot, not including the timestamp.) Looking at the chart the A is to be replaced with a B2 and we then append the remaining characters of '610' making the full code B2610. This code was reported by the BCM. The status byte value of $11 tells me this has the immature and history bits set.

In an effort to simplify the decoding I made a Google spreadsheet to handle the 'heavy lifting'. One only needs to paste in their datalog in the 'DataLogs' tab Column A and see the result in the 'ViewHere' tab. A '1' appearing in the adjacent status column means that DTC has that bit set.

Screenshot_20200715-174348.png

Screenshot_20200715-174421.png

I suspect this will likely need and receive some edits after my initial post

And I was right! First edit: I forgot to link to the spreadsheet!! It is shared access,,

 
Last edited:
  • Like
Reactions: GMArchMan

TJBaker57

Member
Aug 16, 2015
2,900
Colorado
A couple addendums:


AT Z
AT D
AT S1
AT H1
AT AL
AT SH 6C FE F1
19 FF FF 00

That last line uses service $19 to request all codes of any status. I have discovered that replacing the final 00 with FF seems to request not the codes themselves but the number of codes the target module(s) have meeting the status requested by the second byte.

Here are the status, in hexadecimal;

$80 = MIL
$40 = Pending
$20 = Old
$10 = History with Freeze Frame
$08 = Manufacturer
$04 = Manufacturer
$02 = Current Code
$01 = Immature

A note on manufacturer status $08. While we don't know, and may never learn, what these 2 'manufacturer' status are I can say this. When a Tech 2 first connects to my vehicle(s) it requests any codes meeting the status level $08. It does not request current codes, pending codes, etc. Only status $08, 'manufacturer' codes. Hmmmm.....
 
  • Like
Reactions: GMArchMan

TJBaker57

Member
Aug 16, 2015
2,900
Colorado
If we want to check the status byte of a single specific DTC..... We use service (mode) $17 instead of service $19.

Here I have set the 3 byte header by issuing the command string 'AT SH 6C 10 F1'. We are addressing the PCM node $10 here. Then send '17 14 81', the DTC I want is P1481, the 'P1' needs to be coverted back to a hex code using the chart in post #15 above in this thread

Sent: 6C 10 F1 17 14 81 0C
Recvd: 6C F1 10 57 14 81 29 C8

The last byte is the checksum and the second to last byte ($29) in the reply is the DTC status. It decodes to $20 (old code) + $08 (manufacturer) + $01 (Immature)
 
  • Like
Reactions: GMArchMan

TJBaker57

Member
Aug 16, 2015
2,900
Colorado
This thread was created to address the need for reading TCCM codes as many code readers only request PCM codes. To bring focus back to that end here is what is done to retrieve codes from the TCCM.

Using a terminal app like the one for Android I recommended above or similar, regardless of platform connect to your elm327 and issue the following:

AT Z (this resets the elm327 device)
AT D (loads the default settings of the ELM327, redundant,I know)
AT H1 (display headers)
AT S1 (print spaces between bytes, easier to read)
AT AL (allows long replies)
AT SH 6C 1A F1 (sets 3 byte header values, 1A is TCCM)
19 FF FF 00 (request all codes of all 8 status levels)

If you wish to see other combinations of codes status sum the hex values of the code status' you desire and send that sum as the second byte of the request.

Example: We want to see what is causing the service 4WD light only we then send '19 80 FF 00'. If we want pending codes we send '19 40 FF 00'. The reply will return all codes that have the requested status byte set, including those that have other status levels in addition to the level we requested. For example in my previous post I received a status byte level of $29 for DTC P1481. If I had requested any of the status $20, $08, or $01 that sum to $29 I would get this DTC in the result set.

Why bring up this old thread you ask? I read again and again, nearly every day on websites, Facebook, and such the comment "you need a high end scanner for that". No, no you don't. Today for $12 and some reading you can get the codes you want from pretty much any module in the truck. Certainly the high end scanners are nice and can do a lot more than just read codes but not everyone has a couple hundred $$ just lying around for that and you don't need to be at the mercy of Pep Boys, O'Reillys or Autozone for code reading.
 

GNXClone

Member
Jan 2, 2022
1
Florida
If we want to check the status byte of a single specific DTC..... We use service (mode) $17 instead...
Hello,

Would you happen to know ho to retrieve what appears to be extended DTC information?
I currently have a DTC C0110 and found this information:


This page shows:
DTC C0110 04: Pump Motor Circuit Open Circuit
DTC C0110 06: Pump Motor Circuit Short circuit to Ground
DTC C0110 61: Pump Motor Stuck Mechanically

I've scoured the net but haven't been able to find how to retrieve or decode the additional codes following the DTC. It would be really nice to know the specific reason to make diagnosing quicker.

Update: Found what it's called..."symptom byte"

Also found: https://karthik-balu.github.io/projects/2017/11/25/DTCs

Starting to think these are for later models only and that my 2005 Silverado isn't going to support symptom bytes.

Thanks!
 
Last edited:

GMArchMan

Member
Jun 3, 2022
1
Fl
2005 TCCM (Transfer case control module /switch module) Reset.

Difficulty: 1 (10 being hardest)

Symptoms: canyon service 4wd message in dash (srv 4wd). Caused after battery died and new replacement. 4wd push button lights lit up during start and then go off. Some small sounds from transfer case actuator from button press but no lights come on and no full engagent of 4wd with usual clicking into gear sound.

Issue: there is a stuck code in tccm module that tells ecu there is a tccm failure. Cannot access from odb2 scanners as most only penetrate the PCM. Dealers can penetrate. (Currently $235 to have dealer reset tccm.)

Failed attempt: Unplugging tccm fuse for 30 seconds

Successful attempt:

1. Get and plugin any odb2 scanner device like elm327, (WiFi, Bluetooth, USB).
2. Get serial terminal phone software for example like recommended above in this thread (be sure its correct version for WiFi, Bluetooth or USB).
3. Connect software to odb2 scanner device(Bluetooth easy, WiFi you need IP address and port its prob 192.168.0.10 and port 35000 but you can use any free odb2 scanner app and once connected check settings to find what IP and port it connected to your odb2 scanner on, USB easy)
4. Vehicle On (off prob fine too) Issue each of commands from thread above to initialize:

AT Z
AT D
AT S1
AT H1
AT AL
AT SH 6C FE F1

Then send 14 to erase the stuck code.

Lights on 4wd buttons come on and pushing buttons successfully moves actuator to engage the 2wd/4wd button pressed. That's it!

Hope this helps and thank you very much to previous posters on this thread. Could not have done it without their initial work!
 
  • Like
Reactions: Mooseman

TJBaker57

Member
Aug 16, 2015
2,900
Colorado
AT Z
AT D
AT S1
AT H1
AT AL
AT SH 6C FE F1

Then send 14 to erase the stuck code.


A couple of pointers to add here.

Service 14 that is used here is a directive to clear all codes and all diagnostic data from the target module(s). Almost always this service requires that the codes first be read using service 19 described earlier in this thread. Issuing a request for service 14 before reading the codes with service 19 is likely to fail.

If the request is successful the responding module(s) will reply with a "54" in place of the "14" like so ...... "6C F1 1A 54 xx" . (xx will be a CRC value)

Next up is a recommendation to NOT use "FE" where indicated above. The place where the "FE" is seen is the hexadecimal address byte of the target module.

Using "FE" means the target is "all modules".

This means that in addition to clearing the codes and diagnostic data from your intended module, in the case here it was the TCCM, you may also do the same for every module currently awake in the vehicle. This may include the PCM in which case you just reset your emissions monitors and all that. Not desireable if you have a smog inspection coming up.

Far better to clear only the data and codes from your intended patient so in the case here the "set header" message would be:
"AT SH 6C 1A F1",
then read the codes with service 19 described earlier in this thread and THEN the service 14 request:
"14".

The same holds true if working on other modules such as the EBCM (address 29), the SIR module (address 58), the BCM (address 40), the HVAC (address 98) and so on.
 

Forum Statistics

Threads
23,310
Posts
637,777
Members
18,515
Latest member
jonnnnyj

Members Online