http://www.fastfieros.com/tech/vpw_communication_protocol.htm
Breakdown of the j1850 3 byte Header format
Byte1 = priority
Bits 7,6 and 5 are priority 0=High, 7=Low
Bit 4 is header style (0=3 byte header-GM, 1=1 byte header-??)
Bit 3 is In Frame Response (0=Required-Ford, 1=Not allowed-GM)
Bit 2 is addressing mode (1=Physical, 0=Functional)
Bit 1,0 is message type: (depending on bit 2 and 3 see below)
Bit 3 2 1 0
-----------
Functional
1 0 0 0 Function
1 0 0 1 Broadcast
1 0 1 0 Query
1 0 1 1 Read
Physical
1 1 0 0 Node to Node
1 1 0 1 Reserved
1 1 1 0 Reserved
1 1 1 1 Reserved
Byte2 = physical ID of destination
Byte3 = physical ID of source
Typical Physical ID's, PCM = $10, Off-board scan tool = $F1
Header Byte
$48 : 001-0-1-0-00 : Priority 1, 3 byte header, In Frame Response Not Alloed ( GM), Functional Addressing
$68 : 011-0-1-0-00 : Priority 3, 3 byte header, In Frame Response Not Alloed ( GM), Functional Addressing
$6C : 011-0-1-1-00 : Priority 3, 3 byte header, In Frame Response Not Alloed ( GM), Physical Addressing
Functional Addresses:
ID Function
----- ----------------------------
$6A Request Legislated Diagnostics (bit 0 (W bit) = 0 Command)
$6B Report Legislated Dianostics (bit 0 (W bit) = 1 Status)
Request current value of PID ($00..$20)
Send: $68,$6A,$F1 :$01,$PID
Recv: $48,$6B,$10 : $41,$PID,[up to 5 data bytes]
Physical Node Addresses:
ID Module
--------- ----------------------------
$00-$1F Powertrain controllers
$00-$0F Integration/Manufacturer Expansion
$10-$17 Engine controllers
$18-$1F Transmission controllers
$20-$3F Chassis controllers
$20-$27 Integration/Manufacturer Expansion
$28-$2F Brake controllers
$30-$37 Sterring controllers
$38-$3F Suspension controllers
$40-$C7 Body controllers
$40-$57 Integration/Manufacturer Expansion
$48-$5F Restraints
$60-$6F Driver information/Diplays
$70-$7F Lighting
$80-$8F Enterntainment
$90-$97 Personal communications
$98-$9F Climate control (HVAC)
$A0-$BF Convenience (doos, Seats, Windows, etc.)
$C0-$C7 Security
$C8-$CB Electric Vehicle Energy Transfer System (EV-ETS)
$C8 Utility connection services
$C9 AC to AC conversion
$CA AC to DC conversion
$CB Energy storage management
$CC-$CF Future expansion
$D0-$EF Manufacturer specific
$F0-$FD Off-Board Testers/Diagnostic scan tools
$FE All nodes
$FF Null node
Examples of VPW Code (Functional Messages)
For the OBDII mandated diagnostics, requsts are actually made to the functional address $6A,
with whatever processor is responsible for this function answering the request.
Theoretically many different processors can respond to a single functional request,
each contributing their insight as to the information requested.
Request current value of PID ($00..$20):
- Send: $68,$6A,$F1,$01,$PID
- Recv: $48,$6B,$10,$41,$PID,[up to 5 data bytes]
Request freeze frame value of PID ($00..$20):
- Send: $68,$6A,$F1,$02,$PID,$FRAME
- Recv: $48,$6B,$10,$42,$PID,$FRAME,[up to 5 data bytes]
where FRAME is $01..$06 and is the freeze frame number from which to retrieve the PID's history data.
Examples of VPW Code (Physical Messages)
Request GM VIN:
- Send: $6C,$10,$F1,$3C,$01
- Recv: $6C,$F1,$10,$7C,$01,[VIN segment 1 data]
- Send: $6C,$10,$F1,$3C,$02
- Recv: $6C,$F1,$10,$7C,$02,[VIN segment 2 data]
- Send: $6C,$10,$F1,$3C,$03
- Recv: $6C,$F1,$10,$7C,$03,[VIN segment 3 data]
Request GM PCM#:
- Send: $6C,$10,$F1,$3C,$04
- Recv: $6C,$F1,$10,$7C,$04,[PCM #, 4 data bytes]
Request enhanced PID ($0000..$FFFF):
- Send: $6C,$10,$F1,$22,$PID-hsb,$PID-lsb,$01
- Recv: $6C,$F1,$10,$62,$PID-hsb,$PID-lsb,[up to 5 data bytes]
Requesting a DTC
The $XX byte in the following command: $6C,$10,$F1,$19,$XX,$FF,$00
is the status byte. It has the following "bitmapped" values:
- $80 - MIL is illuminated
- $40 - Pending trouble code
- $20 - Old code - MIL was illuminated for this code but is no longer illuminated.
- $10 - History code with freeze frame data available.
- $08 - Manufacturer specific status (I do not know what this means).
- $04 - Manufacturer specific status (I do not know what this means).
- $02 - Current code.
- $01 - Immature code.
To get real trouble codes you should request only
$80+$10+$02=$C2
To get real trouble codes AND pending trouble codes request:
$80+$40+$10+$02=$D2