VPW Communication Protocol

VPW Communication Protocol

Breakdown of the j1850 3 byte Header format

Byte1 = priority

Bits 7,6 and 5 are priority 0=High, 7=Low
Bit 4 is header style (0=3 byte header-GM, 1=1 byte header-??)
Bit 3 is In Frame Response (0=Required-Ford, 1=Not allowed-GM)
Bit 2 is addressing mode (1=Physical, 0=Functional)
Bit 1,0 is message type: (depending on bit 2 and 3 see below)

Bit 3 2 1 0
-----------
Functional

1 0 0 0 Function
1 0 0 1 Broadcast
1 0 1 0 Query
1 0 1 1 Read

Physical

1 1 0 0 Node to Node
1 1 0 1 Reserved
1 1 1 0 Reserved
1 1 1 1 Reserved

Byte2 = physical ID of destination
Byte3 = physical ID of source

Typical Physical ID's, PCM = $10, Off-board scan tool = $F1

Functional Addresses:

ID Function
----- ----------------------------
$6A Request Legislated Diagnostics (bit 0 (W bit) = 0 Command)
$6B Report Legislated Dianostics (bit 0 (W bit) = 1 Status)

Physical Node Addresses:

ID Module
--------- ----------------------------
$00-$1F Powertrain controllers

$00-$0F Integration/Manufacturer Expansion
$10-$17 Engine controllers
$18-$1F Transmission controllers

$20-$3F Chassis controllers

$20-$27 Integration/Manufacturer Expansion
$28-$2F Brake controllers
$30-$37 Sterring controllers
$38-$3F Suspension controllers

$40-$C7 Body controllers

$40-$57 Integration/Manufacturer Expansion
$48-$5F Restraints
$60-$6F Driver information/Diplays
$70-$7F Lighting
$80-$8F Enterntainment
$90-$97 Personal communications
$98-$9F Climate control (HVAC)
$A0-$BF Convenience (doos, Seats, Windows, etc.)
$C0-$C7 Security

$C8-$CB Electric Vehicle Energy Transfer System (EV-ETS)

$C8 Utility connection services
$C9 AC to AC conversion
$CA AC to DC conversion
$CB Energy storage management

$CC-$CF Future expansion

$D0-$EF Manufacturer specific

$F0-$FD Off-Board Testers/Diagnostic scan tools

$FE All nodes

$FF Null node

PCM Mode Requests:

J1979 (Functional) supports modes $01 thru $0F

Mode $01 - Request Current Powertrain Diagnostic Data
Mode $02 - Request Powertrain Freeze Frame Data
Mode $03 - Request Powertrain Diagnostic Trouble Codes
Mode $04 - Request to Clear/Reset Diagnostic Trouble Codes
Mode $05 - Request Oxygen Sensor Monitoring Test Results
Mode $06 - Request On-Board Monitoring Test Results
Mode $07 - Request Pending Powertrain Trouble Codes
Mode $08 - Request Control of On-Board System, Test, or Component
Mode $09 - Request Vehicle Information

J2190 (Physical) supports modes $10 thru $3F and $80 thru $BF

Mode $10 - Initiate Diagnostics Operation
Mode $11 - Request Module Reset
Mode $12 - Request Diagnostic Freeze Frame Data
Mode $13 - Request Diagnostic Trouble Code Information
Mode $14 - Clear Diagnostic Information
Mode $17 - Request Status of Diagnostic Trouble Codes
Mode $19 - Request Diagnostic Trouble Codes by Status
Mode $20 - Return to Normal Mode
Mode $21 - Request Diagnostic Data
Mode $22 - Request Diagnostic Data by PID
Mode $23 - Request Diagnostic Data by Memory Address
Mode $24 - Request Scaling and Offset / PID
Mode $25 - Stop Transmitting Requested Data
Mode $26 - Specifiy Data Rates
Mode $27 - Security Access Mode
Mode $28 - Disable Normal Message Transmission
Mode $29 - Enable Normal Message Transmission
Mode $2A - Request Diagnostic Data Packets
Mode $2B - Dynamically Define Data Packet by Single Data Offsets
Mode $2C - Dynamically Define Diagnostic Data Packet
Mode $2F - Input/Output Control by PID
Mode $30 - Input/Output Control by Data Value ID
Mode $31 - Enter/Start Diagnostic Routine by Test Number
Mode $32 - Exit/Stop Diagnostic Routine by Test Number
Mode $33 - Request Diagnostic Routine Results by Test Number
Mode $34 - Request Download - tool to module
Mode $35 - Request Upload - module to tool
Mode $36 - Block Transfer Message
Mode $37 - Request Data Transfer Exit
Mode $38 - Enter Diagnostic Routine by Address
Mode $39 - Exit Diagnostic Routine by Address
Mode $3A - Request Diagnostic Routine Results
Mode $3B - Write Data Block
Mode $3C - Read Data Block
Mode $3F - Test Device Present
Mode $7F - General Response Message
Mode $A0 - Request High Speed Mode
Mode $A1 - Begin High Speed Mode
Mode $A2 - Programming Prompt
Mode $AE - Request Device Control

PCM Mode Responses:
The response will always be $40 greater than the request mode.

Response $41 - Report Powertrain Diagnostic Data
Response $42 - Report Powertrain Freeze Frame Data
Response $43 - Report Emission Related Diagnositc Powertrain Trouble Codes
Response $44 - Emission-Related Diagnostic Information Cleared
Response $45 - Report Oxygen Sensor Monitoring Test Resluts
Response $46 - Report On-Board Monitoring Test Results for Non-Continuously Monitored Systems
Response $47 - Report On-Board Monitoring Test Results for Continuously Monitored Systems
Response $48 - Report Control of On-Board System, Test, or Component
Response $49 - Report Vehicle Information

PCM Mode $7F Response Codes:

Code $00 - Affirmative Response
Code $10 - General Reject
Code $11 - Mode Not Supported
Code $12 - Sub-Function Not Supported or Invalid format
Code $21 - Busy - Repeat Request
Code $22 - Conditions Not Correct or Request Sequence Error
Code $23 - Routine Not Complete
Code $31 - Request Out of Range
Code $33 - Security Access Denied
Code $34 - Security Access Allowed
Code $35 - Invalid Key
Code $36 - Exceed Number of Attempts
Code $37 - Required Time Delay Not Expired
Code $40 - Download Not Accepted
Code $41 - Improper Download Type
Code $42 - Can't Download to Specified Address
Code $43 - Can't Download Number of Bytes Requested
Code $44 - Ready for Download
Code $50 - Upload not Accepted
Code $51 - Improper Upload Type
Code $52 - Can't Upload from Specified Address
Code $53 - Can't Upload Number of Bytes Requested
Code $54 - Ready for Upload
Code $61 - Normal Exit with Results Available
Code $62 - Normal Exit without Results Available
Code $63 - Abnormal Exit with Results
Code $64 - Abnormal Exit without Results
Code $71 - Transfer Suspended
Code $72 - Transfer Aborted
Code $73 - Block Transfer Complete/Next BLock
Code $74 - Illegal Address in Block Transfer
Code $75 - Illegal Byte Count in Block Transfer
Code $76 - Illegal Block Tranfser Type
Code $77 - Block Transfer Data Checksum Error
Code $78 - Block Transfer Message Correctly Received
Code $79 - Incorrect Byte Count During Block Transfer

PID List:
Provided by Beerman on the forum.

$01 - Number of Emission Related DTC
$03 - Fuel System Status
$04 - Calculated Load
$05 - Engine Coolant Temperature
$06 - Short Term Fuel Trim Bank 1
$07 - Long Term Fuel Trim Bank 1
$08 - Short Term Fuel Trim Bank 2
$09 - Long Term Fuel Trim Bank 2
$0B - Manifold Absolute Pressure
$0C - Engine RPM High Resolution (RPM x4)
$0D - Speed in KPH
$0E - Ignition Timing Advance
$0F - Intake Air Temperature
$10 - Mass Air Flow
$11 - Throttle Position Sensor %
$12 - Commanded Secondary Air
$13 - Report O2 Sensor Configuration
$14 - O2 B1S1
$15 - O2 B1S2
$18 - O2 B2S1
$19 - O2 B2S2
$1C - OBD Requirements
$0020 - $21 - $50 Bit Map Flash Constant
$110F - Rear O2 Current Non-Volatile
$1140 - Mass Air Flow Sensor 1
$1141 - Ignition Voltage
$1143 - Throttle Position Sensor
$1144 - Air Conditioner Pressure
$1145 - O2 Sensor - Bank 1 Sensor 1 (mv)
$1146 - O2 Sensor - Bank 1 Sensor 2 (mv)
$1148 - O2 Sensor - Bank 2 Sensor 1 (mv)
$1149 - O2 Sensor - Bank 2 Sensor 2 (mv)
$1151 - Throttle Position Sensor Normalized in Degrees / Percent
$115E - CAM Engine Speed Activity
$116F - Start Up Engine Coolant Temperature
$1170 - Controlled Canister Perge Solenoid
$1171 - EGR Duty Cycle
$1172 - IAC
$1176 - Current IAC Memory
$1179 - IAC Motor Position
$1190 - Fuel Trim Cell
$1192 - Desired Idle Speed
$119D - Barometric Pressure
$119E - Air Fuel Ratio
$11A1 - Engine Run Time
$11A6 - Knock Retard
$11BD - EGR Test Count
$11C0 - EGR Decel Filter
$11D7 - O2 Response Lean to Rich Switches Bank 1 Sensor 1
$11D8 - Catalyst Monitor EWMA Sample Counter Bank 1
$11E3 - LOW RESOLUTION SIGNAL
$11E4 - Cylinder Mode Misfire Index
$11E6 - Revolution Mode Misfire Index (Balance Time)
$11EA - Misfire Current Cylinder #5
$11EB - Misfire Current Cylinder #6
$11EC - Misfire Current Cylinder #7
$11ED - Misfire Current Cylinder #8
$11F3 - Total Misfires per Test Special
$11F8 - Misfire History Cylinder #5
$11F9 - Misfire History Cylinder #6
$11FA - Misfire History Cylinder #7
$11FB - Misfire History Cylinder #8
$1200 - Total Misfire Current Count
$1201 - Misfire History Cylinder #1
$1202 - Misfire History Cylinder #2
$1203 - Misfire History Cylinder #3
$1204 - Misfire History Cylinder #4
$1205 - Misfire Current Cylinder #2
$1206 - Misfire Current Cylinder #1
$1207 - Misfire Current Cylinder #3
$1208 - Misfire Current Cylinder #4
$120A - Short Term Fuel Trim Bank 1
$120B - Long Term Fuel Trim Bank 1
$120C - Short Term Fuel Trim Bank 2
$1212 - Rich/Lean to Lean/Rich Ratio Sen. 1
$1216 - O2 Response Rich to Lean Switches Bank 2 Sensor 1
$1217 - O2 Response Lean to Rich Switches Bank 2 Sensor 1
$121A - O2 Response Rich to Lean Switches Bank 1 Sensor 1
$121C - O2 Average Bias Voltage
$1227 - Total Misfire Failures Since First Fail
$1228 - Total Misfire Passes Since First Fail
$122A - Cycles of Misfire Data
$1232 - Warm up cycles without an emission fault
$1233 - Warm up cycles without a non-emission fault
$1234 - Mileage Since Last Code Clear
$1235 - Mileage Since First Fail
$1236 - Mileage Since Last Fail
$1237 - Fail Counter
$1238 - Pass Counter
$1239 - No Results Counter
$123A - Long Term Fuel Trim Bank 2
$123D - REAR O2 FAIL TIME LEFT
$1246 - O2 Response Rich to Lean Average Time Bank 2 Sensor 1
$1248 - Catalyst Monitor Average Deviation
$124A - Catalyst Monitor Filtered Deviation Difference
$1258 - Rear O2 Time to Activity
$125A - Injector Pulse Width Average Bank 1
$125B - Injector Pulse Width Average Bank 2
$125D - Knock Retard
$125E - Knock Sensor Active Counter
$1262 - Long Term Fuel Trim Decal
$1263 - Long Term Fuel Trim Idle
$1264 - Long Term Fuel Trim Cruise
$1265 - Long Term Fuel Trim Accel
$1266 - Purge Long Term Fuel Trim #1
$1267 - Purge Long Term Fuel Trim #2
$1268 - Purge Long Term Fuel Trim #3
$1269 - Purge Long Term Fuel Trim #4
$1276 - CRANKSHAFT POSITION SENSOR LOW RESOLUTION ANGLE
$1278 - Average Air Flow When Rear O2 Went Active
$1283 - Air Pump Diag. Percent Lean Time
$1284 - Air Pump Diag. Percent Rich Time
$1286 - Air Pump Diagnostic Active Time
$1601 - A/C Evap Temp
$1602 - Engine Oil Temperature
$1941 - Transmission Input Shaft Speed
$1942 - Transmission Output Shaft Speed
$1970 - TCC PWM Duty Cycle
$1972 - PC (Pressure Control) Solenoid Duty Cycle
$1991 - TCC Slip Speed
$1992 - Time of Latest Shift
$1993 - Time of Latest 1-2 Shift
$1994 - Time of Latest 2-3 Shift
$1995 - Time of Latest 3-4 Shift
$1996 - Shift Time Error for Latest Shift
$1997 - Shift Time Error for 1-2 Shift
$1998 - Shift Time Error for 2-3 Shift
$1999 - Shift Time Error for 3-4 Shift
$199C - Current TAP (Transmission Adaptive Pressure) Cell
$199D - Transmission Pressure
$199E - Pressure Control Actual Current
$199F - Pressure Control Reference Circuit
$19A0 - Shift Delay
$19AD - Transmission Temp Sensor
$19F3 - Transmission Temp
$19F4 - Gear Box Ratio
$19F5 - Current Gear
$1A01 - Z-Body: Steady State Ratio Fail Counter

Examples of VPW Code (Functional Messages)
For the OBDII mandated diagnostics, requsts are actually made to the functional address $6A,
with whatever processor is responsible for this function answering the request.
Theoretically many different processors can respond to a single functional request,
each contributing their insight as to the information requested.

Request current value of PID ($00..$20):

Send: $68,$6A,$F1,$01,$PID
Recv: $48,$6B,$10,$41,$PID,[up to 5 data bytes]

Request freeze frame value of PID ($00..$20):

Send: $68,$6A,$F1,$02,$PID,$FRAME
Recv: $48,$6B,$10,$42,$PID,$FRAME,[up to 5 data bytes]
where FRAME is $01..$06 and is the freeze frame number from which to retrieve the PID's history data.

Examples of VPW Code (Physical Messages)

Request GM VIN:

Send: $6C,$10,$F1,$3C,$01
Recv: $6C,$F1,$10,$7C,$01,[VIN segment 1 data]
Send: $6C,$10,$F1,$3C,$02
Recv: $6C,$F1,$10,$7C,$02,[VIN segment 2 data]
Send: $6C,$10,$F1,$3C,$03
Recv: $6C,$F1,$10,$7C,$03,[VIN segment 3 data]

Request GM PCM#:

Send: $6C,$10,$F1,$3C,$04
Recv: $6C,$F1,$10,$7C,$04,[PCM #, 4 data bytes]

Request enhanced PID ($0000..$FFFF):

Send: $6C,$10,$F1,$22,$PID-hsb,$PID-lsb,$01
Recv: $6C,$F1,$10,$62,$PID-hsb,$PID-lsb,[up to 5 data bytes]

Requesting a DTC

The $XX byte in the following command:
$6C,$10,$F1,$19,$XX,$FF,$00
is the status byte. It has the following "bitmapped" values:

$80 - MIL is illuminated
$40 - Pending trouble code
$20 - Old code - MIL was illuminated for this code but is no longer illuminated.
$10 - History code with freeze frame data available.
$08 - Manufacturer specific status (I do not know what this means).
$04 - Manufacturer specific status (I do not know what this means).
$02 - Current code.
$01 - Immature code.

To get real trouble codes you should request only
$80+$10+$02=$C2

To get real trouble codes AND pending trouble codes request:
$80+$40+$10+$02=$D2

Special thanks to Paul of EFI Live for much of this info. See his site at > http://www.efilive.com/news_20040423.html