Difference between revisions of "Holden:ALDL (8192 Baud)"

Revision as of 06:22, 21 April 2021

Overview

ALDL or Assembly Line Diagnostic Link is the diagnostic interface created by GM and used by Holden on the Commodore models from the VN to the VZ. The VE is the first Commodore to exclusively use CAN bus for diagnostics and inter-module communication. The VN through to VS Commodores used GM's original 160 baud interface (compatible with a GM Tech 1 or Tech 2 scan tool), whilst the VT through to VZ Commodores used the newer 8192 baud interface (compatible with a Tech 2 scan tool). This article will focus on the 8192 baud interface. For information on the 160 baud interface, see ALDL (160 Baud).

Frame Structure

An ALDL frame consists of a message ID, length, an optional number of data bytes (up to 64 bytes), and a 2's compliment checksum. Any multi-byte fields are always big-endian unless otherwise noted. The table below illustrates the structure of an ALDL frame.

Length (bytes)	Field	Notes
1	Message ID	The value `0` is reserved and is not a valid ALDL message ID
1	Length	`0x55` + n, where n is the number of data bytes (up to 64)
n	Data
1	Checksum	2's compliment checksum of all bytes in the frame (message ID, length, and data bytes)

Module IDs

The table below lists IDs for various modules across several Commodore models.^[1]^[2]

ID	Module
`BD`	BCM (VR/VS)
`E4`	Telematics Module (VY)
`EA`	ECC - Climate Control (VY)
`EB`	Radio (VY)
`F0`	ALDL Tester/Scan Tool
`F1`	BCM (VT/VX/VY)
`F2`	Instrument Cluster (VT/VX/VY)
`F2`	SRS (VR/VS)
`F3`	PIM (VY)
`F4`	PCM (VR/VS V8)
`F5`	PCM (VS V6/VT)
`F7`	PCM (VX/VY)
`F9`	ABS/TCS (VR/VS)
`FA`	SRS (VT)
`FB`	SRS (VX/VY)

Checksum Calculation

An ALDL checksum is calculated by adding every byte prior to the checksum field (ID byte, length byte, and data bytes), and calculating the 2's compliment of the last 8 bits in the sum. Verification works in a similar manner; all bytes of the frame are added (including the checksum byte). The last 8 bits of the sum will equal 0 if the sum is valid.

Modes

ALDL diagnostic requests work on the principle of modes. To issue a diagnostic request, an ALDL frame is sent with an ID corresponding to a module's diagnostic ID (see Module IDs), and the first data byte set to the mode number of the request. ALDL diagnostic requests will therefore always have a minimum of 1 data byte. A typical response to a diagnostic request will be an ALDL frame with the same ID as the original request, the first data byte set to the mode number of the request, and an optional number of extra data bytes forming the response. The table below lists the various ALDL modes.

Mode (decimal)	Description
`00`	Normal Mode
`01`	Live Data
`02`	Memory Block Read
`03`	Memory Scatter Read
`04`	Control Function
`08`	Disable Bus Chatter
`09`	Enable Bus Chatter
`10`	Clear DTCs

Mode 0

ALDL Mode 0, or Normal Mode reverts the effect of any previous ALDL requests (except requests with lasting effect such as a DTC clear), returning the addressed module to normal operation.

Mode 1

Each module maintains a set of tables containing live data as well as stored parameters. When a device issues a Mode 1 request to a module, it provides the number of the table being requested. The module responds by transmitting the requested table number, followed by the contents of the table. The exact contents and structure of the table depend on both the table in question, and the module. Tables are numbered sequentially, however most modules have less than 10 tables. Requests for table numbers higher than the total number of tables on a given module will not receive a responseTemplate:Dubious. The table below illustrates the full structure of a Mode 1 request.

Length (bytes)	Field	Value	Notes
1	ID	`F1`
1	Length	`57`
1	Mode	`01`
1	Table	n	Table number
1	Checksum

Mode 2

Mode 2 requests are used to retrieve a block of 64 bytes from the PCM's memory^[3]. Any 16-bit address within the processor's memory address space may be requestedTemplate:Cn. This means that ROM, RAM, calibration data and I/O registers may be retrieved with Mode 2 requests. Whilst Mode 2 requests memory in blocks of 64 bytes, the requested address does not need to be aligned on a 64 byte boundary. This may be useful for reducing the number of requests required for values in close proximity to one another. The below table illustrates the full structure of a Mode 2 request.

Length (bytes)	Field	Value	Notes
1	ID	`F1`
1	Length	`58`
1	Mode	`02`
2	Address	n	16-bit address in big endian format
1	Checksum

Mode 4

A Mode 4 request is used to control a module for testing purposes. Control can include anything from slewing or setting fixed output values, slewing or setting fixed input sensor values, altering the results of certain calculations and invoking certain module functions. Modules that respond to Mode 4 requests include the; PCM, BCM, instrument cluster and ABS/TCS modules. The structure of a Mode 4 request differs greatly depending on the module it is addressed to. The basic structure of a Mode 4 request is illustrated by the table below.

Length (bytes)	Field	Value	Notes
1	ID		ID of the module to be controlled
1	Length	`55` + 1 + n
1	Mode	`04`
n	Control Structure		Varies depending on module
1	Checksum

Mode 8

Periodically, the BCM sends polling requests amongst other data on the bus. These requests poll the PCM for sensor data and operational parameters used by the instrument cluster. A Mode 8 request is used to temporarily disable these messages from being sent. This essentially silences the BCM and quietens the bus, allowing for another device such as a computer or scan tool to transmit with a lower chance of a packet collision. Unless another Mode 8 request is sent within a predetermined amount of timeTemplate:When, the BCM will automatically resume normal bus operation. The BCM will respond with a frame containing a single data byte 08 with an ID of F1 (a frame identical to the request). The below table illustrates the full structure of a Mode 8 request.

Length (bytes)	Field	Value
1	ID	`F1`
1	Length	`56`
1	Mode	`08`
1	Checksum	`B1`

Mode 9

Similar to Mode 8, a Mode 9 request will re-enable BCM chatter. A Mode 9 request can be sent to enable bus chatter earlier, rather than waiting for the original Mode 8 request to time out. This may be useful (and potentially good practice) if a device only requires bus silence for a short period of time, as bus silence for longer periods of time can lead to Check Engine warnings on the clusterTemplate:Cn. The BCM will respond with a frame containing a single data byte 09 with an ID of F1 (a frame identical to the request). The below table illustrates the full structure of a Mode 9 request.

Length (bytes)	Field	Value
1	ID	`F1`
1	Length	`56`
1	Mode	`09`
1	Checksum	`B0`

Mode 10

The majority of modules in the vehicle can have stored DTCs cleared with a Mode 10 request. These include, but are not limited to; the PCM, BCM, ABS/TCS, SRS modules as well as the instrument cluster. The below table illustrates the full structure of a Mode 10 request.

Length (bytes)	Field	Value	Notes
1	ID		ID of the module DTCs will be cleared from (see Module IDs).
1	Length	`56`
1	Mode	`0A`
1	Checksum

References

[1] .net - GM Reverse Engineering (Page 1)

[2] .net - GM Reverse Engineering (Page 10)

[3] Calibra Classic - ECU2PC (ALDL Mode 2)

[1]

[2]

[3]

@@ Line 145: / Line 145: @@
 === Mode 8 ===
-Periodically, the BCM sends polling requests amongst other data on the bus. These requests poll the ECM for sensor data and operational parameters used by the instrument cluster. A Mode 8 request is used to temporarily disable these messages from being sent. This essentially silences the BCM and quietens the bus, allowing for another device such as a computer or scan tool to transmit with a lower chance of a [https://en.wikipedia.org/wiki/Collision_domain#:~:text=A%20network%20collision%20occurs%20when%20more%20than%20one%20device%20attempts%20to%20send%20a%20packet%20on%20a%20network%20segment%20at%20the%20same%20time packet collision]. Unless another Mode 8 request is sent within a predetermined amount of time{{When}}, the BCM will automatically resume normal bus operation. The below table illustrates the full structure of a Mode 8 request.
+Periodically, the BCM sends polling requests amongst other data on the bus. These requests poll the PCM for sensor data and operational parameters used by the instrument cluster. A Mode 8 request is used to temporarily disable these messages from being sent. This essentially silences the BCM and quietens the bus, allowing for another device such as a computer or scan tool to transmit with a lower chance of a [https://en.wikipedia.org/wiki/Collision_domain#:~:text=A%20network%20collision%20occurs%20when%20more%20than%20one%20device%20attempts%20to%20send%20a%20packet%20on%20a%20network%20segment%20at%20the%20same%20time packet collision]. Unless another Mode 8 request is sent within a predetermined amount of time{{When}}, the BCM will automatically resume normal bus operation. The BCM will respond with a frame containing a single data byte <code>08</code> with an ID of <code>F1</code> (a frame identical to the request). The below table illustrates the full structure of a Mode 8 request.
 {|class="wikitable"
@@ Line 161: / Line 161: @@
 === Mode 9 ===
-Similar to [[#Mode 8|Mode 8]], a Mode 9 request will re-enable BCM chatter. A Mode 9 request can be sent to enable bus chatter earlier, rather than waiting for the original Mode 8 request to time out. This may be useful (and potentially good practice) if a device only requires bus silence for a short period of time, as bus silence for longer periods of time can lead to Check Engine warnings on the cluster{{Cn}}. The below table illustrates the full structure of a Mode 9 request.
+Similar to [[#Mode 8|Mode 8]], a Mode 9 request will re-enable BCM chatter. A Mode 9 request can be sent to enable bus chatter earlier, rather than waiting for the original Mode 8 request to time out. This may be useful (and potentially good practice) if a device only requires bus silence for a short period of time, as bus silence for longer periods of time can lead to Check Engine warnings on the cluster{{Cn}}. The BCM will respond with a frame containing a single data byte <code>09</code> with an ID of <code>F1</code> (a frame identical to the request). The below table illustrates the full structure of a Mode 9 request.
 {|class="wikitable"