BCM Bench Programming

[kenjohn1204]

Hi, so I recently got a VCX Nano (USB) model to do bench programming of Ecu, Bcm, and radios. I built a hardness with what I thought was the property connections. My question that when I try to program the bcm. I get a “naodrui” communication error. I setup everything properly and have established that there is communication with the tech2win software, VCX Nano and the tis2000 software.

Any help would be greatly appreciated.

 

[Mooseman]

Have you tried communicating with an actual vehicle? It could be a communication or driver issue on the computer. I know a couple of guys here tried the Nano and were problematic just go get the software working.

 

[TJBaker57]

have established that there is communication with the tech2win software, VCX Nano and the tis2000 software

Does this mean you have read data from the module(s) connected by your bench harness? And what modules have you tried this with? I do not have any experience with the VCX Nano but have a pretty good knowledge of SAE J1850 VPW (serial data) communications.

 

[kenjohn1204]

Does this mean you have read data from the module(s) connected by your bench harness? And what modules have you tried this with? I do not have any experience with the VCX Nano but have a pretty good knowledge of SAE J1850 VPW (serial data) communications.

So in the tech2win software. I was able to pull up the bcm information. Yet I haven’t used it inside a vehicle. Unfortunately I do not have access to a vehicle. I was trying to do strictly off vehicle programming.

 

[mrrsm]

Welcome to GMT Nation...

Unless you have already done so and just forgot to mention it, you may find some *** Useful Information, Diagrams and Imagery of all the Gear in action as "Proof of Concept" in this On Topic Thread:

SOLVED! - How to Make A "GYMKO" Tech 2 Bench-Top Test Harness

BIGGER EDIT: 04/24/2019 For THE BEST On Topic Solution ...Go Directly to Post # 42... BIG EDIT: This Thread originally was to cover creating a Test Harness to use exclusively for diagnosing and repairing the GM Trailblazer and Envoy, etc Instrument Panel Cluster and Components... but...

gmtnation.com

If you are willing to do so, It would be helpful if you would post the story of your experiences of how you created your Harnessing along with the Wiring Schematics you have been following so we can look for any discrepancies.

@Bill Reid , @Mooseman, @m.mcmillen, myself and perhaps a few others here at GMTN have successfully 'Plowed this Field' so to speak... but not without overcoming some difficulties with a few 'hiccups' in development occurring along the way.

Good Luck

*** This Link takes you to a 64 Page PDF of all the possible programmable GM Modules for their Passenger and Truck Series from 1993-2008:

https://www.aa1car.com/library/gm_reprogrammable_modules.pdf

 

[kenjohn1204]

Thanks so much guys, I finally figured out what I was doing wrong. I was running both the tech2win software and the tis2000 at the same time. Once I only ran the tis2000 I was able to program the bcm.

Now I have a second question, how can I read the vin number off the bcm?

 

[mrrsm]

You should Download, Save and Use "The Tech 2 PATHS Bible" linked below as a reference document PDF as it Lists ALL of the Step By Steps for using the Tech 2 in GM Diagnostics... Alphabetically Organized for ease of use:

 

[korn]

I just got a 2009 Envoy and joined this site today. Just wondering what's in the BCM you're looking at? Just wondering as most of my experience is on pre OBDII or custom EFI ECU's. Not too familiar with factory modules.

I did some simple tunes on my older blazer but only on the ECM/PCM. I use HPTuners and dumped the Envoy's ECM already to look around. It wont do any other module so I'm looking at the VCX nano now.

I have to replace my SAS sensor but my Foxwell scan tool wont do it. I guess the ABS is the next module to look at. hopefully the VCX is good for that too.

would like to hear your results...

 

[kenjohn1204]

I just got a 2009 Envoy and joined this site today. Just wondering what's in the BCM you're looking at? Just wondering as most of my experience is on pre OBDII or custom EFI ECU's. Not too familiar with factory modules.

I did some simple tunes on my older blazer but only on the ECM/PCM. I use HPTuners and dumped the Envoy's ECM already to look around. It wont do any other module so I'm looking at the VCX nano now.

I have to replace my SAS sensor but my Foxwell scan tool wont do it. I guess the ABS is the next module to look at. hopefully the VCX is good for that too.

would like to hear your results...

So I was trying to flash the bcm and update the vin number. With the ecu I can confirm the vin change. Yet with the bcm, I am unable to confirm that the new vin number has took. I have been in ever menu in the Tech2win and tis2000 software but can’t find out how to read the bcm vin number. The reason I need this is to unlock radios.

 

[mrrsm]

This is a Quote from a different GM Forum via Post #5:

https://www.gmfullsize.com/threads/gm-tech-2-can-program-bcm.237859/

“The Tech 2 alone cannot program the BCM. You need to connect to the Computer to download everything onto the Tech 2 and then use that to program the BCM. I had to do this a year and a half ago.”

Best Practices would be to follow @Bill Reid ‘s Tech 2 Bench-Top Harness Wiring Schematic and add in, modify or edit the necessary Harnessing for The P-10 PCM, The BCM and The Radio Class 2 Interfaces within your New Design:

This is the correct Wiring Harness Schematic to follow and you will of course, need to obtain a Spare Delphi P-10 PCM of the correct vintage from eBay for this instance to work:

trailblazer p10 pcm | eBay

Find great deals on eBay for trailblazer p10 pcm. Shop with confidence.

www.ebay.com

Then after booting the System with a reliable Power Supply and a UPS Back Up Unit… Open the TIS2000 SPS Programming feature and follow the Calibration Module Installation and Update Procedures just as though you were sitting inside the Vehicle.

@Bill Reid 's Signature Custom Bench-Top Harness Thread:

https://gmtnation.com/forums/threads/p10-pcm-benchtop-harness-with-bcm-radio-support.15270/

For additional information on the P-10 PCM Pin-Out Diagrams and from my own Bench-Top Harness Work, refer to THIS Thread:

SOLVED! - How to Make A "GYMKO" Tech 2 Bench-Top Test Harness

BIGGER EDIT: 04/24/2019 For THE BEST On Topic Solution ...Go Directly to Post # 42... BIG EDIT: This Thread originally was to cover creating a Test Harness to use exclusively for diagnosing and repairing the GM Trailblazer and Envoy, etc Instrument Panel Cluster and Components... but...

gmtnation.com

 

[kenjohn1204]

This is a Quote from a different GM Forum via Post #5:

https://www.gmfullsize.com/threads/gm-tech-2-can-program-bcm.237859/

“The Tech 2 alone cannot program the BCM. You need to connect to the Computer to download everything onto the Tech 2 and then use that to program the BCM. I had to do this a year and a half ago.”

Best Practices would be to follow @Bill Reid ‘s Tech 2 Bench-Top Harness Wiring Schematic and add in, modify or edit the necessary Harnessing for The P-10 PCM, The BCM and The Radio Class 2 Interfaces within your New Design:

This is the correct Wiring Harness Schematic to follow and you will of course, need to obtain a Spare Delphi P-10 PCM of the correct vintage from eBay for this instance to work:

trailblazer p10 pcm | eBay

Find great deals on eBay for trailblazer p10 pcm. Shop with confidence.

www.ebay.com

View attachment 102629

Then after booting the System with a reliable Power Supply and a UPS Back Up Unit… Open the TIS2000 SPS Programming feature and follow the Calibration Module Installation and Update Procedures just as though you were sitting inside the Vehicle.

@Bill Reid 's Signature Custom Bench-Top Harness Thread:

https://gmtnation.com/forums/threads/p10-pcm-benchtop-harness-with-bcm-radio-support.15270/

For additional information on the P-10 PCM Pin-Out Diagrams and from my own Bench-Top Harness Work, refer to THIS Thread:

SOLVED! - How to Make A "GYMKO" Tech 2 Bench-Top Test Harness

BIGGER EDIT: 04/24/2019 For THE BEST On Topic Solution ...Go Directly to Post # 42... BIG EDIT: This Thread originally was to cover creating a Test Harness to use exclusively for diagnosing and repairing the GM Trailblazer and Envoy, etc Instrument Panel Cluster and Components... but...

gmtnation.com

I was able to program the bcm by itself. I can see the updated calibration, but can not find a place to verify the updated vin number. I went through tis2000 to program it.

 

[mrrsm]

FWIW... Since the verification happens by associating the VIN of the P-10 PCM over to the Added or Modified BCM...I think that is where the VIN Number Options comes up.

***I have seen TWO VIN Options occurring when working on a Corvette P-01...and avoided adding in the re-flash VIN until the 2nd Option to Add the VIN came up in SPS. I'm referring of course to the Text in 5a of this Linked Instructional on ECM Programming as what was guiding me here:

How to Program an Electronic Control Module (ECM) with GM SPS - Auto Repair Technician Home

The Service Programming System (SPS) is a PC application that updates (programs or reprograms) the flash calibration files that are stored in a vehicle’s ECM. [...]

www.car-auto-repair.com

I'm trying my best here to help you *winkle* out all possible solutions... :>(

 

[kenjohn1204]

FWIW... Since the verification happens by associating the VIN of the P-10 PCM over to the Added or Modified BCM...I think that is where the VIN Number Options comes up.

***I have seen TWO VIN Options occurring when working on a Corvette P-01...and avoided adding in the re-flash VIN until the 2nd Option to Add the VIN came up in SPS. I'm referring of course to the Text in 5a of this Linked Instructional on ECM Programming as what was guiding me here:

How to Program an Electronic Control Module (ECM) with GM SPS - Auto Repair Technician Home

The Service Programming System (SPS) is a PC application that updates (programs or reprograms) the flash calibration files that are stored in a vehicle’s ECM. [...]

www.car-auto-repair.com

I'm trying my best here to help you *winkle* out all possible solutions... :>(

Cool, I will add a pcm to the mix and see if that works. Thanks to everyone for taking their time out to help. Hopefully as I learn I too can add to this community.

 

[korn]

So I was trying to flash the bcm and update the vin number. With the ecu I can confirm the vin change. Yet with the bcm, I am unable to confirm that the new vin number has took. I have been in ever menu in the Tech2win and tis2000 software but can’t find out how to read the bcm vin number. The reason I need this is to unlock radios.

Thanks for the response. So far I have stayed away from the radio... My XM is expired so I may just swap to an aftermarket HU. I thought about getting a better factory radio from eBay so I'd be interested to see if you are successful. I thought I had read that an older gm the tech2 had a vin relearn option under navradio/specialfunctions that would erase the vin from the HU and then the HU would marry itself to the new vin..

I looked at restoring the chime but don't want a Metra module if I can make my own. I'm not sure if the chime comes from the VCIM as audio or serial data. I guess I'll wait for summer for that. For now I'm using an FM modulator to keep me entertained. I have the stock UB0, UE1, UQA radio.

 

[TJBaker57]

Cool, I will add a pcm to the mix and see if that works. Thanks to everyone for taking their time out to help. Hopefully as I learn I too can add to this community.

Have you managed to get the VIN from the BCM yet? I can't add anything to the discussion of using a Tech 2 or similar to get that data but I can describe how the ask for the VIN using the serial data language. You would need to use an OBD2 adapter and a serial terminal. Here are general instructions, let me know if more specific directions are needed.



Establish communications with the BCM and a serial data software.

Set message header to C9 FA F1.

Send the following one at a time. The VIN will be sent in 5 separate blocks of 4 characters each in ASCII. Request each block by sending a two character request in the simple form "01", "02", "03", and so on.

Here is a sample....

 

[kenjohn1204]

Have you managed to get the VIN from the BCM yet? I can't add anything to the discussion of using a Tech 2 or similar to get that data but I can describe how the ask for the VIN using the serial data language. You would need to use an OBD2 adapter and a serial terminal. Here are general instructions, let me know if more specific directions are needed.



Establish communications with the BCM and a serial data software.

Set message header to C9 FA F1.

Send the following one at a time. The VIN will be sent in 5 separate blocks of 4 characters each in ASCII. Request each block by sending a two character request in the simple form "01", "02", "03", and so on.

Here is a sample....

View attachment 102645

I still haven’t been able to verify if the bcm has took the new vin. I have been able to unlock radios and program vin into the ecu. I believe the bcm has to the new vin, I just can’t confirm it.

 

[mrrsm]

If @TJBaker57 ‘s suggestion pays off ...and they usually DO... so much The Better because, FWIW**** you CAN Read and Save the OEM BCM BIN File Data using a Special Tool called a “Code Cannibal” as per this demonstration on a GM Vehicle:

**** The Code Cannibal IMMO Key Programmer Tool WORKS... But it will COST A SMALL FORTUNE @ $2.200.00:



https://www.uhs-hardware.com/products/code-cannibal-immo-key-programmer-diagnostic-tool

Here are a few more sites with additional useful information on the topic of BCM Re-Programming:

https://findanyanswer.com/can-you-reprogram-a-body-control-module

https://www.chevymalibuforum.com/threads/has-anyone-ever-installed-a-used-bcm-does-it-work.10693/

I think Kali Linux also has some “Special Hacker Tools” designed for Reading and Saving a variety of Encrypted BIN Files, but that opens up a Whole New Can of Worms if you decide you want to go down THAT road.

 

[TJBaker57]

I don't know how this could be any easier. A $15 investment. This VIN ends in 248049.

 

[xx_ed_xx]

Please dont hurt me, but i joined because of this thread. I am trying to bench top program or if i have to, do it in the vehicle program a couple of early first gen colorado bcm's. I do have a tech 2 and a few other connecting devices

 

[Mooseman]

OK, do you have a question?

 

[LikeEnvoy]

Hi TJ
I just tried your instructions for reading the VIN from a BCM. Sadly, I get CAN ERROR all the time. Have you come across this?
It's a BCM I got from a junk 2007 Envoy Denali and I connected it up on my bench, using my own harness that I put together. I have a Diagnostic connector from a junk 2005 Envoy, an IPC connector and the BCM connectors C1 & C3 (the flat ribbon connector).
My bench power supply is powering the harness with 13V and limited to 1.4A.

I already found that Tech2Win with a VCX-FD device cannot read the VIN from the BCM. It seems it can only read the VIN from a PCM. None of the mobile phone apps I tried can read a VIN either; they also want the PCM /ecu connection before they do anything.
So, a serial terminal.
I tried exactly what you showed above in this thread: atshc9faf1
then 01, 02 etc. I get CAN ERROR.
I also tried 6c 40 f1 3c 01, which, according to fiero's protocol guide (fastfieros.com/tech/vpw_communication_protocol.htm ) should be sending from my diagnostic tool to the BCM and reading a block of data, starting at 01. That also returns CAN ERROR.

( Btw, I tried entering each byte with a space and all together, so 6c40f13c01 and also 6c 40 f1 3c 01. No difference)

Do you have an idea what's wrong?

 

[TJBaker57]

Hi TJ
I just tried your instructions for reading the VIN from a BCM. Sadly, I get CAN ERROR all the time. Have you come across this?
It's a BCM I got from a junk 2007 Envoy Denali and I connected it up on my bench, using my own harness that I put together. I have a Diagnostic connector from a junk 2005 Envoy, an IPC connector and the BCM connectors C1 & C3 (the flat ribbon connector).
My bench power supply is powering the harness with 13V and limited to 1.4A.

I already found that Tech2Win with a VCX-FD device cannot read the VIN from the BCM. It seems it can only read the VIN from a PCM. None of the mobile phone apps I tried can read a VIN either; they also want the PCM /ecu connection before they do anything.
So, a serial terminal.
I tried exactly what you showed above in this thread: atshc9faf1
then 01, 02 etc. I get CAN ERROR.
I also tried 6c 40 f1 3c 01, which, according to fiero's protocol guide (fastfieros.com/tech/vpw_communication_protocol.htm ) should be sending from my diagnostic tool to the BCM and reading a block of data, starting at 01. That also returns CAN ERROR.

( Btw, I tried entering each byte with a space and all together, so 6c40f13c01 and also 6c 40 f1 3c 01. No difference)

Do you have an idea what's wrong?

Good possibility that your OBDII adapter is set to the wrong protocol. Most likely it is trying to use ISO 15765-4 (2 wire high speed CANBUS) instead of the SAE J1850 VPW that you need to be using.

Without explaining it all.... try this:

ATTP2
ATAL
ATH1
ATS1
ATSHC9FAF1
01
02
03
04
05

 

[LikeEnvoy]

OK I tried this.
No CAN error but it says NO DATA for each of the blocks requested.
This was on the BCM.

I also tried it on an IPC I have, to see if I can read the VIN from the IPC EEPROM.
NO DATA again.
I also tried it but substituted 60 for the FA (so ATSHC960F1) assuming the protocol notes I mentioned are correct and 60 is the IPC.
Oh well. GM seems to make everything difficult; changing equipment and addresses, eh?
It was worth a try. Thanks TJ.

 

[TJBaker57]

OK I tried this.
No CAN error but it says NO DATA for each of the blocks requested.
This was on the BCM.

I also tried it on an IPC I have, to see if I can read the VIN from the IPC EEPROM.
NO DATA again.
I also tried it but substituted 60 for the FA (so ATSHC960F1) assuming the protocol notes I mentioned are correct and 60 is the IPC.
Oh well. GM seems to make everything difficult; changing equipment and addresses, eh?
It was worth a try. Thanks TJ.

Regarding substituting 60 for FA,,, in this form of message FA is NOT a hardware address. It is a functional address for the VIN number. Substituting 60 in place of FA sent a request to an SAE reserved function.

Have you verified you are in fact connected to the network??

Try this to see if you are in fact connected..

ATTP2
ATAL
ATH1
ATS1
ATMA


If you are connected and there is any traffic at all you will see it onscreen.

 

[TJBaker57]

@LikeEnvoy

What terminals have you powered at the BCM?

 

[LikeEnvoy]

AH- just saw your replies. I'll be back onto this fairly soon. Just getting a bit of filling and paintwork done on the bottom of the rear doors while the weather is suitable

 

[LikeEnvoy]

OK- Just tried that. I forgot to turn my IGN supply on at first, so I got ATMA as a response to the last command. Then I turned my IGN power on and a flood of messages began.
Most starting with 28 and some with 88 or 08 or AB or 6A.

I have Batt + to BCM connector C1-A3
and to C3: A1, A2, B4, B13, B17
Then my "Ignition switch" supplies power to C3: A18, A19, A20
Oh, and Gnd to A11 & B11

I wonder If I need B15 Accessory voltage?

 

[TJBaker57]

turned my IGN power on and a flood of messages began.

So this proves your adapter is working and you are connected properly to the data bus.

wonder If I need B15 Accessory voltage?

YES. B15 is a signal used by the BCM to determine ignition key position. The BCM uses this and other factors to determine the vehicle "Power Mode".

 

[LikeEnvoy]

Aha. OK, I jumped my "IGN switch" wire to B15 as well.
First good news is the cluster.
Before, when I plugged my cluster in together with the BCM,, the cluster no longer whirred the motors at power-on or lit all the LEDs. It had worked normally before I had the BCM connected.
So now, with B15 connected to IGN switch voltage, I noticed that with my Instrument cluster connected as well, the cluster starts up properly and the correct LEDS turn on.

Great improvement. Odd that the cluster had worked fine without the BCM connected, but as soon as I connected the BCM too, it didn't start up properly. This suggests that the BCM has some control over the cluster and without telling B15 that the IGN switch was on, it prevented the cluster from normal operation.

Anyway, now to try the serial com commands to see if I can read the VIN from the BCM.

YES! with only BCM connected, I got all 5 responses. Well done TJ. Thanks for bearing with me and offering all this help.

So I got these:
01 88 FB 40 01 00 00 00 31 66
02 88 FB 40 02 47 4B 45 54 2E
03 88 FB 40 03 36 33 4D 30 DC
04 88 FB 40 04 37 32 31 33 BE
05 88 FB 40 05 30 38 30 31 59

So I take the last digit of the last 4 characters of each response
0 0 1 6 B 5 4 E 3 D 0 C 2 1 3 E 8 0 1 9
something's not right because I remember when I got this BCM it was from the same car as the DIC cluster I pulled and I know the VIN of the cluster was 1GKET63M072130801.
I checked the ASCII codes online and it's beginning to come together.
31=1 66=f 47 =G 4B=K 45=E 54=T 2E= huh? period dot or full stop?
36=6 33=3 4D=M 30=0 DC= huh?

AH, wait. That last character seems like it is a sort of end character for the return message.

If I ignore that last hex character in each response I get this:
31=1
47 =G 4B=K 45=E 54=T
36=6 33=3 4D=M 30=0
37=7 32=2 31=1 33=3
30=0 38=8 30=0 31=1
Yes, that works. Odd that my responses have an 'end' character that I must ignore.

Well done though. This works perfectly.
So if I want to check what VIN number is in my IPC, which of the command characters do I change, to address the IPC?

 

[TJBaker57]

Odd that the cluster had worked fine without the BCM connected, but as soon as I connected the BCM too, it didn't start up properly

Not odd at all really. The BCM is the "Power Mode Master". It is not the onset of power that causes the radio to turn on, the cluster to activate and so on. It is the specifics of the power mode message from the BCM that instructs the various modules to wake up and get ready for work. Without B15 connected the proper power mode message was not sent but instead a different power mode message is broadcast by the BCM.

Odd that my responses have an 'end' character that I must ignore.

Again, not odd. That last byte is the checksum byte. it is used by the receiving modules to verify proper receipt of the whole message .

Well done though. This works perfectly.
So if I want to check what VIN number is in my IPC, which of the command characters do I change, to address the IPC?

Not all modules store the VIN. The message you sent was not addressed specifically to the BCM. Instead that message is addressed to any and every module that may have the VIN number stored and is also programmed to respond to such requests. The radio stores at least a partial VIN to compare to the BCMs stored VIN for the prupose of security/theft deterrence. And even if you had not sent that request for the VIN number the BCM would have broadcast the VIN anyway. It does so at every startup. Modules like the airbag controller need at least a partial VIN to configure themselves. Sometimes modules like the airbag controller will request part of the VIN even when the BCM had just broadcast the very same data!!

I have not encountered a VIN number in an IPC. It may be in there somewhere but I know of no reason an IPC would need the VIN.

 

[LikeEnvoy]

Good Info. Thanks again TJ. Hopefully this may help others too.