LS1GTO Forums banner

You don't need a Tech-II to reset SDM (airbag) trouble codes

39K views 55 replies 24 participants last post by  GNXClone 
#1 ·
I successfully reset mine last night. It's soooooo nice not to have to hit the mode button to clear the dash display, and look at that red airbag light anymore! :D

The code was set when my clock spring broke. I fixed the clock spring, and had hoped the light would go out on it's own after a few start ups, but it didn't. So I Googled and came up with the necessary info.

If you want to do this yourself, all you need is:

FlashTool V1.39
http://delcohacking.net/forums/viewtopic.php?f=3&t=82

This byte sequence: FB,56,0A,A5
http://www.delcohacking.net/forums/viewtopic.php?f=13&t=156&start=120#p27150

This circuit to connect the GM UART 8192 to your PC's RS-232 port (DATA is on Pin-9 of the OBD-II connector by the way):


Here's the cable I made. Worked like a champ! I scored the OBD-II connector from a junked car that had an OBD-II extender. I already had the transistors, resistors and diode.
 
See less See more
2
#3 ·
Not only that, some USB-serial dongles are notoriously temperamental. I'd almost prefer to slap a serial card in a desktop PC. I just refurbished my Lenovo X61 laptop that I use for tuning because it has a media slice that includes a legacy serial port and can be left mounted in the car while the laptop is removed. I don't believe anyone makes a media slice unit any more. With a SSD in it, I don't have to worry about it being jostled in the car. I might have to try this, since I have a failed clockspring as well. The fail was leaving it accessible to morons who thought turning the wheel with the rack disconnected was a good idea.
 
#10 ·
Not only that, some USB-serial dongles are notoriously temperamental. I'd almost prefer to slap a serial card in a desktop PC. I just refurbished my Lenovo X61 laptop that I use for tuning because it has a media slice that includes a legacy serial port and can be left mounted in the car while the laptop is removed. I don't believe anyone makes a media slice unit any more. With a SSD in it, I don't have to worry about it being jostled in the car. I might have to try this, since I have a failed clockspring as well. The fail was leaving it accessible to morons who thought turning the wheel with the rack disconnected was a good idea.


haha... dongles
 
#6 ·
 

Attachments

#5 ·
ok, that is awesome. you should rent it out because im too stupid to make something like that :D
 
#7 ·
I owe most of my successes to others via Google. And I definitely would not have the awesome GTO I have today without this forum. Just paying it back.

Luckily I have an older laptop with a real RS-232 port. I've read that some USB serial cables won't work. I've also read that some have had success with them. It has to do with the ability to set a baud rate near 8192. On the PC, they get close enough at something like 8228 bps.

Another cool thing about this cable...if one could gain access to a Tech-II, one could easily snoop the various messages used to configure things such as the instrument panel, etc. Unfortunately, I have neither the time nor motivation for that.
 
#8 ·
Just for fun, anyone care to decode this? It's the chatter which was repeated over and over with the key on, engine off. I believe B9 is the BCM's module ID.

The second byte the length, plus 0x55. The last byte is a two's complement checksum.

So the first message is: 02 00 00 sent to module id B9
Second is: 94 0B 02 sent to module id 40

so on and so forth...

Code:
11:01:17 PM     Rx'd Frame = B9, 58, 2, 0, 0, ED, 
11:01:17 PM     Rx'd Frame = 40, 58, 94, B, 2, C7, 
11:01:17 PM     Rx'd Frame = 41, 68, 12, 0, 0, 0, 73, 1A, 0, 0, 70, F2, 40, 0, 0, 16, 0, 0, 1, 9B, 0, 64, 
11:01:17 PM     Rx'd Frame = A8, 55, 3, 
11:01:17 PM     Rx'd Frame = 20, 55, 8B, 
11:01:17 PM     Rx'd Frame = 91, 59, 3, 11, 0, 0, 2, 
11:01:17 PM     Rx'd Frame = A0, 55, B, 
11:01:17 PM     Rx'd Frame = 11, 5D, 7, FF, 10, 40, 5, 7E, 4, 0, B5,
 
#19 · (Edited)
Code:
11:01:17 PM     Rx'd Frame = B9, 58, 2, 0, 0, ED, 
11:01:17 PM     Rx'd Frame = 40, 58, 94, B, 2, C7, 
11:01:17 PM     Rx'd Frame = 41, 68, 12, 0, 0, 0, 73, 1A, 0, 0, 70, F2, 40, 0, 0, 16, 0, 0, 1, 9B, 0, 64, 
11:01:17 PM     Rx'd Frame = A8, 55, 3, 
11:01:17 PM     Rx'd Frame = 20, 55, 8B, 
11:01:17 PM     Rx'd Frame = 91, 59, 3, 11, 0, 0, 2, 
11:01:17 PM     Rx'd Frame = A0, 55, B, 
11:01:17 PM     Rx'd Frame = 11, 5D, 7, FF, 10, 40, 5, 7E, 4, 0, B5,
I can tell you how that stuff is structured, but I cant read the data. You need GM specific documentation for that.

Module Identify; message length -$55 in this case 3; message is 2 ,0 ,0 ; checksum

Edit:
If some one had the time, they could buy an ELM327, and log the shit out of everything HPTuners (or whatever) does and reverse engineer it. I have the tools, but not the time. I dont thnk SAE sells GM-specific message stuff, only GM would have it, AFAIK.
 
#18 ·
Thanks.

This particular cable can't spy on HP Tuners because that's on the high-speed (OBD-II) LAN. But there are other ways to spy on it which don't even require a cable. ;)

ABS, ECM and TCM (and PIM) are high-speed. SRS, IP, BCM and radio (and PIM again) are on the GM UART 8192 line. The PIM allows the low-speed and high-speed networks to communicate, so the ECM can send RPM to the IP, and the BCM can send the security key to the ECM...for instance. (05/06 MY, not sure about 04)
 
#16 ·
"Links to all OBD2 protocols including CAN, Keyword 2000, ISO 9142-2, J-1850 (VPW & PWM) to decode “Check Engine” light problems"

It doesn't mention GM UART protocol. Which is what the SRS, Radio, IP and BCM are in the 05/06 GTO. Not saying it doesn't do it, just that it's unclear if it does.

Also, I wanted to avoid paying a dealer even $25 to $150 for the reset. My cable cost less than $10 and the rest was free.
 
#12 ·
Thanks for the link, I had built nearly the same 8192-serial adapter, but never finished doing any software to sniff it. I'll download it now

I run a laptop with a serial port, so that is not a problem.

Thanks,

Ryan
 
#14 ·
Ditto,

I've got access to a tech2 and tis2web & tis2000 on DVD, but having an extra cheap option is always good.

I am 90% sure that this tool could be used to do the cluster, but I have not had a chance to sniff it yet... I'll try to program my cluster to change from M6 to A4 and capture the bus traffic...
 
#26 ·
Very cool! I know the IP and the PIM both hold auto/manual info. There are likely commands to change both embedded in there. Would be interesting to compare the long strings of bytes with EEPROM contents to see if there are any matches.
 
#22 ·
Damn, I wish you lived nearby so I can clear this airbag fault light that just started...I *think* it was from me having the window down a little during the last rain..so stupid we have to worry about a little water in the cab...I checked everything else and it seemed to work, so thinking the sensor just got wet..something to fix I guess (so it doesn't happen again), but this light/alert is so damn annoying and pisses me off it can only be cleared with a dealer/service station (those with Tech II).

This is a good idea, but not sure if it would work for me with my 'new' laptop.
 
#24 ·
Whats the title of the doc?
 
#27 ·
Looks like a simple little project. I have had this problem since I bought my car. I may try it pretty soon and see if it clear up my problem.
 
#28 ·
I need to get the eeprom image off of my cluster, but I did get some bytes to match the eeprom image that I have, so I do think that you are on to something. I did not see the mileage go across the data bus

do you have your cluster eeprom data?
 
#29 ·
I don't have my data with me unfortunately. It's on my laptop at home.

My hope is that configuration involves direct writes to the eeprom. If it does, and we decode that message, that would make modifying the IP so much easier. I hate having to pull it all apart to read/write the eeprom. I would guess programming the BCM and PIM and Radio also uses the same method.
 
#30 ·
I find these to be the most interesting. Looks like Mode-17 is security seed/key. Mode-32 is write/config. Mode-33 is verify. Mode-26 ???
Mode-0 and Mode-1 are documented on the web.

That's my guess anyway.

Code:
1:09:02 PM     Rx'd Frame = F2, 57, 1, 4, B2, 
1:09:02 PM     Rx'd Frame = F2, 98, 1, 4, 5, 7E, 72, A0, C, 0, 0, 0, 0, 63, 0, 0, 0, 0, 0, 8, 91, 61, 18, 81, 0, C8, 0, 0, FF, C0, 3C, 0, 5, 3, 0, 0, 0, 5, DC, 0, 0, 0, 0, 0, 1, B4, B4, B4, B4, B4, B4, 4, 0, 7C, 80, 78, 5, 40, 80, C0, FF, 5, 5A, 46, 5A, 5, 4, 1C, 2, D3, 

// Request security seed
1:09:04 PM     Rx'd Frame = F2, 57, 11, 0, A6, 
1:09:04 PM     Rx'd Frame = F2, 58, 11, AB, 2E, CC, 

// Send security key
1:09:04 PM     Rx'd Frame = F2, 59, 11, 1, 8F, DB, 39, 
1:09:04 PM     Rx'd Frame = F2, 58, 11, 8F, DB, 3B, 

1:09:05 PM     Rx'd Frame = F2, 57, 1, 4, B2, 
1:09:05 PM     Rx'd Frame = F2, 98, 1, 4, 5, 7E, 72, A0, C, 0, 0, 0, 0, 63, 0, 0, 0, 0, 0, 8, 91, 61, 18, 81, 0, C8, 0, 0, FF, C0, 3C, 0, 5, 3, 0, 0, 0, 5, DC, 0, 0, 0, 0, 0, 1, B4, B4, B4, B4, B4, B4, 4, 0, 7C, 80, 78, 5, 40, 80, C0, FF, 5, 5A, 46, 5A, 5, 4, 1C, 2, D3, 

1:09:09 PM     Rx'd Frame = F2, 57, 1, 4, B2, 
1:09:09 PM     Rx'd Frame = F2, 98, 1, 4, 5, 7E, 72, A0, C, 0, 0, 0, 0, 63, 0, 0, 0, 0, 0, 8, 91, 61, 18, 81, 0, C8, 0, 0, FF, C0, 3C, 0, 5, 3, 0, 0, 0, 5, DC, 0, 0, 0, 0, 0, 1, B4, B4, B4, B4, B4, B4, 4, 0, 7C, 80, 78, 5, 40, 80, C0, FF, 5, 5A, 46, 5A, 5, 4, 1C, 2, D3, 

// Write value 5 to FD ?
1:09:09 PM     Rx'd Frame = F2, 5A, 20, 55, 0, FD, 5, 3D, 
1:09:09 PM     Rx'd Frame = F2, 59, 20, 1, 0, FD, 97, 

// What did you just write?
1:09:10 PM     Rx'd Frame = F2, 56, 21, 97, 
1:09:10 PM     Rx'd Frame = F2, 59, 21, 0, 0, FD, 97, 

1:09:10 PM     Rx'd Frame = F2, 59, 20, 1, 0, 1, 93, 

1:09:10 PM     Rx'd Frame = F2, 56, 21, 97, 
1:09:10 PM     Rx'd Frame = F2, 59, 21, 0, 0, 1, 93, 

1:09:11 PM     Rx'd Frame = F2, 5A, 20, 55, 0, 66, 3, D6, 
1:09:11 PM     Rx'd Frame = F2, 59, 20, 1, 0, 66, 2E, 

1:09:11 PM     Rx'd Frame = F2, 56, 21, 97, 
1:09:11 PM     Rx'd Frame = F2, 59, 21, 0, 0, 66, 2E, 

1:09:11 PM     Rx'd Frame = F2, 5A, 20, 55, 0, 7E, 1, C0, 
1:09:11 PM     Rx'd Frame = F2, 59, 20, 1, 0, 7E, 16, 

1:09:11 PM     Rx'd Frame = F2, 56, 21, 97, 
1:09:11 PM     Rx'd Frame = F2, 59, 21, 0, 0, 7E, 16, 

1:09:12 PM     Rx'd Frame = F2, 5A, 20, 55, 0, A6, 63, 36, 
1:09:12 PM     Rx'd Frame = F2, 59, 20, 1, 0, A6, EE, 

1:09:12 PM     Rx'd Frame = F2, 56, 21, 97, 
1:09:12 PM     Rx'd Frame = F2, 59, 21, 0, 0, A6, EE, 

1:09:12 PM     Rx'd Frame = F2, 59, 20, 1, 0, 33, 61, 

1:09:13 PM     Rx'd Frame = F2, 56, 21, 97, 
1:09:13 PM     Rx'd Frame = F2, 59, 21, 0, 0, 33, 61, 

1:09:13 PM     Rx'd Frame = F2, 57, 1, 4, B2, 
1:09:13 PM     Rx'd Frame = F2, 98, 1, 4, 5, 7E, 72, A0, C, 0, 0, 0, 0, 63, 0, 0, 0, 0, 0, 8, 91, 61, 18, A5, 0, C8, 1, 0, FF, C0, 3C, 0, 5, 3, 0, 0, 0, 5, DC, 0, 0, 0, 0, 0, 1, B4, B4, B4, B4, B4, B4, 4, 0, 7C, 80, 78, 5, 40, 80, C0, FF, 5, 5A, 46, 5A, 5, 4, 1C, 2, AE, 

// No clue, read something which returns 8
1:09:24 PM     Rx'd Frame = F2, 57, 1A, 1, 9C, 
1:09:24 PM     Rx'd Frame = F2, 58, 1A, 1, 8, 93, 

1:09:24 PM     Rx'd Frame = F2, 57, 1, 4, B2, 
1:09:24 PM     Rx'd Frame = F2, 98, 1, 4, 5, 7E, 72, A0, C, 0, 0, 0, 0, 63, 0, 0, 0, 0, 0, 8, 91, 61, 18, A5, 0, C8, 1, 0, FF, C0, 3C, 0, 5, 3, 0, 0, 0, 5, DC, 0, 0, 0, 0, 0, 1, B4, B4, B4, B4, B4, B4, 4, 0, 7C, 80, 78, 5, 40, 80, C0, FF, 5, 5A, 46, 5A, 5, 4, 1C, 2, AE, 

// Back to normal comm
1:09:26 PM     Rx'd Frame = F2, 56, 0, B8, 
1:09:26 PM     Rx'd Frame = F2, 56, 0, B8, 

Here is what changed:

                                                                  XX         X                                                                                            
[ 5, 7E, 72, A0, C, 0, 0, 0, 0, 63, 0, 0, 0, 0, 0, 8, 91, 61, 18, 81, 0, C8, 0, 0, FF, C0, 3C, 0, 5, 3, 0, 0, 0, 5, DC, 0, 0, 0, 0, 0, 1, B4, B4, B4, B4, B4, B4, 4, 0, 7C, 80, 78, 5, 40, 80, C0, FF, 5, 5A, 46, 5A, 5, 4, 1C, 2 ]
[ 5, 7E, 72, A0, C, 0, 0, 0, 0, 63, 0, 0, 0, 0, 0, 8, 91, 61, 18, A5, 0, C8, 1, 0, FF, C0, 3C, 0, 5, 3, 0, 0, 0, 5, DC, 0, 0, 0, 0, 0, 1, B4, B4, B4, B4, B4, B4, 4, 0, 7C, 80, 78, 5, 40, 80, C0, FF, 5, 5A, 46, 5A, 5, 4, 1C, 2 ]
 
#33 · (Edited)
Might be the same thing, I used 2N2222 transistors. Diode is 1N4148 I think.

Yup:
The 2N2222 is an NPN transistor that can safely switch three times as much current as the 2N3904 but has otherwise similar characteristics.[4] Nevertheless, in many applications such as variable frequency oscillators where lower currents are used to minimize thermal heating and consequent thermal drift of the fundamental frequency, the greater current capacity of the 2N2222 gives it no advantage. Whereas the 2N2222 is optimized to reach its highest gain at currents of around 150 mA, the 2N3904 is optimized for currents of around 10 mA.
 
#35 ·
ok so clearly I am not as smart as I thought...dayum....heres my dilemma...my recline seat motor went out so I replaced it, on accident I started the car w/out everything hooked and the air bag light came on...I have yanked the battery I reflashed it with my HP Tuner and even went to the dealer with a Tech II, they said it was a "miscommunication with passenger side HVAC" and bc it was a "active" code he couldnt reset it(he did it for free)...I never touched the passenger side...is there any other way to clear this annoying light and beep I get? I hate having "idiot" lights on my dash
 
#36 ·
Damn, this thread is full of win
 
This is an older thread, you may not receive a response, and could be reviving an old thread. Please consider creating a new thread.
Top