Enhanced PID's over CAN protocol?
 

At least for J1850 cars (which I understand is a completely different protocol than any flavor of CAN), you could get undocumented PID's from the car by sending a physically-addressed J2190 message. This link shows some of the ones that apparently work on LT1/LS1 cars.

I've been trying to do the same thing with my 2004 CTS. I can send and receive multi-packeted CAN messages (i.e. getting RPM, engine load, speed, etc. all in one packet). However, my car doesn't appear to support all of the PID's that I'd like it to. For example, the ECM doesn't seem to support any of the official J1979 throttle position PID's. I'd wager that the car does have some PID for this, but it's probably not an SAE-official one.

The question is, how do I get this info from the ECU? Is there any semi-documented list of "enhanced" PID's for CAN vehicles?

Edit:

Here's an example of a test that I tried to get ignition voltage (1141). I wasn't sure about endianness so I tried the bytes as both 11 41 an 41 11:

07 E0 03 22 11 41
07 E0 03 22 41 11

In either case, I get the following response from the car:

07 68 03 7F 22 11

I interpret that as a J1979 error message:
07 68 -- ECU address
03 -- Message length
7F -- J1979 Negative Response Service identifier
22 -- J1979 service identifier
11 -- Response code "serviceNotSupported".

Thoughts?

Thanks!

So I did more research and testing last night, and I've got more questions.

I ran across this post on MP3Car.com, which shows some of the data exchanged between a CAN scan tool and a GM vehicle.

In that example, the scan tool uses J2190 command 0x2C to define a custom PID (called a DPID) and then gets that data using a manufacturer-reserved command, 0xAA.


Now, when I try to break down the 0x2C command, I get this:

7E 00 Address
04 Packet length
2C "Define PID" command
FE User-defined PID (I think, according to J2190, that this can be any one-byte number)
00 11 Two-byte PID value

Now, according to the spec, there should be another byte between the "FE" and the "00". This should be a one-byte bitmask that tells the PCM/ECM/ECU about how to build this custom PID request. I'm guessing that it's missing because GM has bent the rules?

I did my own experiment with this:


Data sent:
0x07, 0xE0, 0x04, 0x2C, 0xFE, 0x00, 0x11

Response (seems to be good):
0x07 0x68 0x6C 0x7E

But when I tried to send a more standardized J2190 command, I got an error...
Data sent:
0x07, 0xE0, 0x05, 0x2C, 0xFE, 0x49, 0x11, 0x49

Response:
0x07 0x68 0x7F 0x2C 0x12

I think that last 0x12 corresponds to a "sub function not supported / invalid format" error.

Thoughts? What piece(s) am I missing here?

Thanks!