Need Guidance on Pontiac 3.9L G6 GTP & Other LZ9 Vehicles

[Keith]

Hello all!

I just received my UTD version of the M2 and I am itching to get in there and break something!

List of vehicles that use the VVT 3.9L LZ9 motor:
2006 Chevrolet Impala, Monte Carlo, Malibu SS, Malibu Maxx SS and Uplander; Pontiac G6 GTP and SV6; Buick Terraza; and Saturn Relay.

I did a search on the forums and found no mention of the Pontiac G6, or the LZ9 anywhere and figured it was worth making a thread. All years of the G6 use the CAN bus and Macchina recommends using the “SavvyCAN” library.

I am curious if we have any users on the message boards who have tweaked a LZ9 powered vehicle with the M2 already and if so, please give us your input!

My background is in electrical and computer engineering, so I am sure I will figure it out eventually, but I’d love to get some feedback for anyone who can assist in pointing me in the right direction. Things to avoid is also valuable info.

Another point of interest is my Dad has a 2016 SS Camaro (3rd best, to LTE and ZL1) that I drive occasionally. I imagine the LS1-LS6 motors are some of the more popular items, when compared to the LZ9. Although the LZ9 was an award winning motor by motor trend, so it’s no slouch either! I’ll update this post as I progress in my tuning, as well as when the thread starts getting valuable information worthy of being at the top in the OP!

Thanks and happy tuning day!

[DivinityArcane]

I think it depends what you’re looking to do. I know SavvyCAN will be very useful for you to find/target frames you’re looking for, but as far as functionality it depends what you want to do. Are you trying to just get data from the car or are you looking to actually send commands and things of that nature?

[amorget]

What do you mean by tweak? If you are trying to make changes to effect the performance of the engine, just buy HPTuners. There has been a little talk about writing to an ECM using a Maccina but since there is already a tool on the market for that, you’d be miles ahead by just starting there.

[Keith]

Besides the obvious diagnostic uses for things in SavvyCAN, I’d like to be able to:

(Toggle Y/N) Disable Speed Limiter
(Toggle Y/N) Disable Rev Limiter

I have no problem blazing my own trail here figuring out what exactly the LZ9 needs to crack these nuts, but I figured I’m not the only one. I do have “The Car Hacker’s Handbook” to help me in my pursuits and plenty of resources at my college (UNC-Charlotte’s Computer Engineering).

I plan to spend a long time in SavvyCAN learning about how that system works before attempting anything and I hope to find some direct guidance on these topics.

(Pretend the M2 can tune at it’s full potential if it still can’t do this yet)
Say we did a “tune” on a SS Camaro, does the M2 need to stay in the car for the tune to remain in effect or does it stay no matter if the M2 is plugged in or not? I assume it doesn’t need to be plugged in, except for the tune itself, or for diagnostic logging.

[DivinityArcane]

I’m not sure on the capabilities of those specific vehicles, but every instance I know of the rev limiters and speed governor are in the PCM or other module and part of the firmware flashed onto them. You would have to do reprogramming, which would require at the very least knowing what location in the binary contents those values are stored at, and on any modern vehicle also know how to set the correct checksum/hash so that it passes the checks internally and thinks that it is a proper tune. The suggestion of HPTuners is a good one for doing things like this, since they already found where the majority of the values are within the binary content of the modules and let you modify them, and it already handles the reconstruction of the data for you. That’s not to say that you couldn’t use HPT to try and make something yourself, but for that, the amount of work far outweighs the benefits. HPT has many thousands of hours of labor and research, and reinventing the wheel there isn’t going to be much of a profit to you.

Once the firmware/data is flashed on, you don’t need the device connected to the car anymore, unless of course you’re using it for something else like you said, datalogging, etc.

[Keith]

Before I get ahead of myself too much, I first want to make sure I can get SavvyCAN working for diagnostic logging/sniffing the CAN bus.

I followed the instructions given here: https://docs.macchina.cc/m2/getting-started/arduino.html down to a T and I was able to get the drivers to show up in the IDE. I ran the board info option and this is what I got:

I used M2RET (Version 345, found here: http://www.savvycan.com/) to flash my M2 and everything said successful (can’t remember if I did this before or after the Arduino setup part, probably before).

Then I went to open SavvyCAN (after closing Arduino IDE since we can’t have multiple programs open that use the same BUS) and my questions begin here, how do I know for sure the device is working if it hasn’t yet been used in a vehicle?

My Main Settings Page of SavvyCAN:

Here is the connection settings page

Does everything look good so far?

I also ran this sketch that is given on one of the tutorial pages to ensure that serial communications work (it appears it was successful):

int AssociateState = 0; // variable for reading the associate status

void setup() {
Serial.begin(9600); // Serial port for XBEE socket
SerialUSB.begin(9600); // Native USB port
pinMode(XBEE_MULT2, INPUT); // DIGI Associate PIN
pinMode(DS6, OUTPUT); // Green LED
pinMode(XBEE_RST, OUTPUT);
digitalWrite(XBEE_RST, HIGH); // Make sure RESET is HIGH
pinMode(DS2, OUTPUT);
digitalWrite(DS2, LOW); // Turns on Red LED
}

void loop() {

if (SerialUSB.available()) { // read from port 1, send to port 0:
int inByte = SerialUSB.read();
Serial.write(inByte);
}

if (Serial.available()) { // read from port 0, send to port 1:
int inByte = Serial.read();
SerialUSB.write(inByte);
}

AssociateState = digitalRead(XBEE_MULT2);

if (AssociateState == HIGH) {
digitalWrite(DS6, HIGH); // turn LED on:
} else {
digitalWrite(DS6, LOW); // turn LED off:
}
}

Now a few questions:

When I upload a sketch to the device, that is going to the SD card correct? Does M2RET flash the memory on the Arduino Due/M2 itself? In other words, uploading a sketch isn’t going to mess up the M2RET flash will it?

What do I need to do now that it appears everything is set up to start logging the CAN bus? I plugged it in once already to my OBD-II port and it just did the blink sketch that was still uploaded to it.

Is there a specific sketch I need to upload to data log? I can easily follow steps when given, but I’m still a noobie about what exactly is needed (at this point in the process anyway). I assume I need to do something to tell the M2 to log the CAN bus to a data file, but don’t see this info given anywhere that I’ve seen.

I don’t intend to use the M2 in tandem with a laptop or anything unless needed for a specific tune (not constantly in my car), but I’m not sure the M2 capable software is even at the stage where that is needed yet. In the “Car Hacker’s Handbook” they mention maybe two apps that should work, but on an info page by Macchina I found at least 3-4. How many software packages currently work for the M2? Such as SavvyCAN, but not just diagnostics, if there are any.

Thanks in advance for all of your help and guidance, I think this community has excellent potential!

[CollinK]

Yeah the pictures looked like it was set up properly. I’d set the time keeping to seconds instead of microseconds. It tends to be a lot easier on the eyes.

M2RET and the blink sketch both flash onto the on-board FLASH. Nothing ever runs from the SDCard. The processor used really doesn’t support running from sdcards. So, you’ll have to reflash M2RET if you want to capture CAN with SavvyCAN. Once you have M2RET running and connected to SavvyCAN you should be able to capture data by plugging it into the OBDII port. You need for the speed set to be the same as your car. 500,000 is the usual speed. The second most likely speed is 250,000.

If you want to capture CAN data to the SDCard then you have to bring up a serial console (the one built into the Arduino IDE works fine) and enable line endings (any of them will do CR, LF, CRLF). Then send ? (press enter to send it) and you should get a menu. From there you can set up the name of the file and turn on file logging. You can set whether to automatically use the sdcard or whether you’d like to turn it on and off.

As for how many apps. Well, embarrassingly enough, I don’t know. There are more sketches than just M2RET and more apps than just SavvyCAN but I personally haven’t tested all that many. In theory you could set M2RET to be a LAWICEL compatible device and then connect via serial as a slcan device in linux. Then any socketcan compatible app should work. Along those same lines, as it should emulate a lawicel device, it should work with apps that interface over that serial protocol. But, the vast majority of testing has been with M2RET and SavvyCAN. From there it tends to turn into a lot of custom sketches so that people can do exactly what they want to do.

[Keith]

Thanks for your input, it was extremely detailed and cleared up a lot of my questions!

I reflashed with M2RET so the M2 was ready for sniffing the CAN bus and I hooked it up to my car today. I drove 2 hours total and when I got home and hooked my M2 back up to my PC SavvyCAN looks no different than the images I posted above. Is there any setting that I need to make sure I have either on or off? (Such as “Listen Only” option where the Baud rate is listed)

I’ve heard that some cars have a very quiet CAN bus and require commands to be sent to get the vehicle to send CAN instructions to the M2. Do you think that is my issue?

Also how many of the buses should I have on? It shows there are 3 total, should I have all 3 on with the 500,000 baud rate?

Thanks in advance for any assitance!

[CollinK]

Ordinarily you need savvycan connected while you are driving in order to capture traffic. It doesn’t by default capture and then dump the capture to savvycan when you connect. Though, that’d be really cool if it did. If you want to capture without anything connected then you need to set that up via the text console (Serial Monitor in the IDE) then it should log to the sdcard. Once you’ve captured that way you’d have to take the SDCard out of the M2 and transfer the files to your PC the old fashioned way. But, being able to do that without removing the card really would be a good idea.

Chances are you only have one CAN bus on your ODBII port, perhaps 2. The third CAN bus on the M2 is single wire CAN. You might have that too, I don’t know. The first CAN bus should be 500k, the second one if it exists could be 250k or 500k. The single wire CAN is almost certainly 33.3k if it exists at all.

[Keith]

Thank you for clearing up another point of confusion for me, I kind of just assumed it worked in that manner.

Say I do want logging on the M2 without having to use a 2nd device to get SavvyCAN to work:

You say I need to create a sketch in Arduino IDE that will allow the M2 and the CAN bus to log to an SD card, is this a generic sketch that is posted somewhere on Macchina.cc or will I need to customize it for my vehicle?

We talked about how M2RET works vs. uploading a sketch and you said that both will write to the on-board FLASH memory. How do I tell the Arduino IDE where to write the sketch and not overwrite M2RET’s flash? Or does M2RET not clear the entire FLASH storage during it’s flashing procedure? I’m surprised this stuff isn’t given in the main guide here on a Macchina.

I’m using the portable version of Arduino IDE 1.8.9 and I have my programmer set to “AVRISP mkII.” Are there any other settings I need to check or are most of the defaults correct?

Question on possible devices in tandem with M2 during use:

Is it possible to use a tablet or even a phone instead of a computer in tandem with the M2 to do this? I’m guessing it comes down to SavvyCAN’s compatibility and the USB bus generation/chipset on whatever mobile device you use.

Thanks as always for the assitance!

[redheadedrod]

SavvyCAN is compatible with Linux or WIndows. To use with WindowsRT you would have to recompile it and hopefully the libraries are available in RT format.

Your GM’s may be too old to be using CANBUS. Some vehicles were in a transitional period in 2006. Such as the trucks had CANBUS but only for the engine and transmission. I know the G6 still used ALDL (ODB1) for talking to the dash cluster. I don’t know what other systems also used ALDL but I also don’t know what year they converted over to the full CANBUS.

I have a GM service manual that is good through 2009 so if you tell me the year and model of the vehicle you are trying to connect to I can see if it has canbus or class2 bus (Class 2 is J1850VPW).

The thing about J1850VPW is that there is a library here that will work on it but it is very basic and needs to be expanded. It doesn’t work with any utilities at this time and is basically just an interface. I do have extensive information however on J1850VPW and can help.

On a tuning note… That isn’t going to happen easily… GM does some crazy stuff to make it difficult to tune your PCM. The good news is that if you are not on CANBUS there is an open source setup that has been created that will work. Still somewhat in the testing stages but they have been able to pull the PCM image and have had some success pushing it back up to the PCM. There is a freeware tuning program that you can use to actually do the tuning. The information is available out there… Also if you use a Tech2 you may be able to reverse engineer some codes as well. Tech2 clones can be had for around $300.

If I ever get time… I plan to roll support for all of this into the M2.

Rodney

[Keith]

Thanks for all of your feedback!

The vehicle I am trying to use this on is a 2006 Pontiac G6 GTP 3.9L (LZ9) w/ 6-Speed manual.

From what you said, are you talking about logging onto SD or onto the onboard FLASH?

Why is that the $20-$30 ELM327 OBDII chipset has such powerful monitoring software (Torque Pro), yet the M2 doesn’t even have proper support to log a CAN bus to a SD card out of the box? I don’t remember anything I read stating I’d have to run a computer in tandem to log (without programming the M2). The ELM327 chipset is a joke compared to the M2’s hardware. I know they are made for different tasks, but it’s just the easiest example to use. Is this just because the M2 is still so “new” (for most people)?

I followed the Macchina from M1 to M2 production cycle before I purchased a unit, but this kicked off at least 2 years ago, right? It’s not like this just came out in the last few months…

This has left me wondering what if anything I am going to be able to do with the XBee Module (WiFi/BT) that I ordered to go with the M2. Looks like unless we want to create the software ourselves, this is going to be quite the wait as the software catches up with the hardware. As I’ve stated, I’m in Computer Engineering, so I’m sure I could help with creating software, but doubt I could go from scratch.

Thanks again!

[redheadedrod]

The M2 is significantly more powerful than the ELM. Even the STN devices (Superset of ELM) doesn’t come close. Just that no one has actually created a software package that goes beyond what Collin has done at this point in time.

I have promised to do this myself but I am currently working on a Masters and working full time so I have limited time to accomplish this on my own. It wouldn’t take much to go from the framework I built to get there. If you are familiar with writing software for the Arduino that could help dramatically. I just need to take a good couple weeks where I can work on the code and get it up to par. Once it gets to that point then adding any XBEE modules will be easy.

There is no reason why the M2 can’t do everything within the device. You can use the SD card for logging and for storing other data (Such as a look up table for PID’s etc…)
With the Xbee module you should be able to theoretically upload any log files over the network to a server automatically.

I recently graduated with a Computer Science degree but I have been tinkering around in code for decades.

I will look up your car and see what databuses it actually has.

[redheadedrod]

Ok, yes your information is correct about the car having CANBUS…

Lowspeed CANBUS (SWCAN 33k baud)
BCM, VCIM(Cell/Onstar), Radio, XM, AirBag, Convertable top control, Dash Cluster, HVAC controls, Theft deterrent.

Highspeed (CANBUS should be 500k baud)
BCM, PCM, Transmission, VCIM, Power Steering, Electronic Brake Control Module

The BCM is a bridge module and the brain of the vehicle. But won’t talk without the PCM included as it is the heart of the control system.

Best thing I can suggest to do to test is to do what I do… Get an ODBII Y cable and use a ELM compatible device with a program that you know will talk to the car then hook up the M2 and see if you can see anything on the M2 while the ELM is communicating.

Some vehicles may require you to send the BCM codes to talk to it. I wouldn’t think that would be the case in your G6 but it is possible. Again, also consider trying a different USB cable. I had problems where I could program the M2 but not actually use it and it came down to an incompatible USB cable.

I will be doing some hacking of my car the next week or so for my Cryptology class and will be using the M2 to perform my demo with SavvyCAN. When I get back from vacation in Florida I will try to get more involved with the software as much as I can. (In Florida from May 1-5)

By chance, where are you located?

[Keith]

But won’t talk without the PCM included as it is the heart of the control system.

Please elaborate on this.

Get an ODBII Y cable and use a ELM compatible device with a program that you know will talk to the car then hook up the M2 and see if you can see anything on the M2 while the ELM is communicating.

Are you saying to do this with a PC in the car at the time? I assume logging to SD isn’t working by default based on what @CollinK said, as he did make, or was a primary creator of SavvyCAN right? He said I need to write some Arduino IDE code to tell the M2 to talk to the SD card, but I have no basis of information to write this code. It’s stabbing in the dark for me at this point.

Collin’s comments on SD vs. Onboard and how SavvyCAN actually is able to work, currently, with the M2.

Though, that’d be really cool if it did. If you want to capture without anything connected then you need to set that up via the text console (Serial Monitor in the IDE) then it should log to the sdcard. Once you’ve captured that way you’d have to take the SDCard out of the M2 and transfer the files to your PC the old fashioned way. But, being able to do that without removing the card really would be a good idea.

I have a GM service manual that is good through 2009 so if you tell me the year and model of the vehicle you are trying to connect to I can see if it has canbus or class2 bus (Class 2 is J1850VPW).

Can you PM me the relevant pages just for what I need to know for my vehicle? Getting these guides isn’t cheap and you don’t need 90% of it, it’s a racket imo, like most textbooks.

The thing about J1850VPW is that there is a library here that will work on it but it is very basic and needs to be expanded.

Link? I’d rather not just have to pick a random library, hoping it’s correct.

On a tuning note… That isn’t going to happen easily… GM does some crazy stuff to make it difficult to tune your PCM.

Yes, I have become aware of this. Tuning the PCM is more easily done through more orthodox “tuning” methods, though still not cheap, requires a flash of the main controller I believe, although, I could do this in my own lab, lol.

There is no reason why the M2 can’t do everything within the device. You can use the SD card for logging and for storing other data (Such as a look up table for PID’s etc…)

I agree, but do you know the code format that should be used to prevent overwriting M2RET’s flash? Is the M2’s on-board memory overwritten each time you upload a sketch or is it only added to the on-board? (volatile vs. non., right?)

By chance, where are you located?

North Carolina

Lowspeed CANBUS (SWCAN 33k baud)
BCM, VCIM(Cell/Onstar), Radio, XM, AirBag, Convertable top control, Dash Cluster, HVAC controls, Theft deterrent.

Highspeed (CANBUS should be 500k baud)
BCM, PCM, Transmission, VCIM, Power Steering, Electronic Brake Control Module

I acquired a few documents related to the G6 that may come in handy in the future for others, it’s specifically for a 2007 G6, but how much could have changed for the computer in 1 year? Not much.

PP_TRANSPORTATION AUTOMOBILE PONTIAC G6 2007 I - GENERAL_DATA.pdf (48.7 KB)
PP_TRANSPORTATION AUTOMOBILE PONTIAC G6 2007 III - START UPS_DATA.pdf (46.1 KB)
PP_TRANSPORTATION AUTOMOBILE PONTIAC G6 2007 II - DRIVE BYS_DATA.pdf (48.1 KB)

[redheadedrod]

I have a lab setup at home using 2002 s10 truck modules. The BCM did not communicate at all until I added the PCM to the system. I understand this is the case with all GM vehicles. The BCM is the master module but needs the “heartbeat” from the PCM to work. If you capture that heartbeat command you can make the BCM work but you have to keep sending it to the BCM within a specific time period or the BCM stops communicating with anything else.

Some vehicles may have a different configuration such as at least some years of the Corvette.

As far as the Y cable… To test that my M2 is working or not I use a Y cable and an ELM (Actually STN) device. I have this ELM device talk to the car or test lab using my computer. (I have a laptop that I use)
This allows me to know that there is communications on that port. You could also use any ODBII scanner that shows continuous live data. Then I connect my M2 also. The M2 I have connected to SavvyCAN on the same computer on a different USB port obviously. I then know I should be getting something on the M2 and if I don’t I have the wrong combination of M2 firmware and SavvyCAN installed or not properly installed. This is only to verify there is data on the port as you would expect and if you are not getting anything from the M2 you have something misconfigured. SavvyCAN will try to guess the proper baud rates but it can be wrong. Should be 500k for the high speed CANBUS and 33k for the SWCAN. If you are getting data on your SavvyCAN screen then you don’t need to do this. Again, if you have issues and nothing else seems to make sense try changing the USB cable. I had it write the firmware but not communicate with SavvyCAN properly and tracked it down to the USB cable being different somehow. The Arduino hardware seems to be somewhat finicky about the USB cable.

I believe Collin is saying you can use the logging now but you have to manually turn it on using the serial terminal built into SavvyCAN. I have not tried it at all.

As we already determined you don’t need the J1850VPW library for your car but it would be found on the main page where you found the other stuff. There is only one J1850VPW library at this time.
https://showcase.macchina.cc/

Tuning of the car requires a process that I don’t 100% understand. Basically you have to upload a program commonly called a Kernel into the PCM. This kernel then has the code in it to either read or write to the PCM flash memory and to communicate with the ODBII port. This kernel then is run by rebooting the PCM into it and the kernel communicates with the PC or whatever you are using to program it with. So you have to write a kernel for each type of PCM out there. May be able to have a baseline kernel that just needs minor modifications but still needs to be recompiled. I understand this is the same process that has been used since the J1850VPW protocol came out and has continued with CANBUS for GM vehicles. I also understand this is the same process for programming all of the modules in the car but each needs its own Kernel. I have not seen anyone actually try this though. You can capture a kernel and binary for a module using something like the M2 to log the data while using a GM SPS compatible device. But then you need to know when the kernel stops and the data begins which is reasonably easy to do if you understand the commandset. Note that this type of stuff is stuff I hope to include support for with the M2 when I have time to finish the framework I am building and can expand upon it. Please note that you can not use an ELM or even an STN device to log the programming data as it will fly by too fast and will flood the buffer in either device. The M2 however will happily log the data as fast as it comes in but the software has not been written to do this yet.

Consider the M2 having 3 different areas of memory/storage…
FLASH - Non volitile ram. There is a very small portion of runtime flashable ram that will survive between reboots but it is not big enough to use for anything other than program settings you want to save between reboots.
SDCard - Requires running a library to access the SDCard. I have not played with this but it is included in the M2 default software so I assume it works. I don’t know if Collin or anyone else has tested it though. But since he talks of how to turn it on I am assuming it works.
RAM - This volitile memory can store running variables but is deleted when the M2 is reset or turned off.

If you are logging stuff you will want to use the SDCard if storing on the M2. No other option available. None of the firmware is stored on the SDCard. It is there for external data storage.

I am in Michigan currently located within 10 miles of Collin.

As far as PMing the pages… I am currently busy working on stuff for my Masters and it is somewhat of a pain the way they do it but if you tell me specifically what you want I can probably work out something but emailing you directly would likely be easier. If you want to PM me your email address.

[Keith]

Finally finished with finals for this semester in Comp Engineering. So, I finally have some time to look at this again. I’m going to do some testing with the M2 + laptop over the weekend and see what I can get.

Also, my SuperB module arrived today! Excited to put this thing to use!

Thanks so much for your feedback @redheadedrod , sorry for the long delay getting back to the thread. I’m going to study what you wrote and get back to you if I have new questions (I’m sure I will).

Thanks again!

[redheadedrod]

If you have problems programming that module let me know… There is a thread around here somewhere. I had some difficulty programming mine at first. Basically you install linux on it if you use the base configuration. Looked pretty cool and I was able to manually get it to connect to my network but that is one of the things I plan to program into my new library. I have support for it already designed in… I did the programming of the main USB ports. The SuperB would be a superset of one of the USB ports. You can use the M2 to program the SuperB but it takes a little finagling. I should write up a DIY howto with code… You need a custom sketch in your M2 to allow it to work as a transport mechanism to flash the SuperB.

I went on vacation initially for a week but was enjoying myself so much that I stayed for an extra week. Playing catchup on my new semester. I completed my Computer Science degree in December and working on a Masters in Cyber Security now. I hope to use the M2 with some hacking projects I have.

I have encapsulated the driver I created in an object which will make life a lot easier to standardize interfaces.