How to play with Device Control.
Once you found out the Diagnostic ID for any particular controller, you can now start sending new an exciting request to it to see what it can do. Device Control (or I/O Control) is usually to most dynamic. The premise of this service is just as it sounds, to control the hardware. This service is typically used for mechanics to test the controllers output features such as actuating door locks, turning on/off lights, etc. This is a very interesting service in that it allows you to actuate features discretely in the vehicle. So instead of turning on all Left Turn Indicators (like when you do when you push down on the turn indicator switch) you can turn on only the Left Front Indicator Lamp. Now string that together with some music and other lights and you can have a cool Car Disco Party Mode.
So how does it work? When that depend on what kind of Diagnostics your car uses. There are three common types of Diagnostics: Keyword 2000 (ISO 14230), Universal Diagnostic Services (UDS ISO 14229) and GM LAN (GMW3110). I’ll talk about them individually below. For my examples I’ll use the Engine Control Modules standard Diagnostic ID, but you can sub out your modules ID. The effects will likely be different but the concepts remain the same. Also keep in mind that its often the case the you will have to initiate a Start Diagnostics Command (0x10). I will give these in the example but the Subfunction may be different (0x03 being the most common, but also try 0xC0 or 0x90 as well)
Keyword:
0x7E0 02 10 03 00 00 00 00 00 – Start Diagnostics (0x03 is the Mode this may be different on some OEMS)
0x7E8 02 50 03 00 00 00 00 00 – Positive Response to Start Diagnostics
0x7E0 04 30 01 07 01 00 00 00 – IO Control of IO 0x01; Short Term Adjustment (0x07); Turn ON (0x01)
0x7E8 02 70 01 00 00 00 00 00 – Positive Response. (Be careful because it gives you a positive response but does NOTHING; no control is executed. This is rare.)
0x7E0 03 30 01 00 00 00 00 00 – Return Control of IO 0x01 back to ECM.
0x7E8 02 70 01 00 00 00 00 00 – Positive Response.
UDS:
0x7E0 02 10 03 00 00 00 00 00 – Start Diagnostics (0x03 is the Mode this may be different on some OEMS)
0x7E8 02 50 03 00 00 00 00 00 – Positive Response to Start Diagnostics
0x7E0 06 2F 12 34 03 80 00 00 – IO Control of IO 0x1234; Short Term Adjustment (0x03); Turn ON (0x80, this could vary widely depending on the IO being controlled)
0x7E8 03 6F 12 34 00 00 00 00 – Positive Response.
0x7E0 04 2F 12 34 00 00 00 00 – Return Control to ECM.
0x7E8 03 6F 12 34 00 00 00 00 – Positive Response.
GM LAN:
(Start Diagnostics not needed)
0x7E0 07 AE 01 08 00 08 00 64 – IO Control of IO 0x01; Turn on 0x0800 (Bit Map of IOs, IO Bitmap duplicated in next two bytes to prevent accidental triggering) to 100% (0x64).
0x7E8 02 EE 01 00 00 00 00 00 – Positive Response
Common Negative Responses:
0x7E8 03 7F XX 80 00 00 00 00 – Incorrect Diagnostic Session. You need to change the Subfunction in Start Diagnostics.
0x7E8 03 7F XX 22 00 00 00 00 – Condition Not Correct. Likely the Key Needs to be in the RUN Possition.
0x7E8 03 7F XX 31 00 00 00 00 – Incorrect Format. Something’s wrong with your request message.
