LML VATS question...

[DURAtotheMAX]

Ross/Paul...

Is there any chance you can explain exactly what the VATS switches/settings in EFILive actually do in the code? How did you find those switches? Is there anything else in the "system" segment of an LML bin that has anything possibly related to VATS?

As far as I can tell, none of the VATS switches seem to do anything at all. Originally I thought that the "VATS disable" switch would at least allow the engine to start without a valid transponder signal from the key, but maybe still need valid state-of-health from the theft deterrent module and BCM....but that does not seem to be the case. I have gone through dozens of different combinations of VATS switches on the bench, and they all seem to still require a valid key, a theft deterrent module (which is on low speed GMLAN) hooked up, and the BCM hooked up.

I have reverse engineered all of the CAN messages for "crank request" and "BCM is alive and well" for LMM...that works perfectly. With VATS in EFILive set to disable, I can have a BCM sitting in standalone on the bench, send it the proper CAN messages, and it will engage the starter relay just like factory.......which is cool, because Im sure it (my little smart BCM-emulator box) would work for the E38/E67/etc ECM's too...thus giving those gasser standalone guys "proper" crank request with neutral-start-safety, starter over-crank protection, and automated cranking.

The theft challenge/response passwords are sent from the ECM on CAN, and the BCM sends theft info back. It seems to be a complex password, I assume this is the proprietary GM anti-theft algorithm.

The LMM has two VATS enable switches...anti-theft enable/disable, and anti-theft type (PK1, PK2, PK3). In order for my BCM emulator box to work and make the ECM trigger the starter relay, either the anti-theft switch has to be set to disable, OR the anti-theft system type has to be set to something other than PassKey 3. It also works if you set both of them to disable AND to PK1/PK2.

With VATS set to enable and PK3 (factory), the LMM behaves just like the LML and even with the crank request CAN messages, it still wont trigger the starter relay unless the BCM, TDM, and key are valid.

What is interesting though, is that the "anti-theft enable/disable" switch seems to be a simple global "allow ECM to crank/start if theft information received on CAN is missing/invalid".....the anti-theft system type switch determines whether the ECM sends a password challenge/request . So with theft set to disable, and Theft type set to PK3, the ECM still sends out theft data , BUT it doesnt care if theres no response. With the theft system type set to PK1/PK2, the ECM does not send out any data at all.

So Id have to imagine there are similar switches in at least the E86a LML, since the 2007.5-2010 LMM and 2011-2014 LML electrical architecture, CAN messages, anti-theft systems, algorithms etc are IDENTICAL between the two...

In summary...is there anything else, at all, in the E86a code that might be for VATS???

I dont care about needing to make the ECM/VATS "super super dumb" to the point where it will start just by jumping the starter terminals...because I can already do the BCM state-of-health messages and crank-request messages. But I cant fake those BCM password messages because, as far as I can tell, its an extremely complex password algorithm.

Thoughts/ideas? I know this has been discussed before, but I figured it wouldnt hurt to bring it up again now that I have figured out another piece of the puzzle.

Ben