Corvette CCM Reverse Engineering Anyone?

[spfautsch]

Dunno sort of new to this stuff but really would like to find out why the CCM (95) did not program, it was done in the car

Whoa. Am I missing something or do you have like five or six model years worth of hardware you're working on?

I'm happy you're enthusiastic, but we might want to dial that back a bit. This is all highly untested, and we need to be methodical and solve one problem at a time or this will devolve into chaos quickly. No offense but it's starting to sound like you called all your friends with C4s and said "bring me your CCMs". Let's figure out how to crawl before we try to run.

[-=Jeff=-]

I am helping out one close friend with a 1995 LT5 that has a 1995 LT1 CCM. since that was what you guys started with I tried to write that today. I have 4 CCMs personally (partly to help see what works what does not). the 90, 91 and two 92s are spares. I don't want to FUBAR one in a running car.

My test bench is currently set for 1990-91, so I will focus on that, but I will need to get the 1995 CCM back soon, again, that I understood was working with the original flashhack..

[-=Jeff=-]

Can you send me the .bin you attempted to write pls (will PM you my email). I can try writing it to the donor CCM. Also, please turn on the 'Comms' debugging and copy / paste that logging info when you're asking for help with flashhack. Otherwise we have no way to sanity check your question.

You should never need to force a full write.

NomakeWan: I haven't forgotten about the 8051 PCM, will make every effort to open it up tomorrow and investigate as well as look into the security loop messaging. Sorry I've been awol but Saturday was picture perfect weather and a car show I made a commitment to attend so the entire day was spent on that. Yesterday was almost entirely spent re-assembling the CCM / PCM test bench. I just managed to get a test build for windows working for jeff to test.

to clarify.. I would select the comms button along bottom and copy that? or select Debug and use that? or both.

This I am actually super curious about as well. The error about L98/LT5 exists in the 1990 CCM, but there is no bit in the ECM reply message specifying engine type. There is, however, mention that something in the reply message tips the CCM off as to which ECM it's talking to. Unfortunately my information does not actually specify explicitly what this data would be. However, you are correct that something in the datastream allows the CCM to know whether it's talking to the L98 or LT5 ECM.


No worries, I had a feeling it was that. I only just got back to the thread today and saw how much the two of you had gone back and forth, so totally understandable. Thanks again!

Well I can tell you the simulation message I believe to be the same for both, the 1995 I was looking at today with LT1 CCM, still read the Coolant etc data, so I wonder if there is an initial handshake for the LT5 vs L98. looking at the wiring I don't think htere is anything else to specify engine model.

[NomakeWan]

Well I can tell you the simulation message I believe to be the same for both, the 1995 I was looking at today with LT1 CCM, still read the Coolant etc data, so I wonder if there is an initial handshake for the LT5 vs L98. looking at the wiring I don't think htere is anything else to specify engine model.

It's not wiring, no. The 1995 definition specifically says, and I quote:

"During start-up, the CCM requests and receives information from the PCM or ECM as long as a DTC 41 is not present. This information is compared to configuration information store(d) in the CCM. This determines if the CCM has been programmed for the current vehicle's engine configuration."

"DTC 81 will set when start-up has occurred, a current DTC 41 is not present, and the CCM's stored engine configuration does not match the configuration information received from the PCM or ECM."

The above is in the 1995 service manual. I will note that my Arduino sketch does not trigger DTC 81, so the answer must lie within the $41 reply. If it were anything else, that DTC would set because my sketch is only designed to reply to $40 polls and nothing else. So if the answer were in some other handshake, then I would have experienced DTC 81 while testing the sketch.

[-=Jeff=-]

It's not wiring, no. The 1995 definition specifically says, and I quote:

"During start-up, the CCM requests and receives information from the PCM or ECM as long as a DTC 41 is not present. This information is compared to configuration information store(d) in the CCM. This determines if the CCM has been programmed for the current vehicle's engine configuration."

"DTC 81 will set when start-up has occurred, a current DTC 41 is not present, and the CCM's stored engine configuration does not match the configuration information received from the PCM or ECM."

The above is in the 1995 service manual. I will note that my Arduino sketch does not trigger DTC 81, so the answer must lie within the $41 reply. If it were anything else, that DTC would set because my sketch is only designed to reply to $40 polls and nothing else. So if the answer were in some other handshake, then I would have experienced DTC 81 while testing the sketch.

HUH, interesting.. I assume if I ground the CCM Diag line that will put me in the diagnostic mode and show DTCs on the cluster right? I will double check the FSM and see what DTCs are showing for the Cluster. I know one is the PASSKey.. I have a few more to try to see if I can determine which one it is

That leads me to a brute force Resistor question.. do you need to leave the Resistor Circuit open when 'key' is off waiting for the reset?

[NomakeWan]

HUH, interesting.. I assume if I ground the CCM Diag line that will put me in the diagnostic mode and show DTCs on the cluster right? I will double check the FSM and see what DTCs are showing for the Cluster. I know one is the PASSKey.. I have a few more to try to see if I can determine which one it is

That leads me to a brute force Resistor question.. do you need to leave the Resistor Circuit open when 'key' is off waiting for the reset?

You are correct on the DTC thing, yes.

I don't believe you need to leave the resistor open. I think the timer only sets when you attempt to turn the key to run.

[spfautsch]

I am helping out one close friend with a 1995 LT5 that has a 1995 LT1 CCM. since that was what you guys started with I tried to write that today.

I looked at those bins - what xdf did you use to make that change?

The only difference in the bin you wrote was the unlock enable bit at $B6CA, the LT5 bit was unchanged. It probably wrote that just fine, but the code the module runs checks that at boot every time and if the odometer has > ~100 miles accumulated it clears it immediately, hence the FE there in the two subsequent reads.

Also, you can clear the 'read all ccm memory' parameter as there's really no point in dumping the entire memory every time after programming to verify changes. Makes it a lot easier to look at the eeprom in a hex editor without all the rom and memory.

[-=Jeff=-]

I looked at those bins - what xdf did you use to make that change?

well I thought it was the 94-96 CCM xdf. but clearly it was not.

The only difference in the bin you wrote was the unlock enable bit at $B6CA, the LT5 bit was unchanged. It probably wrote that just fine, but the code the module runs checks that at boot every time and if the odometer has > ~100 miles accumulated it clears it immediately, hence the FF there in the two subsequent reads.

Also, you can clear the 'read all ccm memory' parameter as there's really no point in dumping the entire memory every time after programming to verify changes. Makes it a lot easier to look at the eeprom in a hex editor without all the rom and memory.

I will look at that CCM tonight, I have the CCM, without the car, I was working on it outside and iti s very possible I had the wrong XDF.

so the failure yesterday could have been an IBKEC error.. I did send you a PM I had success with the version you built, I still would like to know if the address I looked at for the LT5 flag in 1990 was correct or not (different than 94)

[spfautsch]

I haven't looked at your 90 bin in any detail but just opened it up using the 94-96 xdf and the manual trans and LT5 bits were set. C68 was also set, but every bin we've looked at had that set. I don't think it was ever cleared even on cars that actually shipped with C60 hvac.

All three bytes related to vats are $01 so that's unusual. Otherwise I see no reason to think any locations are different from the 94-96.

[-=Jeff=-]

I believe they are. I found the VATS in a different spot. the 90 ZR-1 BIN , shows the key value of 14, also in comparing it to the 90_ccm from NomakeWAN, I have reason to believe the data for the flags and VATs are moved, I was look at the HEX for this

Also NomakeWan 90_ccm has a Passkey of 11, so I found it in a different spot followed by an $AA and $55

I also found different locations comparing the 2 for the L98 vs LT5 and manual.. I don't have all of it here with me but will look at it again tonight

[spfautsch]

You're right - the bytes where the 94-96 option bits are happened to be FFs in the 90 so that explains it looking right in tunerpro. It looks like vats starts at $B6F9 and the option bits begin at $B6C9 with the mode 5 enable now at $B6CD. That explains the possible faux pas of setting the unlock bit instead of the LT5 bit at $B6CA.

I suspect we need to figure out where / if there are calibration IDs so we can tell what xdf is needed.

[-=Jeff=-]

You're right - the bytes where the 94-96 option bits are happened to be FFs in the 90 so that explains it looking right in tunerpro. It looks like vats starts at $B6F9 and the option bits begin at $B6C9 with the mode 5 enable now at $B6CD. That explains the possible faux pas of setting the unlock bit instead of the LT5 bit at $B6CA.

I suspect we need to figure out where / if there are calibration IDs so we can tell what xdf is needed.

you mean $B69F not $B6F9 in the 1990 right?

Also 1991 seems to be similar to the 1990

[spfautsch]

Correct $B69F. My second cup of coffee hadn't quite taken effect yet so typing was a struggle.

NomakeWan here's that 910 ohm resistor. My macro photography skills leave something to be desired, but the same location on the 1333 PCM is populated with a 75k ohm.

[NomakeWan]

NomakeWan here's that 910 ohm resistor. My macro photography skills leave something to be desired, but the same location on the 1333 PCM is populated with a 75k ohm.

Bingo!! Thanks so much, that completely clears everything up. So yes, electrically the F-body PCM is a 'bus master', while the Y-body is a 'bus slave'. In a situation where all devices on the line are GM devices using the SXR chip this is irrelevant since the chips can handle the appropriate line controls. But if you introduce a foreign device to the mix, the line level can get wonky if there's no electrical master on the bus. At least, that's what the spec sheet seems to suggest.

[spfautsch]

Exactly. Same reason why I (and others) have reported difficulties logging ALDL data with an 8051 PCM in a Y body. Impedance mismatch.

I've been working on logging some broadcast traffic after reflashing my testbench 1333 with vats enabled. But as luck would have it my laptop decided to do something weird and now after having to pull the (non-removable) battery to revive it, the ctrl keys quit working. Pretty difficult to use as ctrl is the one key I use more than any other save maybe the space bar. :-(