Corvette CCM Reverse Engineering Anyone?

[Tom H]

While I don't have much to offer to this thread, perhaps this one detail might be of interest. In working with the '97 PCM and I believe all those from '94 up, low power mode is entered by resetting the Power Monitor IC (PMIC). The circuit uses too much current to just stop the CPU. When the PCM wants low power mode it goes into a tight loop: bra *
After the watchdog/cop time out the PMIC doesn't power until it sees ignition voltage.

Any mod to the car that asserts leakage voltage on to the ignition: even a very short pulse will turn on my pcm.

Hope this is of some use.
-Tom

[spfautsch]

Not sure if that's what's employed here, but my interest in identifying the 81848 52 pin IC is because I've traced all the inputs that wake the processor to this chip. It's also handling all the other digital inputs and at least a dozen digital outputs.

Honestly, I'm not 100% confident I haven't already resolved my battery drain issue. I've had the salvage CCM in the car with all fuses in for several days and there's been no noticeable drain. I intend to reinstall the original that has some temporary repair caps installed to see how things pan out.

At this point my priority is to try and locate the reman pin and hope we can learn how to reprogram these units because it seems like the number of dealers / individuals that have the equipment and expertise to reprogram them is dwindling. Repairing them also seems a tall order - most of the solid state stuff on the board is Delco branded, making cross references a major pita.

[kur4o]

81848 can be referred as a ccm TPU unit. There is some shared memory within the 3-4000$ range where I traced one of the input to main code.

I suspect most of the input- outputs are handled by this chip and send to main cpu via shared memory region.

[spfautsch]

Let's call it IC "C" for brevity.

I was sort of hoping for a cross reference with possibly a datasheet. But I've traced everything out except 6 pins that have vias underneath the chip. I'm leaning towards this being SPI because it has four lines direct to the cpu pins 22 (miso), 23 (mosi), 24 (sck) and 31 (pa3 - assuming device select).

It appears to have 40 general purpose i/o pins, 12 are used as outputs and I've traced the other 27 back to sources, verified, etc. The inputs labeled feedback I assume are for open circuit detection. I'll continue to work on pin 10, but here's where I think most of these registers map to in (what I assume is) ram.

inputs:           register bit:
 8 ign3 (e4)                  8
 9 ign1 (e5)                  7
10 unknown (via under chip)   6
11 park lights on (d14)       5
12 disarm utd (d15)           4
13 r door sw (d16)            3
14 l door sw (c12)            2
15 key in sw (c11)            1 $6449
16 hatch sw (c10)             8
17 unlock ckt (c5)            7
18 lock ckt (c4)              6
19 arm utd (c3)               5
20 defrost req (d5)           4
21 diag mode (d6)             3
22 unused (d7)                2
23 oil float sw (f8)          1 $6448
24 turn flasher (f9)          8
25 seat belt sw (f10)         7
26 hi beam (f15)              6
27 unused (e14)               5
28 m clock feedback           4
29 data strobe feedback       3
30 data clock feedback        2
31 lcd data feedback          1 $6447
32 lcd blanking feedback      8
33 courtesy lamp feedback     7
34 defog control feedback     6
35 horn feedback              5

outputs:
36 low oil lamp (d13)         4
37 courtesy lamps (d12)       3
38 lcd blanking (d11)         2
39 rear defog (d10)           1 $6446
40 horn (c16)                 8
41 chime 2 (c15)              7
42 chime 1 (c14)              6
43 seat belt lamp (c13)       5
44 check gauges lamp (c9)     4
45 change oil lamp (c8)       3
46 door ajar lamp (c7)        2
47 security lamp (c6)         1 $????

It took a while to confirm $6446-$6449 because when messing with inputs, outputs become affected i.e. closing either door switch causes the courtesy lights to turn on. Likewise, when commanding outputs, some of the feedback pins change state as well.

To jump straight to the chase, I don't think the reman pin is coming in this ic. The only input not accounted for is VSS, which I believe is handled by the cpu.

I know quite a bit more but will only give generalizations now. All 8 adc inputs to the cpu seem to be accounted for. There's an unused one that would connect to E8 if the components were present. I think this is to accomodate another light sensor for a DRL option that I believe was only sold in Canada. The LCD outputs are all driven directly by the cpu pins PA4-PA7.

The other PLCC52 chip labeled 'delco 16126532' which I'll refer to as ic "B" appears to handle all the PWM outputs, but that's about all I've had a chance to trace down. My guess is that it does use shared ram due to the number of lines it shares with the uveprom and what I believe is a dram chip labeled 'delco 16089396'.

[kur4o]

You got that right. It must be spi since There is some spi routine that seems do nothing. I guess some data is exchanged between the chips, or some initialization is commanded. Which means cpu can command the IC "C" with re configuration on the fly.

You did some pretty good hacking job already. Maybe I can try to map the data with disassembly and will get really good sense of some of the stuff.

[spfautsch]

If you hold off another day or so before investing a bunch of effort, I just started working on tracing out the remaining cpu pins.

I was able to trace out all except pin 3 of chip c. Pin 10 seems to be a feedback circuit for the starter relay. The rest seem to be related to system reset and interrupts.

[spfautsch]

Well that didn't take long.

I've already documented the ADC inputs to the cpu.

The memory data lines consume all 8 expansion bus pins, 9-16. Only 7 of the 8 address bus pins are used, leaving PB7 / pin 35 open for other purposes.

Reset and the two interrupts, as well as the rx and tx pins are accounted for. 22-24 are used by SPI, as well as PA3 / 31 which is apparently used as chip select for SPI.

The LCD is driven directly by PA7 / 27 through PA4 / 30.

This only leaves PD5 / 25 and pins 32-35 unaccounted. 32, 33 and 35 appear to be related to some sort of serial / i2c bus that ties to the two most centered SOIC16 chips. 34 heads over towards the other SOIC16 chip between the crystal and the big red capacitor. The part # on this seems to cross to a TI CD4555B which is described as a dual binary to 1-of-4 decoder. This would essentially take 3 inputs and turn them into 8 outputs. Pin 25 is the only one that looks interesting here, and it's connected with an under-chip via so I'll have to break out the soldering iron again to determine whether this is connected.

I'm going to take a break for a few hours, possibly days and you know, shave, shower, etc.

This appears to be a 3 layer pcb, and there are some traces that are particularly hard to locate with "mortal" tools. It may warrant some potentially destructive forensics such as removing the PLCC52 packaged ICs, xray photography, etc.

On the good news side, it appears my battery drain issue seems to be resolved. I just started it and let it warm up until closed loop for the first time in almost a month. Hopefully it can sit for a couple weeks without killing the battery (dammit, the weather is nice and it would be fun to drive). Unfortunately I'm reluctant to put the car back to a drive-able state because it may be useful having access to the CCM module / wiring. I'd simply re-locate it, but I've seen mention that the external / female connector bodies are no longer in production / available.

If there's any documentation anyone would care to share / point me towards I'm ready to read. It seems like it's time to discover what the module wants to talk about with brute force. I've controlled a bunch of outputs based on the discovery NomakeWan posted over in the flashhack discussion, but I'd like to start finding out about the ADC registers, software version, whatever the module wants to tell me without dumping the entire memory range.