Here's a couple quick pics of the board (click for full res).
Though I also doubt the unit can self program the VIN and options, I have seen mention of a learn procedure for the VATS resistor value over on cf. I guess I'll have a deep reading assignment on my plate when the FSM arrives.
I'm very reluctant to drop $370 on a chinese clone tech2 for fear the only thing I'll learn is that it can't talk to this antique module.
T2 won`t help much. Here is what we have as data.
Now it needs to be cleared what is on the eprom.
I suspect eeprom is stored in the processor, which seem as some variant of 68hc11.
The main bin can be stored to the eprom or inside the processor too.
Noticed some options configuration. Here we might have it at the eprom also.
Someone posted dumps of ccm and I even managed to make a disasembly of them, but couldn`t figure anything specific.
You can read the ccm with flashhack and post the dump too.
Step too. Unsolder the eprom and try to det a dump of it, also put a socket, in case a deeper hackjob will be needed.
We also need to figure what went wrong with the ccm and figure if that consuption is the result of the ccm or something else keeps it alive.
Newer modules have something called go to sleep after predefined time elapsed. Also it sends messages to other modules to wake and sleep them. Something similar might be used here and something might be preventing the ccm to go to low power mode.
Tom H have deeper insight about the vats exchange info between pcm and ccm. It is some password related cycling of some data that is still unclear in the dissasembly.
There was some post somewhere in the corvette forums about repairing ccms, and updating the vins, but was paid top secret stuff. Someone might dig up the threads.
Also adding some datalogging to eehack of that module will not be hard at all, since the stream data is available already. Not so sure about handling dtcs.
Just looked at some diagrams. Freeking complex unit, operating almost anything in the car. Including driving directly the instrument panel.
The 31 32 pins your are reffering are like pins F1 and F2 -battery input. ALso tons of inputs that wake up the module. I guess it goes to sleep when all is quiet, and the car is locked.
Some interesting pin is d6 -diagnostic enable. Goes to DLC terminal 12. Likely when it is grounded or resistored like 4-10kohm it runs some tests.
Thanks kur4o - saved me a bunch of money there. I've done a little bit more searching over at cf and found where they used a tech 2 to dump a PCM and then a tech 1 on the CCM so was suspicious the functionality didn't exist in the newer tool. Looking at the 1, it seems like it needs a memory card for CCM / BCM programming. :-\
I'm looking for the aldl pin to try and dump them on the bench. Then will hook up the original one in car and see if it shows any DTCs. I wasn't seeing the SYS message, but maybe not all DTCs trigger that. I highly doubt that the remanned unit has the same fault as mine, but anything's possible. I'm pretty sure in some model years, leaving the key in the ignition would cause the CCM to never go to sleep.
I noticed a VIN (in two places) in the two dumps NomakeWan posted in the other thread so I'm hoping to find out if the eeprom in the remanned unit has been wiped. It would really suck if the eeprom is integrated with the processor though. I don't see anything that looks like a jtag type pad except for the 5 next to the 28 pin SOIC in the lower right corner. They're just vias to bring those traces to the other plane, but the spacing seems suspiciously uniform.
I wonder if diagnostic enable might be the "magic" pin.
e13 and f12 are the aldl pins.
There is an older 10mb tech2 card that works with older vehicles but needs custom adapter which is 600$ and never managed to run it, So tech1 with the proper cartridge might be the only option.
ALso some dissasembly hacks can reveal all the hidden features.
Why would you care about the vin that is programmed. It is never used between communication between ccm and pcm. It is the correct signal from key and the communication that is handled between pcm and ccm. If key is good. It shoul send the pcm correct signal.
What is more important are the options that are being programmed in the ccm. They might give you troubles.
The 100 miles thing was actually confirmed several times over on Corvette Forums, including by, as I recall, people who had actually worked at GM during the C4's run. As for hard evidence of that as well as the ability to remanufacture CCMs, yes, there is this little tidbit to confirm it:Originally Posted by steveo
ccmreman.jpg
This info can be assumed from several data points. First, the ALDL data request commands for both the PCM and CCM are public information, available right here on Gearhead-EFI's servers. If you sift through those, you will see that the parameters you are asking about are not part of any datastream. Additionally, they are not a part of the $41 datastream. As such, we can infer that the CCM is incapable of querying other modules (such as ECM/PCM) for the data that would be stored in secured locations.
Speaking of, yes, VATS resistor code is stored in the CCM. This value should be a part of the dump I posted, actually; that memory location is only prevented from access if no key (or the incorrect key) is inserted into the ignition. Since I only talk to the car with my car's proper key inserted, it should be there.
Also yes, the odometer is only stored in the CCM.
The three solder pads on the bottom-left appear curious to me. That said, as expected, they don't just point you at what pin you'd need to ground in order to override the EEPROM. That would be an insane security problem. Even I haven't seen any documentation pointing out where this pin would be. I'm sure GM knows, and I'm sure there must be some third-party remanufacturers who know, but I'm afraid I do not.Here's a couple quick pics of the board (click for full res).
Though I also doubt the unit can self program the VIN and options, I have seen mention of a learn procedure for the VATS resistor value over on cf.
As for the VATS relearn procedure, you'll note if you go back and check that those threads were referring to people who had new or remanufactured CCMs installed, and were being told that this procedure had to be done within the first 100 miles.
It's not all that interesting. This is just the normal self-diagnostic pin on the ALDL connector (on a 94-96, this is pin 12, which you then jumper to pin 4, ground). When this pin is grounded, the CCM acts like a Tech 2, allowing the buttons on the dashboard to act as the Tech 2's buttons. Initially it queries ALDL devices for DTCs, then displays any available DTCs on the dashboard. Once DTC display is complete, you can either use the dash buttons to repeat the messages or can also switch modes to clear DTCs or run actuators. This functionality is detailed here: https://tech.corvettecentral.com/201...-trouble-codes
Sadly not.
1990 Corvette (Manual)
1994 Corvette (Automatic)
1995 Corvette (Manual)
Those are all tied together - there's another trace between the right pads on the back side. Holding a light behind the unpainted area around the pads it seems like there might be a trace leaving the right pad in a middle layer, but it dead ends on the visible layers. It reads 40mohm to ground.
I figured that's what it was but haven't been able to look at all the schematics thus far.
I'm interested in knowing if the remanned unit has had the eeprom erased before I connect it to the car. Since I know my vin and how many miles are on mine I'm hoping to be able to extrapolate their location in the dump. Though I'm somewhat worried they used some sort of hash algo on the odometer reading. Edit: and it occurred to me it's probably not stored in units of miles but rather some proprietary GM unit.
Edit: Still no luck with serial data. May have to put it back in the car to troubleshoot.
Last edited by spfautsch; 09-15-2021 at 11:01 PM.
Momentary 12v on key up to the diagnostic pin should put it in boot mode, not ground.
-Carl
Thanks, that helped me make sense of the pin numbering terminology. They're numbered 1-16 right to left, so what I was calling gray 31 & 32 are F1 and 2 and grounds are on E15 and 16. I assume the gray connector is c and d. Maybe the unpopulated 40 pin IDC header is a and b?
I'm not getting anything with only one serial pin connected, so am having to find connectors to add a second.
Oddly, I'm finding when I power up the board without applying power to the CCM1 and CCM3 circuits, the board sometimes comes up in sleep mode, and sometimes doesn't, but seems to go to sleep eventually. Both of the two additional power circuits are unswitched to battery afaik.
Please see below the relevant pages for pinouts related to power supply and ALDL comms.
ccmwiring1.jpgccmwiring2.jpg
1990 Corvette (Manual)
1994 Corvette (Automatic)
1995 Corvette (Manual)
I found the disassembly I made while ago.
The ram is located at $6000-65ff the eeprom is located at $7000-$71ff main code is at 8000-ffff, first part containing some calibration details, than main code.
We have $200 bytes of eeprom.
NomakeWan can you make an updated dump of the ccm you have. Hope thay gathered some mileage, so we can identify some stuff pretty quick, if the eeprom increase at some places.
I think figuring some commands and sequences will not be hard at all when we label the eeprom.
As far as the secret pin. It is most likely connected to the a/d channels of processor and will have some 12v voltage, when grounded it will override something in the code.
Figuring other grounding inputs inputs and tracing the pcb patterns will likely find the secret pin.
Posting Permissions
Reply With Quote
Bookmarks