Corvette CCM Reverse Engineering Anyone?

[-=Jeff=-]

at this point, it is probably easier to work through my harness to get he wires I want as all the connectors are there..

[-=Jeff=-]

I am getting data on the serial bus but having this issue:

Reconnecting to ALDL bus, please wait....
ERROR! The bus is still noisy (retry)...
ERROR! The bus is still noisy (retry)...
ERROR! The bus is still noisy (retry)...
ERROR! Could not become the ALDL bus master.
ERROR! Error reading segment 0[40]
ERROR! Could not complete read procedure.

how do I get it not noisy?

[NomakeWan]

According to the source code for flashhack, those error messages in that order will be sent if no bus master is found within 5 seconds, and yet there is still data on the line every half-second for three retries.

What is likely happening here is that you did not power up the CCM in the proper sequence, and so it is not sending the proper bus master heartbeat message (which starts with F0, and is the "CCM requesting the presence of external bus master" call).

On my wiring layout I posted earlier, you'll notice two of the entries say "when key is inserted into cylinder" and "when key is turned to run position." These mean exactly as I wrote. You do not connect them until the rest are connected. Then you first "insert the key" by connecting C11 to ground, followed by "turning the key" by connecting both E4 and E5 to +12V. Doing this should tell the CCM that it should run the power on sequence, which will start broadcasting F0 diagnostic messages. It's this message which Flashhack looks for in order to become the bus master.

If you just power the CCM up but don't follow the correct sequence, it will broadcast its normal status request messages ($40 and $10) but will not broadcast the bus master request message (F0).

[-=Jeff=-]

Yeah that is.. lol, I was going to add switches, now I will have to.

Also turns out I think the 3 spares are 1-1990, 1-1991 and 1-1992

Will know when I get them scanned

I also have a harness to connect the cluster in my bench

[-=Jeff=-]

I still must be doing it wrong.. here is what you had earlier:
GRAY Connector
C1 Ground
C11 Ground (when key is inserted into cylinder)

GREEN Connector
E4 & E5 +12V (when key is turned to run position)
E12 to F5 PASSkey Resistor Value (VATS)
F1 +12V
F12 ALDL

SO, do I apply the 12v Last?

Right now my sequence is:

F1 - 12v C1 GND
C11 to ground
E4 and E5 12v
then try ALDL

I don't have the VATS code for this unit

[NomakeWan]

I still must be doing it wrong.. here is what you had earlier:
GRAY Connector
C1 Ground
C11 Ground (when key is inserted into cylinder)

GREEN Connector
E4 & E5 +12V (when key is turned to run position)
E12 to F5 PASSkey Resistor Value (VATS)
F1 +12V
F12 ALDL

SO, do I apply the 12v Last?

Right now my sequence is:

F1 - 12v C1 GND
C11 to ground
E4 and E5 12v
then try ALDL

I don't have the VATS code for this unit

Disclaimer that I haven't bench-tested one of these units, and when steveo bench-tested his, he had an ECM to plug into it and had the ECM reprogrammed to send a specific bus message to make the CCM happy. I personally don't believe that's necessary because a reman facility likely wouldn't have that available. So I believe the issue is in the sequencing.

That said, your sequencing looks correct for what I would assume is necessary. It is possible that not having the right PASSkey resistor value is causing this issue, but the documentation for the 1990 CCM seems to imply that you will still be able to query the CCM, you just won't be able to access the memory locations that store PASSkey information.

I won't be able to test it right this second, but likely tomorrow I may be able to test idle data messages on a CCM without the appropriate PASSkey and no ECM on the serial data bus. I'll just unplug my ECM's blue connector and then unplug the VATS harness from under the steering wheel, then turn the key to run and watch the idle messages.

And not having the right resistor isn't a big deal on a bench. VATS has a 4-minute timer. So try the resistance value for #1. Doesn't work, wait 5 minutes, then try #2. Rinse and repeat until you hit the right one.

To make it easier, you can connect a bulb to the security light output on the CCM. Wire the bulb between C6 and F2. If the security light comes on solid when you apply +12V to E4+E5, it's the wrong PASSkey and you have to wait 5 minutes. If the security light doesn't come on at all when you apply +12V to E4+E5, you found the right value.

Aren't GM cars great?



EDIT: Try killing the ground signal to C11 at the same time you apply +12V to E4 and E5. Had a look at my FSM as a sanity-check and in fact the C11 ground input states, "Key-in ignition switch is grounded with key inserted and ignition in 'off' or 'accessory' position" which implies that it will not be grounded when the key is turned to 'run'.

[-=Jeff=-]

Well I have a CCM I believe I know the PASSkey

I have a cluster connected and Security is solid.

I will need to program one out of car, but will know the PASSkey. Let me try that next

I have an ECM and I assume all it needs is power and Serial. I can do that next.

[-=Jeff=-]

Here are some CCM p/n:
1990 - 16146688 or 16138909
1991 - 16155502
1992 - 16193458, 88999216, 16159188, 16159191
1993 - 16193458, 88999216, 16159188, 16159191

[cruiserbrett]

I read through a lot of this thread during the last two days and wanted to compliment the efforts! Awesome. I love the efforts to map so much of the functions D50FB5E1-3F5A-4A40-8A5A-1A824C38234C.jpgof the CCM, and I don’t even have a corvette. I wish I had 1/50th the skill set here-I want to make the ‘8708 run Two injector tbi, but just can’t figure out how to map registers.

I don’t have much to add to this thread, but if the green 32 pin connector needed is 12089591, I have a yellow version.

Happy to send out a few to anyone in need to further this effort.

[-=Jeff=-]

NomakeWan,

I used your demo code you posted, I think it worked but not sure, however I was able to capture a bin from one of the 1992 CCMs. I have worked through about 5 PASSKey codes but no luck yet. Reason I say I am not sure the demo code worked for me is that my cluster was still showing a SYS on the LCD. but the BIN Dump is Legit. I just need to figure out the PASSKey.

I used the picture found in this thread showing how to connect the diode and resistor, which looked to be a 1K. so I think it was correct.

next plan is to add another Port and grab the RX to see the data. EDIT = this will use the 94-95 xdf. the 90-91 is different

[NomakeWan]

NomakeWan,

I used your demo code you posted, I think it worked but not sure, however I was able to capture a bin from one of the 1992 CCMs. I have worked through about 5 PASSKey codes but no luck yet. Reason I say I am not sure the demo code worked for me is that my cluster was still showing a SYS on the LCD. but the BIN Dump is Legit. I just need to figure out the PASSKey.

Your dash showed SYS because you have TONS of other componentry that the CCM expects to be there which just plain isn't. If you were to jump the service connector to read codes, you'd find the CCM codes would be all things like "HVAC LED CIRCUIT OPEN" and "PHOTODIODE CIRCUIT OPEN" and things like that.

The way to know if it worked is just to look at the raw data on the bus while it's idle. If you see bus messages starting with F0, then you're active. The fact that you were able to dump the BIN suggests that was the case.

EDIT: CCM does have a code for "PASSkey invalid key detected," so that'll throw SYS as well.

[-=Jeff=-]

Yes I have some missing.. I always thought the SYS a basic comm error. I will look through some data tomorrow.

My bench has a cluster with all wires that go to CCM wired. I did the same with the DIC, I can cycle through things. Just not sure why my second CCM won't read.. will
Do more later this week

[NomakeWan]

Think of "SYS" like the Service Engine Soon light, except for the CCM instead of the ECM.

[-=Jeff=-]

Think of "SYS" like the Service Engine Soon light, except for the CCM instead of the ECM.

Yeah I should probably fix that, I know a few resistors will fix it, same error occurs (HVAC LED CIRCUIT OPEN) with an aftermarket radio and C60 HVAC.

I bought a 1991 CCM today, I have some other ideas for it, but will need to find the VATS code on it.

Back to the 1992 CCM and the MEGA Arduino code. I did a quick look and did not see and F0, but I agree that it must have worked. However, I would have expected to see the data not be ZERO on the cluster, maybe it will not show because of the SYS light

I may have time to mess with it tonight as I really want to try and get the VATS info.

Looked at your code again.. it is only processing the 0x40 and 0x41 messaging. I would need to add the F0 message wouldn't I? If so, where is that info.. that code is Polling, but it looks like we need the 'master request'?

[NomakeWan]

Yeah I should probably fix that, I know a few resistors will fix it, same error occurs (HVAC LED CIRCUIT OPEN) with an aftermarket radio and C60 HVAC.

I bought a 1991 CCM today, I have some other ideas for it, but will need to find the VATS code on it.

Back to the 1992 CCM and the MEGA Arduino code. I did a quick look and did not see and F0, but I agree that it must have worked. However, I would have expected to see the data not be ZERO on the cluster, maybe it will not show because of the SYS light

I may have time to mess with it tonight as I really want to try and get the VATS info.

Looked at your code again.. it is only processing the 0x40 and 0x41 messaging. I would need to add the F0 message wouldn't I? If so, where is that info.. that code is Polling, but it looks like we need the 'master request'?

F0 is "CCM is requesting the presence of external devices" and is the "heartbeat" call for connecting to a Corvette data bus. The CCM makes this call by itself. If you reply to this F0 call with an F1 call ("External device requesting control of CCM"), that gets you in business.

On the Corvette, the only interaction the CCM has with the ECM as far as data goes is a call/response for specific pieces of data. The CCM makes a $40 call, which is a request to the ECM for that specific datagram (on the 90 it is literally just 40 55 6B, which is Datagram-Length-Checksum; on the 92-96 there is also a handshake that we do not fully understand added). If the ECM is online, it accepts this $40 call and responds with $41, which is the datagram containing all the information the CCM wants. It is this $41 call that my code is able to emulate. I detect the incoming call and respond accordingly.

My code is designed to work properly on a 1994-1996 CCM the way it was written. If you are using it on a 1992 CCM, please be sure that all the appropriate values have been changed per the instructions in the header. The 1992-1993 CCM uses a shorter response than the 1994-1995 does, but listens for the same handshake. The 90 of course has a shorter handshake it listens for, and a shorter $41 response.