Thank you, that's a big help. I have already decoded the complete $AE $01 suite of commands. If I find any missing from your info I will post them. Your file also has other commands in the $AE $02 and $03 range. Those are the ones I am after.Originally Posted by kur4o
Again, thanks -Tom
I have a question for those more used to working on LT1s with pro tools... There is a built in test that permits the user to pulse/disable injectors. As part of that, the user can set the a/f ratio. How do the pro tools use this. I expect that injectors are disabled in sequence to find a dead cylinder (?). Perhaps the commanded a/f ratio is used to stop feedback from O2s that will detect excess air (from the un-fueled cyl) in the exhaust. If someone could describe the test and give details about the intent/result it would be interesting for me.
Still a bit unsure about the following. I have done no testing with the A/F ratio part. I have disabled each injector and seen that work on my scope. The testing is triggered by the following j1850 sequence:
4C 10 F0 AE 02 00 00 20 00 00 xx <CRC>
xx =
00 NONE
01 CYLINDER 1
02 CYLINDER 2
04 CYLINDER 3
08 CYLINDER 4
10 CYLINDER 5
20 CYLINDER 6
40 CYLINDER 7
80 CYLINDER 8
FF ALL
4C 10 F0 AE 02 00 00 60 00 00 xx <CRC>
xx =
commanded a/f
When I get completed there will be a post about all the supported mode $AE commands (or most of them). I am not knowledgeable on auto trans and the whole sub-mode $03 is a/t might need some help there also.
-Tom
Some errors above...
4C 10 F0 AE 02 00 00 20 00 00 xx <CRC> sets afr
4C 10 F0 AE 02 00 00 60 00 00 xx <CRC> sets disabled cyls
more on the way...
I still hope to hear from someone who has experience with pro tools that use to suspend an injector. I think it works like this, but...
you read from the PCM it's calculated a/f ratio. Then send the command a/f ratio to that value. Then send a sequence of disable injector commands.
This sequence would prevent the PCM from compensating for the extra air sent down the exhaust by fixing the a/f. Disable each injector in turn and note rpm loss. A dead cylinder would not change the rpm. Other ideas?
----------
Spark timing can be changed using mode $AE submode $02. Command is: 4C 10 F0 AE 02 00 00 04 00 NN 00 where NN is the timing you are requesting.
Edit post---
enter NN of $00 for -64 degrees, $80 for 0degrees and $FF for +63.5 degrees
---
With most (all?) mode AE commands, the PCM must be conditioned with a $A8 command first. These commands have a timeout unless the A8 is re-issued every few seconds.
There are just a bunch of commands, not sure what use they all are but I am working through testing them. Hope to post a list soon. Mode $AE Submode $03 are a bit of a problem for me to go through. First up they are all automatic trans related and my bench is set for manual. Second, I don't know much about automatic. I will look around the web to see if I can find a manual for a a/t diagnostic tool. That should give me an idea what to look for.
-Tom
Last edited by Tom H; 07-27-2021 at 09:23 PM.
Interesting to look as the similarities and differences between your command collection and what I find for '97...
Later PCM
----------
FUEL GAUGE
6C 10 F1 AE 02 40 1A 00 00 00 00 D4 10%
6C 10 F1 AE 02 40 33 00 00 00 00 08 20%
6C 10 F1 AE 02 40 4D 00 00 00 00 AE 30%
6C 10 F1 AE 02 40 66 00 00 00 00 A6 40%
6C 10 F1 AE 02 40 80 00 00 00 00 BA 50%
'97 PCM
--------
4C 10 F0 AE 02 40 00 00 00 00 00 <CRC>
In the '97 code mode $ae submode $40 has no other parameters and I believe is used to clear out the short term fuel trim table (both left and right).
code is
Not completely figured out yet but mostly there. I will continue next post ...Code:BANK0:7040 BANK0:7040 loc_7040: ; CODE XREF: VEC_OUTPUT_CMP2+326j BANK0:7040 ; VEC_OUTPUT_CMP2+335j BANK0:7040 ldaa M$AES$02P$00 ; M$AE PID $02 PARAM 0 BANK0:7043 bita #$40 BANK0:7045 beq loc_7060 BANK0:7045 BANK0:7047 brset <byte_7D $04 loc_7063 ; BIT 01 BANK0:7047 ; BIT 02 BANK0:7047 ; BIT 04 BANK0:7047 ; BIT 08 BANK0:7047 ; BIT 10 BANK0:7047 ; BIT 20 BANK0:7047 ; BIT 40 TX MESSAGE IN PROGRESS BANK0:7047 ; BIT 80 DISABLE BACKGROUND MESSAGES BANK0:7047 ; BANK0:7047 BANK0:704B bset <byte_7D $04 ; BIT 01 BANK0:704B ; BIT 02 BANK0:704B ; BIT 04 BANK0:704B ; BIT 08 BANK0:704B ; BIT 10 BANK0:704B ; BIT 20 BANK0:704B ; BIT 40 TX MESSAGE IN PROGRESS BANK0:704B ; BIT 80 DISABLE BACKGROUND MESSAGES BANK0:704B ; BANK0:704E ldaa #$80 ; CENTER FOR SHORT TERM FUEL TRIM BANK0:7050 ldx #$0026 BANK0:7050 BANK0:7053 BANK0:7053 loc_7053: ; CODE XREF: VEC_OUTPUT_CMP2+350j BANK0:7053 staa $23,x ; CLEAR TABLE TOP DOWN BANK0:7055 dex ; $0049 THROUGH $0024 BANK0:7056 bne loc_7053 ; LOOP CLEARING SHORT TERM FUEL TRIM SETTINGS BANK0:7056 BANK0:7058 staa STFT_B1 ; B1 (LEFT) SHORT TERM FUEL TRIM BANK0:705B staa STFT_B2 ; B2 (RIGHT) SHORT TERM FUEL TRIM BANK0:705E bra loc_7063
-Tom
Later PCM
----------
??? pwd ID
6C 10 F1 AE 02 80 [XX] 00 00 00 00
'97 PCM
--------
4C 10 F0 AE 02 80 00 00 00 00 00
In the '97 code mode $ae submode $80 has no other parameters and I believe is used to center the IAC.
Code is:
Code:BANK0:7025 loc_7025: ; CODE XREF: VEC_OUTPUT_CMP2:loc_701Ej BANK0:7025 ldaa M$AES$02P$00 ; M$AE PID $02 PARAM 0 BANK0:7028 bita #$80 BANK0:702A beq loc_703D BANK0:702A BANK0:702C brset <byte_7D $02 loc_7040 ; BIT 01 BANK0:702C ; BIT 02 BANK0:702C ; BIT 04 BANK0:702C ; BIT 08 BANK0:702C ; BIT 10 BANK0:702C ; BIT 20 BANK0:702C ; BIT 40 TX MESSAGE IN PROGRESS BANK0:702C ; BIT 80 DISABLE BACKGROUND MESSAGES BANK0:702C ; BANK0:702C BANK0:7030 bset <byte_7D $02 ; BIT 01 BANK0:7030 ; BIT 02 BANK0:7030 ; BIT 04 BANK0:7030 ; BIT 08 BANK0:7030 ; BIT 10 BANK0:7030 ; BIT 20 BANK0:7030 ; BIT 40 TX MESSAGE IN PROGRESS BANK0:7030 ; BIT 80 DISABLE BACKGROUND MESSAGES BANK0:7030 ; BANK0:7033 bset <byte_B7 $04 ; BIT 01 BANK0:7033 ; BIT 02 GEAR CHANGE IAC STEPS ACTIVE BANK0:7033 ; BIT 04 BANK0:7033 ; BIT 08 IAC TIMEOUT STEPS TIMER EXPIRED BANK0:7033 ; BIT 10 PARK/NEUTRAL SELECTED PREVIOUS STATE BANK0:7033 ; BIT 20 BANK0:7033 ; BIT 40 IAC LOW SPEED CONDITIONS ?? VEHICLE MOVING ?? BANK0:7033 ; BIT 80 AUTO TRANS PARK/NEUTRAL SELECTED FLAG BANK0:7033 ; BANK0:7036 ldab #$FF BANK0:7038 stab IAC_POSITION ; IAC MOTOR POSITION BANK0:703B bra loc_7040
The idle air control system is quite complex. There are a bunch of things relating to shifting of automatic trans from neutral to in gear, air conditioning, perhaps power steering load, various test controls. Also to be considered is the timing of the outputs to the motor. Each step needs to be sent and then a delay before the next step. This is needed to let the motor catch up with the applied state. It is going to take some effort to sort through all this.
-Tom
Usually when a cylinder is cut the tool monitors increase in map and drop in rpm, to figure if the cylinder is producing less power. High increase in map indicates strong cylinder. No change indicates bad cylinder.
It can be hardbuilt in code, that whenever a cylinder is disabled the pcm commands Open loop. In earier code when a cylinder is disabled you cannot change or command afr. The command is exclusive to each other. There might be something similar in the later code.
It is more than likely there will be some commands that are not present throughout the years. For example 97 can`t command fuel gauge, because there is not such an option built in the pcm.
Automatic trans have some simple commands for solenoids and line pressure. Most are simple on/off. Some pwm solenoids can be commanded with different pwm%.
An OBDII question for you all...
My PCM supports Mode $19 requests. Request is four bytes format like:
This all looks a lot like the Mode $18 listed in SAE J2190 -> in fact so much the same I wonder if some thing changed along the way or ??Code:BANK0:CF01 ************************************************* BANK0:CF01 * MODE $19: REQUEST DTCS BY STATUS BANK0:CF01 * REQUESTS H0,H1,H2,$19,$XX,$FF,$00 RETURN DTCS BANK0:CF01 * H0,H1,H2,$19,$XX,$FF,$FF COUNT OF DTC BANK0:CF01 * BANK0:CF01 * STATUS IS XX --> ANY/ALL OF THE BITS ORED TOGETHER BANK0:CF01 * $80 - MIL ILLUMINATED BANK0:CF01 * $40 - MIL PENDING BANK0:CF01 * $20 - MIL PREVIOUSLY ILLUMINATED -OLD CODE BANK0:CF01 * $10 - STORED TROUBLE CODE (FREEZE FRAMD DATA AVAILABLE) BANK0:CF01 * $08 - GM SPECIFIC STATUS 1 BANK0:CF01 * $04 - GM SPECIFIC STATUS 0 BANK0:CF01 * $02 - CURRENT DTC CODE BANK0:CF01 * $01 - IMMATURE DTC CODE BANK0:CF01 *************************************************
Can anyone tell me where Mode $19 is speced or any details? If you have the document, that would be icing on the cake.
Thanks,
-Tom
Hi Tom,
I'm not 100% positive but I think that is retrieval of permanent dtc codes stored in non-volatile memory. I don't have any info
-Carl
From the look of the code, it seems that just like mode $18 it filters by group:Hi Tom,
I'm not 100% positive but I think that is retrieval of permanent dtc codes stored in non-volatile memory. I don't have any info
PCM
Chassis
Body
Undefined
All
and by DTC status:
Warning lamp illuminated for this code
Warning lamp pending for this code, not illuminate but malfunction was detected
Warning lamp was previously illuminated for this code, malfunction not currently detected, code not yet erased
Stored trouble code
Manufacturer specific status
Manufacturer specific status
Current code - present at time of request
Maturing/intermittent code - insufficient data to consider as a malfunction
There are just a few references to this mode on the web, but nothing specific. Wonder if later cars use mode $19 (?)
-Tom
Working through the code int the '97 LT1, at some point you are going need a good understanding of OBDII. I do not claim to have all the answers, but this is my starting point. I spent a career designing data comm hardware, so it is natural for me to look at the system through the OSI (Open System Interconnect) model.
Layer SAE standard Covers
--------------------------------------------------------------------
Layer 1 Physical layer J1850 Bits, voltages, time
J1962 Connector
Layer 2 Data link layer J1850 Header, symbols
J2178
Layer 3 Network layer
Layer 4 Transport layer
Layer 5 Session layer
Layer 6 Presentation layer
Layer 7 Application layer J1978 Messages, filtering, response
J2190
For the most part, folks interested in tuning need not concern with physical details. They are covered by the Data Link Controller (DLC) which is a 68HC58 in this PCM and the connector, connector pin out and so on are all standardized by the GM design. If you want details of the DLC electrical interface, I posted a schematic with most of the details earlier. Just a very few details are of interest here working with the software. The DLC MC68HC58 IC marked 20686 is clocked with a 4.0MHZ ceramic resonator. This will help make sense of some of the initialization code. The DLC is interfaced in parallel mode and uses two locations $1060 and $1061. These locations are multiplexed to provide all the required access. A quick web search will turn up the data sheet you will need if you want to investigate bit level use of this chip.
In this post I won't dwell much on the setup of the DLC, other than to point out that the DLC is polled not interrupt driven. The '97 PCM provides for an interrupt capability, but this is not used in production code. The production code services the Data Link Controller (DLC) interrupts with code that just turns off the interrupt.
Skipping over the electrical and bus level details brings us to software, specifically how PCM code interacts with the DLC. The code detailed here is specific to just a few years/models but may be of interest to folks looking at later code. If nothing else, details of the type of concerns that the coders had could be of interest. I found many examples where the code is checking to ensure the vehicle is not moving or that the engine is not turning (even if it is off).
In my case, I began by messing around with an ELM327 based connection to my PC over USB. I was happy with this until it was uncovered that:
- GM uses a 4X mode at times that ELM327 does not support
- The ELM327 forces a request/response operation
- The ELM327 forces adherence to the J1850 standard and does not permit long frames
- Getting a driver to use this module is a PIA, I made it work but...
There are probably other shortcomings as well. I was not able to find a way to easily download the PCM using this module. If your goal is to debug a problem you *might* get away with one of these cheap units however if your goal is to tune there exist cables and software that permit this. As always you get what you pay for.
The OBDII code in most modes has a request/response format. That is to say, info (or action) is requested and a single response frame is generated. There are some requests however that have multiple responses. An example of this is a request for freeze frame data. A request for freeze frame data will result in 23 or 138 frames of data. A warning to anyone still using an ELM327 type interface... depending on timer settings, most or all of these frames will be lost. It is just beyond the capabilities of that device. I coded my own interface using an Arduino Nano to be sure that all the details were understood, but many good interface cables exist. I have not tried them, so there are no suggestions or recommendations here.
For the most part just a few standards control the details of interest to tuners. J1979 spec sets up functional communications while J2190 spec sets up the physical communications. In '97 there is only one device communicating with the tester equipment. This makes the difference between physical and functional frames quite small. J2178 discusses the differences, but for my purpose I will just discuss what has been done on this PCM and leave other analysis to those with that interest.
OK, so that's all the lead in/boiler plate/intro stuff out of the way. Let's focus on the different commands that testers can issue to find details of problems and/or tune. As mentioned in the previous paragraph there are two comms modes used: functional and physical. We will start with the functional as set out in J1979
Headers
-------
There are two headers of interest to us. Skipping through all the details of various J1850 headers that can be supported to focus on those that are supported. GM uses a three byte consolidated header. Upper three bits are priority which are don't care on a bus with only two devices. In-frame responses are not used. For my purpose here I will use one of three headers:
Functional: $48 $6A $F0
Physical TSide: $4C $10 $F0
Physical ESide: $4C $18 $F0
Functional modes
----------------
The '97 PCM supports functional modes 1 through 7 defined in the standard:
MODE $01, REQUEST CURRENT POWERTRAIN DIAGNOSTIC DATA
MODE $02, REQUEST POWERTRAIN FREEZE FRAME DATA
MODE $03, REQUEST POWERTRAIN DIAGNOSTIC TROUBLE CODES
MODE $04, REQUEST CLEAR/RESET DIAGNOSTIC TROUBLE CODES
MODE $05, REQUEST OXYGEN SENSOR MONITORING TEST RESULTS
MODE $06, REQUEST ONBOARD MONITORING TEST RESULTS
MODE $07, REQUEST PENDING TROUBLE CODES
Mode $01
--------
This mode requests current powertrain diagnostic data and uses a functional header. The format used is:
$48 $6A $F0 $01 <Truncated_PID>
The truncated pid is any pid in which the first two digits are 00. This means that all PIDs that are not within the first 256 can not use this mode. The higher value PIDs are accessed using other modes and physical addressing. Those are detailed here later. PIDs that can be used with this mode are:
Tru Result
PID
--- ------
$00 SUPPORTED PID $01 - $20, BIT MAP FLASH CONST $BFBFF990
$01 NUMBER OF EMISSION-RELATED TROUBLE CODES AND MIL STATUS
$03 FUEL SYSTEM STATUS:
$04 ROUTINE:CALCULATED LOAD VALUE: 0% TO 100%
$05 ENGINE COOLANT TEMPERATURE: -40C TO 215C
$06 LEFT SHORT TERM FUEL TRIM: -100% (LEAN) TO 99.22% (RICH)
$07 LEFT LONG TERM FUEL TRIM: -100% (LEAN) TO 99.22% (RICH)
$08 RIGHT SHORT TERM FUEL TRIM: -100% (LEAN) TO 99.22% (RICH)
$09 RIGHT LONG TERM FUEL TRIM: -100% (LEAN) TO 99.22% (RICH)
$0B MANIFOLD ABSOLUTE PRESSURE: 0KPA TO 255KPA
$0C ENGINE RPM HIGH RES (RPM X 4): 0 TO 16383.75 RPM
$0D SPEED IN KPH: 0 TO 255 KPH
$0E ROUTINE: IGNITION TIMING: -64 TO +63.5 DEGREES
$0F INTAKE AIR TEMPERATURE: -40C TO 215C
$10 MASS AIR FLOW: G/SEC: 0GM/S TO 655.35GM/S
$11 THROTTLE POSITION SENSOR: 0% TO 100%
$12 COMMANDED SECOND AIR
$13 O2 SENSOR CONFIGURATION: $33 = 2 SENSORS/BANK
$14 O2 B1S1 VOLTAGE: 0 TO 1 VOLT: SHORT TERM FUEL TRIM
$15 O2 B1S2 VOLTAGE: 0 TO 1 VOLT: $FF
$18 O2 B2S1 VOLTAGE: 0 TO 1 VOLT: SHORT TERM FUEL TRIM
$19 O2 B2S2 VOLTAGE: 0 TO 1 VOLT: $FF
$1C OBD II TYPE: $01
Here are some examples from my bench PCM
\B 48 6A F0 01 00 59 \E Request: SUPPORTED PID $01 - $20
\B 48 6B 10 41 00 BF BF F9 90 B5 \E
\B 48 6A F0 01 03 7E \E Request: FUEL SYSTEM STATUS
\B 48 6B 10 41 03 01 01 84 \E
\B 48 6A F0 01 05 30 \E Request: ENGINE COOLANT TEMPERATURE
\B 48 6B 10 41 05 00 90 \E
The response header: echos the priority of the request, targets the functional response, sources from the TSide. The response data has variable width depending on the PID requested.
Mode $02
--------
This mode requests powertrain freeze frame data and use a functional header. The format used is:
$48 $6A $F0 $02 <PID> <Frame_number>
PIDs $00 and $01 are supported.
This PCM responds only to frame number $00.
Here are some examples from my bench PCM
\B 48 6A F0 02 00 00 9C \E Request: Supported pid
\B 48 6B 10 42 00 00 7F B9 80 00 DC \E
\B 48 6A F0 02 02 00 04 \E
\B 48 6B 10 42 02 00 00 00 89 \E Request: PID that caused the freeze (in this case none)
Supported PIDs are bit mapped: Starting from the MSB of the first data (7F in this case), moving from MSB through LSB, support is as follows:
Supported are PID
A 02, 03, 04, 05, 06, 07, 08,
B 09, 0B, 0C, 0D, 10,
C 11,
D
Mode $03
--------
This mode requests emission related powertrain diagnostic trouble codes
On my work bench I forced TPS out of range and requested mode 3:
\B 48 6A F0 03 CB \E
\B 48 6B 10 43 01 22 00 00 00 00 E3 \E
The response here is P0122 which is: P0122 THROTTLE POSITION SENSOR CIRCUIT LOW VOLTAGE
Mode $04
--------
This mode requests clearing of DTCs, freeze data, and other on board testing results.
On my bench:
\B 48 6A F0 04 98 \E Request to clear all
\B 48 6B 10 44 52 \E
In my case, the TPS fault will still show up because it is registered with the system right when it happens.
Mode $05
--------
This mode requests results of O2 monitoring.
Inputs to mode $05 are test_id (TID) and O2_sensor number (O2).
Valid test IDs are:
TID $00 SUPPORTED TIDs $01 THRU $20
TID $01 RICH TO LEAN SENSOR THRESHOLD VOLTAGE
TID $02 LEAN TO RICH SENSOR THRESHOLD VOLTAGE
TID $03 LOW VOLTAGE USED TO CALCULATE PASSAGE TIME
TID $04 HIGH VOLTATE USED TO CALCULATE PASSAGE TIME
TID $05 RICH TO LEAN CALCULATE PASSAGE TIME
TID $06 LEAN TO RICH CALCULATE PASSAGE TIME
TID $20 SUPPORTED TIDs $21 THRU $40
TID $40 SUPPORTED TIDs $41 THRU $60
TID $60 SUPPORTED TIDs $61 THRU $80
TID $70 O2 SENSOR WITH LESS THAN 255 COUNTS
TID $71 O2 SENSOR WITH LESS THAN 255 COUNTS
Valid O2 sensor numbers are:
O2 $01 O2 SENSOR BANK 1 SENSOR 1
O2 $02 O2 SENSOR BANK 1 SENSOR 2
O2 $10 O2 SENSOR BANK 2 SENSOR 1
O2 $20 O2 SENSOR BANK 2 SENSOR 2
"Supported TIDs: are done just like mode $02: First data to last data, MSB to LSB.
At the time I did this, there are no O2 sensor simulators connected. Here is just a sample of invalid results.
\B 48 6A F0 05 01 10 97 \E Request for results of O2 test: RICH TO LEAN SENSOR THRESHOLD VOLTAGE, Bank2 Sensor1
\B 48 6B 10 45 01 10 00 2C \E
Of interest here is that no testing for sensor 2 is supported. There are tests in the physical section for issues relating to the second O2.
Mode $06
--------
This mode requests on-board monitoring test results for non-continuously monitored systems. The '97 LT1 supports this list of TIDs:
"Supported TIDs: are done just like mode $02: First data to last data, MSB to LSB. Not sure what the FF indicates but it is in the standard as a constant. Why (??) probably never know.
TID $00 TIDs supported (range 01h to 20h)
TID $03 SECONDARY AIR INJECTION REACTION SYSTEM MONITOR
TID $04 CATALYST EFFICIENCY STEADY STATE MONITOR
TID $06 O2 SENSOR HEATER SYSTEM TIME TO ACTIVITY MONITOR
TID $07 EXHAUST GAS RECIRCULATION SYSTEM MONITOR
\B 48 6A F0 06 00 A0 \E Request supported TIDs
\B 48 6B 10 46 00 FF 36 00 00 00 6D \E
\B 48 6A F0 06 03 87 \E Request secondary air results
\B 48 6B 10 46 03 01 00 00 FF FF A1 \E
\B 48 6B 10 46 03 02 00 00 FF FF 1F \E
\B 48 6A F0 06 04 D4 \E Request cat efficiency results
\B 48 6B 10 46 04 20 80 00 02 00 ED \E
\B 48 6B 10 46 04 30 80 00 02 00 03 \E
\B 48 6A F0 06 06 EE \E Request O2 heater time to activity results
\B 48 6B 10 46 06 35 00 00 00 00 FD \E
\B 48 6B 10 46 06 41 00 00 00 00 F8 \E
\B 48 6B 10 46 06 55 00 00 00 00 A3 \E
\B 48 6B 10 46 06 61 00 00 00 00 39 \E
\B 48 6A F0 06 07 F3 \E Request EGR results
\B 48 6B 10 46 07 0C 00 00 00 00 89 \E
\B 48 6B 10 46 07 0D 00 00 00 00 E3 \E
I need to go through and detail the results here. GM published a paper on Mode $05 that gives us what we need to accomplish this along with J1979
Mode $07
--------
This mode requests on-board monitoring test results for continuously monitored systems. These are all the DTCs normally issued as fault codes.
Test examples from my bench setup:
\B 48 6A F0 07 BF \E
\B 48 6B 10 47 01 22 00 00 00 00 8A \E
The 01 22 indicates that my TPS sensor is disconnected.
That was quite a bit of decoding to get all this figured and written down. Sad part is that the physical is much more complicated. I hope to get this done in Sept (?)
-Tom
Do you need an OBDII interface cable that doesn't use the ELM327 chip? I have one that's gathering dust that I specifically bought in hopes of being able to help with development for the 1996~1997 LT1/LT4 PCM interface. I think it would be far better in your hands than mine. Here's what it is for reference: https://obdxpro.com/product/obdx-pro-vt
Though mine is USB-only, no bluetooth. Same thing, though.
1990 Corvette (Manual)
1994 Corvette (Automatic)
1995 Corvette (Manual)
Thank you for your kind offer... for now I will stay with my home brew cable. There are two specific things I want to look at. First is the bit by bit arbitration and then the PCMs use of the break symbol. That cable looks like a very good one, I was going to order one a while back but they were out of stock. USB only is the best one for bench use IMO.
-Tom
My post contains an error the line:
PIDs $00 and $01 are supported.
Should read
PIDs $00 and $02 are supported.
-T
Hi,
I have been working through all the OBDII physically addressed modes. As usual, I got sidetracked in the mode $34/36 routines. Somewhere way back in this thread I figured out how the download works but at the time was working through the bootstrap and didn't go further. While working through the mode$34/6 I decided to write a bit of code to download to the PCM. My code is a PC command line app that takes an Srecord file and downloads it to ram. Optionally it executes the code at the address specified in the S9 record.
I have tested this with a simple "hello world" type app just to check it out. In a week or two I will code a .S19 file that will support mode $35. This mode is not supported by the native code and will let the user dump the flash, eeprom or ram.
Before I go to the effort to post this on the list, I would like to know if there is any interest (?), so two questions:
--> What free tools are available for the early OBDII PCMs that permit up/download of the flash and reprogramming. If there are already tools out there, no need for me to proceed in this.
--> The tool uses my home brew cable, would anyone offer to test using a standard cable?
I am back to figuring out all the physically addressed commands. Once done, I will post the results.
-Tom
Posting Permissions
Reply With Quote
Bookmarks