1997 F-Body ECM

[kur4o]

Great work on the hardware side. It does clear some missing pieces.

The rpm calculations come in many different scalars, because of the various tables that need different resolution. There is aso a rpm variation coefficient, that is not clear what is does.

Here is the code that is used for PCM flashing. I tried to label most of them. You can do a disassembly to get an insight of the process.

[Tom H]

Working through test tool interface code at the moment. I have found the download sequence in mode $34. Interesting that controller $10 and controller $18 which I take to be Tside and Eside are handled differently. Hmmm perhaps I got this wrong(?) Good puzzle though. Almost looks like one is download and the other download & execute. More effort needed here.

I got the hardware work I planned done, although I expect to be back there again at some point. The code shows more hardware and the hardware shows more code....

Still trying to get hold of a board with both 68HC11 and D84G on it. Any ideas what to ask for? I don't care if it is an ECM or ABS or ??. Just need a common cheap part to mess with.

Most of the physically addressed modes J2190 are now commented. Some confusion still exists, but getting better. Not much work on Eside yet.

Thank you for your interest, I will look through the write routine now. Hope this is a good boost.

Perhaps I should caution everyone... The ribbon cable between E&T sides is VERY FRAGILE. After investigating hardware I put it back on the test bench and there was no life. Hours and hours later I am back up with several wires jumpered between boards. Probably should replace the PCM or at least the ribbon cable. I was thinking to install headers on the board with a plug in cable. Would be very convenient to be able to separate the boards. Wires fracture at the internal insulation displacement contacts: no hope to repair w/o jumper or replace cable.

[kur4o]

$10 as primary communication ID should be tside. $18 should be eside. Must be confirmed in code as it is only assumption.
$18 triggers the VPP voltage for both chips during erase/write.

Mode 34 is only for requesting mode 36. If the pcm agrees it response with 44.
Mode 36 80 is for download and execute. 36 00 is for download only. Some earlier pcm only have download and execute mode only so it doesn`t matter if it is 36 80 or 36 00.
Mode A1 is for high speed comm x4 vpw mode.

Here are sample msgs.
6C 10 F0 34 00 [03 42] [00 00 EE] request data download for $342 bytes at 00 00 EE ram address
6C F0 10 74 00 44 response [pcm agreed ]
tool sends
6D 10 F0 36 00 03 42 00 00 EE ....message....[XX XX or YY]
xxxx= block checksum if used
yy=1 byte checksum only

You will get a confirmation message before the pcm execute the code at EE address.

This example is for newer PCMs and might differ slightly with the 97 lt1 pcm.



I have seen D84G as only processor in 94 camaro ABS and SIR modules. Will try to gey you a pictures of those.

[Tom H]

I have an update regarding the data link controller. No longer a need to guess regarding the registers and use of the comms part....

I have found a data sheet at:

http://pdf.datasheetcatalog.com/data.../374731_DS.pdf

which I believe is the the part marked:
54545T40
20686
466 {?delco?delphi?other? logo}

The post I made earlier is perhaps how the prototype was done, but not the actual chip. It makes dis-assembly much easier when the exact definition of bits is know. Perhaps a list of GM parts vs. house numbers can be assembled on this forum? I have found a number of them that relate to my PCM, but they are used all over and can help with other projects.

-Tom

[Tom H]

Here is code used to service frame receive with the DLC in cases where the code waits for the frame to become available. Service of asynchronous / background frames uses other code. This is the code used when sending data to the PCM for programming. It was lucky that I was able to find the data sheet for the MC68HC58 because while the operation isn't complex, it is hard to decipher with out the bit definitions.

-Tom

************************************************
* LOOP WHILE MONITORING DLC RETURN WHEN
* FRAME IS AVAILABLE, ON TIME OUT, ON ERROR
************************************************

DDDB  37		PSHB			; SAVE REGISTERS
DDDC  18 3C		PSHY			; 

DDDE  18 CE 0D 3A	LDY	#$0D3A		; SET TIME OUT CONSTANT 3386
DDE2  7F 1C 10		CLR	$1C10		; SET LOOP COUNTER

DDE5  BD 4E 7F		JSR	$4E7F		; RESET THE COP
DDE8  BD 4E 8A		JSR	$4E8A		; RESET THE PORT EXPANDER WATCHDOG

DDEB  7A 1C 10		DEC	$1C10		; DECREMENT LOOP COUNT AND RESET
DDEE  26 0A		BNE	$DDFA		; WATCHDOGS EVERY 256 LOOPS

DDF0  BD 4E 7F		JSR	$4E7F		; RESET THE COP
DDF3  BD 4E 8A		JSR	$4E8A		; RESET THE PORT EXPANDER WATCHDOG

DDF6  18 09		DEY			; DECREMENT TIME OUT COUNT
DDF8  27 2B		BEQ	$DE25		; BRANCH TIME OUT EXPIRED

DDFA  B6 10 60		LDAA	$1060		; READ DATA LINK CONTROLLER STATUS
DDFD  85 E0		BITA	#$E0		; TEST RECEIVE FIFO STATUS FIELD
DDFF  27 EA		BEQ	$DDEB		; LOOP ON BUFFER INVALID/EMPTY

DE01  B7 1C 07		STAA	$1C07		; SAVE RFS FIELD OF STATUS WORD

DE04  FC 10 60		LDD	$1060		; READ STATUS & DATA

DE07  B1 1C 07		CMPA	$1C07		; TEST FOR STATUS CHANGE
DE0A  23 03		BLS	$DE0F		; 

DE0C  B6 1C 07		LDAA	$1C07		; GET ORIGNIAL STATUS RFS FIELD
DE0F  18 38		PULY			; RESTORE IY

DE11  81 A0		CMPA	#$A0		; TEST FOR COMPLETION CODE AT HEAD OF BUFFER
DE13  24 03		BCC	$DE18		; BRANCH ON COMPLETION CODE AT HEAD

DE15  0C		CLC			; INDICATE NOT LAST BYTE (COMPLETION)
DE16  20 1C		BRA	$DE34		; PASS DATA BACK TO CALLING ROUTINE

* PROCESS COMPLETEION CODE
DE18  C5 40		BITB	#$40		; TEST RECEIVE FIFO OVER RUN
DE1A  26 09		BNE	$DE25		; BRANCH ON OVER RUN

DE1C  5D		TSTB			; TEST ERROR INDICATION
DE1D  2A 14		BPL	$DE33		; BRANCH NO ERROR

* ERROR CODE FIELD
* 00 CRC error
* 01 Incomplete byte
* 10 Bit timing error
* 11 Break
DE1F  C4 03		ANDB	#$03		; 
DE21  C1 03		CMPB	#$03		; 
DE23  27 02		BEQ	$DE27		; BRANCH BREAK DETECTED

* TIME OUT
DE25  20 FE		BRA	$DE25		; LOOP TILL WATCHDOG

DE27  8E 1C 2A		LDS	#$1C2A		; RESET STACK

DE2A  CC F8 0A		LDD	#$F80A		; ABORT TRANSMISSION
DE2D  FD 10 60		STD	$1060		; RE-CONFIGURE DLC
						; FOR INTERRUPT OPERATION
DE30  7E DC 5F		JMP	$DC5F		; GET FRAME

DE33  0D		SEC			; CARRY INDICATES COMPLETION CODE
						; FRAME READY
DE34  17		TBA			; TRANSFER DATA TO ACCA
DE35  33		PULB			; RESTORE REGISTER
DE36  39		RTS			; DONE

[jthompson122183]

I'm anxious to see about how the 3->2 downshift works in the 96/97 code, maybe we can Port it over to the 94/95 for those that obd1 swap the 96/97.

BTW are you Tom Hussey from here
https://web.archive.org/web/20030527...y/msg00279.htm
If so wow I congrats on working on this platform for so long

[Tom H]

I hope once complete any/all code could be ported or modified. Sticking with GM tested code is safe: exhaustivly tested and considering the entire design. So far I have detailed much of the OBDII and Tside code. Three is transmission code I have not touched... yet. There is 100K of code and that is a steep thing for disassembly. I hope that we could get there...

I am that same person from a lifetime ago. I can't say I have been working on the platform all this time however. I had the car new and took it solo racing. This love of road racing grew and I bought an open wheel car: Formula Vee. Ran that in regional racing (CASC up here in Canada is like SCCA down in US). The Camaro met it's demise on our busy highway 401 one afternoon when I stopped for road construction backup. When I woke, I was looking up at someone's oil pan through the shattered back glass. I was lucky the seat had broken and it went up, landing on top.
I am planning a project now, and started again a month ago to understand the ECMs. I had some code that I wrote from all those years ago but am starting almost fresh. I have discovered (and re-discovered) much of the work I did back then.

I hope that this work will be of use to someone other than myself. Currently I am working on download. I have now digested steps up to the point where the tester has entered Mode $34. Last step is mode 36 to actually send something. I was surprised that all this isn't more common knowledge. I am now working out details such as which bytes are contained in the 16bit checksum of the download mode 36 commands. I hope to post details and a program to get a PCM reply of "Hello world!" soon.

Cheers, -Tom