06 aa is the positive response when upload is good, it can be followed with some data like 2 byte checksum or chipid.
It is some standard frame response.
This is the header that is uploaded via mode5 request for a checksum range.1C75 BD 1C 2E JSR $1C2E ; NOT REFERENCED
1C78 0000 ; CHECKSUM RANGE START
1C7A 0000 ; CHECKSUM RANGE END
1C7C 0000 ; WORKING CHECKSUM RANGE END
And you are right it is 7e not bd. This was the initial version that crashes but wasn`t fixed in the dissasembly.
I took a step back and realized there's still hundreds of parameters left. I started writing a script that takes in the '95 XDF, loads in all the scalars, tables and flags, then loads up the BeyondCompare output and steps through for matches. I'll include enough logic to handle little differences like individual cylinder fuel trims, which appear to be different from '95 to '96. Unless this is a waste of time...
i'd be doing some disassembly at this point.. you have a lot of input now to label some things, and track those back to identify the code responsible for them. there are lots of things you wont be able to find the way you're going at it. for example where's the switch to disable the crank sensor? that one is pretty important for 96-97 cars with huge cams.
Hi Steveo,Originally Posted by steveo
Could you explain a bit more about how a large cam needs the crank sensor code disabled? This is stuff I don't know enough about...
-Tom
the crank sensor on these engines is only there to feed the OBD-ii misfire detection requirement. it compares the cam and crank angles i suppose and if they're too far off it figures there's a misfire.
you can imagine how the cam to crank relationship looks with a really lumpy cam. it causes the timing chain to jog back and forth a lot and cause the same kind of result as a real misfire.
the check engine light flashes if that happens. that might be a good clue, if you can find a routine that looks like it's flashing the CEL rather than just sticking it on, you could probably track that back and find the memory containing the error bit, then go back from there and find the misfire detection code.
it'd be nice to find the parameters so you could widen the angle that it considers a misfire and still retain some misfire detection, but other tools don't have that so people tend to just disable the error code so their dash doesn't blink at them. also the misfire detection doesn't SEEM to do anything other than flash the light, but nobody is 100% sure about that
I am sure (?) I can find it, once past these programming routines I will take a look. You are talking about the dtc.. right? There is a table where each dtc can be disabled/enabled. I sort of remember that there are four classes. I will refresh and post back later.
Somewhere in the last 25yrs I was told by someone (sort of vague?) that misfire was done by looking at the time between hi-res ticks. If she fires, the momentary acceleration of the crank would reduce time to the next tick. That & the
operation of the crank sensor beyond looking for the disable is probably a fall task. That is unless we all get locked down.
Easy to see how a lumpy cam would mess with all the crank acceleration stuff also.
-Tom
i dont know if the DTC is separate from the misfire detection code flashing the check engine light...it does both
Hi,
From what I can tell, the DTCs related to the crank position sensor are these.
P0300 ENGINE MISFIRE DETECTED: RANDOM/MULTIPLE CYLINDER
P0301 CYLINDER 1 MISFIRE DETECTED
P0302 CYLINDER 2 MISFIRE DETECTED
P0303 CYLINDER 3 MISFIRE DETECTED
P0304 CYLINDER 4 MISFIRE DETECTED
P0305 CYLINDER 5 MISFIRE DETECTED
P0306 CYLINDER 6 MISFIRE DETECTED
P0307 CYLINDER 7 MISFIRE DETECTED
P0308 CYLINDER 8 MISFIRE DETECTED
P0335 CRANKSHAFT POSITION SENSOR CIRCUIT MALFUNCTION
P0336 CRANKSHAFT POSITION SENSOR CIRCUIT RANGE/PERFORMANCE
I think we can eliminate anything with a "CIRCUIT" in the name because no amount
of cam can affect continuity of the sensor. My thinking is that the P0300 would
be the code I would expect. In the '97 code I see a table of enables for DTC processing
starting at $20B0, 17bytes deep. Each bit controls the processing of a DTC, set is on. I believe
that clearing bit 7 of $20B4 will eliminate the DTC P0300. It would be more interesting to work
through the code to see if a parameter in the calibration can be change to eliminate the DTC at idle where
the impact of the cam is setting this thing off.
-Tom
PS: This table would be a good thing for the XDF to have...
I added that bit to my draft XDF, but what indexing are you using? 20B4 is 00 in both a '96 B-car BIN and a '97 F-body BIN, and both are in a field of 00s.
Is that in the E side or the T side? I'll email you.
Last edited by sherlock9c1; 05-04-2020 at 05:44 PM.
Thank you, I think the transmit routine detailed here is correct now. I was interested to find that in the flash code there seems to be separate support for Intel and AMD sourced flash. I would expect that with the size of GM they would have had relationships with both vendors. The Intel was preferred but AMD was backup. I wonder if any PCMs were produced with the AMD parts. If so, all code needs to check the manufacturer and device id and have these separate routines. I noticed this in the erase code where there is a sequence for the AMD only UNLOCK.
Not had tiime to look at the '97 code you sent yet, but thank you for the update.
After this post, I plan to move details back to the '97 F-body thread. I now notice that this thread was to be about XDF and my posts are a bit of a hijack...
-Tom
Code:************************************************* * SEND ALDL MESSAGE ************************************************* 012C 36 PSHA ; SAVE REGISTERS ON STACK 012D 18 3C PSHY ; 012F 3C PSHX ; MOVE POINTER TO MESSAGE ON STACK 0130 18 38 PULY ; TO IY 0132 CE 10 00 LDX #$1000 ; 68HC11 REGISTER BASE ADDRESS 0135 86 08 LDAA #$08 ; TRANSMIT ENABLE 0137 A7 2D STAA $2D,X ; SCI CONTROL REGISTER 0139 37 PSHB ; RT DELAY 013A C6 0B LDAB #$0B ; 013C 5A DECB ; 013D 26 FD BNE $013C ; 013F 33 PULB ; 0140 B6 18 03 LDAA $1803 ; PRU PORT B DIRECTION 0143 8A 40 ORAA #$40 ; 0145 B7 18 03 STAA $1803 ; 0148 B6 18 02 LDAA $1802 ; PRU PORT B 014B 8A 40 ORAA #$40 ; ALDL TX ENABLE 014D B7 18 02 STAA $1802 ; 0150 4F CLRA ; INITIALIZE CHECKSUM 0151 97 2E STAA @$2E ; * MESSAGE CONTENT: * [DEVICE ID] [LENGTH] [MODE] [MESSAGE …] [CHECKSUM] * * DEVICE ID: $F4 FOR TSIDE, $E4 FOR ESIDE * LENGTH: MESSAGE LENGTH + $52 * MESSAGE LENGTH INCLUDES DEVICE ID, LENGTH, MODE, MESSAGE() AND CHECKSUM * MODE: MODE1 – READ DIAGNOSTIC INFORMATION * MODE2 – READ MEMORY SEGMENT (64 Bytes) * MODE3 – READ MEMORY SEGMENT (Arbitrary, 1-84 Bytes) * MODE4 – TEST ACTUATORS * MODE5 – ENTER PROGRAMMING MODE * MODE6 – UPLOAD AND EXECUTE PROGRAM SEGMENT * MODE7 – BROADCAST * MODE8 – DISABLE CHATTER (TAKE BUS MASTER) * MODE9 – ENABLE CHATTER (GIVE BUS MASTER) * MODE10 – CLEAR MALF CODES * MODE12 – PROGRAM AUXILIARY FLASH MEMORY * MODE13 – SECURITY CHALLENGE/RESPONSE * 0153 86 F4 LDAA #$F4 ; PCM DEVICE ID: PCM 0155 8D 2E BSR $0185 ; SCI TRANSMIT BYTE 0157 17 TBA ; MESSAGE CONTENT LENGTH 0158 8B 55 ADDA #$55 ; LENGTH: ID + LENGTH + CONTENT +SUM + 0X52 015A 8D 29 BSR $0185 ; SCI TRANSMIT BYTE 015C 18 A6 00 LDAA $00,Y ; LOOP THROUGH MESSAGE 015F 8D 24 BSR $0185 ; SCI TRANSMIT BYTE 0161 18 08 INY ; INCREMENT POINTER 0163 5A DECB ; DECREMENT REMAINING BYTE COUNT 0164 26 F6 BNE $015C ; LOOP 0166 96 2E LDAA @$2E ; CHECKSUM 0168 40 NEGA ; NEGATE, SUM OF 0XFF 0169 8D 1A BSR $0185 ; SCI TRANSMIT BYTE 016B 1F 2E 40 FC BRCLR $2E,X,$40,$016B ; LOOP TILL TRANSMIT COMPLETE 016F B6 18 03 LDAA $1803 ; SET PRU PORT B DIRECTION 0172 84 BF ANDA #$BF ; DEFAULT ALDL TO DISABLE TX 0174 B7 18 03 STAA $1803 ; 0177 37 PSHB ; SAVE REGISTERS 0178 C6 0B LDAB #$0B ; 3 + 2 + (11 *5) + 4 = 64 ECLOCK 017A 5A DECB ; RT DELAY = 20US 017B 26 FD BNE $017A ; LOOP 017D 33 PULB ; RESTORE REGISTERS 017E 1D 2D 08 BCLR $2D,X,$08 ; DISABLE SCI TRANSMITTER SCCR2:TE 0181 18 38 PULY ; RESTORE REGISTERS 0183 32 PULA ; 0184 39 RTS ; DONE
Posting Permissions
Reply With Quote
Bookmarks