the crank sensor on these engines is only there to feed the OBD-ii misfire detection requirement. it compares the cam and crank angles i suppose and if they're too far off it figures there's a misfire.
you can imagine how the cam to crank relationship looks with a really lumpy cam. it causes the timing chain to jog back and forth a lot and cause the same kind of result as a real misfire.
the check engine light flashes if that happens. that might be a good clue, if you can find a routine that looks like it's flashing the CEL rather than just sticking it on, you could probably track that back and find the memory containing the error bit, then go back from there and find the misfire detection code.
it'd be nice to find the parameters so you could widen the angle that it considers a misfire and still retain some misfire detection, but other tools don't have that so people tend to just disable the error code so their dash doesn't blink at them. also the misfire detection doesn't SEEM to do anything other than flash the light, but nobody is 100% sure about that
I am sure (?) I can find it, once past these programming routines I will take a look. You are talking about the dtc.. right? There is a table where each dtc can be disabled/enabled. I sort of remember that there are four classes. I will refresh and post back later.
Somewhere in the last 25yrs I was told by someone (sort of vague?) that misfire was done by looking at the time between hi-res ticks. If she fires, the momentary acceleration of the crank would reduce time to the next tick. That & the
operation of the crank sensor beyond looking for the disable is probably a fall task. That is unless we all get locked down.
Easy to see how a lumpy cam would mess with all the crank acceleration stuff also.
-Tom
i dont know if the DTC is separate from the misfire detection code flashing the check engine light...it does both
i don't have a car
from memory it sets that obd-ii code called random misfire
More comments added.
Well, I've got the disassembler open and am looking at the OBD1 code, with a whole lot of help from kur4o. And great work him on the commenting! I need to start an Ibuprofen fund; whew this is new territory for me.
Thank you, I think the transmit routine detailed here is correct now. I was interested to find that in the flash code there seems to be separate support for Intel and AMD sourced flash. I would expect that with the size of GM they would have had relationships with both vendors. The Intel was preferred but AMD was backup. I wonder if any PCMs were produced with the AMD parts. If so, all code needs to check the manufacturer and device id and have these separate routines. I noticed this in the erase code where there is a sequence for the AMD only UNLOCK.
Not had tiime to look at the '97 code you sent yet, but thank you for the update.
After this post, I plan to move details back to the '97 F-body thread. I now notice that this thread was to be about XDF and my posts are a bit of a hijack...
-Tom
Code:************************************************* * SEND ALDL MESSAGE ************************************************* 012C 36 PSHA ; SAVE REGISTERS ON STACK 012D 18 3C PSHY ; 012F 3C PSHX ; MOVE POINTER TO MESSAGE ON STACK 0130 18 38 PULY ; TO IY 0132 CE 10 00 LDX #$1000 ; 68HC11 REGISTER BASE ADDRESS 0135 86 08 LDAA #$08 ; TRANSMIT ENABLE 0137 A7 2D STAA $2D,X ; SCI CONTROL REGISTER 0139 37 PSHB ; RT DELAY 013A C6 0B LDAB #$0B ; 013C 5A DECB ; 013D 26 FD BNE $013C ; 013F 33 PULB ; 0140 B6 18 03 LDAA $1803 ; PRU PORT B DIRECTION 0143 8A 40 ORAA #$40 ; 0145 B7 18 03 STAA $1803 ; 0148 B6 18 02 LDAA $1802 ; PRU PORT B 014B 8A 40 ORAA #$40 ; ALDL TX ENABLE 014D B7 18 02 STAA $1802 ; 0150 4F CLRA ; INITIALIZE CHECKSUM 0151 97 2E STAA @$2E ; * MESSAGE CONTENT: * [DEVICE ID] [LENGTH] [MODE] [MESSAGE …] [CHECKSUM] * * DEVICE ID: $F4 FOR TSIDE, $E4 FOR ESIDE * LENGTH: MESSAGE LENGTH + $52 * MESSAGE LENGTH INCLUDES DEVICE ID, LENGTH, MODE, MESSAGE() AND CHECKSUM * MODE: MODE1 – READ DIAGNOSTIC INFORMATION * MODE2 – READ MEMORY SEGMENT (64 Bytes) * MODE3 – READ MEMORY SEGMENT (Arbitrary, 1-84 Bytes) * MODE4 – TEST ACTUATORS * MODE5 – ENTER PROGRAMMING MODE * MODE6 – UPLOAD AND EXECUTE PROGRAM SEGMENT * MODE7 – BROADCAST * MODE8 – DISABLE CHATTER (TAKE BUS MASTER) * MODE9 – ENABLE CHATTER (GIVE BUS MASTER) * MODE10 – CLEAR MALF CODES * MODE12 – PROGRAM AUXILIARY FLASH MEMORY * MODE13 – SECURITY CHALLENGE/RESPONSE * 0153 86 F4 LDAA #$F4 ; PCM DEVICE ID: PCM 0155 8D 2E BSR $0185 ; SCI TRANSMIT BYTE 0157 17 TBA ; MESSAGE CONTENT LENGTH 0158 8B 55 ADDA #$55 ; LENGTH: ID + LENGTH + CONTENT +SUM + 0X52 015A 8D 29 BSR $0185 ; SCI TRANSMIT BYTE 015C 18 A6 00 LDAA $00,Y ; LOOP THROUGH MESSAGE 015F 8D 24 BSR $0185 ; SCI TRANSMIT BYTE 0161 18 08 INY ; INCREMENT POINTER 0163 5A DECB ; DECREMENT REMAINING BYTE COUNT 0164 26 F6 BNE $015C ; LOOP 0166 96 2E LDAA @$2E ; CHECKSUM 0168 40 NEGA ; NEGATE, SUM OF 0XFF 0169 8D 1A BSR $0185 ; SCI TRANSMIT BYTE 016B 1F 2E 40 FC BRCLR $2E,X,$40,$016B ; LOOP TILL TRANSMIT COMPLETE 016F B6 18 03 LDAA $1803 ; SET PRU PORT B DIRECTION 0172 84 BF ANDA #$BF ; DEFAULT ALDL TO DISABLE TX 0174 B7 18 03 STAA $1803 ; 0177 37 PSHB ; SAVE REGISTERS 0178 C6 0B LDAB #$0B ; 3 + 2 + (11 *5) + 4 = 64 ECLOCK 017A 5A DECB ; RT DELAY = 20US 017B 26 FD BNE $017A ; LOOP 017D 33 PULB ; RESTORE REGISTERS 017E 1D 2D 08 BCLR $2D,X,$08 ; DISABLE SCI TRANSMITTER SCCR2:TE 0181 18 38 PULY ; RESTORE REGISTERS 0183 32 PULA ; 0184 39 RTS ; DONE
Hi,
From what I can tell, the DTCs related to the crank position sensor are these.
P0300 ENGINE MISFIRE DETECTED: RANDOM/MULTIPLE CYLINDER
P0301 CYLINDER 1 MISFIRE DETECTED
P0302 CYLINDER 2 MISFIRE DETECTED
P0303 CYLINDER 3 MISFIRE DETECTED
P0304 CYLINDER 4 MISFIRE DETECTED
P0305 CYLINDER 5 MISFIRE DETECTED
P0306 CYLINDER 6 MISFIRE DETECTED
P0307 CYLINDER 7 MISFIRE DETECTED
P0308 CYLINDER 8 MISFIRE DETECTED
P0335 CRANKSHAFT POSITION SENSOR CIRCUIT MALFUNCTION
P0336 CRANKSHAFT POSITION SENSOR CIRCUIT RANGE/PERFORMANCE
I think we can eliminate anything with a "CIRCUIT" in the name because no amount
of cam can affect continuity of the sensor. My thinking is that the P0300 would
be the code I would expect. In the '97 code I see a table of enables for DTC processing
starting at $20B0, 17bytes deep. Each bit controls the processing of a DTC, set is on. I believe
that clearing bit 7 of $20B4 will eliminate the DTC P0300. It would be more interesting to work
through the code to see if a parameter in the calibration can be change to eliminate the DTC at idle where
the impact of the cam is setting this thing off.
-Tom
PS: This table would be a good thing for the XDF to have...
I added that bit to my draft XDF, but what indexing are you using? 20B4 is 00 in both a '96 B-car BIN and a '97 F-body BIN, and both are in a field of 00s.
Is that in the E side or the T side? I'll email you.
Last edited by sherlock9c1; 05-04-2020 at 05:44 PM.
You can check here for a way to open the files or
if you are still having troubles here are some htmls. There is options to export to other formats but don`t what they are.
I managed to find that there are 2 revisions for the 96-97 files[1 for 96 and 1 for 97]. This is valid only for the latest updates by gm so any older p/n for the vin might have different layout.
I am looking for stock bins to confirm there isn`t any older revisions.
For now at least 2 xdfs will be needed.
We can transfer the thread`s topic to xdf and flash creations and we will be spot on with the conversation without spamming the thread.
I hope sherlock9c1 doesn`t mind.
No worries. Moderators, organize away.
Kur4o, I was just realizing that the BIN I was pattern-matching on was from Tunercat OBD2 (now JET DST). But is the organization of the file arbitary, dependent on what order the EEPROM memories are read? So the blocks might be re-arranged in a different order than what Tunercat OBD2 did?
I am not sure about the tunercat layout, but the best one might be
tside 2000 ram + bank 0 + bank 1 + bank 2 +eside 2000 ram + eside rom.
For better offset experience eside might be first than tside full binary like
eside full bin with ram + tside full bin with ram.
Bookmarks