1997 F-Body ECM

[DownUnder]

Just read through all 33pages, awesome work so far!
I did see some early attempts/work into making a kernel for read and writing for the ECUs.

I started looking through a kernel, but cannot see the registers for the DLCMD (Data Link Controller Module) where its actually reading or writing VPW frames.

From what I understand, these are using the HC11 processor.. and looking through the datasheet, I dont see a dedicated register for J1850 VPW communication, but I do see that in something like a HC12.
Is this all being doing using something like SPI? Anyone dived further into understanding that?

[Tom H]

I did see some early attempts/work into making a kernel for read and writing for the ECUs.

I started looking through a kernel, but cannot see the registers for the DLCMD (Data Link Controller Module) where its actually reading or writing VPW frames.

From what I understand, these are using the HC11 processor.. and looking through the datasheet, I dont see a dedicated register for J1850 VPW communication, but I do see that in something like a HC12.
Is this all being doing using something like SPI? Anyone dived further into understanding that?

Taking your questions somewhat out of order...

There are two processors Tside and Eside that communicate over SPI. The scheme used is a bit different depending on direction, here is how:
Tside sends a set of parameters to Eside. The "mastership" of the bus is swapped each byte sent. This reduces interrupts. Data from T -> E is the same each transfer block (32 bytes). The T->E has a paged scheme, transfering 19 bytes of data each block + 10 bytes that are paged. There are eight pages such that over 8 transfer cycles, 80 bytes are sent. This is enough to send all the statistics required for OBDII. This is my best try at a general summary. Getting into the details is a bit more difficult, so I will leave it here unless you have some specific question...

The VPW comms is provided by a chip external to the processors. It is accessed only by the TSide so read and write to the ESide must be done by passing through the TProcessor. The SCI is internal to the processor. For '96 and '97 the Eside SCI is not used: that is all the ALDL comms is looked after by the TSide. Once again any data destined for ALDL from the ESide must be passesd to the TProcessor over SPI for tx on the SCI/ALDL. Chip used for VPW is Motorola MC68HC58 Data Link Controller. The DLC is addressed at $1060 & $1061.

There was a request to separate PCM info from tools info. There is a second set of posts regarding tools to read and write the PCM. All of my tools have used a home brew cable that I use to access the PCM. The tools I wrote connect to the PCM through this cable over USB based NRZ (serial) comms. The cable is set up to act much like the age old ELM327 except that it has capability to send large frames required to download/upload. Have a look through
http://www.gearhead-efi.com/Fuel-Inj...7-F-Body-Tools
At some point I will add the 4X feature and enable both read and write. For now the work on my system.

Hope this answers some of your questions.
-Tom

[DownUnder]

Taking your questions somewhat out of order...

There are two processors Tside and Eside that communicate over SPI. The scheme used is a bit different depending on direction, here is how:
Tside sends a set of parameters to Eside. The "mastership" of the bus is swapped each byte sent. This reduces interrupts. Data from T -> E is the same each transfer block (32 bytes). The T->E has a paged scheme, transfering 19 bytes of data each block + 10 bytes that are paged. There are eight pages such that over 8 transfer cycles, 80 bytes are sent. This is enough to send all the statistics required for OBDII. This is my best try at a general summary. Getting into the details is a bit more difficult, so I will leave it here unless you have some specific question...

The VPW comms is provided by a chip external to the processors. It is accessed only by the TSide so read and write to the ESide must be done by passing through the TProcessor. The SCI is internal to the processor. For '96 and '97 the Eside SCI is not used: that is all the ALDL comms is looked after by the TSide. Once again any data destined for ALDL from the ESide must be passesd to the TProcessor over SPI for tx on the SCI/ALDL. Chip used for VPW is Motorola MC68HC58 Data Link Controller. The DLC is addressed at $1060 & $1061.

There was a request to separate PCM info from tools info. There is a second set of posts regarding tools to read and write the PCM. All of my tools have used a home brew cable that I use to access the PCM. The tools I wrote connect to the PCM through this cable over USB based NRZ (serial) comms. The cable is set up to act much like the age old ELM327 except that it has capability to send large frames required to download/upload. Have a look through
http://www.gearhead-efi.com/Fuel-Inj...7-F-Body-Tools
At some point I will add the 4X feature and enable both read and write. For now the work on my system.

Hope this answers some of your questions.
-Tom

This makes quite a bit more sense.
I could see the addressing to 0x1060 and also 0x1061, but it didn't quite line up with what I was expecting with the HC11 reference manual.
The only reason they looked interesting was they were checking specific hex values that I use in the later model ECU kernels for the DLC status. (ie.. checking for a completion code).
In comparison to working with the P01/P59/P04/P12 ecus, this does seem to be a bit more complicated with the dual processor setup.

Nice work on the tool! Looks like the circuit is a derivative of the ELM from what I can see.
I program with the OBDX Pro tools since I am the programmer for them, Pete (My colleague) does all the circuit designing and testing.

Looking through that thread, look like you have already created an application to read (0x35) the ECU data. Did you have plans to continue to add in the writing capability also?

[Tom H]

Hi,

The CSIO1 pin (68HC11F1 pin 22) is programmed to be the chip select for the DLC. Since the DLC has only two physical addresses, only A0 and the chip select are needed. The two registers are duplicated over and over within the range, but for simplicity only the 0x1060/1 are used within the code.

The home brew cable was designed to get around limitations in the ELM. If I had it to do again, I would have moved all the CRC into software. Doing it that way would be better because the CRC would cover the data through the USB link as well. That said, reinventing the wheel isn't a thing I plan to do...

I have download/program software working on my bench. It targets only two years of PCM (96/7). For the most part these PCMs are obsolete, the later units are probably a better bet for most people. I am at a cross roads as to if I will continue to work on this PCM. I keep running into lack of information regarding the TPU and try as I might have not been able to crack into it.

-Tom

[DownUnder]

Hi,

The CSIO1 pin (68HC11F1 pin 22) is programmed to be the chip select for the DLC. Since the DLC has only two physical addresses, only A0 and the chip select are needed. The two registers are duplicated over and over within the range, but for simplicity only the 0x1060/1 are used within the code.

The home brew cable was designed to get around limitations in the ELM. If I had it to do again, I would have moved all the CRC into software. Doing it that way would be better because the CRC would cover the data through the USB link as well. That said, reinventing the wheel isn't a thing I plan to do...

I have download/program software working on my bench. It targets only two years of PCM (96/7). For the most part these PCMs are obsolete, the later units are probably a better bet for most people. I am at a cross roads as to if I will continue to work on this PCM. I keep running into lack of information regarding the TPU and try as I might have not been able to crack into it.

-Tom

I was told that there was not really a solution for the 96/7 vehicles hence was directed to here as the closest kind of "DIY" tuning solution.

Just like the P01/P59 PCMs, there was not really any work done for reverse engineering completed or people helping out until there was an option available to read/write.

Id be happy to help get the kernels into a easy to use application, or even possibly into something like LSDroid which is also a free based program.

[Tom H]

I was told that there was not really a solution for the 96/7 vehicles hence was directed to here as the closest kind of "DIY" tuning solution.

Just like the P01/P59 PCMs, there was not really any work done for reverse engineering completed or people helping out until there was an option available to read/write.

Id be happy to help get the kernels into a easy to use application, or even possibly into something like LSDroid which is also a free based program.

As this is part of the "tools" topic, we should move the discussion there http://www.gearhead-efi.com/Fuel-Inj...7-F-Body-Tools

I have a solution for read & program of the 96/7 LT1 PCMs. This all is separate from the bootstrap discussion (resurrection of the bricked).

I have a good deal of the reverse engineering done with a little help from my friends here.

My software skills are not quite up to your level. I don't have kernels. Just a few c++ classes that I stitch together to upload/download code to the PCM. For the actual programming routines that run on the 'HC11s, Kur4o provided them and I used them without (or with few) modifications. If you would like to make up a tool for these PCMs I will try to support you where I can.

-Tom

[kur4o]

Hi Tom,

Did you managed to reverse the hardware side of ignition control. I am only interested in the signal that pcm sends to ignition control module and what type of it is. Usually there is a dwell timing that goes to ICM. Does the pcm supplies voltage or just ground the icm pin, while grounded the coil charges and once the ground is removed the coil fires. I am just speculating. I think this was covered in other threads but can`t find it.

Thanks