PDA

View Full Version : Am here now



Padgett
11-03-2021, 05:37 PM
Have nearly always just used my name since before the Internet was the Internet. First computer game in 1957, bouncing messages off a satellite a decade later, and designing digital controls for large afterburning gas turbine engines and flight controls for aircraft in the '70s. Been into cars for as long (as a teen could not afford a TR3B, could afford a Jag XK. Then found out why. Still have whitworth tools. Took the cure but a fan of DOHC-6s just now with VVT and redline 7,000 (Jag would go 7,000. Once.).

Been a fan of instrumentation ever since well ever. Have a Prince On-Board Computer from the '70s (had a smaller version in my '78 Sunbird with SBC). First reprogramming was an '84 Fiero with "Computer Command Control" and 2Kx8 PROM. Mostly reprogram cars to run cooler, 180-190F. Find that everything under the hood lasts longer when I do.

Got very deep into reprogramming the '88 Reatta 3800. Bought in '01 & still have. As my wont, collected nearly all the 5B computer .bins and played with a few. Found that after about 20 years the 27C256 PROM would not reliably erase so now mostly Am here now.use a bag on the side from Moates.

Teens were kind of a blur had a '93 GTP with Twin Dual Overhead Cam V-6 and a Getrag that I played with the tuning a bit and would give Porches fits. Sounded great while doing it. Is nothing like a healthy 6.

Fast forward to 2020 and in central Florida the bottom drops out of the car market thanks to Florida being closed for the foo. Sold my last Reatta convertible a few years earlier & replaced with a SLK320 Merc. Was in a retractable phase but soon found that with the top down there is not even room for groceries. Is common for retracables. So nice to drive around & easy to park (157" long). Still had an open slot in the garage so began looking. First thought about an XLR but same trunk issues and peculiar way of retracting, the tonneau would hit the overhead door track in the garage.

Then discovered something I had looked at several times but rejected because was too expensive and I really did not like the steering wheel (didn't like on an '84 Thunderbird either, no place to hang thumbs). After careful study fixated on the 89 Allante.(first year of 4.5 engine (4100 is too sloooooow), last year before decontenting began (still had standard removable hardtop).

Fact is that when I look I usually find. After looking at several (Northstar in '93 is good but needed wind wings to prevent drafts (I sit reclined and about as far back as possible. Screwey position saved life when flew a split window) and telescopic steering was also gone. Found a very nice 64k '89 with everything working including A/C and clear Florida title ($300 value & no hassle) down in Port St Lucie for pocket change. FWD is nice for a tow dolly. And soon was occupying the garage.

Problem is they tend to attract others. About a month later a neighbor inherited a not-so-nice '89 with hardtop, cold air, & also 64k miles. Had a Texas title and did not really want despite everything working so lowballed but said would pay $300 more with a clear Florida title.

Skipping to end, he did, and I did and now have two running driving 89 Allantes wedged into garage for a total cost of about 1/4 an XLR & nice sized trunk even with convertible (both have two tops, cloth and hardtop) Pocket change.

So cats being unable to help and an empty nest turns out it takes two people to remove the hardtop. Or a hoist & tree-saver 3" strap. Next I replace the U-gly steering wheel with a three spoke Reatta wheel.

Then the real problem emerges: the electronics that seem to have been designed by a Japanese (lotsa little white wires - no color coding) High School class from magazine articles. I have never seen coolant fans controlled by pulse width modulation before. And that is just the start. Turns out the ecm, a 1227750, has no documentation. Anywhere. No TunerCat defintions. Nuttin (probably the PWM).

Have dumps of most of the 27C256 PROMs and disassembilies but not commented. OTOH in 90 the PWM was replaced by more conventional relays and the same engine (LQ6) is used through the '92 model year so tables probably the same. ECM is now 16132240 and definitions exist but now has a 512k Flash.

Which brings up the just discovered by me Gearhead. Have a lot of .bins, mostly 3800 and now Allante (HT4100 & 4.5 V8) but very little on the 1227750. Ludis has nothing. TC has nothing. Does anyone here have any locations particularly for switch parameters ?

Please help,

Padgett

1project2many
11-03-2021, 08:27 PM
Howdy and welcome. I've long wanted an '89. I fell in love with the cartoon-like gauges years ago, drove one around while in ASEP, promised myself I'd return some day.

Piles of white wires? Nothing new there. Found the same thing once in a Toronado with CRT. Harness must have been made from scratch, no pictures or guides, in place in the car. Everything was so snug and tight but it was lotsa work to remove and re-install. Helped me get a raise though. Nothing like laying a pile of components and an all-white wire harness on the dealership floor before lunch then leaving with a promise of no return unless we talk pay.

I have never seen anything on the 7750. Those cars weren't exactly laying around and much of what Ludis cataloged came from junk yard finds or ebay sales. The ECM looks like a C3 so it might not be too difficult to locate some of the switches and easier to find tables during a disassembly. Have you checked the Mask ID to see if the code matches another 4100/4500 equipped car?

Padgett
11-04-2021, 03:43 AM
No, the problem is the Allante was the only GM car I know of to use PWM for the engine cooling fans and the ECM program reflects that. Means there is a table for fan speeds and not just switches.

AFAIK the Computer Command Control (C3 or CCC) were only used in early (Fiero) computer cars. By the time the Allante came along the 1227750 was P4 with and 8192 baud ALDL and a 27C256 but with a pair of PWM pinouts instead of discrete outputs. Hence the dump is over 19,000 lines and just have not found a round tuit. Pretty sure it looks like most GM ECMs but have enough oddball programming that nothing I've found lines up even close.

Have been through A Lot of Reattas and most had touchscreens. No Big. Allante has analogs to just about everything and ALDLSTUFF has a group (A86) for the Allante (V) with 4.5 (LQ6). May be able to use the 1632240 ECM also for a later LQ6 and suspect the maps may be the same.just uses a flash 512k PROM instead of a 27c256. Such fun.

1project2many
11-04-2021, 04:06 AM
My bad... ECM looks like P4. Trying to rush an answer before leaving the shop.

Maybe oddball code... Lotus programmed Quad 4 engines were like that. Not really oddball, but they didn't re-use old GM code and they optimized better than US programmed ecm's. The datastream is key to cracking the nut so at least that's available.

Do you have a mask ID?

Padgett
11-04-2021, 05:35 AM
That is one problem. Byte 0008 of Allante PROMS contain $00 which does not seem to match anything. Been working mostly with an 89 ANSU /7126 but have several 87-89 Memcals which use the 27C256 Prom. Several later ones also.

1project2many
11-04-2021, 06:16 AM
Is there any chance GM loaded the file into the upper 1/2 of the chip? It wouldn't be the first time..

Padgett
11-04-2021, 04:50 PM
Yes for 90-92. Am working with 87-89 which uses a 27c256 and all is loaded. Here is the first section of the ANSU. (Something about grandmothers ans sucking eggs...)
17244

1project2many
11-05-2021, 04:59 AM
Interesting. If you're seeing similar data in different calibrations then chances are high this is valid information.

Are you able to determine the code entry point? Have you been able to match up any of the calibration locations to the ALDL data?

Just out of curiousity, have you tried using Tunercat's checksum utility to see if it calculates a number that seems valid? Or maybe try loading it into Bithoist?

Padgett
11-05-2021, 07:44 AM
Yes entry is from the top of memory just like any other Motorolla 68xx. No haven't been able to match ALDL data, trying to figure out where to start. Tried a couple of BitHoist. All came back
Mask ID: Unknown

1project2many
11-05-2021, 04:08 PM
These are intriguing. It's easy to ID the ALDL table when you have the location of the PromID but obviously the beginning of these files is not quite the same as other GM cals. Other variables I use are RPM or Spark Advance. Spark code is generally similar in C3 and P4 families, especially with regards to reading / writing spark hardware. I usually look for a section that contains the common P4 hardware locations for spark / dwell:



AC44: PSHB
AC45: PSHA
AC46: TSX
AC47: CLRA
AC48: CLRB
AC49: SUBD L3FC0 ; RPM = ((65536 * 120)/8)/CAL
AC4C: LSRD
AC4D: LSRD
AC4E: LSRD
AC4F: LSRD
AC50: ORAA #$F0
AC52: ADDD L3FF6

Finding a call to L3FC0 followed by several DIV or LSRD is usually a key to unlocking sections of the spark code. $3FC0 is one location used for RPM in many P4's and the address $3FC0 is sometimes found in the ALDL table.

No promises but if you'd like a second set of eyes I'm willing to take a look.

Padgett
11-05-2021, 05:28 PM
Thank you but this ECU is wierd. The PWM for the coolant fans is one. Also the F7 trans is the only one I know before 1991 that has 2-3 and 3-4 shift solenoids so the ECM programming is like nothing I've seen before but has been a while.

Any help gratefully accepted, need to switch back from many years of 8088 & subs. Can send both .bin and zipped disassembly.

Severale $3FCO
L3F82 EQU $3F82
L3F84 EQU $3F84
L3F86 EQU $3F86
L3F88 EQU $3F88
L3F8A EQU $3F8A
L3F8E EQU $3F8E
L3F92 EQU $3F92
L3FAC EQU $3FAC
L3FAE EQU $3FAE
L3FB0 EQU $3FB0
L3FB2 EQU $3FB2
L3FB4 EQU $3FB4
L3FBA EQU $3FBA
L3FBC EQU $3FBC
> L3FC0 EQU $3FC0
L3FC2 EQU $3FC2
L3FC4 EQU $3FC4
L3FC6 EQU $3FC6
L3FCE EQU $3FCE
L3FD0 EQU $3FD0
L3FD2 EQU $3FD2
L3FD4 EQU $3FD4
L3FD6 EQU $3FD6
L3FD8 EQU $3FD8
L3FDC EQU $3FDC
L3FE0 EQU $3FE0
L3FE4 EQU $3FE4
L3FE6 EQU $3FE6
L3FE8 EQU $3FE8
L3FEC EQU $3FEC
L3FF2 EQU $3FF2
L3FF6 EQU $3FF6
L3FFA EQU $3FFA
L3FFC EQU $3FFC
L4000 EQU $4000

AFDF: 89 00 ADCA #$0000
AFE1: FE 3F C0 LDX L3FC0 <<<
AFE4: BD D9 58 JSR LD958
AFE7: 4D TSTA
AFE8: 27 05 BEQ LAFEF


Thank you,

Padgett

1project2many
11-05-2021, 05:58 PM
I can work from a .bin . You're welcome to attach it to this thread. If my disassembler has issues with it I'll ask for your copy. Nothing special about one over another, it's just a matter of familiarity.

Padgett
11-05-2021, 06:06 PM
OK will try. Let me know if works. Most forums do not allow .bins.
ps used to summer at Holderness/Squam Lake but was when the Old Man of the Mountain was still there.

1project2many
11-05-2021, 06:39 PM
OK will try. Let me know if works. Most forums do not allow .bins.
It worked. We definitely allow .bin files.



ps used to summer at Holderness/Squam Lake but was when the Old Man of the Mountain was still there.
That was quite a few years ago. I was out of state when the old man fell and it was hard to believe it had happened. The good news is the lake is still here. :)

Padgett
11-05-2021, 07:00 PM
Well I have a whole bunch of .bins, mostly $5B (3800) from when I first got deep into them at the turn of the century. ALDL computers are mostly easy unless something screwy like this.
What disassembler do you use ? I still use v1.4 of the CATS disassembler.

1project2many
11-06-2021, 02:29 AM
I use an old disassembler called Donald Whisnant's Code Seeking Disassembler. https://github.com/dewhisna/m6811dis

There's a newer version out there created / modified by his daughter, Donna Whisnant's Generic Code-Seeking Disassembler with Fuzzy-Function Analyzer https://github.com/dewhisna/gendasm . I imagine this one is helpful when you have sections of code repeated from one file to another but I have never tried it.

Plenty of folks use the Tunercat disassembler. It's a good tool.

1project2many
11-06-2021, 04:19 AM
Parallel code to the ignition code I posted earlier

LADB8: std L3FF2
std L196C
beq LADE1
subd L193A
lsld
lsld
lsld
sei
addd L194A
std L194A
ldd L3FFC
oraa #0x04
jsr LDAA8
std L3FFC

1project2many
11-06-2021, 04:46 AM
Using the BCC Lookup spreadsheet (http://gearhead-efi.com/gearhead-efi/doc/BCC%20lookup.xls), ANSU has a ScanID of 7096. Using Windows Calculator to convert this to hexadecimal, $1BB8 Opening the .bin in a hex editor we immediately find $1BB8 at L00 and L01. In the code we can find both 0001 and 8001 in several places so this will require more dective work tomorrow.

Padgett
11-06-2021, 10:50 AM
I only find L8000 in one place, at F55D

My disassembly looks a little different. ADB8 is the start of a subroutine and called from two places.
ADB8: FD 3F F2 LADB8 STD L3FF2
ADBB: FD 19 6C STD L196C
ADBE: 27 21 BEQ LADE1
ADC0: B3 19 3A SUBD L193A
ADC3: 05 ASLD
ADC4: 05 ASLD
ADC5: 05 ASLD
ADC6: 0F SEI
ADC7: F3 19 4A ADDD L194A
ADCA: FD 19 4A STD L194A
ADCD: FC 3F FC LDD L3FFC
ADD0: 8A 04 ORAA #$0004
ADD2: BD DA A8 JSR LDAA8
ADD5: FD 3F FC STD L3FFC
ADD8: BD DA A8 JSR LDAA8
ADDB: 84 FB ANDA #$00FB
ADDD: FD 3F FC STD L3FFC
ADE0: 0E CLI
ADE1: 39 LADE1 RTS

and is called from AD92 & AD9F

It has been a long time but is slowly coming back, used to be able to just whip through this. Thank you for your help it is appreciated.

BTW it looks like DASM91 only runs under Linux. I work mostly in Windows but have a couple of Linux machines (Manjaro, Ubuntu and Kali).

1project2many
11-08-2021, 05:26 AM
I'm still playing with this.

TC includes the raw hex data with the output as well as the instructions which can be helpful. ASLD and LSLD are the same instruction with the same opcode ($05). Those are the only differences I can see between disassemblies so far.

I'm attempting to locate the checksum routine to help determine the mask ID. No luck yet.

Padgett
11-08-2021, 06:30 PM
Well the whole preamble looks odd. Normally I would expect the Mask to be in 0008 and the checksum to be in 0006-0007 but it does not look that way. Here is a collection of Allante PROMs including the ANSU. So far nothing I've looked for has been there.

ps first three are 87-88 4.1 engine. ANSU is the 4.5 LQ6 engine used 89-92.

17256

1project2many
11-08-2021, 10:06 PM
Ok, time for a sanity check. The 7750 was used in Allante from '87 to '89. The 4.1 calibrations look consistent enough to work on disassembling but the 4.5 looks wrong. It may be completely unique but I really have to wonder because GM loved to re-use code. You can find the same code snippets in vehicles from the first CCC cars all the way to the ZR1. Even GM built race / custom vehicles from that period used stock code with trouble codes and emissions functions shut off. They may have created something unique for a one year only configuration vehicle but it seems strange when they already had working code for that ecm and vehicle.

Unfortunately it looks like there were only two calibrations for the 7750 / LQ6.
ANSU7126 and ANZR9603. If we had ANZR we could at least look for similar bytes in the preamble.

Out of curiousity, have you tried burning ANSU back into a chip to see if the ECM accepts it?

Padgett
11-09-2021, 02:45 AM
Interesting, I just reread the memcal and it came back slightly different.
Orig New
00000003: F2 8E
00000004: 07 0F
00000005: 54 43

Do have another 1989 but will need to remove from the car.

Padgett
11-09-2021, 04:28 AM
Meanwhile here are two for the 87-88 4100. The cars are the same and use the same oddball equipment. 4.5 is just a bored out 4.1.

Padgett
11-10-2021, 06:29 PM
Finding similar 3FC0 (RPM?) sequence in both AKAA and ANSU just different locations.
ANSU
A368: FE 3F C0 LDX L3FC0
A36B: CC 00 0F LDD #$000F
A36E: 03 FDIV
A36F: 3C PSHX
A370: 3C PSHX
A371: 32 PULA
A372: 33 PULB
A373: 04 LSRD
A374: 04 LSRD
A375: 04 LSRD

AKAA
A1C6: FE 3F C0 LDX L3FC0
A1C9: CC 00 0F LDD #$000F
A1CC: 03 FDIV
A1CD: 3C PSHX
A1CE: 3C PSHX
A1CF: 32 PULA
A1D0: 33 PULB
A1D1: 04 LSRD
A1D2: 04 LSRD
A1D3: 04 LSRD

1project2many
11-11-2021, 03:14 AM
Yes... and I'm finding the code is similar between the calibrations at other locations as well. So I have more faith that the version of ANSU you posted is valid. The challenge now is going to be working out details.

Padgett
11-11-2021, 05:49 AM
Thank you, things are coming back slowly to me just always worked with V6s before and V8s are a bit different. Just got PromEdit working again, makes it easy to search binary. Major difference should be the PWM coolant fan control and the solenoid shifting in the F7 transmission.