Clear BLM data using Mode 4 with $0D

[sturgillbd]

I have been following the EE hacking thread and saw where stored BLM data is being cleared with with a Mode 4 command. I started digging into this for the PCM's that run the $0D mask. I have looked at the A217.ds file and there is nothing for Mode 4. Here is what I have found in the Disassembly for $0D:


;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
; Check for ALDL mode 4 (engine diags)
;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
;
LF3BF BRCLR L0042,#$01,LF3E3 ;Status word, bra if b0==0, not in ALDL mode 4
;
LDAA L0390 ;Load ALDL mode number (start of eng. diag. data
;buffer)
CMPA #$04 ;ALDL mode 4
BNE LF3E3 ;Bra if !=, not in ALDL mode 4
;
;-In ALDL mode 4 (Engine diags)
;
BSET L003B,#$10 ;Status word, set b4, in ALDL mode 4 (engine diag.)
;
;-Check if BLM reset requested
;
LDAA L0393 ;Load external request word from diag. buffer
BITA #$10 ;Test b4, reset BLMs
BEQ LF3E0 ;Bra if ==0, reset BLM command not sent
;
BRSET L0045,#$10,LF3E3 ;Status word, bra if b4==1, BLMs already reset
;
JSR LEF1D ;Routine to reset BLMs
;
BSET L0045,#$10 ;Set b4, BLMs reset
BRA LF3E3 ;Bra to continue
;
;-Here if reset not requested
;
LF3E0 BCLR L0045,#$10 ;Clear b4, BLM reset flag
;

How can I find what to send to the PCM in mode 4 to clear stored BLM data along with the message length. I am wanting to set it up as a macro in Tunerpro much like the Clear trouble Codes Macro.
Any insight would be greatly appreciated

Brian

[steveo]

seems mode 4 is always really simple, and incredibly useful, but one of the most poorly documented aldl modes for most masks.



LDAA L0393 ;Load external request word from diag. buffer
BITA #$10 ;Test b4, reset BLMs
BEQ LF3E0 ;Bra if ==0, reset BLM command not sent


you'll have to dig into the assembly a bit more to figure those things out. you will likely find other useful things.

i'd start by looking for other usages of L0393 in the disassembly to assist in finding where the mode4 request itself is processed. something stored a mode4 request byte there, and probably stores a bunch of other request bytes elsewhere.

[steveo]

i took a quick look and found $0D uses eleven mode4 command bytes offset from memory address 0x0391

so here's a memory address to byte number table



L0391 ; 1
L0392 ; 2
L0393 ; 3
L0394 ; 4
L0395 ; 5
L0396 ; 6
L0397 ; 7
L0398 ; 8
L0399 ; 9
L039A ; 10
L039B ; 11


your 0x0393 (the blm reset byte) maps to the third one.. so:

so a blm reset command: F4 61 04 00 00 10 00 00 00 00 00 00 00 00 [checksum]

this command is self-clearing, but many mode4 commands will stick around until you negate them with another mode4 command.

there are TONS of cool mode4 commands if you dig into the disassembly a bit more. now that you have that table, figuring out how to formulate the command should be easy.

[sturgillbd]

Thank you steveo! I will try to create the macro a little later this afternoon. I will also look through the disassembly at all of those addresses. I'll post my results later today.

Thanks again,
Brian

[sturgillbd]

I calculated the checksum and it seems to work. I created a macro based off what 93V8S10 had done for the current adx file. I just could find nothing on what the PCM replies after sending the command. Any idea what the PCM sends back? I guess I can try to do a serial capture to see the result. Attached are screenshots of what I did in Tunerpro.

[steveo]

ecm should afaik respond with a simple 0xF4 0x56 0x04 [checksum]

even though this isn't an LT1 and it wont 'connect' to it, eehack (in my signature) has a serial command testing tool on it's 'advanced' tab that would work for you. it calculates the length and checksum bytes for you.

you'll have to send a 'silence' request manually first, then the mode4 command within a few seconds (lucky there's two fields)

[sturgillbd]

If anyone else wishes to try this adx, It is attached to this post. This adx also logs calculated airflow through the engine vs rpm and map via history tables. I replaced the Prom ID in the datastream with calculated airflow from the disassembly in my bin. See http://www.gearhead-efi.com/Fuel-Injection/showthread.php?4647-Calculated-AirFlow for some basic details. It would be good if others can test this. Hopefully it works so you can clear BLM without having to remove the battery cable between VE adjustments.