Page 21 of 35 FirstFirst ... 11161718192021222324252631 ... LastLast
Results 301 to 315 of 511

Thread: Corvette CCM Reverse Engineering Anyone?

  1. #301
    Fuel Injected!
    Join Date
    Jul 2019
    Location
    Orange, CA
    Posts
    757
    If I'm reading the definition correctly, Mode 0 is "return everything to pre-tester state," while Mode 9 is "reenable regular ALDL polls." It would be interesting to know how they're actually differentiated in the CCM's BIN. I suppose it's possible that Mode 9 won't actually restore the digital dash functionality, for one.

    Anyway to get the $40 broadcast message you should have to send F157074071. The spec doesn't have any warnings about having to send a Mode 9 before that, so I assume that'll be unnecessary.
    Last edited by NomakeWan; 11-06-2021 at 11:58 PM.
    1990 Corvette (Manual)
    1994 Corvette (Automatic)
    1995 Corvette (Manual)

  2. #302
    Fuel Injected! spfautsch's Avatar
    Join Date
    Apr 2015
    Location
    Montgomery City, MO
    Age
    52
    Posts
    883
    Did some experimentation and it seems like the mode 9 resumes broadcasts according to what I would assume is a "default" scheduling program. My assumption is that it does not assume bus master role in this situation, but haven't been able to investigate further.

    I've got a lot more work to do here but I think it's progress. My logger wasn't sending a bus master / heartbeat message before, and once I added that the ccm shut the f up for a whopping 5 seconds before it sent a self-resume announcement, so I think there are things we can learn from this info.

    Code:
    7745:41 67 02 F1 00 4B 4C 01 00 83 C6 06 E3 00 3D FF FF 00 FF FF 62
    7748[F1 56 08 B1]
    7867:F0 56 F1 C9
    7869[F1 56 08 B1]
    7880:F1 56 08 B1
    7881[F1 56 F0 C9]
    13939:F1 56 00 B9
    13963:10 59 08 4B 02 00 42
    13990:40 57 FF FF 6B
    14163:10 59 00 4B 02 00 4A
    14191:40 57 FF FF 6B
    14363:10 59 00 4B 02 00 4A
    14391:40 57 FF FF 6B
    14563:10 59 00 4B 02 00 4A
    14590:40 57 FF FF 6B
    14764:10 59 00 4B 02 00 4A
    14791:40 57 FF FF 6B
    I'll keep plugging away at it when possible. I got a couple hours to experiment tonight, but probably wont see more time with the car until early Tuesday.

  3. #303
    LT1 specialist steveo's Avatar
    Join Date
    Aug 2013
    Posts
    4,002
    mode 9 resumes broadcasts according to what I would assume is a "default" scheduling program. My assumption is that it does not assume bus master role in this situation, but haven't been able to investigate further.
    it certainly should if it's following the rules

  4. #304
    Fuel Injected!
    Join Date
    Jul 2019
    Location
    Orange, CA
    Posts
    757
    Quote Originally Posted by spfautsch View Post
    Did some experimentation and it seems like the mode 9 resumes broadcasts according to what I would assume is a "default" scheduling program. My assumption is that it does not assume bus master role in this situation, but haven't been able to investigate further.

    I've got a lot more work to do here but I think it's progress. My logger wasn't sending a bus master / heartbeat message before, and once I added that the ccm shut the f up for a whopping 5 seconds before it sent a self-resume announcement, so I think there are things we can learn from this info.

    Code:
    7745:41 67 02 F1 00 4B 4C 01 00 83 C6 06 E3 00 3D FF FF 00 FF FF 62
    7748[F1 56 08 B1]
    7867:F0 56 F1 C9
    7869[F1 56 08 B1]
    7880:F1 56 08 B1
    7881[F1 56 F0 C9]
    13939:F1 56 00 B9
    13963:10 59 08 4B 02 00 42
    13990:40 57 FF FF 6B
    14163:10 59 00 4B 02 00 4A
    14191:40 57 FF FF 6B
    14363:10 59 00 4B 02 00 4A
    14391:40 57 FF FF 6B
    14563:10 59 00 4B 02 00 4A
    14590:40 57 FF FF 6B
    14764:10 59 00 4B 02 00 4A
    14791:40 57 FF FF 6B
    I'll keep plugging away at it when possible. I got a couple hours to experiment tonight, but probably wont see more time with the car until early Tuesday.
    What is an F0 mode? An undocumented feature of the CCM?

    Also why is your logger attempting to send a Mode 8 request before the CCM sends an F0 external device poll?
    1990 Corvette (Manual)
    1994 Corvette (Automatic)
    1995 Corvette (Manual)

  5. #305
    Fuel Injected! spfautsch's Avatar
    Join Date
    Apr 2015
    Location
    Montgomery City, MO
    Age
    52
    Posts
    883
    Quote Originally Posted by NomakeWan View Post
    What is an F0 mode? An undocumented feature of the CCM?
    That's the tester announcing it's bus master? May not be needed since wasn't used for the log I made two days ago.

    Quote Originally Posted by NomakeWan View Post
    Also why is your logger attempting to send a Mode 8 request before the CCM sends an F0 external device poll?
    That was me doing a stupid in the message pump "logic".

    steveo you must not have had enough tequila when you were testing the mode 7 stuff. Works just as expected for me with ccm silenced.

    Code:
    138337[F4 57 01 00 B4]
    F4 92 01 00 00 00 00 00 00 00 00 7C 3E 00 04 06 40 00 02 2F 0B C5 0D 4C 27 5E 83 4D 28 20 4F 19 00 8F F1 DC D8 65 A8 10 86 88 80 80 00 A0 00 A4 05 8A 00 38 14 1A 00 04 CD FF 00 00 00 00 6B 43
    138434[F1 57 07 10 A1]
    10 59 00 5E 27 00 12
    138452[F1 57 07 40 71]
    40 57 FF FF 6B
    41 67 27 51 00 5E 4D 01 04 05 DC BF E3 00 3F FF FF 00 FF FF 72
    138497138499[F1 56 F0 C9]
    F4 57 01 00 B4
    138509[F4 57 01 00 B4]
    F4 92 01 00 00 00 00 00 00 00 00 7C 3E 00 04 06 40 00 02 57 0B 8E 0D 4C 28 5E 83 4D 28 20 53 19 00 8F F1 DE D8 65 A9 10 86 88 80 80 00 A2 00 A5 05 85 00 38 14 19 00 04 CD FF 00 00 00 00 6C 4C
    Gauges were updating and average fuel consumption started dropping while it was idling so I think this will work great. Just need to fine tune things and make it handle when the PCM shuts down gracefully, loss of sync, etc.
    Attached Files Attached Files

  6. #306
    Fuel Injected!
    Join Date
    Jul 2019
    Location
    Orange, CA
    Posts
    757
    Quote Originally Posted by spfautsch View Post
    That's the tester announcing it's bus master? May not be needed since wasn't used for the log I made two days ago.
    You are correct, it's unnecessary. The F0 poll is not "announcing bus master," it is "CCM is seeking external devices who wish to become bus master." It is not a mode, it is a unique device ID only used for this single poll (similar to the $10, $40, and $41 polls).

    Quote Originally Posted by spfautsch View Post
    That was me doing a stupid in the message pump "logic".
    Fair enough. A lot of ADS/ADX files do the same thing; just blast the bus with Mode 8 rather than wait for the F0 and reply to that directly. Easy enough fix.

    Quote Originally Posted by spfautsch View Post
    steveo you must not have had enough tequila when you were testing the mode 7 stuff. Works just as expected for me with ccm silenced.

    Code:
    138337[F4 57 01 00 B4]
    F4 92 01 00 00 00 00 00 00 00 00 7C 3E 00 04 06 40 00 02 2F 0B C5 0D 4C 27 5E 83 4D 28 20 4F 19 00 8F F1 DC D8 65 A8 10 86 88 80 80 00 A0 00 A4 05 8A 00 38 14 1A 00 04 CD FF 00 00 00 00 6B 43
    138434[F1 57 07 10 A1]
    10 59 00 5E 27 00 12
    138452[F1 57 07 40 71]
    40 57 FF FF 6B
    41 67 27 51 00 5E 4D 01 04 05 DC BF E3 00 3F FF FF 00 FF FF 72
    138497138499[F1 56 F0 C9]
    F4 57 01 00 B4
    138509[F4 57 01 00 B4]
    F4 92 01 00 00 00 00 00 00 00 00 7C 3E 00 04 06 40 00 02 57 0B 8E 0D 4C 28 5E 83 4D 28 20 53 19 00 8F F1 DE D8 65 A9 10 86 88 80 80 00 A2 00 A5 05 85 00 38 14 19 00 04 CD FF 00 00 00 00 6C 4C
    Gauges were updating and average fuel consumption started dropping while it was idling so I think this will work great. Just need to fine tune things and make it handle when the PCM shuts down gracefully, loss of sync, etc.
    Sweet! Just as an experiment, try sending this message to the bus after silencing the CCM and see what happens. I'm not sure if it will work, but if it does it'll save one message frame.

    F4570741AE

    If this works, it'll skip the step of asking the CCM to send the $40 poll and just tell the PCM to send the $41 response directly. I don't know if the PCM will actually honor the Mode 7 request, and if it does, I don't know if the CCM will actually accept the resulting $41 poll when it wasn't the one that solicited it. But it's worth a shot!
    1990 Corvette (Manual)
    1994 Corvette (Automatic)
    1995 Corvette (Manual)

  7. #307
    Fuel Injected! spfautsch's Avatar
    Join Date
    Apr 2015
    Location
    Montgomery City, MO
    Age
    52
    Posts
    883
    Quote Originally Posted by NomakeWan View Post
    Fair enough. A lot of ADS/ADX files do the same thing; just blast the bus with Mode 8
    My intention was to try sending a mode 8 after seeing the 41 message from the PCM that was initiated by mode 9. But I didn't have the message pump accounting for whether it had silenced the CCM or sent a mode 9 yet. Didn't work either way. Apparently the CCM will only honor a mode 8 request for a short time after sending the f0f1 heartbeat.

    Quote Originally Posted by NomakeWan View Post
    F4570741AE
    Wouldn't that be F4 57 07 41 6D? And no luck either way.

    This should work nicely. I can separate the 10 and 40 requests between six or eight logging messages so the 07/40/41 exchange isn't adjacent and thus lose slightly less time logging.

  8. #308
    LT1 specialist steveo's Avatar
    Join Date
    Aug 2013
    Posts
    4,002
    steveo you must not have had enough tequila when you were testing the mode 7 stuff. Works just as expected for me with ccm silenced
    you're right
    flashhack is too strict
    it was rejecting the reply as the request/reply first byte has to match in flashhack land
    makes sense if idle traffic isn't present but otherwise not

  9. #309
    Fuel Injected!
    Join Date
    Jul 2019
    Location
    Orange, CA
    Posts
    757
    Quote Originally Posted by spfautsch View Post
    Wouldn't that be F4 57 07 41 6D? And no luck either way.

    This should work nicely. I can separate the 10 and 40 requests between six or eight logging messages so the 07/40/41 exchange isn't adjacent and thus lose slightly less time logging.
    You are correct, it's 6D. I'm not sure what my calculator was doing. I must've fat-fingered one of the bytes while doing the addition step. Good catch, and thanks for running the experiment! Looking forward to seeing what your logging comes up with. Being able to log data from the PCM without messing up the dash and the ABS/ASR would be very nice indeed.
    1990 Corvette (Manual)
    1994 Corvette (Automatic)
    1995 Corvette (Manual)

  10. #310
    Fuel Injected! spfautsch's Avatar
    Join Date
    Apr 2015
    Location
    Montgomery City, MO
    Age
    52
    Posts
    883
    I've found eehack's raw cmd function great for this - saved me from finding / building something on my own. No need to be connected to the ALDL to send / see the checksum byte.

    Today's logging was off a good bit on avg mpg. 23.0 actual / 24.3 by the dic (including 60 miles w/o logging) and then 25.8 actual / 22.1 by dic on the return trip (only 60 miles).

    I'll have to do some more test-drives with different ratios of PCM polling to CCM traffic. That'll be a tall order with the time change and winter coming. I hate driving this thing at night because the deer-infested winding back-roads will be calling out to me to avoid the mind-numbing monotony of sitting in interstate gridlock.

    Whatever the case, the dic-based fuel consumption stuff isn't all that terribly important to me. The gauges work and everything else does so I'm happy with it given that I can make logging to a SD card works. Ordered a logging shield with RTC today, hope to have it in a couple.

    I'll need to figure out handling when the ASR / ABS barges into ALDL communications and gracefully reconnecting. Beyond that it should be completely unnoticeable.

    Have the VIN / patch / auto trans / maf discovery figured out for the most part. Though I might just remove the e-side / maf check altogether since it's not really relevant to passive logging and doesn't work with the engine running anyway.

  11. #311
    Fuel Injected!
    Join Date
    Jul 2019
    Location
    Orange, CA
    Posts
    757
    I'm actually not entirely sure how the ABS/ASR thing works, so good luck. I know that it freaks out and throws a Code 72 when you connect a scan tool like a Tech 2 or EEHack, but I'm not entirely sure why since you shouldn't actually be telling it to shut up and it isn't supposed to talk unless spoken to (by the CCM). I haven't done any raw idle logging while driving, however, so it's entirely possible that's why I haven't seen any traffic from it. I will point out however that the GM definition I have states it's not supposed to actually talk on the bus unless the CCM specifically requests it to.

    So hey, another mystery to solve!
    1990 Corvette (Manual)
    1994 Corvette (Automatic)
    1995 Corvette (Manual)

  12. #312
    Fuel Injected! spfautsch's Avatar
    Join Date
    Apr 2015
    Location
    Montgomery City, MO
    Age
    52
    Posts
    883
    eehack will send a F9 mode 8 command if the 'silence extra modules' is checked. This is what causes the MIL on the ASR / ABS module (currently known as the EBTCM module).

    As memory serves, I was seeing eehack disconnect after an ASR event. My assumption was that the module was barging in with a message and stepping on messages currently in progress. So I had steveo leave this option enabled on y bodies by default. This was back in 2015-ish. I never ran an idle scan to prove it, perhaps this will be my chance to solve that mystery.

    I suspect the (calling it) EBTCM module is sending a message that it has intervened with throttle control. Possibly a precursor to the modern stuff where these modules only interact over canbus. But that's just my suspicion.

  13. #313
    Fuel Injected!
    Join Date
    Jul 2019
    Location
    Orange, CA
    Posts
    757
    Quote Originally Posted by spfautsch View Post
    eehack will send a F9 mode 8 command if the 'silence extra modules' is checked. This is what causes the MIL on the ASR / ABS module (currently known as the EBTCM module).

    As memory serves, I was seeing eehack disconnect after an ASR event. My assumption was that the module was barging in with a message and stepping on messages currently in progress. So I had steveo leave this option enabled on y bodies by default. This was back in 2015-ish. I never ran an idle scan to prove it, perhaps this will be my chance to solve that mystery.

    I suspect the (calling it) EBTCM module is sending a message that it has intervened with throttle control. Possibly a precursor to the modern stuff where these modules only interact over canbus. But that's just my suspicion.
    According to what I've found so far, only the Delco ABS on the F-body actually does that; it sends a message over the UART to the PCM telling it about ASR events. This PCM function is disabled on Y-Body calibrations.

    I am super curious about your experiment however!
    1990 Corvette (Manual)
    1994 Corvette (Automatic)
    1995 Corvette (Manual)

  14. #314
    LT1 specialist steveo's Avatar
    Join Date
    Aug 2013
    Posts
    4,002
    eehack uses that silence f9 command because another logging tool uses it and one of my users had convinced me it was necessary
    i'd never proven it and had no trouble without it on my 1994 or 1995 fbody
    eehack was written on both a test bench and in a 1997 body with an 8051 ecm straight wired to the aldl so 'the rest of the bus' was never something i worried about when first developing it

  15. #315
    Fuel Injected! spfautsch's Avatar
    Join Date
    Apr 2015
    Location
    Montgomery City, MO
    Age
    52
    Posts
    883
    Quote Originally Posted by steveo View Post
    eehack uses that silence f9 command because another logging tool uses it and one of my users had convinced me it was necessary
    I'm fairly certain I was that user. Will keep you posted if I find it necessary with my logger project.

    So here's an arduino sketch (mega 2560 minimum required due to 2+ hardware serial ports) to log to an SD card in a Y-body. Representative logfiles included. As with my previous example sketch, this is a minimalist, down-and-dirty representation of functionality. I will probably not post a lot more about it unless there are users with interest, but wanted to put it up for the possible benefit of NomakeWan. At the very least it will demonstrate how to use a hardware timer / counter (timer 3 on the mega) to implement a delay between ALDL receive and microcontroller transmit.

    This grabs data from the ALDL and the DIY-LTCC simultaneously and writes to an SD card. I'm particularly proud of the .eedata file creation. Even while requesting some CCM broadcast data between the PCM requests that eehack would normally ask for, I'm seeing an .eedata file with roughly the same acquisition rate as eehack manages while completely silencing the CCM. I've no idea how accurate the fuel consumption data is, but the primary fundamentals of the "black box logger" concept have been satisfied.

    I think I have no further use for the reman CCM steveo. NomakeWan if you'd like to use it coordinate with steveo. Otherwise steveo, hang on to it for the immediate future. I would like to have it back eventually, but currently have a "date" with a paint gun, waterproof sandpaper, and the such for the next few months.
    Attached Files Attached Files

Similar Threads

  1. car bogs down when switching into reverse/D
    By CAMMED LT1 in forum GM EFI Systems
    Replies: 4
    Last Post: 09-27-2021, 12:34 AM
  2. 12212156 code reverse engineering project in Ghidra
    By dzidaV8 in forum OBDII Tuning
    Replies: 8
    Last Post: 01-13-2020, 11:04 AM
  3. Help!! 93 Lt1 6M Reverse lockout
    By noeysuarez in forum GM EFI Systems
    Replies: 3
    Last Post: 09-14-2017, 08:17 AM
  4. 4l60e reverse boost valve location and procedure
    By JTodd in forum Introductions
    Replies: 1
    Last Post: 04-19-2013, 01:20 AM
  5. T56 reverse lockout options with TBI PCM
    By CDeeZ in forum GM EFI Systems
    Replies: 1
    Last Post: 02-26-2013, 05:06 PM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •