Corvette CCM Reverse Engineering Anyone?

[NomakeWan]

Yeah, the trip going to 0.0 was totally expected. That's why I thought initially that I had somehow gotten into trip mode instead. Only to flip over and realize no, that was the normal odometer reading "0" with no decimals, and no trip. Every other gauge on the dash worked fine.

Trust me, I was totally shocked. And I'm absolutely kicking myself for not grabbing my laptop and plugging in right then and there. While I'm glad that my CCM isn't magically corrupted, I'm also irritated that I didn't confirm Mode 5 while the dash was reading 0 miles...

[spfautsch]

It's just a hobby, don't let missed opportunities trouble you.

After additional thought I wonder if you might have inadvertently "glitched" the ccm's boot process while connecting the charged battery (a process that is generally very hit-and-miss with plenty of arcing when the bolt makes contact). This takes me back to the satellite card days when the hacker du-jour was to switch the card's power / vcc line to ground at strategic times after power-on in an attempt to cause the bootloader to skip critical instructions. For the Y body ccm the spot you might have skipped was the region where the eeprom was copied to ram.

Unfortunately and likewise, life events have made it so I won't be bringing the C4 home this winter for paint and other final restoration processes as was originally planned. So I won't be quite as able + motivated to work on it as I likely will be to continue working on my 0411 programs for ecmhack and doing minor restoration repairs on the C5. I'd really like to get the C4 "done", but my employer is moving in the coming months and I'm going to need reliable transportation throughout that process and my "plan a" for that resource (reliable transpo) was just recently flushed down the bowl.

[steveo]

if we knew why it happened and it was reproducible it would be handy, but it must be a rare fault. you don't see a lot of cars rolling themselves back from a dead battery.

[AngryCorvair]

Edit: Since I just moved it, I know where my test bench cables are at, and I just happen to have a ccm thanks to AngryCorvair that I don't know the passkey value to (maybe I do, but I'll pretend I don't). Probably won't have a chance to do that until late tomorrow evening.

My apologies for the very late reply to this. I still have the steering column and keys for the CCM donor car, so I can get you the resistance value on Thursday 12/8. I'm away from home ATM.

C4 Options.jpg

EDIT: I wrote that reply when i was back on page 27. now that i'm fully caught up I see you already figured out the passkey on my (now your) CCM. I'll add a pic of the option code sticker in case any of that info would help.

[-=Jeff=-]

NomakeWan,

that particular corvette is not named Christine or is red by chance is it?

[NomakeWan]

Hahaha, nah, she doesn't have a name yet and is arctic white. But every so often, yeah, she does do some weird shit.

Just fired it up yesterday to move it out of the driveway so I could work on our race car, zero issues. Looks like my previous issue was indeed just a defective battery. Which is sad since the production date on it was May 2022. Guess they don't even make lead-acid batteries the way they used to anymore.

[-=Jeff=-]

So it warmed up enough to get out in the garage to try some stuff. I was using NoMakeWAN's Arduino code to see how well I can just read the bus and grab the data.. that was not working too well. it would see the data but get cut off or never be on the 0 index. I tried changing it around to read 2 bytes of data then read more data once it matched the first 2. but that did not seem to work. I will revisit it again and see if I can get that to work. I did get something working with printing data out to the serial port which slows it down quite a bit of course, but I don't need super fast data for it either. so right now I have something, but will play around with it some more and see if I can get it working without having the serial (to usb) print commands.

[-=Jeff=-]

1991 CCM installed in my 1990 thanks to those in this thread.. https://youtu.be/AUCy_FxxNGg

Before anyone asks about the LCD, I have the interface board from BATEE, that allows the later LCD to be used in an Early car, which I prefer

Also I have my 'Monitor' working.. I am using my Arduino DUE with the current setup I have but added a page. then I am using a Mega to read the ALDL Data and then I send a subset of the data to the DUE to be displayed.. I am thinking I might just send the whole message from the Mega, but not sure I need everything from it yet

edit: added photos

[NomakeWan]

Interface board? I don't recall seeing such a thing on BATEE. As someone who also owns a 90 I'm quite curious.

Congrats on successfully swapping in the '91 CCM!

[-=Jeff=-]

Interface board? I don't recall seeing such a thing on BATEE. As someone who also owns a 90 I'm quite curious.

Congrats on successfully swapping in the '91 CCM!

Not on his website but is offered.. $100 I believe, email him and ask for it.

[NomakeWan]

Some initial theory how it works.

Pcm responds for 2 seconds with 0000 at reset. Maybe some time for initialization.

Ccm sends seed to pcm.
Pcm process seed and convert to key. Respond with some random timer data.
ccm sends key
pcm matches precalculated key with ccm key. If all good pcms sends FFFF.

I think if the pcm response with ffff, that might fool that all is good. Anyway it is the pcm that needs to start the engine. CCm doesn`t care much.

Steveo you can give it a try with some fake pcm responses.

I wanted to bring this post back to say that it's precisely correct. I was looking through my FSM while analyzing a totally separate system and stumbled onto this description of the FEDS security system buried in one of the chapters:

feds1.jpg feds2.jpg

So it would appear that the "FFFF" response from the PCM side is "...a message noting that FEDS has been successfully completed is sent to the CCM."

[-=Jeff=-]

That is a good find!!

As for my project, it has been on hold due to weather and other things I needed to address on the car. I have a logger setup like spfautsch (hardware) but in the interim I will be using a variation of what NomakeWAN had done. I just need to wire it in and find a good spot to get 12v for the Mega. This will get me the Digital Coolant Display I am after. Long term I like the idea of logging data if the logger version spfautsch has proves out. I should be able to mess with that over the summer while the car is out.

[-=Jeff=-]

I think this is still CCM related..

First, I was looking to do the Arduino Datalogger that spfautsch has, but I was going to tweak it for my car. Well that is still a plan, just not right now. I want to play with it a bit an get it working then I will implement it in the car, hopefully.

That said, I kept my Arduino DUE/Screen in the car and added some basic stuff on an Arduino, based on NomakeWan's previous CCM simulator I changed it around to read the data off the ALDL and then send it to my DUE. now the Serial communication to the DUE is 115.2K baud, I could probably go faster, but I am bottle necked at 8192 either way that seemed to work, I used a Bidirectional level shifter to interface between the MEGA and DUE. now I got it working but oddly enough the info I got form NomakeWan showed some details of converting the temperatures.. the Data sheet show the 1 count= .75 degrees C. so with that and the 0-255 converts to -40 to 151. I did the formulas and tested in my car. but the temperature read wrong, then I did Celcius (counts *.75), still wrong. oddly enough the correct conversion was Count = Degrees F (or within a degree). Still scratching my head on that one, but here is a link to a quick Youtube with the correct Temps and my pressing the Throttle (key on Engine off)

I confirmed the temps on the display with my IR temp gun on the Coolant ports near my Temperatures sensors. this will work for me this summer..


https://youtu.be/PecCOdT0dl4

[NomakeWan]

That's very strange indeed. All the code in the car itself uses metric measurements for temperatures, and I have confirmed via the ADX files for 1990-1996 that the equation never changed from 1990, which was "Count x 0.75 - 40 = Deg C". In fact, if you test my original unaltered code in your car you can confirm this for yourself.

My code was originally designed as a proof-of-concept to allow someone to make the CCM happy while spoofing the coolant temp. If you set the coolant temp value in my code to CD (205 counts), the dash should display 236.75F (I forget if it rounds up or down). This is because 205 x 0.75 - 40 = 113.75C, which is 236.75F.

[-=Jeff=-]

That's very strange indeed. All the code in the car itself uses metric measurements for temperatures, and I have confirmed via the ADX files for 1990-1996 that the equation never changed from 1990, which was "Count x 0.75 - 40 = Deg C". In fact, if you test my original unaltered code in your car you can confirm this for yourself.

My code was originally designed as a proof-of-concept to allow someone to make the CCM happy while spoofing the coolant temp. If you set the coolant temp value in my code to CD (205 counts), the dash should display 236.75F (I forget if it rounds up or down). This is because 205 x 0.75 - 40 = 113.75C, which is 236.75F.

I totally agree with you. It confused the hell out of me. I had it, I checked it 2 or 3 times. it should have worked that way for for some weird unknown reason it is not that way. Like I said I was checking it with my IR temp gun too, I will look at the code again just to be sure I am not going crazy, but it looks to be the 'wrong' way