EE dissection

**Faceman** · 02-17-2015

Could you send me a soft copy of the programmers reference manual or can I download it?

Did anybody already read out the bootloader ROM of the two MCUs? Is there any interesting stuff inside? Of course not for operating the vehicle under normal conditions, but maybe other things?

**steveo** · 02-17-2015

I'm so close to a working flash tool right now; it reads but I bricked my spare ecm so work is on hold until I socket it.

**RobertISaar** · 02-18-2015

Originally Posted by Faceman

Could you send me a soft copy of the programmers reference manual or can I download it?

Did anybody already read out the bootloader ROM of the two MCUs? Is there any interesting stuff inside? Of course not for operating the vehicle under normal conditions, but maybe other things?

I'm certain I've uploaded them to the forum before, but I can't remember where.... either way, i'll see if I can attach them to this post.

barely squeaked under the size limit for a ZIP archive, should have both PDFs in it.

Originally Posted by steveo

I'm so close to a working flash tool right now; it reads but I bricked my spare ecm so work is on hold until I socket it.

I forget, were you working on LT1 only or was the V6 PCM included in that project as well?

**steveo** · 02-18-2015

I forget, were you working on LT1 only or was the V6 PCM included in that project as well?

i don't have V6 stuff to test with, so we're probably talking LT1 only.. but i betcha they're the same command set?

**RobertISaar** · 02-18-2015

similar, at least. simpler to implement, if I had to guess, since you don't have to try and communicate with only E or T and pass it information over SPI(since I think that is how the 94-95 LT1 PCM is setup, one side doesn't have a physical connection to the ALDL port? I might be thinking of the 93-95 northstar unit too.....). address E with $F4 and address T with $E4, I might have those reversed, though.

they run 32KB PROMs(mapped from 8000-FFFF as one would expect), the madtuner(and I assume tunercat as well) flashing software stacks them into a single 64KB BIN with the E-side first. I don't have many specifics beyond that, when I was working with him, madtuner figured out the upload/download routines while I dealt with finding stuff in the calibrations.

**steveo** · 02-18-2015

similar, at least. simpler to implement, if I had to guess, since you don't have to try and communicate with only E or T and pass it information over SPI(since I think that is how the 94-95 LT1 PCM is setup, one side doesn't have a physical connection to the ALDL port? I might be thinking of the 93-95 northstar unit too.....)

nah they're both pinned out to the aldl port for serial comms. it doesn't pass over SPI for flash routine.

each board has nearly identical code for flashing. you just flash one board, then flash the other.

the e-side is actually really talkative if you know where to poke at it, most of the diagnostic routines are there but many are nerfed or simply unfinished. i've only tested some flash routine related junk, mostly mode 0x06 and mode 0x0D.

**RobertISaar** · 02-23-2015

here's a screenshot of what you get with the P66 V6 when using the madtuner software, the VIN tab is the same for the 94-95 LT1, but you see a couple of different things here. with the P66 V6 all of this data can be grabbed with a single mode 1, message 4 request to the T-side. message 4 is almost entirely pulled from the T-side's processor's EEPROM.

E04-E13 stores the serial number
E20-E23 stores the calibration ID(which unless you/someone else modifies it, it appears to be the last factory calibration that was flashed to the PCM, good to know if you forget to pull the original BIN)
E24-E34 stores the VIN

that's all of the EEPROM data in that tab, the E-side and T-side part numbers are pulled from the E-side and T-side calibrations in the flash area from 8000-8003.

I imagine the LT1 stuff will be setup in a similar fashion.

**jthompson122183** · 10-17-2015

Transient fuel routine related tables

Code:

;--------------------------------------
; Fuel Boiling Time vs. Coolant vs. Map
; table size 5 x 15
;
; TBL = 100 * SEC'S
;--------------------------------------
ORG $26F2 ;

FCB 0 ; Min COOL Val
FCB 0 ; Min MAP Value
FCB 5 ; COL'S/ROW

;--------------------------------------------------
; -40 Deg C COOL
;
; Seconds Kpa MAP
;--------------------------------------------------
FCB 69 ; 0.690 20.0
FCB 86 ; 0.860 40.0
FCB 92 ; 0.920 60.0
FCB 98 ; 0.980 80.0
FCB 104 ; 1.040 100.0


;---------------------------------------
; Fuel on Cylinder Wall Multiplier Vs Cylinder time/DegK 
; Table Lines = 255
;
; TBL = 256 * Mult
;---------------------------------------
ORG $2740

L2740 FCB 255 ; 0.996 
L2741 FCB 255 ; 0.996 
L2742 FCB 254 ; 0.992 
L2743 FCB 253 ; 0.988


;--------------------------------------------------
; Puddle Limit vs. Filtered Airflow
; Table Lines = 17
;
; Table = .4096 * mgrams
;--------------------------------------------------
ORG $2893 

mgrams gms/sec Airflow
;----------------------------------
L2893 FCB 255 ; 623 0.0
L2894 FCB 255 ; 623 8.0
L2895 FCB 255 ; 623 16.0
L2896 FCB 255 ; 623 24.0
L2897 FCB 255 ; 623 32.0

Found that here http://ls1tech.com/forums/pcm-diagno...-has-ltft.html

also found this for explanation http://www.hptuners.com/forum/showth...A-how-to-guide
and this also http://www.hptuners.com/forum/showth...Transient-Fuel

**kur4o** · 10-18-2015

These are some really interesting links.
Thanks for digging them out.
Interesting, who is the author of this dissasembly.

**steveo** · 10-18-2015

that's awesome; those tables were always a huge question in my mind!

i'll put them in my next XDF for sure

**fbody_Brian** · 10-20-2015

Originally Posted by kur4o

These are some really interesting links.
Thanks for digging them out.
Interesting, who is the author of this dissasembly.

Very interesting! Wish there were more posts like that out there. Funny how it's a post from 04 yet it seems like new info.
It's so exciting to know that there's still more discoveries and tuning capabilities for the old LT1.

**steveo** · 10-20-2015

Originally Posted by fbody_Brian

Very interesting! Wish there were more posts like that out there. Funny how it's a post from 04 yet it seems like new info.
It's so exciting to know that there's still more discoveries and tuning capabilities for the old LT1.

that's the thing, the hackers ripped $ ee apart in the late 90s, then abandoned it because the ls1 is tastier and profitable. it makes it interesting. there arent many new discoveries.

I wish all work done back then was in the public domain, but we do have some scraps like this to pick at while guys like ku4ro and robert and me try to reinvent the wheel.

I do know that the o2 timing stuff that robert discovered is fairly fresh, though. ive analyzed a lot of bins and never really seen it modified.