Page 21 of 24 FirstFirst ... 11161718192021222324 LastLast
Results 301 to 315 of 349

Thread: Anyone worked with the 16196397 yet?

  1. #301
    Fuel Injected!
    Join Date
    Jun 2015
    Age
    36
    Posts
    354
    Excellent. I'll attempt that this evening.

  2. #302
    Fuel Injected!
    Join Date
    Jun 2015
    Age
    36
    Posts
    354
    Still dont' have the hang of this XDF patching thing. I can patch it via hex editing and the wideband stuff *works*, I just need to get the value into the normal datastream instead of the E-side only datastream now. Once that's done, wideband support is in.

    Boost code has possibly been fixed but since I can't get the XDF patching to work, I'm afraid to dive in and start hex-editing that many lines in so many places, especially with the wierdness in locations between the XDF patch and the patch notes.

  3. #303
    Fuel Injected!
    Join Date
    Jun 2015
    Age
    36
    Posts
    354
    So here is the big issue right now. I have NO idea if the patch has different locations in it, or if the XDF needs offsets added/subtracted to make sense of the split-bin thing, but the locations that are edited in the XDF are VERY different than the locations being called for in the patch notes.

    I have attached the new attempt at getting the data transferred across the from E-side to T-side, but when I go to edit the patch in the XDF, I find a LOT of things very different.

    For example, the line that changes the spark table to 0-6400RPM:

    Patch Notes:
    4D5A:
    $65 65 ;changes spark table to 0-6400RPM range

    Actual XDF Patch:
    4D5A:
    New Data: 65 Old data: 61

    That looks OK...

    Then we get to the next few lines:

    Patch Notes:
    Code:
    1BAR emulation
    
    99D6:
    JSR L9410			BD 94 10
    
    9BC3:
    JSR L9410			BD 94 10
    
    BD10:
    JSR L940D			BD 94 0D
    
    CCA1:
    JMP L942F			7E 94 2F
    
    
    940D:
    LDAA L1031			B6 10 31
    But then looking at the locations in the XDF:

    99D6 seems to line up with 19D6
    9BC3 seems to line up with 1BC3
    BD10 seems to line up with 3D10
    CCA1 seems to line up with 4CA1
    940D seems to line up with 140D

    But I have no way to really know...and patching the wrong sections of code means certain death to another PCM. I'd really rather not go through the process of disassembling the PCM again and burning the FLASH chips and re-assembling the PCM again-it isn't all that reliable and so far none of the socketed PCMs work exactly the same as they used to. They *work*, but Winflash complains about wrong responses at the end of the flash, wheras the stock unsocketed PCMs never complain.

    If I can get the boost patch to work, and figure out if there is an offset for E-side code or if the numbers are just a bit off, then I can go ahead and write in the patch for the wideband sensor and get that going in the XDF as well.
    Attached Files Attached Files

  4. #304
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,470
    You defenitely need to add offset at the xdf.
    The e and t side are actually 64kb bins each at the dissasembly. They are shrinked to 32kb. The processor sees 32kb empty space + 32 kb data. The data starts at $8000.
    I guess at the xdf you need to compare addresses and do proper offset.
    The rule will be add +$8000 for the first side of the full bin and keep the address at the second part of the bin, since it is already offsetted by $8000.

    You can check my dissasembly to get started with the offsets. E and T bins are with added empty space to make full 64kb.
    The dissasembly is not full, I needed it only to hack to the PCM to drive PWM fuel gauge. Luckily there were one empty channel I could use. I think I identified all empty pins and corresponding software addresses.

    For the tunercat flash I also got only troubles using it. It is almost imposiible to flash if the PCM is on car. In the bench it works almost all the time.
    You can try different brand sockets and triple check all solder joints. Don`t push the chip all the way down in the socket. Put some plastic spacer and make sure the chip is flush with the edge of the socket.

    So far I only flash on bench or remove chips and burn them with a programer

    We should complaint with tunercat to make more stable flash version.
    Attached Files Attached Files

  5. #305
    Fuel Injected!
    Join Date
    Jun 2015
    Age
    36
    Posts
    354
    I have very few problems with winflash, just if I am using anything other than a bone stock BIN in a non socketed pcm the last character returned by the PCM isn't what winflash to wants to hear and it complains...stuff still works though.

  6. #306
    Super Moderator
    Join Date
    Mar 2011
    Location
    Camden, MI
    Age
    35
    Posts
    3,026
    Quote Originally Posted by Xnke View Post
    So here is the big issue right now. I have NO idea if the patch has different locations in it, or if the XDF needs offsets added/subtracted to make sense of the split-bin thing, but the locations that are edited in the XDF are VERY different than the locations being called for in the patch notes.
    yes, there is offsetting going on due to the E-side being packed into the first 32KB of the combined BIN. T-side doesn't have this issue and all addresses are accurate to their native location.
    1995 Chevrolet Monte Carlo LS 3100 + 4T60E


  7. #307
    Fuel Injected!
    Join Date
    Jun 2015
    Age
    36
    Posts
    354
    I'm on my way out to the combustion lab now-will be loading the new patch and seeing if I got it right or I bricked another PCM!

    There is still one more E-side-to-T-side SPI transfer slot left-I am hoping to use that to get the wideband value moved over if this works.

  8. #308
    Super Moderator
    Join Date
    Mar 2011
    Location
    Camden, MI
    Age
    35
    Posts
    3,026
    even if that last slot wouldn't be available, it wouldn't be difficult to either use just the E-side ADX when dialing in the fuel calibration or change the standard ADX to grab a frame from the E-side that has been modified to include the wideband value(preferably the shortest length message to keep log rate up).

    sorry about the lack of communication, there's been a hell of a curveball thrown at work... one person getting fired for sexual harassment has thrown most of the shop into chaos, combined with a sudden workforce reduction on the 1st and 3rd shifts, now our shift has to pick up the slack.
    1995 Chevrolet Monte Carlo LS 3100 + 4T60E


  9. #309
    Fuel Injected!
    Join Date
    Jun 2015
    Age
    36
    Posts
    354
    No problem man. The boost patch I just tried does not work at all, so back to the drawing board.

    It's basically the patch you sent in the codebase .zip, but I changed the values that were used to send the stuff across the SPI-The values are being updated now, but they're very erratic and I probably got some operators wrong or something. Maybe I switched 2-bar map and emulated 1 bar map? I dunno.

    More logs and data soon.

  10. #310
    Fuel Injected!
    Join Date
    Jun 2015
    Age
    36
    Posts
    354
    Ok. So, it doesn't work at all. BUT! Winflash doesn't complain about the PCM giving a wrong response at the end of flashing it, so that's a plus.

    Current BIN: NoVats94 F manualpatchtest.bin

    Current XDF: P66 V6-modded by jake(1).xdf

    Current ADX: E-side only P66V6_1.adx

    Current Log: Oopstest.xdl

    Patch Data: new boost coderevision2.txt

    Take a look through the patch data and see if I did something stupid-I also have the patch entered into the XDF but when I first attempt to patch a virgin BIN, it says patch data indeterminate, so I may have screwed something up there too. I don't know.
    Attached Files Attached Files
    Last edited by Xnke; 06-04-2017 at 01:57 AM.

  11. #311
    Carb and Points!
    Join Date
    May 2017
    Location
    Perth, Western Australia
    Age
    37
    Posts
    6
    So there's a few issues with the patch:
    The JSR instruction target address needs to be corrected.
    patch prob 2.jpg
    patch prob.jpg
    Also that .adx isn't working properly
    ADX.png
    The attached spreadsheet is based on the raw data from the XDL log file..
    oops log.xls

  12. #312
    Fuel Injected!
    Join Date
    Jun 2015
    Age
    36
    Posts
    354
    well, since BA47 is only two bytes, I'll have to make a jump to insert my three byte modification, right?

    The JSR target address is a goof I made I think, something related to the offset? instead of jumping to 9458, should I instead jump to 1458? That's where the new spark table code is inserted into the blank space. So at CD5B, I currently have "7E 94 58" but when I subtract the address offset that means CD5B becomes 4D5B. Which also means that location 9458 becomes 1458. Right now 9458 is something to do with main spark table, but 1458 is blank space that I put in some instructions to do the 2bar map stuff. Should I change, at location CD5B, to "7E 14 58" ??
    Last edited by Xnke; 06-05-2017 at 12:25 AM.

  13. #313
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,470
    Quote Originally Posted by Xnke View Post
    well, since BA47 is only two bytes, I'll have to make a jump to insert my three byte modification, right?

    The JSR target address is a goof I made I think, something related to the offset? instead of jumping to 9458, should I instead jump to 1458? That's where the new spark table code is inserted into the blank space. So at CD5B, I currently have "7E 94 58" but when I subtract the address offset that means CD5B becomes 4D5B. Which also means that location 9458 becomes 1458. Right now 9458 is something to do with main spark table, but 1458 is blank space that I put in some instructions to do the 2bar map stuff. Should I change, at location CD5B, to "7E 14 58" ??

    You shouldn`t do that. It will mess the code. Use +$8000 offset only when you add the patch in tunerpro.
    At the bin you should keep the relative address location. On e and t side they both start at 8000 relative address.
    0-2000 is only used as RAM memory. 2000-8000 is empty memory or memory shared with other processors on the board, since I have seen jumps in that region.

  14. #314
    Carb and Points!
    Join Date
    May 2017
    Location
    Perth, Western Australia
    Age
    37
    Posts
    6
    Quote Originally Posted by Xnke View Post
    well, since BA47 is only two bytes, I'll have to make a jump to insert my three byte modification, right?

    The JSR target address is a goof I made I think, something related to the offset? instead of jumping to 9458, should I instead jump to 1458? That's where the new spark table code is inserted into the blank space. So at CD5B, I currently have "7E 94 58" but when I subtract the address offset that means CD5B becomes 4D5B. Which also means that location 9458 becomes 1458. Right now 9458 is something to do with main spark table, but 1458 is blank space that I put in some instructions to do the 2bar map stuff. Should I change, at location CD5B, to "7E 14 58" ??
    The addresses are all correct, they are absolute, definitely do not subtract 0x8000.
    Apologies, there is an extra line of code that is never executed that was confusing me:
    ROM:CD5E BD 94 60 jsr loc_945F+1 ; main spark table
    you could replace this instruction with NOPs to avoid confusion.
    you can do this to avoid having to jump around:
    at BA44:
    F6 03 69 : ldab byte_369
    FD 01 B3 : std byte_1B3
    48 : asla (we put acca into byte_1B3, so we add acca to itself. ie multiply by 2)
    01 : nop
    ------
    BA4C:
    1B : aba (as per before)

  15. #315
    Fuel Injected!
    Join Date
    Jun 2015
    Age
    36
    Posts
    354
    Here's the results of today:

    Now, I see no MAP values other than 10.35kpa, and Baro values are stuck at 95kpa, and even looking directly at the E-side values, they never change or are updated. It's like the new code isn't even being executed at all.

    I can't get the actual raw values (by putting them into the mode 1 message 0 stream) to give data-which is why I don't think they're actually being executed. That's why I loaded the E-side ADX, I filled in value 49 and 50 from the ALDL message table with the 0369 and 036A values, which should be RawMAP and MAP map exceeds 1BAR, and you'll see the MAP exceeds 1 bar flicker a moment but never does the RAW ECM MAP value change.
    Attached Files Attached Files
    Last edited by Xnke; 06-21-2017 at 11:14 PM.

Similar Threads

  1. 16172693 16184164 16184737 16196397 PCM Information P66 V6
    By RobertISaar in forum GM ECM - Bins - TunerPro Definition Files - Wiring Diagrams - Tuner Info!
    Replies: 5
    Last Post: 04-18-2014, 05:49 PM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •