1997 F-Body ECM

**Tom H** · 01-18-2020

I got a bit carried away using the bootstrap mode and got a bit off topic. Still, it's worth posting some of what I found out to the list. I wanted to get more sure of my setup before going after the TPU. I needed to make sure all the assembler switches were well understood and try a few test cases.

One easy target is the Port Replacement Unit with RAM (PRU) used on my boards. It is marked with GM house numbers:

65146C91
66285
466

The main features of this part are:

2K (less a few) RAM
Four channels of Pulse
Four ports of I/O
Watchdog timer

I wrote a simple RAM test for addresses $1810 through $1FFF. Then I wrote programs to toggle each bit of the first 3 ports. The device can be configured for input or output. I did not output on lines used as inputs to prevent contention. The last I/O port is open drain, thus needing no direction settings. I found the lower four bits. Still missing from my understanding are four pins and four register bits. Some day, a bit more work here...

The PWM section is interesting. The lower byte configures the pulse width in 1/256 increments. That I had figured would be the case. The upper byte of the PWM config was not known to me, so I wrote a routine to manipulate it. Turns out that the PWM section is driven by Eclock divided by 2. The upper byte scales this and affects the rep rate of the pwm. The lower the number the faster the rep rate. I guess this was done to tune the response of things like egr. Electro magnetic radiation may also come into it...run things as slow as you can. If trying to filter and create an analog you might want to run it fast. In any case, I have a couple of attachments. First is an excel table of pwm config upper byte vs repetition rate. Second is the pinout of the PRU.

If anyone can help with the missing pins/register bits, please post. The pins are connected to the ribbon cable and to a unknown chip:

609-3700521
CP08978
144436
9638N

Any and all details of that chip are of great interest.

-Tom

**kur4o** · 01-19-2020

609-3700521
CP08978
144436
9638N

94-95 has the very same chip. Visual comparison shows some similarities with the injector driver chip but smaller. Both are marked NCR. SO it could be some driver chip??Ignition coil driver??.

I was sure the first byte of the PWM output is some frequency but never have the time to measure it. Gm uses some fix value there. The second byte is 0-ff and ff is on all the time, it is used on the fuel pump output. It also can be interpreted like this. First byte is off time[Lower is shorter]. Second byte is ON time. On and Off times are scaled by the frequency of the CPU.

I compared some random memory range between 94-95 and 96-97 code and it looks like they are set identically.

Code:

RESERVED:1800 byte_1800:      fcb 1                   ; DATA XREF: __RESET-4B0Dw
RESERVED:1800                                         ; __RESET-4B09w ...
RESERVED:1800                                         ; HARDWARE CONTROL WORD
RESERVED:1800                                         ; load $40 at reset than cleared at reset
RESERVED:1800                                         ;
RESERVED:1800                                         ; $01 1=PIN B9 energize
RESERVED:1800                                         ;     1= byte_2f $02 = 1
RESERVED:1800                                         ;     1=set from TSIDE on some system error ad volt<4V with fan 1 and 2
RESERVED:1800                                         ;     1= ENGINE OFF SERVICE FIELD GROUNDED
RESERVED:1800                                         ;     1=byte_82 $08 set
RESERVED:1800                                         ; $02 1=AIR PUMP relay ON; OFF IF VOLTAGE > 17.1
RESERVED:1800                                         ; $04 1= OIL LEVEL LAMP ON
RESERVED:1800                                         ;     1=Byte_27 $80 = 1 SET BY 1804 $20
RESERVED:1800                                         ; $08 1=byte_2e $40 = 1 $40 AT shift sol rel b0
RESERVED:1800                                         ; $10 1=byte_2e $80 = 1 $80 ATshift sol rel b1
RESERVED:1800                                         ; $40 1=???some rel???
RESERVED:1801 byte_1801:      fcb $FF                 ; DATA XREF: __RESET-4B1Bw
RESERVED:1801                                         ; SOL_PLUS_OTHERsub_48E7+18Cw
RESERVED:1801                                         ; Load FF at reset
RESERVED:1802 byte_1802:      fcb $9C                 ; DATA XREF: __RESET-4B04w
RESERVED:1802                                         ; OC4I+9Ar ...
RESERVED:1802                                         ; load $04 at reset
RESERVED:1802                                         ;
RESERVED:1802                                         ; $01 1=FAN 1 ON
RESERVED:1802                                         ; $02 1=FAN 2 ON
RESERVED:1802                                         ; $04 1=always set
RESERVED:1802                                         ; $08 1= INJECTOR FAULT
RESERVED:1802                                         ; $10 1=PIN 24 B+
RESERVED:1802                                         ;     0=PIN 24 grounded
RESERVED:1803 byte_1803:      fcb 7                   ; DATA XREF: __RESET-4B16w
RESERVED:1803                                         ; SOL_PLUS_OTHERsub_48E7+18Fr ...
RESERVED:1803                                         ; Load $03 at reset
RESERVED:1804 byte_1804:      fcb $FC                 ; DATA XREF: OC4I+A0r
RESERVED:1804                                         ; SPIEsub_6EF6r ...
RESERVED:1804                                         ; HARDWARE STATUS WORD
RESERVED:1804                                         ;
RESERVED:1804                                         ; $01 1=?? BYTE_33 $04
RESERVED:1804                                         ; $02 1=?? BYTE_33 $08
RESERVED:1804                                         ; $04=1 set byte_35 $20 ??POWER STEERING SWITCH??
RESERVED:1804                                         ; $08 1=??
RESERVED:1804                                         ; $20 1=??
RESERVED:1804                                         ; $10 1=???+
RESERVED:1804                                         ; $40 0=CRUISE ACTIVE OR TCC TEMP SWITCH
RESERVED:1804                                         ;
RESERVED:1804                                         ; tside INFO
RESERVED:1804                                         ; $01 1=AC REQUEST
RESERVED:1804                                         ; $02 1=AC CLUTCH STATUS ON
RESERVED:1804                                         ; $04 1=POWER STEERING REQUST
RESERVED:1804                                         ; $08 1=HEATED WINDSHIELD REQUEST pin B25
RESERVED:1804                                         ; $10 1=OIL CHANGE RESET SWITCH pin B18
RESERVED:1804                                         ; $20 1=OIL LEVEL SWITCH
RESERVED:1804                                         ; $40 1=CRUISE CONTROL request pin B22
RESERVED:1804                                         ; $80 1=pin B23
RESERVED:1805 byte_1805:      fcb 0                   ; DATA XREF: __RESET-4B12w
RESERVED:1805                                         ; SOL_PLUS_OTHERsub_48E7+198w
RESERVED:1805                                         ; cleared at reset
RESERVED:1806 byte_1806:      fcb $D1                 ; DATA XREF: __RESET-4AB1w
RESERVED:1806                                         ; __RESET-4AAEw ...
RESERVED:1807 byte_1807:      fcb 3                   ; DATA XREF: __RESET-4AFFw
RESERVED:1807                                         ; SOL_PLUS_OTHERsub_48E7+E6r ...
RESERVED:1807                                         ; load $03 at reset
RESERVED:1807                                         ; ??POSS FUEL PUMP ?? semi engaged at ign on once
RESERVED:1808 word_1808:      fdb $BF00               ; DATA XREF: SOL_PLUS_OTHERsub_48E7+1Bw
RESERVED:1808                                         ; sub_7CFE+1D6w
RESERVED:1808                                         ; PWM DC% CHANNEL 1
RESERVED:1808                                         ;
RESERVED:1808                                         ; $BF + $ EGR DC%
RESERVED:180A word_180A:      fdb $2FE6               ; DATA XREF: __RESET-48D3w
RESERVED:180A                                         ; RTII:loc_514Aw ...
RESERVED:180A                                         ; PWM DC% CHANNEL 2 ??PIN A12 output??
RESERVED:180A                                         ; at reset and RTII loaded from calc tps=b and 2f=a ??TRACTION TPS SEND??
RESERVED:180A                                         ; at sub_7cfe  loaded with bf9a
RESERVED:180A                                         ;
RESERVED:180A                                         ; ADR#0 CALC VALUE AD_voltage
RESERVED:180A                                         ; loaded with $2700 from ad_voltage if B+<17.7V
RESERVED:180A                                         ; if B+>17.1V loaded from ad value + calculations
RESERVED:180A                                         ;
RESERVED:180A                                         ; ??HARD CONTROL WORD?? 2F00 or 2F?? if B+>17.1V
RESERVED:180C word_180C:      fdb $BF00               ; DATA XREF: __RESET-4AF9w
RESERVED:180C                                         ; SOL_PLUS_OTHERsub_48E7:loc_4932w ...
RESERVED:180C                                         ; PWM DC% CHANNEL 3 FUEL PUMP relay
RESERVED:180C                                         ;
RESERVED:180C                                         ; Load bfff at reset
RESERVED:180C                                         ; Load 2f4c at sub_7cfe
RESERVED:180C                                         ;
RESERVED:180C                                         ; BF00 if BYTE_2e $20 =1
RESERVED:180C                                         ; BFFF if BYTE_2e $20 =0
RESERVED:180E word_180E:      fdb $5100               ; DATA XREF: SOL_PLUS_OTHERsub_48E7+13w
RESERVED:180E                                         ; sub_7CFE+1E8w
RESERVED:180E                                         ; PWM DC% CHANNEL 4
RESERVED:180E                                         ;
RESERVED:180E                                         ; $51 + $3-2 DC

FSR:1000 PORTA:          fcb 8                   ; DATA XREF: __RESET-4B4Bw
FSR:1000                                         ; OC4I+A6r ...
FSR:1000                                         ; $20 1=Performance pattern requested
FSR:1000                                         ; $40 1=(DRIVE 2)some Auto pattern requested


FSR:1031 ADR1:           fcb $1D                 ; DATA XREF: __RESET-49F7r
FSR:1031                                         ; __RESET-49E8r ...
FSR:1031                                         ; 7 byte_12f - EST AD Voltage
FSR:1031                                         ; 6 byte_12e
FSR:1031                                         ; 5 coolant temp
FSR:1031                                         ;   -byte_12d raw;
FSR:1031                                         ;   -byte_1d9 byte_192 filtered with 7fee
FSR:1031                                         ; 4 Intake temp
FSR:1031                                         ;   -byte_12c raw
FSR:1031                                         ;   -byte_1d8 filtered with 80ee
FSR:1031                                         ; 3 tps voltage
FSR:1031                                         ; 2 map voltage
FSR:1031                                         ; 1 byte_129 some AD voltage
FSR:1031                                         ; 0 byte_128 IGN AD Voltage

**Tom H** · 01-19-2020

Originally Posted by kur4o

94-95 has the very same chip. Visual comparison shows some similarities with the injector driver chip but smaller. Both are marked NCR. SO it could be some driver chip??Ignition coil driver??.

I think this is related to the ignition circuit. Traced half of the lines. On my target board, both the injector driver and this chip are marked "Symbios logic". I would like to document some of what I am doing and post. The 144436 chip drives (receives??) from one of the staggered single inline packs up on the aluminum heat spreader. I think earlier you had a board with these parts removed. Can you give me the house numbers for the SIPs? I intend to refer to them as marked.
SIP_RB_CS.jpg

Originally Posted by kur4o

I was sure the first byte of the PWM output is some frequency but never have the time to measure it. Gm uses some fix value there. The second byte is 0-ff and ff is on all the time, it is used on the fuel pump output. It also can be interpreted like this. First byte is off time[Lower is shorter]. Second byte is ON time. On and Off times are scaled by the frequency of the CPU.

First byte sets the clock rate/rep rate of the PWM. Second byte sets the pulse width in increments of 1/256.

My first try with the TPU will be to see if I can configure it such that I can read VATS outside the GM program. This is a good test because I *think* I know which words of the microcode relate to it. Perhaps I can try to change the place where the transition count is stored, that way I can prove the function of one of the fields. If I can, it's a small victory, but could potentially unlock the tpu. Time will tell.

-Tom

**dzidaV8** · 01-19-2020

Here are my findings from the time I was reverse engineering the boards of LT1:

[disregard the TPU address mapping, it was done assuming the TPU was another HC11]

**Tom H** · 01-19-2020

Thank you dzidaV8. What I am looking for is the printing on the chips for identification. I have a 99.9% match with the info you sent.

Cheers,
Tom

**kur4o** · 01-20-2020

I have the numbers from different boards that looks similar or analog to the ones you have.

Sip2 and SIp3 can be one of these
014
m33al
41398
or
Motorola
16180566
QPD32B

Sip4 is the voltage regulator. On 94 board is marked
70306
466 33738985

The 23 pin SIPs are quad driver chips. They are on almost any gm pcm from 90-on.
I have a marking from one from 96 gm board.
185
16166240
YYEK9546.

I think that you can lift the chips a little to read the marking . The pins are flexible enough to withstand 2-3mm lift.

On my pcm I have burned the 5v output on the voltage regulator and managed to find a replacement on ali express, so these must be some standard quaddrivers.

**Tom H** · 01-20-2020

Thank you kur4o, I will put the info into the schematic.

I came across a few functions that will be of interest. A bunch of posts back, I tried to list all the expected functions of TPU. I missed tach output and speedo outputs. Here are the pins on the tpu

4 RED CONNECTOR SIP PIN 19 "OUT 3 CONTROL": OUT 3 ENGINE SPEED OUT
5 BLACK CONNECTOR SIP PIN 5 "OUT 2 CONTROL": OUT 2 DRIVES VSS OUT
6 RED CONNECTOR THROUGH NETWORK OF R/C/DIODE/COMPARATOR: DRIVEN BY VSS IN

-Tom

**Tom H** · 01-21-2020

Some success this morning working with the TPU. I first wrote a routine to load the TPU. Used the '97 flash routine with no mods. Seemed to load OK (no smoke) so I added a timer driven read/display of the VATS register at $146A. This also worked. I looped the EGR pwm back to the VATS input. I set the EGR for a 50HZ rep rate and a square wave using the constant $7A80 to configure the pwm at $1808. Reading back and subtracting last value gave me the constant I expected.

I will next try to mod the microcode to see if I can place the output at a different place.

Small steps...

-Tom

**kur4o** · 01-22-2020

Originally Posted by Tom H

Some success this morning working with the TPU. I first wrote a routine to load the TPU. Used the '97 flash routine with no mods. Seemed to load OK (no smoke) so I added a timer driven read/display of the VATS register at $146A. This also worked. I looped the EGR pwm back to the VATS input. I set the EGR for a 50HZ rep rate and a square wave using the constant $7A80 to configure the pwm at $1808. Reading back and subtracting last value gave me the constant I expected.

I will next try to mod the microcode to see if I can place the output at a different place.

Small steps...

-Tom

That is some serious progress here. I think the next step should be to try to read the full memory range of TPU from $0-$2000. That way we can rip the config file from 94-95 pcm and compare the structure. There is a possibility that a second vss input is left on the table, needed for 4l80e transmission, or the crank sensor is logged by the tpu.

**Tom H** · 01-22-2020

Question for you, do we know how/where the gear ratio is set in the calibration? Given that the VSS is routed to the TPU and that the speedo output is routed from the TPU, it makes sense that the rear gear ratio would be a constant entered into the TPU.

On the output side, I have been told that the pulse rate is 4000/mile. Is this true of all the options? I know mine had a 250 KPH speedo. Others had tires that limited the top speed to some lesser number and I believe the gauge was calibrated for a lower top end. Is this calibration taken up in the dash it's self?

I am asking to understand what to expect. The divisor will depend on the ratio of the output shaft gear in the trans and the number of poles in the sensor it's self. The real answer I need is how many pulses are generated by one turn of the drive shaft OR pulses per mile from the vss.

It will be interesting to read back the content. Just hope it can read back. My TPU is marked

185
16195392
D84G
KQQNF9630C

Expect the last line is a designation of which line the part was built on and a date code. Probably only the second number will indicate if the earlier parts are the same. Given the same number, I expect whatever I read back will be valid for your part.

-Tom

**kur4o** · 01-22-2020

RESERVED:5E77 ldd word_3355
RESERVED:5E7A std word_1436 Speedometer scalar base
RESERVED:5E7D ldd word_3357
RESERVED:5E80 std word_1438 Speedometer scalar - divisor
RESERVED:5E83 ldd word_3359
RESERVED:5E86 std word_143A Stopped vehicle VSS pulse delay
RESERVED:5E89 ldd word_335B
RESERVED:5E8C std word_1434
RESERVED:5E8F ldd word_335F
RESERVED:5E92 std word_15D4
RESERVED:5E95 ldd word_3361
RESERVED:5E98 std word_15D6
RESERVED:5E9B ldd word_3363
RESERVED:5E9E std word_14B6

This is from a 96 lt4 calibration. It might differ slightly in your case. The other config data is also very interesting but nobody knows what it does.
On 96 code there are more config parameters and the chip is marked 16166079 KQELS9344G.

Here is some description from the Steveo`s xdf file.

This is the base scalar for speedometer calibration. This should be set to PPM/4000.

You may develop a PPM value as follows:

PPM = sensor spec * gear ratio * tire revolutions per mile

known sensor values:
- 40 for a 4L60E
- 17 for a T56 F-body or B-body
- 2 for a T56 Y-Body
_______________

This is the divisor for speedometer calibration. This should be set to, after the base scalar is determined, to:

4000 / ( PPM / Speedometer Scaler - Base )

You may develop a PPM value as follows:

PPM = sensor spec * gear ratio * tire revolutions per mile

known sensor values:
- 40 for a 4L60E
- 17 for a T56 F-body or B-body
- 2 for a T56 Y-Body

_____________________________

When a VSS pulse has not happened for this amount of time, the vehicle is considered 'stopped'.

70-80msec seems to be appropriate.

On the output side, I have been told that the pulse rate is 4000/mile. Is this true of all the options? I know mine had a 250 KPH speedo. Others had tires that limited the top speed to some lesser number and I believe the gauge was calibrated for a lower top end. Is this calibration taken up in the dash it's self?

The vss output is used for all the modules in the car, dash, abs, sir, radio, cruise control. It is fixed value of 4000ppm. The input and conversion is what differs.

**Tom H** · 01-22-2020

Thank you for finding all that for me. Picture gets a little more clear

Looking at read back of internals... First here is what I think the code does:

Code:

*************************************************
* INITIALIZE TIO
*************************************************
A4A6  4F          	CLRA			; 
A4A7  C6 44       	LDAB   #$44		; 
A4A9  FD 16 FC    	STD    $16FC		; $0044

* DELAY 250US
A4AC  86 F2       	LDAA   #$F2		; 2| (242 * 13) + 2 = 3148 CYCLES
A4AE  01          	NOP			; 2|
A4AF  01          	NOP			; 2|
A4B0  01          	NOP			; 2|
A4B1  01          	NOP			; 2|
A4B2  4A          	DECA			; 2|
A4B3  26 F9       	BNE    $A4AE		; 3|

A4B5  86 40       	LDAA   #$40		; 
A4B7  5F          	CLRB			; 
A4B8  FD 16 FE    	STD    $16FE		; $4000

A4BB  01          	NOP			; 
A4BC  01          	NOP			; 
A4BD  01          	NOP			; 

* INITIALIZE THE MICROSTORE
A4BE  4F          	CLRA			; SET FOR LOADING THE MICROSTORE
A4BF  C6 03       	LDAB   #$03		; 
A4C1  FD 16 F0    	STD    $16F0		; 

A4C4  CE A8 7C    	LDX    #$A87C		; MICROSTORE IN ESIDE FLASH
A4C7  18 CE 14 00 	LDY    #$1400		; MICROSTORE LOAD POINTER (ALT FUNCTION)

A4CB  EC 00       	LDD    $00,X		; MOVE MICROSTORE FROM FLASH TO THE TPU
A4CD  FD 16 E0    	STD    $16E0		; 
A4D0  EC 02       	LDD    $02,X		; 
A4D2  FD 16 E2    	STD    $16E2		; 
A4D5  EC 04       	LDD    $04,X		; 
A4D7  FD 16 E4    	STD    $16E4		; 
A4DA  EC 06       	LDD    $06,X		; 
A4DC  FD 16 E6    	STD    $16E6		;
 
A4DF  18 EF 00    	STY    $00,Y		; UPDATE MICROCODE WORD

A4E2  18 08       	INY			; POINTER FOR NEXT MICROCODE
A4E4  18 08       	INY			;

It looks to me as if an internal ROM takes control on reset. The internal ROM code looks for the write cycle to $14XX. When it sees the cycle, it uses the lower 8b as internal address (skipping A0 as internal is all 16b) and the data from $16E0 -8 and saves that internally. I expect that for debug there would be a different control register setting that would read back, and write the internal data to 16E0-8.

Since we have no real data on any internal ROM, all I can do is to initialize the part and try to read back one of the values initialized. Just a WAG but looks to me as if $16F0 may be the key.

Ideas?

-Tom

**Tom H** · 01-22-2020

News is not the best: I tried all combinations first in $16F0 then in $16F2. These do not cause a read back into $16E0-8 addresses that are used to load the RAM. It is possible that 'some other set of addresses' are used for read back.

I will try some other ideas now.

-Tom

**kur4o** · 01-23-2020

A4DF 18 EF 00 STY $00,Y ; UPDATE MICROCODE WORD

A4E2 18 08 INY ; POINTER FOR NEXT MICROCODE
A4E4 18 08 INY ;

I think that STY clear memory from 1400-15ff. It looks like it copies the value from 1400 and stores it[ $100 cycles word ] from 1400-15ff. 1400 looks like one of the injectors bpw so at reset should be cleared.

I think 16f0 needs more examination to figure what is going on at the hardware level. I am sure that 0003 sets some pin high or low on the ram chip, and some switching happens there. We have the microcode but no clue of the op codes it uses. Cracking the instruction set will open the door. Did you managed to define the memory range accessible to eside. I think that writing to the shared memory is a function of internal switching in the RAM chip. That extended ram chip might do more than we thought.

**kur4o** · 01-24-2020

Here are some of the dwell settings in the TPU. I am trying to find why there are 3 different dwell timings

Code:

RESERVED:149E word_149E:      fdb 0                   ; DATA XREF: OC4I+65Ew
RESERVED:149E                                         ; IRQ+A2w ...
RESERVED:149E                                         ; Final dwell - $0001
RESERVED:14A0                 fcb   0
RESERVED:14A1                 fcb   0
RESERVED:14A2 word_14A2:      fdb 0                   ; DATA XREF: OC4I:loc_4FB2w
RESERVED:14A2                                         ; _TPU_scalar_resetsub_A4A4+192w
RESERVED:14A2                                         ; 2083 VALUE;
RESERVED:14A2                                         ;  #6 MINIMUM
RESERVED:14A2                                         ;
RESERVED:14A2                                         ; Dwell 1 $28 value min dwell???
RESERVED:14A4                 fcb   0
RESERVED:14A5                 fcb   0
RESERVED:14A6 word_14A6:      fdb 0                   ; DATA XREF: OC4I+667w
RESERVED:14A6                                         ; _TPU_scalar_resetsub_A4A4+18Cw ...
RESERVED:14A6                                         ; final dwell -$0002

149e is the main dwell calculated from pcm.
14a2 is always preset with $0028. Might be some scalar.
14a6 equals [149e-$0002].

I will be grateful if you can test the settings and figure what they do and the conversion factor of 149e to ms[I suspect it is the same as injector BPW but that $28 scalar might change the equation] .

I found that the pcm has built in routine for reading through obd2. It uses mode 35. If you want to try reading it I will get you the command set.