1997 F-Body ECM

[DownUnder]

Just read through all 33pages, awesome work so far!
I did see some early attempts/work into making a kernel for read and writing for the ECUs.

I started looking through a kernel, but cannot see the registers for the DLCMD (Data Link Controller Module) where its actually reading or writing VPW frames.

From what I understand, these are using the HC11 processor.. and looking through the datasheet, I dont see a dedicated register for J1850 VPW communication, but I do see that in something like a HC12.
Is this all being doing using something like SPI? Anyone dived further into understanding that?

[Tom H]

I did see some early attempts/work into making a kernel for read and writing for the ECUs.

I started looking through a kernel, but cannot see the registers for the DLCMD (Data Link Controller Module) where its actually reading or writing VPW frames.

From what I understand, these are using the HC11 processor.. and looking through the datasheet, I dont see a dedicated register for J1850 VPW communication, but I do see that in something like a HC12.
Is this all being doing using something like SPI? Anyone dived further into understanding that?

Taking your questions somewhat out of order...

There are two processors Tside and Eside that communicate over SPI. The scheme used is a bit different depending on direction, here is how:
Tside sends a set of parameters to Eside. The "mastership" of the bus is swapped each byte sent. This reduces interrupts. Data from T -> E is the same each transfer block (32 bytes). The T->E has a paged scheme, transfering 19 bytes of data each block + 10 bytes that are paged. There are eight pages such that over 8 transfer cycles, 80 bytes are sent. This is enough to send all the statistics required for OBDII. This is my best try at a general summary. Getting into the details is a bit more difficult, so I will leave it here unless you have some specific question...

The VPW comms is provided by a chip external to the processors. It is accessed only by the TSide so read and write to the ESide must be done by passing through the TProcessor. The SCI is internal to the processor. For '96 and '97 the Eside SCI is not used: that is all the ALDL comms is looked after by the TSide. Once again any data destined for ALDL from the ESide must be passesd to the TProcessor over SPI for tx on the SCI/ALDL. Chip used for VPW is Motorola MC68HC58 Data Link Controller. The DLC is addressed at $1060 & $1061.

There was a request to separate PCM info from tools info. There is a second set of posts regarding tools to read and write the PCM. All of my tools have used a home brew cable that I use to access the PCM. The tools I wrote connect to the PCM through this cable over USB based NRZ (serial) comms. The cable is set up to act much like the age old ELM327 except that it has capability to send large frames required to download/upload. Have a look through
http://www.gearhead-efi.com/Fuel-Inj...7-F-Body-Tools
At some point I will add the 4X feature and enable both read and write. For now the work on my system.

Hope this answers some of your questions.
-Tom

[DownUnder]

Taking your questions somewhat out of order...

There are two processors Tside and Eside that communicate over SPI. The scheme used is a bit different depending on direction, here is how:
Tside sends a set of parameters to Eside. The "mastership" of the bus is swapped each byte sent. This reduces interrupts. Data from T -> E is the same each transfer block (32 bytes). The T->E has a paged scheme, transfering 19 bytes of data each block + 10 bytes that are paged. There are eight pages such that over 8 transfer cycles, 80 bytes are sent. This is enough to send all the statistics required for OBDII. This is my best try at a general summary. Getting into the details is a bit more difficult, so I will leave it here unless you have some specific question...

The VPW comms is provided by a chip external to the processors. It is accessed only by the TSide so read and write to the ESide must be done by passing through the TProcessor. The SCI is internal to the processor. For '96 and '97 the Eside SCI is not used: that is all the ALDL comms is looked after by the TSide. Once again any data destined for ALDL from the ESide must be passesd to the TProcessor over SPI for tx on the SCI/ALDL. Chip used for VPW is Motorola MC68HC58 Data Link Controller. The DLC is addressed at $1060 & $1061.

There was a request to separate PCM info from tools info. There is a second set of posts regarding tools to read and write the PCM. All of my tools have used a home brew cable that I use to access the PCM. The tools I wrote connect to the PCM through this cable over USB based NRZ (serial) comms. The cable is set up to act much like the age old ELM327 except that it has capability to send large frames required to download/upload. Have a look through
http://www.gearhead-efi.com/Fuel-Inj...7-F-Body-Tools
At some point I will add the 4X feature and enable both read and write. For now the work on my system.

Hope this answers some of your questions.
-Tom

This makes quite a bit more sense.
I could see the addressing to 0x1060 and also 0x1061, but it didn't quite line up with what I was expecting with the HC11 reference manual.
The only reason they looked interesting was they were checking specific hex values that I use in the later model ECU kernels for the DLC status. (ie.. checking for a completion code).
In comparison to working with the P01/P59/P04/P12 ecus, this does seem to be a bit more complicated with the dual processor setup.

Nice work on the tool! Looks like the circuit is a derivative of the ELM from what I can see.
I program with the OBDX Pro tools since I am the programmer for them, Pete (My colleague) does all the circuit designing and testing.

Looking through that thread, look like you have already created an application to read (0x35) the ECU data. Did you have plans to continue to add in the writing capability also?

[Tom H]

Hi,

The CSIO1 pin (68HC11F1 pin 22) is programmed to be the chip select for the DLC. Since the DLC has only two physical addresses, only A0 and the chip select are needed. The two registers are duplicated over and over within the range, but for simplicity only the 0x1060/1 are used within the code.

The home brew cable was designed to get around limitations in the ELM. If I had it to do again, I would have moved all the CRC into software. Doing it that way would be better because the CRC would cover the data through the USB link as well. That said, reinventing the wheel isn't a thing I plan to do...

I have download/program software working on my bench. It targets only two years of PCM (96/7). For the most part these PCMs are obsolete, the later units are probably a better bet for most people. I am at a cross roads as to if I will continue to work on this PCM. I keep running into lack of information regarding the TPU and try as I might have not been able to crack into it.

-Tom

[DownUnder]

Hi,

The CSIO1 pin (68HC11F1 pin 22) is programmed to be the chip select for the DLC. Since the DLC has only two physical addresses, only A0 and the chip select are needed. The two registers are duplicated over and over within the range, but for simplicity only the 0x1060/1 are used within the code.

The home brew cable was designed to get around limitations in the ELM. If I had it to do again, I would have moved all the CRC into software. Doing it that way would be better because the CRC would cover the data through the USB link as well. That said, reinventing the wheel isn't a thing I plan to do...

I have download/program software working on my bench. It targets only two years of PCM (96/7). For the most part these PCMs are obsolete, the later units are probably a better bet for most people. I am at a cross roads as to if I will continue to work on this PCM. I keep running into lack of information regarding the TPU and try as I might have not been able to crack into it.

-Tom

I was told that there was not really a solution for the 96/7 vehicles hence was directed to here as the closest kind of "DIY" tuning solution.

Just like the P01/P59 PCMs, there was not really any work done for reverse engineering completed or people helping out until there was an option available to read/write.

Id be happy to help get the kernels into a easy to use application, or even possibly into something like LSDroid which is also a free based program.

[Tom H]

I was told that there was not really a solution for the 96/7 vehicles hence was directed to here as the closest kind of "DIY" tuning solution.

Just like the P01/P59 PCMs, there was not really any work done for reverse engineering completed or people helping out until there was an option available to read/write.

Id be happy to help get the kernels into a easy to use application, or even possibly into something like LSDroid which is also a free based program.

As this is part of the "tools" topic, we should move the discussion there http://www.gearhead-efi.com/Fuel-Inj...7-F-Body-Tools

I have a solution for read & program of the 96/7 LT1 PCMs. This all is separate from the bootstrap discussion (resurrection of the bricked).

I have a good deal of the reverse engineering done with a little help from my friends here.

My software skills are not quite up to your level. I don't have kernels. Just a few c++ classes that I stitch together to upload/download code to the PCM. For the actual programming routines that run on the 'HC11s, Kur4o provided them and I used them without (or with few) modifications. If you would like to make up a tool for these PCMs I will try to support you where I can.

-Tom

[kur4o]

Hi Tom,

Did you managed to reverse the hardware side of ignition control. I am only interested in the signal that pcm sends to ignition control module and what type of it is. Usually there is a dwell timing that goes to ICM. Does the pcm supplies voltage or just ground the icm pin, while grounded the coil charges and once the ground is removed the coil fires. I am just speculating. I think this was covered in other threads but can`t find it.

Thanks

[Tom H]

Hi Tom,

Did you managed to reverse the hardware side of ignition control. I am only interested in the signal that pcm sends to ignition control module and what type of it is. Usually there is a dwell timing that goes to ICM. Does the pcm supplies voltage or just ground the icm pin, while grounded the coil charges and once the ground is removed the coil fires. I am just speculating. I think this was covered in other threads but can`t find it.

Thanks

Hi,

I will give you all that I have, some hope it will be what you need.

The signal we are speaking about: ignition control is generated by the ESide and connects out through Black or C2 pin 5. The ignition control is both an output and an input (I expect the earlier PCMs are the same). The output is pulled high resistively and an NPN transistor is used bring the signal low. The output is monitored by a mystery chip marked 27474. I think this is a small semi-custom chip like a pal or something. Probably not too much in it.
Your question I think goes to the output type but once dwell comes into it, that is all TPU. Still banging my head on that chip. Some figured out but not all.

Here is the schematic for the bit you are concerned about.

Ignition.jpg

If I didn't answer your question...please ask again

-Tom

[kur4o]

I am mostly interested in the interaction between pcm and ICM. Type of driver and how that interacts with dwell time. I need to reread the coil thread.

Thanks for the schematics, looks really interesting. On engine cranking service manual specify 1-4V AC voltage output from pcm to ICM. Not sure how that correlates with dwell time. I guess some scoping will reveal more.

[kur4o]

I went through 55 page thread and here is some scope chart of dwell signal from 94-95lt1.
Might give you some insight to better correlate it with hardware side.
http://www.gearhead-efi.com/Fuel-Inj...=180#post67834

http://www.gearhead-efi.com/Fuel-Inj...8&d=1510370313

[Tom H]

HI,
The TPU asserts and de-asserts the ignition control output. It also monitors the ignition control, verifying that there is no external short (it may also look at timing to ensure there isn't too much loading).

I don't have all the answers here... yet but the pins involved on the TPU are 7, 8 and 9. Pin 7 is the monitor. I believe 8 and 9 control the output with one being "limp mode" and the other normally used to fire the coil. I don't have an ICM to check the function however it looks to me like it is just a switch. It is external to the PCM for maintenance and thermal reasons. Perhaps you can answer- is the ICM just a switch with certain limiting built in? This is what I expect.

I need to read the thread before I get further into the ignition control of the TPU.

-Tom

[kur4o]

I cracked open 2 ICM one original gm one and some chinese knock off.
Gm looked like knock module inside, had some fat transistor soldered to back steel plate to enhance cooling, and some small factor custom chip.
Chinese knock off was dead already with no runtime. There was some transistor and a small 8 pin chip but couldn`t read the label. It had burned already one trace on board and likely the transistor also failed. No cooling whatsoever inside. Chinese knock offs are totally waste of time unless they get some custom coolers installed.

I will try to source some pics but can`t promise.

[kur4o]

Some diagram on a similar platform using same ignition parts.

[Tom H]

Gm looked like knock module inside, had some fat transistor soldered to back steel plate to enhance cooling, and some small factor custom chip.

Just a WAG from me: Chip drives the gate (base?) of the transistor and provides over current protection. Transistor drives the coil based on the input from PCM. Want more dwell? -> fatten the pulse from PWM. Too much dwell make the pulse less wide.
These are all things the TPU does very well.
Chip is probably there to drive the output transistor and shut things down if there is a short.
I need to get hold of one of these and have a look-see.

Look forward to the pics if you can

-Tom