Page 2 of 34 FirstFirst 123456712 ... LastLast
Results 16 to 30 of 509

Thread: 1997 F-Body ECM

  1. #16
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Some code used to read A/Ds in a round robin sequence...

    Code:
    ************************************************
    * READ A/D CONVERTERS 
    ************************************************
    4DEB  86 10       	LDAA   #$10            ; START A/D, PE0 - PE3  
    4DED  B7 10 30    	STAA   $1030           ; MULTI MODE
    4DF0  3A          	ABX                    ; REAL TIME DELAY
    4DF1  3D          	MUL                    ; OF 136 CYCLES
    4DF2  03          	FDIV                   ;
    4DF3  03          	FDIV                   ;
    4DF4  03          	FDIV                   ; 
    
    4DF5  FC 10 31    	LDD    $1031           ; READ ANALOG FROM PE0, PE1
    4DF8  B7 01 02    	STAA   $0102           ; AC PRESSURE
    4DFB  F7 01 03    	STAB   $0103           ; AN1 ??
    
    4DFE  FC 10 33    	LDD    $1033           ; READ ANALOG FROM PE2, PE3
    4E01  B7 01 04    	STAA   $0104           ; AN2 ??
    4E04  F7 01 05    	STAB   $0105           ; AN3 ??
    
    4E07  CE 10 02    	LDX    #$1002          ; MUX CONTROL, PORT G0-2
    4E0A  1D 00 07    	BCLR   $00,X,$07       ; CLEAR ANALOG SELECT BITS
    
    4E0D  B6 01 01    	LDAA   $0101           ; MODULO 8 COUNT
    4E10  AA 00       	ORRA   $00,X           ; UPDATE PORT TO SELECT
    4E12  A7 00       	STAA   $00,X           ; ANALOG INPUTS INTO A/D
    
    4E14  86 14       	LDAA   #$14            ; START A/D, PE4 - PE7 
    4E16  B7 10 30    	STAA   $1030           ; MULTI MODE
    4E19  3A          	ABX                    ; REAL TIME DELAY
    4E1A  3D          	MUL                    ; OF 136 CYCLES
    4E1B  03          	FDIV                   ;
    4E1C  03          	FDIV                   ;
    4E1D  03          	FDIV                   ; 
    
    4E1E  B6 10 31    	LDAA   $1031           ; READ ANALOG FROM PE4
    4E21  B7 01 06    	STAA   $0106           ; ONE OF EIGHT INPUTS
    
    4E24  F6 01 01    	LDAB   $0101           ; 
    4E27  CE 01 07    	LDX    #$0107          ; 
    4E2A  3A          	ABX                    ; ADD OFFSET
    
    4E2B  B6 10 32    	LDAA   $1032           ; READ ANALOG FROM PE5
    4E2E  A7 00       	STAA   $00,X           ; SAVE LOCATON W OFFSET
    
    
    4E30  CE 01 0F    	LDX    #$010F          ; MUX 1 BASE ADDRESS
    4E33  3A          	ABX                    ; ADD OFFSET
    
    4E34  B6 10 33    	LDAA   $1033           ; READ ANALOG FROM PE6
    4E37  A7 00       	STAA   $00,X           ; SAVE
    
    4E39  CE 01 17    	LDX    #$0117          ; MUX 2 BASE ADDRESS
    4E3C  3A          	ABX                    ; ADD OFFSET
    
    4E3D  B6 10 34    	LDAA   $1034           ; READ ANALOG FROM PE7
    4E40  A7 00       	STAA   $00,X           ; IGNITION VOLTAGE
    
    * $0101 IS A MODULO 8 COUNTER (0-7) INCREMENTED EACH TIME THIS IS CALLED
    4E42  B6 01 01    	LDAA   $0101           ; READ CURRENT COUNT
    4E45  4C          	INCA                   ; INCREMENT COUNT
    4E46  81 08       	CMPA   #$08            ; TEST FOR OVER 
    4E48  25 01       	BCS    $4E4B           ; BRANCH IF NOT OVER
    
    4E4A  4F          	CLRA                   ; WRAP COUNT
    4E4B  B7 01 01    	STAA   $0101           ; SAVE CURRENT COUNT

  2. #17
    Fuel Injected! spfautsch's Avatar
    Join Date
    Apr 2015
    Location
    Montgomery City, MO
    Age
    52
    Posts
    883
    Quote Originally Posted by Tom H View Post
    Does anyone know if the wheel is removed from the optical path... do you measure a 1 or a 0 on high and low resolution inputs???
    I can tell you with certainty that when the optical beam is broken the optotransistor outputs are logic low and when not broken high. It's been a while but I vaguely recall testing with a LED logic probe to determine in which state they are actively conducting (if they were PNP or NPN type transistors). You may find something useful in my rantings from here. I'll see if I can find anything there or in my notes and report back.

    Edit: To update - I don't think I tested the opti outputs for transistor type after all. But I can do that this evening with my test opti that's missing all the high voltage parts.

    Quote Originally Posted by Tom H View Post
    I find talking about degrees relating to Opti a bit confusing. Wheel has 360 slots...cam runs half speed... each slot is 2 degrees crank (yes??).
    It's actually quite simple. The way I built the logic for the diy-ltcc stuff was to count every state change (edit for clarification: either a rising edge or falling edge) on the high res ring as 1 crankshaft degree. This gives you 720 pulses per camshaft revolution. The low res side sees a rising edge signal on each TDC. By counting the degrees while the low res is either high or low one can determine the engine's position within a maximum of 2 low res rising edge triggers (180 crankshaft degrees plus width of indexed low res slot - maximum 46 degrees).

  3. #18
    Fuel Injected! spfautsch's Avatar
    Join Date
    Apr 2015
    Location
    Montgomery City, MO
    Age
    52
    Posts
    883
    Interesting.

    The J520 pickup has two open collector outputs - n-channel so they source / conduct current when low.

    But...

    The low res pin (farthest from the ground pin) conducts when the beam is broken.

    The high res pin (adjacent to low res pin) conducts when the beam is not broken. Since I'm 100% positive the ecu doesn't care about the "polarity" of the high-res signal it wouldn't matter. But you learn something new every day.

    This means what I said in the previous post "with certainty" only applies to the low res signal. :-)

  4. #19
    Fuel Injected! spfautsch's Avatar
    Join Date
    Apr 2015
    Location
    Montgomery City, MO
    Age
    52
    Posts
    883
    Quote Originally Posted by Terminal_Crazy View Post
    I still don’t get why they’d go to the trouble of ID’ing only 4 out of 8 cylinders when you could ID all 8.
    Bear in mind that with a batch injection start routine and a distributor, what I'm about to say is almost pointless but...

    Because even at cranking speeds around 150 RPM, the difference between firing on the first or second compression stroke after the bendix engages the flywheel is almost imperceptible.

    And...

    Because after the ecu has determined rotational position all it needs to do is follow the firing sequence on the low-res rising edge signal to know where it's at until there's a stall condition.

    To further expound on the topic, I'm starting to think the gen 2 LT-1 fires too soon. One of my first modifications to the diy-ltcc may be a surrogate low-res signal to prevent the ecu from firing the injectors (and spark) until oil pressure has been built-up.

  5. #20
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    First, thanks to everyone for your help with my project. I do appreciate your information!

    Another request of you all... Is the pinout of the 30 position ribbon cable between Eside and Tside known? I have traced perhaps half of the lines but it is an undertaking to find the rest. I am somewhat confused by the way that the two boards reference ground. I had expected ground to be passed between the boards on the cable. I can find no grounding. My best guess is that this is done through the case. If true, an important addition to my bench test will be to re-connect grounds. I notice designed in skips in the conformal coating. My best guess is that this is where the grounding is done through the case. Now I wish I didn't throw out the doner's case. If anyone knows about this I am interested in any details.

    If not already known & out there, I plan to post the ribbon pinout once all the bits are found.

    -Tom

  6. #21
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,470
    There is a built in ground bridge on the pcm insulator[which you dumped I guess] The contact point is a big circle at the back of the boards, near the centre.

    Just put separate grounds on the connetors and you will be good for testing. I think there are some separate grounds on the boards, but you will have to measure it.

  7. #22
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477

    VPW comms

    I had a look at the OBDII communication section of the Tside and thought it might be worth posting a short description.

    OBDII communications are handled by the IC marked:
    54545T40
    20686
    466 {?delco?delphi?other? logo}

    I believe this part to be based on/similar to the Harris HIP7030A2. It looks to be based around a 68HC05 with custom interfaces running with an external ceramic resinator of 4MHZ. Pinout is not the same as the Harris part and there are differences. The external input from the data link connector has a capacitor to ground and then a current limit resistor in series for protection. In my notes I have referred to this part as the data link controller. There is a bit of confusion because it shares the TLA with the data link connector, but I will get by...

    The Tside reacts to messages targeting both $10 and $18. I believe that messages targeting the Eside are first received by the Tside and then passed across the SPI. It is worth noting that the ALDL is connected through the 30position ribbon cable and connects directly to both T&Eside processors.

    My project is progressing very slowly. It is hard to trace circuits through the board. Other things like the conformal coating, components in the way and so on make the job even more difficult. As always I will appreciate any corrections or information you can add to these posts.

    GB_CS.jpg

  8. #23
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477

    Bootstrap mode

    Reverse engineering of these boards is a difficult process and I need all the tools I can get my hands on. One tool I have not used yet is the 68HC11 bootstrap mode. In this mode, you can download a small bit of code into the internal RAM and execute it. Care needs to be taken to ensure the code defaults chip selects and things like that so that other parts on the board won't fight each other but in most cases GM defaulted all these with resistors anyway.

    The process for loading is quite simple... The binary code you want to put in ram is pre-fixed with a single $FF character and sent to the serial (aldl). I need to do a bit more checking of the configuration of the serial connections to make sure this can all work out. It is important that when you are bootstrapping one side (E or T) that the other side doesn't try to chat... that would mess up the download for sure.

    Please don't attempt this unless you are sure of what your doing. The HC11 reference manual goes into complete detail on the use of this mode. Myself I am trying to decide if to use this or use the built in download and execute through the EL327 clone.

    I have two photos to show where the mode lines are. If pulled to low when reset is released, the part will enter bootstrap mode. I have used this technique with success for my Optispark simulator.

    It looks to me like this could be used to resurrect a bricked module without de-soldering the FLASH part.

    Second picture is full of glare, but you can make out the locations. I will re-take that photo for future work

    -Tom

    RB_SS.jpg
    GB_SS.jpg

  9. #24
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477

    Eside input signal conditioning

    I have looked through some of the input signals on the Eside and analyzed the circuit. I have made some assumptions... take care when using the information.

    The signals in question are VATS, Traction control and MAF. There is a chip and a good number of resistors and capacitors involved with receiving each of these signals. This is done to control ESD, condition the signal against noise and provide hysteresis.

    I have identified the chip to a functional level. It's pinout and function match that of LM339 quad comparitor. Comparitor chip is marked:
    014
    M66DB
    89551
    LM339 quad comparitor or a variant that shares the pin configuration.

    This chip is used to provide a level switch at 2.5V instead of the standard vil/vih of the receiving part. A network of resistors provide hysteresis to avoid noise problems on the lines.

    The outputs of these signals connect to a 68pin PLCC chip that has not been identified and is probably a custom chip for GM. In my notes I will name this part TPU for timer/processor unit.


    Input:Output
    VATS:TPU pin 20
    Traction Contro:TPU pin 21
    MAF:TPU pin 22
    C1(RED) pin 26:TPU pin 23


    The components to connect C1 26 are not installed on my board set. Unsure if/where it was used.

    Here are some photos to indicate the components.

    MAF_RB_SS.jpg
    TC_RB_SS.jpg
    VATS_RB_SS.jpg
    RB_CS.jpg

    -Tom

  10. #25
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Ive been looking a little closer at the high and low res signals. Later I will post the ins&outs but I have run into a little snag. There is yet another unidentified part and I could sure use some help. Way back when I had a bunch of contacts in LSI logic / Symbios but with M&A activity I have lost touch. There are a couple of Symbios parts on my board. One is the part that drives the injector transistors. It's the other one that needs investigation. It is probably a small gate array I expect. Here are some details...

    Part is marked:

    609-3700521
    CP08978
    144436
    9638N
    SYMBIOS LOGIC
    726

    I will attach a 90% hookup wire list for the part. Only 90% because it is SO hard to trace all the copper.

    What would help is to know which PCMs have the part. For example if it is on all boards with Opti-spark that is a tell. Also interested if it is used anywhere else (I expect not)

    At first I considered if it could be a phase lock loop. This is still one possibility, but I don't think an engine controller needs that kind of resolution. I now believe it is a counter timer chip. It has interconnections with the mysterious 3rd processor TPU chip.

    I have not yet connected my optispark simulator but once done I will set the scope on this part and see what sense I can make of it. Some control of this part is handled by the port replacement chip (66285). It would also be nice if anyone knows the pinout for the PRU to send that along.

    -Tom


    I am adding a picture of the board (red/black connectors...eside) with the component highlighted

    DIG1_RB_CS.jpg
    Attached Files Attached Files
    Last edited by Tom H; 02-03-2019 at 12:15 AM. Reason: Add picture of where the part is...

  11. #26
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,470
    I suspect that part might give low res signal to tside. On 94-95 pcm the tside gets an opti signal at IC3I [TIC3H-register]. It doesn`t seem to be connected to eside anyway.
    The conversion is also different
    tside low res conversion is

    2949120/x = rpm

    eside conversion is
    983040/x = rpm
    0.015234*x= msec

    Or exactly 3 times lower resolution.


    Here are some high res pictures of the 94-95 f-body pcm.
    Attached Images Attached Images
    Attached Files Attached Files

  12. #27
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Here are some details regarding the Eside drivers. I wonder if anyone has lifted one of the drivers from the heat sink to get a look at the manufacturer and numbers? If yes please share...

    I traced the connections to the two 23 pin power SIPs. I believe they are low side drivers perhaps similar to some of the common available parts. I need to look into the code, but expect to find that the parts detect when a driver is open or shorted to power. The pdf contains the connection info.

    -Tom
    Attached Files Attached Files

  13. #28
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,470
    I have a p/n of similar driver that might help you identify the main functions.
    These are known as quad driver and are 23 or 15 pin packages.
    23 pin package:

    motorola
    185
    16166240
    yyek9546

    It is from a gm pcm with 68hc11 processor. The command pinout is the same.

    The 15 pin package from 94 v6 pcm is
    45980
    980 taiwan
    92106
    9326CB

    Voltage regulator chip on 94-95 pcm is
    70306
    466
    33738985

    Could that symbios chip are some kind of AD converters with really high frequency. Injector drivers and highres opti signal are sub 1ms signals. Did you trace the low res signal.

    The pcm you have can communicate over the ALDL bus. It supports mode 01 and mode 03. MODE 3 gives you the ability to request memory dump from RAM realtime for easy debugging. It won`t be hard to patch other modes also.

    To communicate over ALDL you need a simple ftdi based serial to usb converter, and eehack as a comm terminal.

  14. #29
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Once again thanks for your help & info!

    Quite sure the 15 pin sip on my Tside is a stepper motor driver for the IAC. All connections confirm. I will see if I can dig up datasheets but it's sort of a needle in a haystack kind of prop. Fall back is to understand the function such that we can analyze the code better...

    Hmmmm fast a/d: will give that thought. Working through hi&low res trace and will post soon, many thought paths&lots of work to complete. I will try to do this over the next few days. Now trying to prep for testing the optispark simulator. I realize that VATS will get in my way. As I understand it that can be taken care of with a 50hz square wave (?)

    I got the code I am working on from a home brew aldl interface I built. Wish IDA had been around when I did that, my home brew disassembler lacks all the nice features. Thanks for that tip, you are a great help with this project.

    EEhack doesn't like some thing about my setup and crashes. I have the code to see what is wrong... but that is yet another project.

    Not yet started on upload / download code.

    -Tom





    Quote Originally Posted by kur4o View Post
    I have a p/n of similar driver that might help you identify the main functions.
    These are known as quad driver and are 23 or 15 pin packages.
    23 pin package:

    motorola
    185
    16166240
    yyek9546

    It is from a gm pcm with 68hc11 processor. The command pinout is the same.

    The 15 pin package from 94 v6 pcm is
    45980
    980 taiwan
    92106
    9326CB

    Voltage regulator chip on 94-95 pcm is
    70306
    466
    33738985

    Could that symbios chip are some kind of AD converters with really high frequency. Injector drivers and highres opti signal are sub 1ms signals. Did you trace the low res signal.

    The pcm you have can communicate over the ALDL bus. It supports mode 01 and mode 03. MODE 3 gives you the ability to request memory dump from RAM realtime for easy debugging. It won`t be hard to patch other modes also.

    To communicate over ALDL you need a simple ftdi based serial to usb converter, and eehack as a comm terminal.

  15. #30
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Some more detail regarding idle air control stepper motor drive. The driver for the stepper is on the Tside board, interface through the gray connector. The part is a 15 pin SIPP lead formed in an alternating way (Sometimes referred to as zip?)
    The stepper function is quite simple as the motor does not spin, just makes fine adjustments by slight rotation of the lead screw. Because of this there are no need to worry about acceleration and speed. There is a simple table of outputs that are applied to make corrections to idle speed. Since the function is mostly in code, here are a few lines:

    Code:
    546B  F6 18 22        LDAB   $1822           ; INDEX TO MOTOR PHASE CTL
    546E  CE 65 E1        LDX    #$65E1          ; POINT AT IAC PHASE TABLE
    5471  C4 03           ANDB   #$03            ; ADD CURRENT PHASE OFFSET
    5473  3A              ABX                    ; 
    
    5474  B6 10 00        LDAA   $1000           ; SET 2 MS BITS TO CONTROL
    5477  84 3F           ANDA   #$3F            ; IAC MOTOR. CLEAR BITS
    5479  AB 00           ADDA   $00,X           ; THEN SET AS PER TABLE
    547B  B7 10 00        STAA   $1000           ; OUTPUT TO MOTOR
    ...
    Table
     ...
    ************************************************
    * TABLE AFFECTS 2 MS BITS OF PORT A
    * IAC MOTOR PHASES ARE ON BIT 6 AND 7
    ************************************************
    65E1  00 40 C0 80
    The code outputs each of the table entries in sequence causing the motor to step.

    Information about the hookup of this part is in the pdf below

    -Tom

    Update to post: Adding pdf file with details of all the SIPP driver chips and connections. Take care... best efforts only to determine connection
    Attached Files Attached Files
    Last edited by Tom H; 02-04-2019 at 08:33 PM.

Similar Threads

  1. 94-95 LT1 $EE Y-body vs. F/B-body PCM differences
    By johnny_b in forum GM EFI Systems
    Replies: 5
    Last Post: 01-15-2023, 02:41 PM
  2. Tuner Pro XDF 1999-2000 F Body + Y Body
    By john h in forum OBDII Tuning
    Replies: 33
    Last Post: 02-02-2020, 11:12 PM
  3. Replies: 31
    Last Post: 09-20-2018, 06:00 AM
  4. F-body engine install to B-body
    By serge_an in forum GM EFI Systems
    Replies: 4
    Last Post: 09-22-2016, 02:51 PM
  5. 95 F-body Fuel Pump with 95 B-Body Engine/Tank
    By EPS3 in forum GM EFI Systems
    Replies: 7
    Last Post: 09-19-2016, 02:40 PM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •