Bringing TBI and Multi Port Fuel Injection to a New Level.     EFI Conversions and Tuning! Seattle to Portland! E-mail Tuning Consultant!
Page 9 of 10 FirstFirst ... 45678910 LastLast
Results 121 to 135 of 149

Thread: 1997 F-Body ECM

  1. #121
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    721
    Great find, that $800 bytes part is missing on 94-95 code. It must be the instruction set or code for the tpu. Italso is placed on a non shared memory region with eside. I guess on 94-95 version it is hard built. Later it is configurable.

    Now I found some differences that might help you.
    16FC is loaded with 004C vs 0044. than a pause is executed. It might be processor reset or mode change for reset the shared memory.

    16F0 is not set vs loaded with #0003 before the microstore is loaded and than cleared after that.
    It might be set bit that unlocks eside access to TPU non shared memory region.

    Than the microstore is loaded. We will have to find where in the TPU ram that is stored to get the processor`s correct offset.
    That looks like instructions code, or the main core that the TPU runs from. Make a byte repeat analysis to find the opcodes. If we can find the correct offset and the instruction set a disassembly can be made.


    Thatis the other main change the size and address is the same but data slightly differs.
    Code:
                                          fdb $84                 ; a6b4-a704 cal data 1600-??? for tpu
    RESERVED:A6B6                 fdb $CD
    RESERVED:A6B8                 fdb $279
    RESERVED:A6BA                 fdb $379
    RESERVED:A6BC                 fdb $479
    RESERVED:A6BE                 fdb $579
    RESERVED:A6C0                 fdb $679
    RESERVED:A6C2                 fdb $779
    RESERVED:A6C4                 fdb $879
    RESERVED:A6C6                 fdb $9C1
    RESERVED:A6C8                 fdb $AC1
    RESERVED:A6CA                 fdb $B5
    RESERVED:A6CC                 fdb $77
    RESERVED:A6CE                 fdb $7B
    RESERVED:A6D0                 fdb $A2
    RESERVED:A6D2                 fdb $A6
    RESERVED:A6D4                 fdb $1A
    RESERVED:A6D6                 fdb $11A
    RESERVED:A6D8                 fdb $21A
    RESERVED:A6DA                 fdb $31A
    RESERVED:A6DC                 fdb $41A
    RESERVED:A6DE                 fdb $51A
    RESERVED:A6E0                 fdb $61A
    RESERVED:A6E2                 fdb $71A
    RESERVED:A6E4                 fdb $8C8
    RESERVED:A6E6                 fdb $9C8
    RESERVED:A6E8                 fdb $AC8
    RESERVED:A6EA                 fdb $BC8
    RESERVED:A6EC                 fdb $C93
    RESERVED:A6EE                 fdb $D93
    RESERVED:A6F0                 fdb 0
    RESERVED:A6F2                 fdb 0
    RESERVED:A6F4                 fdb $F38
    RESERVED:A6F6                 fdb $E91
    RESERVED:A6F8                 fdb $BB
    RESERVED:A6FA                 fdb 0
    RESERVED:A6FC                 fdb $EA9
    RESERVED:A6FE                 fdb 0
    RESERVED:A700                 fdb 0
    RESERVED:A702                 fdb 0
    vs
    Code:
    RESERVED:7AFC                 fdb $8E                 ; table
    RESERVED:7AFC                                         ; 7AFC-7B4B
    RESERVED:7AFC                                         ; INITIAL VALUES LOADED FOR 1600-1650 at reset
    RESERVED:7AFE                 fdb $CC
    RESERVED:7B00                 fdb $2DE
    RESERVED:7B02                 fdb $3DE
    RESERVED:7B04                 fdb $4DE
    RESERVED:7B06                 fdb $5DE
    RESERVED:7B08                 fdb $6DE
    RESERVED:7B0A                 fdb $7DE
    RESERVED:7B0C                 fdb $A7
    RESERVED:7B0E                 fdb $8F
    RESERVED:7B10                 fdb $D0
    RESERVED:7B12                 fdb $D7
    RESERVED:7B14                 fdb $D8
    RESERVED:7B16                 fdb $76
    RESERVED:7B18                 fdb $AF
    RESERVED:7B1A                 fdb $DD
    RESERVED:7B1C                 fdb $33
    RESERVED:7B1E                 fdb $133
    RESERVED:7B20                 fdb $233
    RESERVED:7B22                 fdb $333
    RESERVED:7B24                 fdb $433
    RESERVED:7B26                 fdb $533
    RESERVED:7B28                 fdb $633
    RESERVED:7B2A                 fdb $733
    RESERVED:7B2C                 fdb $8C6
    RESERVED:7B2E                 fdb $9C6
    RESERVED:7B30                 fdb $AC6
    RESERVED:7B32                 fdb $BC6
    RESERVED:7B34                 fdb $CC6
    RESERVED:7B36                 fdb $DC6
    RESERVED:7B38                 fdb 0
    RESERVED:7B3A                 fdb 0
    RESERVED:7B3C                 fdb $FE4
    RESERVED:7B3E                 fdb $C1
    RESERVED:7B40                 fdb $6E
    RESERVED:7B42                 fdb $C4
    RESERVED:7B44                 fdb $E92
    RESERVED:7B46                 fdb $E85
    RESERVED:7B48                 fdb $AA
    RESERVED:7B4A                 fdb $5C

    I will try to find a bin for the diesel PCM and see how TPU is set there.

  2. #122
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    100
    Quote Originally Posted by kur4o View Post
    $800 bytes part is missing on 94-95 code. It must be the instruction set or code for the tpu. Italso is placed on a non shared memory region with eside. I guess on 94-95 version it is hard built. Later it is configurable.
    OK, that may be a great help. The TPU in the '302 that dzidaV8 wrote about has a ROM and the ability to add custom routines in RAM as an extension. It may be that the 2K of code I am looking at adds extensions to the ROM. Things like multiply, divide and so on, may be routines in the ROM/Library that are called. If true, this would add yet another dimension to the problem. I will see if the ROM can be dumped... it will take me a while though.

    All sorts of guesses on my side but: Given that the TPU exists in a chip select window $1400 : $17FF: Given that the 2K RAM extension exists between $1400 and $14FF: None of this constrains the addressing internal to the TPU. In theory the address space of the TPU could be 524288 bytes wide (that's 64K X 64bit word)!. I think it likely however that the ROM would exist down low between $0000 and $13FF. Time will tell

    -Tom

  3. #123
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    721
    I have another theory. The chip has built in rom with $800 bytes and some bootloader. At reset the $800 bytes are copied to ram and the loop is executed from there. Later eside can take control and rewrite the $800 bytes with user specified code. In 94-95 the code is what the pcm needs, so it is not updated. In 96-97 the code needs some changes and eside loads new custom code for the new features of the pcm.

    The TPU might have different memory layout and the shared memory there can be seen at $0-$2df compared to eside 1400-16df.

    I looked again at the data and it seems like 8byte instruction scheme. Each 8 bytes represent some instructions sequence and the second byte is likely 00 or randomly around 80 or 40.

    It could be some form of calibration data.

  4. #124
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    100

    UN-Brick

    This post is a little off the current topic, but perhaps of use to some folks who have "bricked" a PCM. I am looking at the ESide with a view to placing the processor in bootstrap mode. There is a 40 pin connector that is not populated located opposite edge from the black connector. It's on both T & Eside boards. I believe this was used by the developers and the folks doing the calibrations. The connector attached to a 3rd board with a two port memory. There is still code set up to drive this test board that exists in the release code. An example of this came up when looking at the TPU... Location $3B85 is set in the calibration to a location in the TPU that the engineer wants to monitor. Production code sets it to zero, but when in use it would be set in the $1400 - $17FF range.

    In any case, back to the bricked PCM problem... The un-stuffed connector has connection for TXD, RXD, Ground, ModeA, ModeB and +5V on that connector in the first 8 locations. I believe that was such that the test board could re-flash. We can use these signals in the same way to run test code. Our test code can easily re-flash the part to un-brick. I hope to get the bootstrap mode working today/tomorrow. When this gets done, I will publish some pictures with the pinout and an intro of how to run test code on the ESide board.

    -Tom

  5. #125
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    721
    The un-stuffed connector has connection for TXD, RXD, Ground, ModeA, ModeB and +5V on that connector in the first 8 locations
    That will be awesome if you can figure it out how to use it.
    It is only been speculated how to implement the headers but never done. I traced most of the pins to the memory chip, but there might be more for the processor. Anyway to reflash the chip on board a 12v source will be needed for the VPP pin on the flash chip.


    I managed to find a 2000 diesel bin, and made a quick disassembly. The TPU doesn`t have the extra data written as per 96-97 code. It is set up more like the 94-95 code. I will try some earlier diesel bins to find some data for comparison.

  6. #126
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    100

    UN-Brick

    Hi,

    I was able to place the ESide in bootstrap mode, just a little more complicated than I thought. I had forgotten the bit about the bootstrap places port D in wire or mode. I needed a 10K pullup there. Second is that the RX is not defaulted in my case. This is because the ribbon between E & T sides has been removed. This required a second pullup OR to be driven by my usb<-->serial cable. Since I had no connection, this floated and started a download with no valid data = crash.

    This download mode is the same as I used for my 68HC11 based Opti-simulator. Thus I have the needed software to include the initial 0xFF. Probably won't get to this for a few days to try things out. Wife has some complaints re time spent.

    Details to follow...

    -Tom

  7. #127
    Fuel Injected!
    Join Date
    Jan 2012
    Location
    Poland
    Posts
    138
    Quote Originally Posted by kur4o View Post
    I have another theory. The chip has built in rom with $800 bytes and some bootloader. At reset the $800 bytes are copied to ram and the loop is executed from there. Later eside can take control and rewrite the $800 bytes with user specified code. In 94-95 the code is what the pcm needs, so it is not updated. In 96-97 the code needs some changes and eside loads new custom code for the new features of the pcm.

    The TPU might have different memory layout and the shared memory there can be seen at $0-$2df compared to eside 1400-16df.

    I looked again at the data and it seems like 8byte instruction scheme. Each 8 bytes represent some instructions sequence and the second byte is likely 00 or randomly around 80 or 40.

    It could be some form of calibration data.

    I agree with you, and I think we shouldn't consider the TPU as a microprocessor, I'm pretty sure it's an FPGA matrix with a tiny bootloader, like in 68332 micros. The binary opcodes for 68332 TPU are really dense in data packing (i.e. only two MSb define the major operation, the rest are operands), so there might be no obvious repetition in 16 or 8 bits looking at the binary.

  8. #128
    Fuel Injected!
    Join Date
    Jan 2012
    Location
    Poland
    Posts
    138
    Another interesting piece to read about the TPU in LS1 PCMs
    Attached Files Attached Files

  9. #129
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    100
    Quote Originally Posted by Tom H View Post
    Hi,

    I was able to place the ESide in bootstrap mode, just a little more complicated than I thought. I had forgotten the bit about the bootstrap places port D in wire or mode. I needed a 10K pullup there. Second is that the RX is not defaulted in my case. This is because the ribbon between E & T sides has been removed. This required a second pullup OR to be driven by my usb<-->serial cable. Since I had no connection, this floated and started a download with no valid data = crash.

    This download mode is the same as I used for my 68HC11 based Opti-simulator. Thus I have the needed software to include the initial 0xFF. Probably won't get to this for a few days to try things out. Wife has some complaints re time spent.

    Details to follow...

    -Tom
    I have run code on the ESide this morning, this is yet another tool in the box to unravel the TPU.

    The code I ran is a simple "Hello World!" sort of thing. It just sits there kicking the 68HC11's COP and the PRU's watchdog while sending the message over and over. Plan is now to get a better look at the TPU. Suggestions re code to write are welcome.

    Code:
    * Clock source	12.5829 to the test boards 16MHZ
    * Eclock	 3.1457 to the test boards 4MHZ
    * Baud rate for ESide 1,887.4HZ
    
    REGISTERS	EQU	$1000		;
    RAMSTART	EQU	$0000		;
    RAMEND		EQU	$03FF		;
    
    SCSR		EQU	$2E		;
    SCDR		EQU	$2F		;
    
    
    	ORG	$0000			; SET ORIGIN
    
    START	SEI				; MASK INTERRUPTS
    	LDX	#REGISTERS		; POINT X AT REGISTER BASE ADDRESS
    
    LOOP 	LDY	#HELLO			; POINT AT MESSAGE START
    
    	LDAA	#$55			; RESET 68HC11 COP
    	STAA	$103A			; COP ARMED
    	LDAA	#$AA			; 
    	STAA	$103A			; COP RESET
    
    	LDD	#$50A0			; RESET THE PORT REPLACEMENT
    	STAA	$1806			; WATCHDOG TIMER
    	STAB	$1806			;
    
    WAIT_TX	BRCLR	SCSR,X,#$80,*		; WAIT TO TX NEXT CHAR
    
    	LDAA	0,Y			; READ MESSAGE BYTE
    	STAA	SCDR,X			; TRANSMIT OVER SCI
    
    	INY				; POINT TO NEXT CHAR
    	CPY	#HEND			; TEST FOR LAST OF MESSAGE
    	BEQ	LOOP			; BACK TO 1S WAIT
    
    	BRA	WAIT_TX			; SEND NEXT CHAR
    
    HELLO	DB	"Hello world!!!"
    	DB	$0A
    	DB	$0D
    
    HEND	EQU	*
    
    	END	START
    Again, details to follow...

    -Tom

  10. #130
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    100
    Thank you for the info dzidaV8!

    Looks like I have a bunch of reading ahead.

    -Tom

  11. #131
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    100

    UN-Brick

    Hi,

    This is a quick note to describe how the 68HC11 bootstrap mode can be used to further learning details of the PCM. The second use would be to revive a bricked PCM.

    To place the processor in bootstrap mode, drive both modea and mode pins low and power the board. After reset, TX should be driven to a break condition until you start the download. After the first character of your binary is sent, the tx will echo all the received bytes.

    Assemble your program to run within the internal ram. Small, light, compact is the only way here. Prepend the binary with an FF character and send to the board using 1,888 baud. Once these steps are complete, the bootstrap loader will execute your program at $0.

    The connections to the board are given in the attached picture. Please note that bootstrap mode uses wire or mode. This means that a pullup on the TX is needed OR that your program needs to change the setting. I added the resistor (10K) for simplicity and because the mode affects other pins on the port. I did not want contention with some other chip, and the resistor avoids this. For best practice, I also added a 10K pullup to the RX side. This just defaults the RX to prevent a "download" from starting before I connect the serial.

    I am attaching a few files... I have a program that takes an Srecord file and turns it into a bin, complete with the leading "0xFF". Ask me if you want the source, but it isn't something I am proud of... sort of a hack job to "geterdone". Just a console app but it got carried away re-using some Srecord parsing code that already existed. Nuf said.

    Second attach is an HC11 program to dump areas of memory in srecords. Please note that bootstrap enforces the EEPROM to exist at 0xFE00 - FFFF. So without re-program of the config reg, you can't see that bit. This is of no trouble to me, as the intent is to figure out the TPU.

    Questions: please ask and I will help if I can BUT the major project for me needs to be the TPU. All info and code is offered at your risk and you need to understand the boot mode well before you proceed. I have not written code to erase and clear the FLASH as yet. I will do this later perhaps

    I had trouble attaching the .exe and .asm files. I renamed them as .exe.txt and .asm.txt. I hope these will get through OK.

    -Tom
    Attached Images Attached Images
    Attached Files Attached Files

  12. #132
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    100
    PS

    Here is a sample of the output sent through the SCI serial.

    Code:
    S1132B1078780D0D0F151B2D3F78787878787878B4
    S1132B20780D0D0F151B2D3F7878787878787878A4
    S1132B3020202020201E0A0A0A0A0A0A0A0A0A0A6F
    S1132B400A66666E6238211A110D0606050404042D
    S1132B5004048A864D26190B08050505040404049B
    S1132B60048A864D261905040303020203030404A0
    S1132B705F69737D800702D002D00036003A02D02C
    S1132B8002D0002C003002D002D0004A004E02D005
    S1132B9002D0004000445C5C5C5C5C5C5C5C5C6639
    S1132BA070727476787C8080808080808080808061
    S1132BB080808080808080CD4C003C827F83817BBC
    S1132BC07D7F81897A798181787A88099A01A890B0

  13. #133
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    721
    I still think that the TPU has 2k of ram. 1400-17FF is shared with eside all the time. Eside can access tpu ram from 1800-2000 by setting some byte on the tpu. The switch byte is 16f0 and is set with $0003.

    There is also some special routine for eside to read the shared memory.
    RESERVED:5BCA ldaa word_146A
    RESERVED:5BCD ldd word_146A
    RESERVED:5BD0 std word_21C
    and on 94-95
    RESERVED:426A sei
    RESERVED:426B ldaa word_16D0
    RESERVED:426E nop
    RESERVED:426F ldd word_16D0
    RESERVED:4272 cli
    Any ideas why it takes some extra time to make the read.

    I tried reading the shared memory region with mode2 commands but always a zero is read.

    A small program than can exploit the 16f0 bit might give access to all tpu memory not just the specified range. I am sure a backdoor was left for debugging.

    Try first reading the shared memory region and if successful try setting the 16f0 bit to access all of the memory the TPU sees.

    Awesome work on the bootstrap mode. It is too bad I cannot be of any help there. You will be the only one capable of writing code for unbricking the PCM in bootstrap mode. I suppose it will work with any flash based hc11 PCM of that years. We might be able to read abs and sir modules with it.

  14. #134
    Fuel Injected!
    Join Date
    May 2014
    Age
    36
    Posts
    28
    i'm not a programmer at Your level guys so not sure if this will help but AFAIR 68HC12 is enhanced 16-bit version of the 68HC11. HC12 is used in Megasquirt 2, so try asking here http://www.msextra.com/ or their messageboard and it will shorten up lots of Your hard work. Also first Megasquirt was run by 68HC08 so they should know alot of about HC famili.
    Handyboard that is used for lego alo runs HC11, loader can by found here: https://sourceforge.net/projects/hbloader-uml/
    other links regarding : https://web.archive.org/web/20060710...u-m68hc11.org/


    best regards

  15. #135
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    100
    Thank you WASyL, I will take a look!

    -Tom

Similar Threads

  1. 94-95 LT1 $EE Y-body vs. F/B-body PCM differences
    By johnny_b in forum GM EFI Systems
    Replies: 4
    Last Post: 01-15-2019, 08:48 AM
  2. Replies: 31
    Last Post: 09-19-2018, 08:00 PM
  3. Tuner Pro XDF 1999-2000 F Body + Y Body
    By john h in forum OBDII Tuning
    Replies: 28
    Last Post: 09-18-2017, 07:04 PM
  4. F-body engine install to B-body
    By serge_an in forum GM EFI Systems
    Replies: 4
    Last Post: 09-22-2016, 04:51 AM
  5. 95 F-body Fuel Pump with 95 B-Body Engine/Tank
    By EPS3 in forum GM EFI Systems
    Replies: 7
    Last Post: 09-19-2016, 04:40 AM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •