OBD2 LT1 XDF $EE EEX creation

[kur4o]

I would like to offer what I can... my work is far from perfect though and I hope what I send doesn't present setbacks. I think the most digestible is perhaps my ram tables for the tside. Those can be reached with ELM327 and so on. We can start there. If you need my version of commented code, I can send that also.

-Tom

You did some great work here. I have one question for the tside memory chip. How the data is written to it. The usable banks are 3 banks with 32kb with $2000 bytes added to the first bank to make it 32kb.

How are this written to flash chip is there any offset for the third bank. Is it bank1 and 2 from 0-ffff and bank3 from 10000-18000 or bank 3 from 18000-1FFFF with 10000-18000 empty space.

[sherlock9c1]

Wow that's very helpful. I've done what you suggested - started with an OBD1 BIN and then opened a OBD2 BIN, both in TunerPro, and just used the built-in XDF editor which allows me to immediately see if the tables now match. I started with an Impala (b-body) BIN since there was no options on that carline (like rear axle ratio) to mess anything up in the BIN.

For hex editor / comparison, I'm using BeyondCompare, which is a great tool for the price. It's successfully found all of the big tables I've searched for almost instantly. The latest Windows calculator has a programmer mode that simultaneously displays hex, decimal, binary and octal, and that's been useful too.

So far I've found all the MAF, spark and VE tables. I started working on the transmission tables but ran out of time.

kur4o, can you send me a PM and we'll start talking over email? I'm going to need some help understanding how to read disassembly, otherwise these scalars and check bits will take a long time.

I'd also like to better understand the interplay between RAM and EEPROM while the car's running. What's left as a EEPROM lookup, and what's brought into RAM? I haven't looked at Tom H's attachment yet but will soon.

[Tom H]

You did some great work here. I have one question for the tside memory chip. How the data is written to it. The usable banks are 3 banks with 32kb with $2000 bytes added to the first bank to make it 32kb.

How are this written to flash chip is there any offset for the third bank. Is it bank1 and 2 from 0-ffff and bank3 from 10000-18000 or bank 3 from 18000-1FFFF with 10000-18000 empty space.

On the '96/7 TSide, the FLASH is set up to work in two pages. First page is enabled in the 'HC11 address space from $2000 through $FFFF, second page overlays from $8000 thru $FFFF. Address line 16 is driven by the bank switch bit (port a bit 5) and A 15. I believe the chip marked 014 P56AB 83833 is an AND gate (I need to confirm that it is not a NAND) This means that the 2nd page maintains the same code as the first in the range of $2000 thru $7FFF. The upper 32K are replaced with the 2nd page. In the FLASH chips address range, from $00000 thru $01FFF and from $10000 thru $17FFF are not used. It would be possible to add some logic and expose a 3rd page, but this is not what GM did.
Note that if the part mentioned above turns out to be NAND the address ranges in the flash flip.

Hope this answer is not confusing. If so, ask again and I will try to clarify. It is hard to write these things in a clear way.
-Tom

[Tom H]

On the '96/7 TSide, the FLASH is set up to work in two pages. First page is enabled in the 'HC11 address space from $2000 through $FFFF, second page overlays from $8000 thru $FFFF. Address line 16 is driven by the bank switch bit (port a bit 5) and A 15. I believe the chip marked 014 P56AB 83833 is an AND gate (I need to confirm that it is not a NAND) This means that the 2nd page maintains the same code as the first in the range of $2000 thru $7FFF. The upper 32K are replaced with the 2nd page. In the FLASH chips address range, from $00000 thru $01FFF and from $10000 thru $17FFF are not used. It would be possible to add some logic and expose a 3rd page, but this is not what GM did.
Note that if the part mentioned above turns out to be NAND the address ranges in the flash flip.

Hope this answer is not confusing. If so, ask again and I will try to clarify. It is hard to write these things in a clear way.
-Tom

PS... The reason GM didn't overlay the lower 32K is because of interrupts. All the vectors need to point to the lower area such that if an interrupt happens, it can be serviced no matter which bank is active.

[kur4o]

Tom H

The explanation says it all. So if you read the full flash chip the empty regions will be 0-1fff and 10000-17fff.

I have some routines that will erase and write the intel chips. You can set it up for the bootstrap mode and try some flashing.

Maybe we can move the conversation to the 96-97 lt1 thread.

[Tom H]

Tom H

The explanation says it all. So if you read the full flash chip the empty regions will be 0-1fff and 10000-17fff.

I have some routines that will erase and write the intel chips. You can set it up for the bootstrap mode and try some flashing.

Maybe we can move the conversation to the 96-97 lt1 thread.

Yes, that's what I expect. The question of if the gate is AND or NAND does come into this though and would just flip the banks. Easy to sort out if I had a working Tside (I don't at the moment). One issue gives me pause with what I wrote... the DLC interrupt seems to be in the switched bank. In the case this interrupt fires in the upper bank, the PCM will crash. Yipes did I find a bug???? or is that interrupt just not used. If not used, why provide a vector in a switched bank.

I am getting closer to being able to help with this but still struggling with some of the basics. Also struggling with finger problems... I soldered a header strip in place of the flex cable that broke. I should have placed one on the comp side to use a standard ribbon cable. now I need to cross all the wires ^&%&^%&^%

When I get the latest little (?) project of the schematic done, I would like to disassemble the erase and write routines. Have you already done this??

-Tom

[kur4o]

When I get the latest little (?) project of the schematic done, I would like to disassemble the erase and write routines. Have you already done this??

-Tom

I did it on 94-95 code but I am sure they use the same code. On 96-97 there might be slight difference, but when you get there I will give you a good start.
Chip enable must be set high with vpp to enable most of the functions.

[steveo]

i just got what i think is a 'bricked' 1996 ecm so i'm going to try to bring it back to life and help a bit with this research too.

[Tom H]

I did it on 94-95 code but I am sure they use the same code. On 96-97 there might be slight difference, but when you get there I will give you a good start.
Chip enable must be set high with vpp to enable most of the functions.

Hi Kur4o,

I am 95% through with the TSide schematic. This was a very difficult task... There are just a few chips that I am unable to identify. Two chips from Philips Semi. I believe one is some sort of amplifier and the other may be sample/hold/comparator. To finish work, I need to hook up a sound source and try to characterize the knock filter/ amp/ comparator. All this while simulating a running engine. This will take a while and I need a break SO...

I re-wrote my disassembler and it is ready to work through your code. It will be interesting to see the GM code for programming
-Tom