Page 3 of 10 FirstFirst 12345678 ... LastLast
Results 31 to 45 of 148

Thread: OBD2 LT1 XDF $EE EEX creation

  1. #31
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Quote Originally Posted by steveo View Post
    where's the switch to disable the crank sensor? that one is pretty important for 96-97 cars with huge cams.
    Hi Steveo,

    Could you explain a bit more about how a large cam needs the crank sensor code disabled? This is stuff I don't know enough about...

    -Tom

  2. #32
    LT1 specialist steveo's Avatar
    Join Date
    Aug 2013
    Posts
    4,007
    the crank sensor on these engines is only there to feed the OBD-ii misfire detection requirement. it compares the cam and crank angles i suppose and if they're too far off it figures there's a misfire.

    you can imagine how the cam to crank relationship looks with a really lumpy cam. it causes the timing chain to jog back and forth a lot and cause the same kind of result as a real misfire.

    the check engine light flashes if that happens. that might be a good clue, if you can find a routine that looks like it's flashing the CEL rather than just sticking it on, you could probably track that back and find the memory containing the error bit, then go back from there and find the misfire detection code.

    it'd be nice to find the parameters so you could widen the angle that it considers a misfire and still retain some misfire detection, but other tools don't have that so people tend to just disable the error code so their dash doesn't blink at them. also the misfire detection doesn't SEEM to do anything other than flash the light, but nobody is 100% sure about that

  3. #33
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Quote Originally Posted by steveo View Post
    it'd be nice to find the parameters so you could widen the angle that it considers a misfire and still retain some misfire detection, but other tools don't have that so people tend to just disable the error code so their dash doesn't blink at them. also the misfire detection doesn't SEEM to do anything other than flash the light, but nobody is 100% sure about that
    I am sure (?) I can find it, once past these programming routines I will take a look. You are talking about the dtc.. right? There is a table where each dtc can be disabled/enabled. I sort of remember that there are four classes. I will refresh and post back later.

    Somewhere in the last 25yrs I was told by someone (sort of vague?) that misfire was done by looking at the time between hi-res ticks. If she fires, the momentary acceleration of the crank would reduce time to the next tick. That & the
    operation of the crank sensor beyond looking for the disable is probably a fall task. That is unless we all get locked down.
    Easy to see how a lumpy cam would mess with all the crank acceleration stuff also.

    -Tom

  4. #34

  5. #35
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Quote Originally Posted by steveo View Post
    i dont know if the DTC is separate from the misfire detection code flashing the check engine light...it does both
    If your car is like the 96/7 Camaro/Firebird, I can give you a suggestion in a few days that *should* stop the lights. Can you tell me what code it is throwing??

  6. #36

  7. #37
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,470
    More comments added.
    Attached Files Attached Files

  8. #38
    Fuel Injected!
    Join Date
    Sep 2012
    Location
    Huntsville, AL
    Posts
    237
    Well, I've got the disassembler open and am looking at the OBD1 code, with a whole lot of help from kur4o. And great work him on the commenting! I need to start an Ibuprofen fund; whew this is new territory for me.

  9. #39
    Fuel Injected!
    Join Date
    Nov 2017
    Location
    Californiacation
    Age
    57
    Posts
    811
    Quote Originally Posted by kur4o View Post
    More comments added.
    Hi kur4o,
    My version of ida is so old I cannot view your work. Could I talk you into saving/produce as html so I could view it? My old version of ida used to be able to do that with a keystoke.
    Last edited by In-Tech; 05-04-2020 at 02:17 PM.
    -Carl

  10. #40
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Quote Originally Posted by kur4o View Post
    06 aa is the positive response when upload is good, it can be followed with some data like 2 byte checksum or chipid.

    It is some standard frame response.



    This is the header that is uploaded via mode5 request for a checksum range.
    And you are right it is 7e not bd. This was the initial version that crashes but wasn`t fixed in the dissasembly.
    Thank you, I think the transmit routine detailed here is correct now. I was interested to find that in the flash code there seems to be separate support for Intel and AMD sourced flash. I would expect that with the size of GM they would have had relationships with both vendors. The Intel was preferred but AMD was backup. I wonder if any PCMs were produced with the AMD parts. If so, all code needs to check the manufacturer and device id and have these separate routines. I noticed this in the erase code where there is a sequence for the AMD only UNLOCK.

    Not had tiime to look at the '97 code you sent yet, but thank you for the update.

    After this post, I plan to move details back to the '97 F-body thread. I now notice that this thread was to be about XDF and my posts are a bit of a hijack...

    -Tom

    Code:
    *************************************************
    * SEND ALDL MESSAGE
    *************************************************
    012C  36                 PSHA            ; SAVE REGISTERS ON STACK
    012D  18 3C              PSHY            ; 
    
    012F  3C                 PSHX            ; MOVE POINTER TO MESSAGE ON STACK
    0130  18 38              PULY            ; TO IY
    
    0132  CE 10 00           LDX    #$1000        ; 68HC11 REGISTER BASE ADDRESS
    0135  86 08              LDAA    #$08        ; TRANSMIT ENABLE
    0137  A7 2D              STAA    $2D,X        ; SCI CONTROL REGISTER
    
    0139  37                 PSHB            ; RT DELAY
    013A  C6 0B              LDAB    #$0B        ; 
    013C  5A                 DECB            ; 
    013D  26 FD              BNE    $013C        ; 
    013F  33                 PULB            ; 
    
    0140  B6 18 03           LDAA    $1803        ; PRU PORT B DIRECTION
    0143  8A 40              ORAA    #$40        ; 
    0145  B7 18 03           STAA    $1803        ; 
    
    0148  B6 18 02           LDAA    $1802        ; PRU PORT B
    014B  8A 40              ORAA    #$40        ; ALDL TX ENABLE
    014D  B7 18 02           STAA    $1802        ; 
    
    0150  4F                 CLRA            ; INITIALIZE CHECKSUM
    0151  97 2E              STAA    @$2E        ; 
    
    * MESSAGE CONTENT: 
    * [DEVICE ID] [LENGTH] [MODE] [MESSAGE …] [CHECKSUM]
    *
    * DEVICE ID:    $F4 FOR TSIDE, $E4 FOR ESIDE
    * LENGTH:    MESSAGE LENGTH + $52 
    *        MESSAGE LENGTH INCLUDES DEVICE ID, LENGTH, MODE, MESSAGE() AND CHECKSUM
    * MODE:        MODE1 –  READ DIAGNOSTIC INFORMATION
    *        MODE2 –  READ MEMORY SEGMENT (64 Bytes)
    *        MODE3 –  READ MEMORY SEGMENT (Arbitrary, 1-84 Bytes)
    *        MODE4 –  TEST ACTUATORS
    *        MODE5 –  ENTER PROGRAMMING MODE
    *        MODE6 –  UPLOAD AND EXECUTE PROGRAM SEGMENT
    *        MODE7 –  BROADCAST
    *        MODE8 –  DISABLE CHATTER (TAKE BUS MASTER)
    *        MODE9 –  ENABLE CHATTER (GIVE BUS MASTER)
    *        MODE10 – CLEAR MALF CODES
    *        MODE12 – PROGRAM AUXILIARY FLASH MEMORY
    *        MODE13 – SECURITY CHALLENGE/RESPONSE
    * 
    0153  86 F4              LDAA    #$F4        ; PCM DEVICE ID: PCM
    0155  8D 2E              BSR    $0185        ; SCI TRANSMIT BYTE
    
    0157  17                 TBA            ; MESSAGE CONTENT LENGTH
    
    0158  8B 55              ADDA    #$55        ; LENGTH: ID + LENGTH + CONTENT +SUM + 0X52
    015A  8D 29              BSR    $0185        ; SCI TRANSMIT BYTE
    
    015C  18 A6 00           LDAA    $00,Y        ; LOOP THROUGH MESSAGE
    015F  8D 24              BSR    $0185        ; SCI TRANSMIT BYTE
    
    0161  18 08              INY            ; INCREMENT POINTER
    0163  5A                 DECB            ; DECREMENT REMAINING BYTE COUNT
    0164  26 F6              BNE    $015C        ; LOOP
    
    0166  96 2E              LDAA    @$2E        ; CHECKSUM
    0168  40                 NEGA            ; NEGATE, SUM OF 0XFF
    0169  8D 1A              BSR    $0185        ; SCI TRANSMIT BYTE
    
    016B  1F 2E 40 FC        BRCLR    $2E,X,$40,$016B    ; LOOP TILL TRANSMIT COMPLETE
    
    016F  B6 18 03           LDAA    $1803        ; SET PRU PORT B DIRECTION
    0172  84 BF              ANDA    #$BF        ; DEFAULT ALDL TO DISABLE TX
    0174  B7 18 03           STAA    $1803        ; 
    
    0177  37                 PSHB            ; SAVE REGISTERS
    0178  C6 0B              LDAB    #$0B        ; 3 + 2 + (11 *5) + 4 = 64 ECLOCK
    017A  5A                 DECB            ; RT DELAY = 20US
    017B  26 FD              BNE    $017A        ; LOOP 
    017D  33                 PULB            ; RESTORE REGISTERS
    
    017E  1D 2D 08           BCLR    $2D,X,$08    ; DISABLE SCI TRANSMITTER SCCR2:TE
    
    0181  18 38              PULY            ; RESTORE REGISTERS
    0183  32                 PULA            ; 
    
    0184  39                 RTS            ; DONE

  11. #41
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Quote Originally Posted by steveo View Post
    the crank sensor on these engines is only there to feed the OBD-ii misfire detection requirement. it compares the cam and crank angles i suppose and if they're too far off it figures there's a misfire.

    you can imagine how the cam to crank relationship looks with a really lumpy cam. it causes the timing chain to jog back and forth a lot and cause the same kind of result as a real misfire.

    the check engine light flashes if that happens. that might be a good clue, if you can find a routine that looks like it's flashing the CEL rather than just sticking it on, you could probably track that back and find the memory containing the error bit, then go back from there and find the misfire detection code.

    it'd be nice to find the parameters so you could widen the angle that it considers a misfire and still retain some misfire detection, but other tools don't have that so people tend to just disable the error code so their dash doesn't blink at them. also the misfire detection doesn't SEEM to do anything other than flash the light, but nobody is 100% sure about that
    Hi,

    From what I can tell, the DTCs related to the crank position sensor are these.

    P0300 ENGINE MISFIRE DETECTED: RANDOM/MULTIPLE CYLINDER
    P0301 CYLINDER 1 MISFIRE DETECTED
    P0302 CYLINDER 2 MISFIRE DETECTED
    P0303 CYLINDER 3 MISFIRE DETECTED
    P0304 CYLINDER 4 MISFIRE DETECTED
    P0305 CYLINDER 5 MISFIRE DETECTED
    P0306 CYLINDER 6 MISFIRE DETECTED
    P0307 CYLINDER 7 MISFIRE DETECTED
    P0308 CYLINDER 8 MISFIRE DETECTED
    P0335 CRANKSHAFT POSITION SENSOR CIRCUIT MALFUNCTION
    P0336 CRANKSHAFT POSITION SENSOR CIRCUIT RANGE/PERFORMANCE


    I think we can eliminate anything with a "CIRCUIT" in the name because no amount
    of cam can affect continuity of the sensor. My thinking is that the P0300 would
    be the code I would expect. In the '97 code I see a table of enables for DTC processing
    starting at $20B0, 17bytes deep. Each bit controls the processing of a DTC, set is on. I believe
    that clearing bit 7 of $20B4 will eliminate the DTC P0300. It would be more interesting to work
    through the code to see if a parameter in the calibration can be change to eliminate the DTC at idle where
    the impact of the cam is setting this thing off.

    -Tom

    PS: This table would be a good thing for the XDF to have...

  12. #42
    Fuel Injected!
    Join Date
    Sep 2012
    Location
    Huntsville, AL
    Posts
    237
    I added that bit to my draft XDF, but what indexing are you using? 20B4 is 00 in both a '96 B-car BIN and a '97 F-body BIN, and both are in a field of 00s.

    Is that in the E side or the T side? I'll email you.
    Last edited by sherlock9c1; 05-04-2020 at 05:44 PM.

  13. #43
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,470
    Quote Originally Posted by In-Tech View Post
    Hi kur4o,
    My version of ida is so old I cannot view your work. Could I talk you into saving/produce as html so I could view it? My old version of ida used to be able to do that with a keystoke.
    You can check here for a way to open the files or

    if you are still having troubles here are some htmls. There is options to export to other formats but don`t what they are.


    I managed to find that there are 2 revisions for the 96-97 files[1 for 96 and 1 for 97]. This is valid only for the latest updates by gm so any older p/n for the vin might have different layout.

    I am looking for stock bins to confirm there isn`t any older revisions.


    For now at least 2 xdfs will be needed.


    We can transfer the thread`s topic to xdf and flash creations and we will be spot on with the conversation without spamming the thread.

    I hope sherlock9c1 doesn`t mind.
    Attached Files Attached Files

  14. #44
    Fuel Injected!
    Join Date
    Sep 2012
    Location
    Huntsville, AL
    Posts
    237
    No worries. Moderators, organize away.

    Kur4o, I was just realizing that the BIN I was pattern-matching on was from Tunercat OBD2 (now JET DST). But is the organization of the file arbitary, dependent on what order the EEPROM memories are read? So the blocks might be re-arranged in a different order than what Tunercat OBD2 did?

  15. #45
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,470
    I am not sure about the tunercat layout, but the best one might be

    tside 2000 ram + bank 0 + bank 1 + bank 2 +eside 2000 ram + eside rom.

    For better offset experience eside might be first than tside full binary like

    eside full bin with ram + tside full bin with ram.

Similar Threads

  1. XDF Creation / Editing - How To????
    By B52Bombardier1 in forum OBDII Tuning
    Replies: 5
    Last Post: 02-28-2020, 02:04 AM
  2. new to obd2
    By myburb in forum OBDII Tuning
    Replies: 0
    Last Post: 05-28-2018, 05:54 AM
  3. DHP/AVT-852-002 Rev L OBD2 programmer $250
    By SappySE107 in forum Buy - Sell - Trade - Wanted
    Replies: 2
    Last Post: 02-03-2018, 09:25 AM
  4. flashing OBD2 ECU?
    By vwnut8392 in forum OBDII Tuning
    Replies: 4
    Last Post: 11-25-2017, 01:43 AM
  5. WTB TunerCats II (OBD2)
    By XRelapse13 in forum Buy - Sell - Trade - Wanted
    Replies: 0
    Last Post: 12-16-2014, 08:26 PM

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •