1997 F-Body ECM

[Tom H]

Reverse engineering of these boards is a difficult process and I need all the tools I can get my hands on. One tool I have not used yet is the 68HC11 bootstrap mode. In this mode, you can download a small bit of code into the internal RAM and execute it. Care needs to be taken to ensure the code defaults chip selects and things like that so that other parts on the board won't fight each other but in most cases GM defaulted all these with resistors anyway.

The process for loading is quite simple... The binary code you want to put in ram is pre-fixed with a single $FF character and sent to the serial (aldl). I need to do a bit more checking of the configuration of the serial connections to make sure this can all work out. It is important that when you are bootstrapping one side (E or T) that the other side doesn't try to chat... that would mess up the download for sure.

Please don't attempt this unless you are sure of what your doing. The HC11 reference manual goes into complete detail on the use of this mode. Myself I am trying to decide if to use this or use the built in download and execute through the EL327 clone.

I have two photos to show where the mode lines are. If pulled to low when reset is released, the part will enter bootstrap mode. I have used this technique with success for my Optispark simulator.

It looks to me like this could be used to resurrect a bricked module without de-soldering the FLASH part.

Second picture is full of glare, but you can make out the locations. I will re-take that photo for future work

-Tom

RB_SS.jpg
GB_SS.jpg

[Tom H]

I have looked through some of the input signals on the Eside and analyzed the circuit. I have made some assumptions... take care when using the information.

The signals in question are VATS, Traction control and MAF. There is a chip and a good number of resistors and capacitors involved with receiving each of these signals. This is done to control ESD, condition the signal against noise and provide hysteresis.

I have identified the chip to a functional level. It's pinout and function match that of LM339 quad comparitor. Comparitor chip is marked:
014
M66DB
89551
LM339 quad comparitor or a variant that shares the pin configuration.

This chip is used to provide a level switch at 2.5V instead of the standard vil/vih of the receiving part. A network of resistors provide hysteresis to avoid noise problems on the lines.

The outputs of these signals connect to a 68pin PLCC chip that has not been identified and is probably a custom chip for GM. In my notes I will name this part TPU for timer/processor unit.


Input:Output
VATS:TPU pin 20
Traction Contro:TPU pin 21
MAF:TPU pin 22
C1(RED) pin 26:TPU pin 23


The components to connect C1 26 are not installed on my board set. Unsure if/where it was used.

Here are some photos to indicate the components.

MAF_RB_SS.jpg
TC_RB_SS.jpg
VATS_RB_SS.jpg
RB_CS.jpg

-Tom

[Tom H]

Ive been looking a little closer at the high and low res signals. Later I will post the ins&outs but I have run into a little snag. There is yet another unidentified part and I could sure use some help. Way back when I had a bunch of contacts in LSI logic / Symbios but with M&A activity I have lost touch. There are a couple of Symbios parts on my board. One is the part that drives the injector transistors. It's the other one that needs investigation. It is probably a small gate array I expect. Here are some details...

Part is marked:

609-3700521
CP08978
144436
9638N
SYMBIOS LOGIC
726

I will attach a 90% hookup wire list for the part. Only 90% because it is SO hard to trace all the copper.

What would help is to know which PCMs have the part. For example if it is on all boards with Opti-spark that is a tell. Also interested if it is used anywhere else (I expect not)

At first I considered if it could be a phase lock loop. This is still one possibility, but I don't think an engine controller needs that kind of resolution. I now believe it is a counter timer chip. It has interconnections with the mysterious 3rd processor TPU chip.

I have not yet connected my optispark simulator but once done I will set the scope on this part and see what sense I can make of it. Some control of this part is handled by the port replacement chip (66285). It would also be nice if anyone knows the pinout for the PRU to send that along.

-Tom


I am adding a picture of the board (red/black connectors...eside) with the component highlighted

DIG1_RB_CS.jpg

[kur4o]

I suspect that part might give low res signal to tside. On 94-95 pcm the tside gets an opti signal at IC3I [TIC3H-register]. It doesn`t seem to be connected to eside anyway.
The conversion is also different
tside low res conversion is

2949120/x = rpm

eside conversion is
983040/x = rpm
0.015234*x= msec

Or exactly 3 times lower resolution.


Here are some high res pictures of the 94-95 f-body pcm.

[Tom H]

Here are some details regarding the Eside drivers. I wonder if anyone has lifted one of the drivers from the heat sink to get a look at the manufacturer and numbers? If yes please share...

I traced the connections to the two 23 pin power SIPs. I believe they are low side drivers perhaps similar to some of the common available parts. I need to look into the code, but expect to find that the parts detect when a driver is open or shorted to power. The pdf contains the connection info.

-Tom

[kur4o]

I have a p/n of similar driver that might help you identify the main functions.
These are known as quad driver and are 23 or 15 pin packages.
23 pin package:

motorola
185
16166240
yyek9546

It is from a gm pcm with 68hc11 processor. The command pinout is the same.

The 15 pin package from 94 v6 pcm is
45980
980 taiwan
92106
9326CB

Voltage regulator chip on 94-95 pcm is
70306
466
33738985

Could that symbios chip are some kind of AD converters with really high frequency. Injector drivers and highres opti signal are sub 1ms signals. Did you trace the low res signal.

The pcm you have can communicate over the ALDL bus. It supports mode 01 and mode 03. MODE 3 gives you the ability to request memory dump from RAM realtime for easy debugging. It won`t be hard to patch other modes also.

To communicate over ALDL you need a simple ftdi based serial to usb converter, and eehack as a comm terminal.

[Tom H]

Once again thanks for your help & info!

Quite sure the 15 pin sip on my Tside is a stepper motor driver for the IAC. All connections confirm. I will see if I can dig up datasheets but it's sort of a needle in a haystack kind of prop. Fall back is to understand the function such that we can analyze the code better...

Hmmmm fast a/d: will give that thought. Working through hi&low res trace and will post soon, many thought paths&lots of work to complete. I will try to do this over the next few days. Now trying to prep for testing the optispark simulator. I realize that VATS will get in my way. As I understand it that can be taken care of with a 50hz square wave (?)

I got the code I am working on from a home brew aldl interface I built. Wish IDA had been around when I did that, my home brew disassembler lacks all the nice features. Thanks for that tip, you are a great help with this project.

EEhack doesn't like some thing about my setup and crashes. I have the code to see what is wrong... but that is yet another project.

Not yet started on upload / download code.

-Tom

I have a p/n of similar driver that might help you identify the main functions.
These are known as quad driver and are 23 or 15 pin packages.
23 pin package:

motorola
185
16166240
yyek9546

It is from a gm pcm with 68hc11 processor. The command pinout is the same.

The 15 pin package from 94 v6 pcm is
45980
980 taiwan
92106
9326CB

Voltage regulator chip on 94-95 pcm is
70306
466
33738985

Could that symbios chip are some kind of AD converters with really high frequency. Injector drivers and highres opti signal are sub 1ms signals. Did you trace the low res signal.

The pcm you have can communicate over the ALDL bus. It supports mode 01 and mode 03. MODE 3 gives you the ability to request memory dump from RAM realtime for easy debugging. It won`t be hard to patch other modes also.

To communicate over ALDL you need a simple ftdi based serial to usb converter, and eehack as a comm terminal.