Results 1 to 15 of 509

Thread: 1997 F-Body ECM

Hybrid View

Previous Post Previous Post   Next Post Next Post
  1. #1
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    484
    I am glad folks are interested in this... I would like to get it all figured out if I can.

    I did some more looking through initialization of the TIO. First the microcode is initialized, then the temporary ram and last the shared ram. The new thing I notice is the next block to initialize is the exact size of the pointer table ram outlined in the patent and referred to as pointer table ram. PTRAM is made with 40 words of 12 bits. The PCM table in flash is 40 words by 16bit however, the MS digit is always zero suggesting that only 12 bits are of use.

    With this, I have almost enough to simulate the operation IF i can figure out the order bytes are loaded into the microcode. Writing a simulator will take a bit of time. I spent very little time working with DSPs but the flow and the techniques used by this part are quite similar. Main difference is this is all timer oriented and not a/d d/a oriented.

    I will continue to post but it will take a bit of time to grind through all the details.

    If anyone has any info on this part it will be a great help.

    -Tom

  2. #2
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    484
    Perhaps we have someone who knows DSPs well here?

    My question relates to the patent I mention above in this thread. The execution unit has a block that is named "Immediate Data Generator. The second drawing details the execution unit and the arrows suggest that at times this block drives the A bus and/or the B_bus. Can anyone suggest the function of this block? My best guess (and only a guess) is that it supplies certain constants as directed by the microcode. Both P2A and T2B drive the block, there may be codes within the space (9 bits and 7 bits) that are used to deliver constants????

    What would I give for just a data sheet!

    -Tom

    Small update:

    Size of the Shared RAM is 128 X 16 which needs 7 address lines
    Size of the Temporary RAM is 64 X 16 which needs 6 address lines

    P2A is documented in the patent as having 9 address lines
    T2B is documented as having 7 address lines.

    I think the extra lines are used to address the immediate data generator when the requested data is not in the either of the shared RAMs.

    Hmmmmmm, wonder if the immediate data generator is also in two ported ram. Earlier in this thread I was told that the same TIO chip is used in ABS systems. It would make sense to have as much as possible in RAM. I plan to look at the configuration routine again to see if there are indications that this is true.

    -Tom
    Last edited by Tom H; 10-31-2019 at 06:02 PM.

  3. #3
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,479
    That patent explains it much. Still there is a possibilty the GM upgraded the design 2 or 3 times across the years. I think the configuration was used upto 99+ls1 pcms. Even 98 ls1 pcm have different second tpu/tio processor.

    The shared ram in 94 pcm is between 1400-16FF and I guess 400-8FF is also in relation with it. There are even some subroutines called at that range.

    At reset there are some random data tables and values copied at different address area. The only data that looks like some configuration is copied at 1600-1650 area from bin. Others are mainly scalars and engine initial settings.

    I am gathering some pics from different pcms to see what chips GM used as TIO.
    94 v6 pcm uses different chip for sure, and I remember that older PCMS have even different shared ram area. Something in the $4000 or $6000 range.

    While comparing the code between 94-95 and later 96-97 pcm the access of the shared ram seems a little different. I tried to read that area through mode 3 request but get only zeroes so there are some special requerments for the access of it.

    While you are still there can you trace the pins of the knock module. I managed to find that 2 pins are connected to it for 2 different knock sensors, 1 gets 5v and 2 pins goes to tio or some other chip, I can`t interpret my old drawings better. I disassembled the knock module but can`t tell much of it. It looks like the older memcalls. Some ultra small chip and a dozen of condensers.

  4. #4
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    484
    I have done some looking at the registers the code uses. This is NOT finished work but rather a snap of where I am on this project...

    Code:
    =============================
    POINTER TABLE RAM
    $1600    INITIALIZE    $0084 
    $1602    INITIALIZE    $00CD 
        OVERWRITE    $00CD    OVERWRITE IN INIT ROUTINE
    $1604    INITIALIZE    $0279 
    $1606    INITIALIZE    $0379 
    $1608    INITIALIZE    $0479 
    $160A    INITIALIZE    $0579 
    $160C    INITIALIZE    $0679 
    $160E    INITIALIZE    $0779 
    $1610    INITIALIZE    $0879 
    $1612    INITIALIZE    $09C1 
    $1614    INITIALIZE    $0AC1 
    $1616    INITIALIZE    $00B5 
    $1618    INITIALIZE    $0077 
    $161A    INITIALIZE    $007B 
        OVERWRITE    $00C4    OVERWRITE IN INIT ROUTINE
    $161C    INITIALIZE    $00A2 
    $161E    INITIALIZE    $00A6 
    
    SEQUENC OF 8: $1620-2E IS OVERWRITTEN BY CODE DURING OPERATION SEE $6CDA
    $1620    INITIALIZE    $001A    
    $1622    INITIALIZE    $011A 
    $1624    INITIALIZE    $021A 
    $1626    INITIALIZE    $031A 
    $1628    INITIALIZE    $041A 
    $162A    INITIALIZE    $051A 
    $162C    INITIALIZE    $061A 
    $162E    INITIALIZE    $071A 
    
    $1630    INITIALIZE    $08C8 
    $1632    INITIALIZE    $09C8 
    $1634    INITIALIZE    $0AC8 
    $1636    INITIALIZE    $0BC8 
        OVERWRITE    $00ED    OVERWRITE IN INIT ROUTINE
    $1638    INITIALIZE    $0C93 
        OVERWRITE    $0C9B
    $163A    INITIALIZE    $0D93 
        OVERWRITE    $0D9B    OVERWRITE IN INIT ROUTINE
    $163C    INITIALIZE    $0000 
    $163E    INITIALIZE    $0000 
    $1640    INITIALIZE    $0F38 
    $1642    INITIALIZE    $0E91 
    $1644    INITIALIZE    $00BB 
    $1646    INITIALIZE    $0000 
    $1648    INITIALIZE    $0EA9 
    $164A    INITIALIZE    $0000 
    $164C    INITIALIZE    $0000 
    $164E    INITIALIZE    $0000
    END POINTER TABLE RAM
    =============================
    
    REGISTERS: WRITTEN AT INITIALIZATION, NEVER REVISED
    $1680    INITIALIZE    $0000
    $1682    INITIALIZE    $0001
    $1684    INITIALIZE    $0002
    $1686    INITIALIZE    $0003
    $1688    INITIALIZE    $0004
    $168A    INITIALIZE    $0005
    $168C    INITIALIZE    $0006
    $168E    INITIALIZE    $0007
    $1690    INITIALIZE    $0008
    $1692    INITIALIZE    $0009
    $1694    INITIALIZE    $000A
    $1696    INITIALIZE    $000B
    $1698    INITIALIZE    $000C
    $169A    INITIALIZE    $000D
    $169C    INITIALIZE    $0000
    $169E    INITIALIZE    $0000
    
    REGISTER: READ ONLY
    $16C2    HIGH RESOLUTION PULSE COUNT
    
    REGISTERS: WRITTEN AT INITIALIZATION, NEVER REVISED
    $16D0    INITIALIZE    $C001
    $16D2    INITIALIZE    $0000
    $16D4    INITIALIZE    $0001
    
    * INITIALIZATION SEQUENCE STARTS WITH A HARDWARE RESET
    * TOGGLING PORT G BIT2 (0X04) BEGINS HARDWARE INITIALIZATION
    * SOME SOFTWARE INITIALIZATION OF CONTROL REGISTERS AND TIME DELAY
    * REGISTER AT $16F0 SETS TIO FOR MICROCODE LOADING
    * TABLE DATE IS MOVED FOUR 16BIT WORDS AT A TIME INTO REGISTERS $16E0-E7
    * MICROCODE ADDRESS IS WRITTEN INTO $1400, LOWER 8 IS MICROCODE ADDRESS TO PLACE
    * 64BIT MICROCODE AT IN THE STORE
    * LOOP THROUGH TABLE
    * END SEQUENCE WITH SETTING $16F0 FOR NORMAL OPERATION (MICROCODE IS NOW LOADED)
    $16E0    MICROCODE INITIALIZATION REGISTER 0
    $16E2    MICROCODE INITIALIZATION REGISTER 1
    $16E4    MICROCODE INITIALIZATION REGISTER 2
    $16E6    MICROCODE INITIALIZATION REGISTER 3
    $16F0    WRITTEN BEFORE LOADING THE MICROCODE    $0003
        WRITTEN AFTER LOADING THE MICROCODE    $0000    OVERWRITE IN INIT ROUTINE
    
    $16F4    WRITTEN BY SOFTWARE DURING OPERATION, READ IN IRQ SERVICE
        SOME VALUES ARE: $3C00, $0400, $0800, $1000, $2000, $3800
        ASSUMPTION BITS 2, 3, 4, 5 IN THE UPPER WORD ARE ACTIVE
    $16F8    COLD RESTART $0003
        CODE OVERWRITES $0003
        
    $16FA    RESTART $0000
        CODE OVERWRITES $0000
    
    $16FC    INITIALIZATION $0044
        
    $16FE    INITIALIZATION $4000
        OVERWRITE: OR WITH $1B1D
        OVERWRITE: OR WITH $8000

    The things (of use?) that have been found ...

    $1492 COUNT OF SPARK EVENTS FROM EST FEEDBACK
    $14D6 PARAMETER VALID FLAGS | ENABLED INJECTORS
    BIT 0001 INJECTOR 0 ENABLE
    BIT 0002 INJECTOR 1 ENABLE
    BIT 0004 INJECTOR 2 ENABLE
    BIT 0008 INJECTOR 3 ENABLE
    BIT 0010 INJECTOR 4 ENABLE
    BIT 0020 INJECTOR 5 ENABLE
    BIT 0040 INJECTOR 6 ENABLE
    BIT 0080 INJECTOR 7 ENABLE
    BIT 0100 NOT USED
    BIT 0200 NOT USED
    BIT 0400 NOT USED
    BIT 0800 NOT USED
    BIT 1000 NOT USED
    BIT 2000 BAROMETRIC PRESSURE VALID
    BIT 4000 ENGINE COOLANT TEMPERATURE (ECT) VALID
    BIT 8000 SOME_PARAMETER VALID

    $15D8 HIRES COUNT AT LAST LO RES RISING EDGE
    $16C2 HIGH RESOLUTION PULSE COUNT

    Hope to figure out the microcode soon...
    -Tom
    Last edited by Tom H; 11-14-2019 at 11:00 PM.

  5. #5
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    484
    Quote Originally Posted by kur4o View Post
    The shared ram in 94 pcm is between 1400-16FF and I guess 400-8FF is also in relation with it. There are even some subroutines called at that range.
    ...
    I am gathering some pics from different pcms to see what chips GM used as TIO.

    While comparing the code between 94-95 and later 96-97 pcm the access of the shared ram seems a little different.

    While you are still there can you trace the pins of the knock module. I managed to find that 2 pins are connected to it for 2 different knock sensors, 1 gets 5v and 2 pins goes to tio or some other chip, I can`t interpret my old drawings better. I disassembled the knock module but can`t tell much of it. It looks like the older memcalls. Some ultra small chip and a dozen of condensers.
    I think & will confirm when I get a chance, the area just above ram connects to the injector driver circuit (?)

    Have you checked to see if the microcode has changed? If yes, the part can be hooked up different and still do the same function. Pins, Addresses or whatever can all be moved.

    I will also look at the knock module as part of getting the pinout of tio. This project seems to grow and grow. Very well written and tested code but a mind bender to reverse...

    -Tom

  6. #6
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    484
    I have had a good look at the knock sensor circuit and am now trying to understand the function. As usual, one of the most difficult parts of the task is determining the parts used. I believe the 16194972 is some sort of OP-AMP. The power to it is filtered or from another rail <not +5> or ?? There is also an LM339 type quad comparitor used in the circuit for level slice. I am tracing the outputs, but expect to find that the ribbon cable is driven across to the TIO on the Eboard.
    The TIO continues to be a mystery (but I am working on it still...).
    Plan to publish the knock sensor module and i/f to the TIO soon.

    Q1: The Op amp looks to me like it has the logo of a now defunct Philips Semi. Can anyone identify this part?
    Knock.jpg
    PhilipsLogo.jpg


    Continuing work on the TIO chip...
    I have some more info and a question here.

    The Eside takes raw ignition voltage and does a prescale function on it with a number of inflection points:
    -Below 4.8V, index is voltage/2
    -Below 14.8V, index is (voltage less 3.6 volts) X 2
    -Above 14.8V but below 19.6V, index is voltage/2 + 15V
    -Above 19.6V, index is 19.6V/2 + 15V

    Q2: I am not sure why the prescale is needed when the result is just fed into a look up table for the result. Why not just go directly to the LUT and adjust the LUT to give the needed result? Note: this all is at $4568 in the '97 code. Replicated at $5DC5

    I wrote some code to look at the function of the prescale and the interpolated LUT:
    Table.jpg

    Axis is ignition voltage from 0x00 0Volts through 0xFF 25.5Volts
    Red is the prescale output
    Yel/Green is the output after interpolation

    Q3: The result is written into the TIO. Do we know it's function. I guess it might be used to extend injector on time when battery voltage is low OR perhaps extend dwell on ignition with low battery?


    My experience with this code is that it is very well written & tested. I found it unusual that the table is set up for interpolation but has one less element than is necessary to cover the range of inputs. In this case, the first element of the next table is used. My guess here is that the table is of little use where ignition voltage is VERY VERY high. This unusual element only comes into play should the voltage reach 24.0V. At that point I would expect smoke out of the PCM anyway. The area affected by this ?oversight? / don't care condition is marked by the arrow I added to the graph.

    -Tom

  7. #7
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,479
    The op am you are suspecting is a Philips made, and in someway is a really important chip. It appears on any pcm board I have look at till 2007 but have different p/n.
    Only on 94-95 is 14 pin and is labeled
    27472 b 462
    877650D
    hss9333 2y

    Couldn`t find any info for it. Can it be used for some form of diagnostics like open and short to G and B+, and protection if the circuit goes straight to the processor.

    Q2

    That table is the injector voltage offset, The result is send to the TIO and it is applied there to the commanded injector pulse width.

    The voltage is scaled for table lookup, so you have lower resolution below 4.8 and above 14.8, and higher resolution at midrange.
    If there is no prescaling you will need 255 bytes table for lookup[0-FF range] and most of them will be useless, now it is shrinked substantially and is memory space optimized.

    Other scalers are also loaded at TIO memory range.
    Some of them are final spark value, dwell timing, inj pw, inj offset pw, EOIT target, scalars for VSS calculations, and many more that are still unclear.

  8. #8
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    484
    Quick note regarding knock filter...

    Interesting that pin 3 of the filter (see my pin designation below) is connected to the external PCM blue connector on pin 13. Since I don't yet know the function, it may be for monitoring knock OR to permit external modification of the filter.

    Regarding the "Op-amp"/whatever chip. I see it connecting to the filter. Looks to me like the part is a dual. Interesting that the part changed to a 16 pin. I will take a look at the photos of your board and see if it will give me some traction on figuring out the function.

    KnockFilter.jpg

    PS: This is a view of the Socket from the topside!

    -Tom

Similar Threads

  1. 94-95 LT1 $EE Y-body vs. F/B-body PCM differences
    By johnny_b in forum GM EFI Systems
    Replies: 5
    Last Post: 01-15-2023, 02:41 PM
  2. Tuner Pro XDF 1999-2000 F Body + Y Body
    By john h in forum OBDII Tuning
    Replies: 33
    Last Post: 02-02-2020, 11:12 PM
  3. Replies: 31
    Last Post: 09-20-2018, 06:00 AM
  4. F-body engine install to B-body
    By serge_an in forum GM EFI Systems
    Replies: 4
    Last Post: 09-22-2016, 02:51 PM
  5. 95 F-body Fuel Pump with 95 B-Body Engine/Tank
    By EPS3 in forum GM EFI Systems
    Replies: 7
    Last Post: 09-19-2016, 02:40 PM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •