MonteCarSlow

It was one of those rainy overcast days today.

I don't know if it works yet...

32kb of ROM ($8000-$FFFF) , 4kb of RAM ($5000-$5FFF)

MonteCarSlow

A question for RBob, or anyone else that is in the know...

Does the watch dog kick in if the ECM doesn't see ignition pulses? I don't have an ecm bench to stimulate anything (well, except for the 4000lb one outside).

I've gotten to the stage of having source code compiling, and I think I've gotten all the right hardware registers remapped to their new values. I've also built some debug software that lets me blink a LED attached to the TCC pin (to verify basic functionality).

On a scope, I'm seeing the watch dog timeout on a 140ms period.

Any ideas?

MonteCarSlow

eprom checksum...

dimented24x7

iTrader: (2)

Ive always wanted to add extra ram!

I think the COP only activates if the computer stops servicing it, like if it freezes up or the checksum fails and the computer halts to reset. My guess is that youll become quite familiar with it once you start adding on all the extras Ive made mine lock up many times, sometimes while driving down the road.

If there are no ref. pulses the computer still keeps running but certain portions of the code are skipped since the motor is assumed not to be running.

MonteCarSlow

I just confirmed the sram works. If anyone wants to know how I wired up the extra ram, send me a PM.

junkcltr

iTrader: (1)

Looks good. I like to see updated boards. A sure sign of progress. Since you are messing with code.......why not just drop in a NVSRAM or small PCB with SRAM and battery backup? That would allow you to make some ALDL modifications and do real time tuning via the ALDL without the need of an "emulator"?

J

dimented24x7

iTrader: (2)

With a properly prepped hack, you could litterally dump the the calibration onto the sram and update via a serial data stream. Another cool idea I never got around to trying.

junkcltr

iTrader: (1)

Maybe with a 4Kb ECM it would work but not with the 16K and 32K bins because you run out of address space. Using the NVRAM making everything adjustable via the ALDL.

dimented24x7

iTrader: (2)

I meant the calibration portion of the code. My mistake for not being more clear. IIRC it should fall well below 4K for a tbi ecm. If you have a good compilable hack you can just relocate it with a simple 'ORG'.

EDIT: This is assuming it has some form of constant power, or at least 12 volts from the batt.

dimented24x7

iTrader: (2)

Actually the more I think about that, the more I like your idea of having everything on some form of non-volatile ram. Would make testing alot easier. When Im done I could just pop the expantion board out and pop the memcal back in.

MonteCarSlow

This could easily be done on a 730. The chip select line for U15 (unpopulated) could be used to address a serial eeprom. Fill in the missing sram and you've got 2k of ram and NV storage.

The C3 doesn't have a uart... yet...

I suppose if the speedreader doesn't materialize anytime soon we could build a romless C3 with a memory addressable uart. Both would be fairly easy to hack together and should enable high speed logging. A programmed AVR micro could be made to look like a uart to the C3's cpu.

I need to spend more time studying assembler instead of dreaming up what I can attach to the ECM......

dimented24x7

iTrader: (2)

The assembler side of things isnt too bad. Dont even have to know assembly, just have to go through and make sure all the addressing in the hack is relative so it can be placed in the memory as you see fit. Its mostly just alot of mindless typing.

junkcltr

iTrader: (1)

Yes, the chip select for U15 could be used as an SRAM chip select. How do you know what address space to read/write to make the R/~W signal active? That address space can't already by used.

You can fit a lot of the 730 data tables in the 2K of SRAM.

MonteCarSlow

You don't need to use the U15 chip select for sram. I'd use it for a serial eeprom...

The SRAM would go at U3. It's already mapped in at $1800-1FFF by U4.

On boot up, copy the 2kb stored in eeprom to ram. Modify the source code to read the calibration tables at the sram location. Modify an ALDL command to allow byte writes to the eeprom (and copy to sram)... and presto... tune on the fly P4 ecm (no romulator/whatever required). Damn... I gotta hack this together. This is doesn't sound that hard at all!

junkcltr

iTrader: (1)

I have talked about this many times before on this board. It isn't that hard. Do a search and you will come up with some decent material.

The thing is the ALDL needs to be dealt with properly. As far as I know, the current ALDL readers don't sync with the ECM in a true manner. You need that to be reliable.
Or you can be like some of the "emulators" out there and do it unreliably async, but then you get people saying "how come my new toy doesn't work??". Anyway, time the PC side software to work with the timing of the ALDL Tx/Rx and make sure the baud is correct. You can get by with "good enough" but if you do that then you will have the first "it works right emulator" out there.

Overall, install a TI/benchmark or Dalles NVRAM in place of the PROM and write some code much like the P4 mode 4 code (see 730/165 ECM hac) and you are done. On-the-fly for about $40 and no junk hanging out of the ECM. It all fits in there nicely.

J

junkcltr

iTrader: (1)

I guess the serial ram would be OK. very slow though.

The 730 needs more than 2K ram. 2k more is better than none though.

Ditch the whole boot and copy thing. Just go NVRAM. Do a small PWB with two battery backups and it will last longer than the car will.
Before you know it you might even decide to market the idea and cash in like others have.....or you can stay true to the DIY/learning envrionment. The NVRAM or battery for the whole PROM is really the best & most simple way to go in terms of hardware and software.

J

MonteCarSlow

junkcltr,

I ordered a 32k nvram (BQ4011 from Digikey) and the 74hc00 nand gate that goes at U8. I'm going to go with your suggestion and replace the 32k eprom at $8000-FFFF with nvram.

Here's what I'm going to do to a spare 730 when the parts come in (perhaps you can double check what I'm doing if you can follow it):

1) replace eprom in memcal with socket and install BQ4011 nvsram
2) cut 5V trace to J4 pin 1
3) cut A14 trace to J4 pin 4
4) strap A14 trace to J4 pin 1
5) install U8 (74HC00, 14pin soic package)
6) cut the trace to either pin 12 or 13 of U8, then strap that pin to the RESET line (to prevent accidental writing to the nvsram during power up/down)
6) strap /WE from U8 pin 8 to J4 pin 4

I'm not sure if this part is needed (depends on what the CPU does when addressing 8000-FFFF):
7) cut /ROMOE trace to J4 pin 14
8) strap /OE from U8 to J4 pine 14

So far this is a $15 (Cdn) modification...

junkcltr

iTrader: (1)

Yes, I follow what you are doing.

Don't forget that there is 'other' unused mem space that you can map back to the NVRAM if you run into problems with the upper address space read/write. As you know, it is a 16bit address space.....just a hint.

Yeah, it can be done for not much money. I built a PROM emulator years ago because I didn't want to mess with the PROM code. Later on, I decided on board RAM was the better way to go. You have to do it all though. No one doing ALDL PC code supports it. Something to keep in mind if you are using the PC RS-232 port for ALDL. ALDLReader_X is not going to like your ALDLWriter trying to take over the RS_232 port it is using.

Don't forget the decoder chip that GM installed on the board and Ludis figured out and provided info. Thanks Ludis.


Where did yo get the protoPCB built that is in the picture with no solder mask but silkscreen included? What is that board supposed to do? Microchip PIC.....????


J

junkcltr

iTrader: (1)

Kind of surprised you are thinking of that. Most don't. I bet if you looked at the available "emulators", you would find that none have this protection. No protection at all.

J

junkcltr

iTrader: (1)

You may find that you lose the ability to read instructions from the program memory if you remove the original !OE signal. It all depends what you find happens with the 0x8000 and up address space.

Also, watch the temperature range on the commercial Ti NVSRAM. Some guys are building automotive equipment with these chips in their products and selling the stuff to people that don't know any better. They are only rated for +32 (yes, +32) degrees Faren. to +158 degrees Faren.

Just something to keep in mind........buyer beware.

J

MonteCarSlow

Originally posted by junkcltr
Yes, I follow what you are doing.

Don't forget that there is 'other' unused mem space that you can map back to the NVRAM if you run into problems with the upper address space read/write. As you know, it is a 16bit address space.....just a hint.


I doubt it will be a problem, but if I find I can't write to 8000-FFFF, I'll map the nvram in at 1000-2FFF. That space does not appear to be used, unless I'm mistaken.

Yeah, it can be done for not much money. I built a PROM emulator years ago because I didn't want to mess with the PROM code. Later on, I decided on board RAM was the better way to go. You have to do it all though. No one doing ALDL PC code supports it. Something to keep in mind if you are using the PC RS-232 port for ALDL. ALDLReader_X is not going to like your ALDLWriter trying to take over the RS_232 port it is using.


I use Craig's old E6 qbasic for logging on a dos laptop. I've modified E6 to my liking, I think I can base something crude on qbasic to interact with the aldl (as a proof on concept anyway).

Don't forget the decoder chip that GM installed on the board and Ludis figured out and provided info. Thanks Ludis.


Not needed if the nvram is placed at 8000-FFFF (and /ROMEN is asserted on a write to 8000-FFFF region)

Where did yo get the protoPCB built that is in the picture with no solder mask but silkscreen included? What is that board supposed to do? Microchip PIC.....????


That's RBob's secret. Just kidding, it's a lockers board. Thanks RBob!!

MonteCarSlow

Yes, quite aware of that. Even the industrial temp range of the device is quite low on the high temp limit.

junkcltr

iTrader: (1)

It sounds like you know what you are doing with the address map stuff. You need a bit more than 8K to map the 730 data but I think you probably have the rest figured out.

I never heard of a "lockers board". Is that a manufacturer? RBob has secrets? He has answered every question perfectly that I ever had. I regard both him and Grumpy as experts on all ECM stuff. I was just surprised to see a PIC in use when other manufacturers are producing better architectures targeted for PIC type apps. Not to mention that GCC has been ported for them. Is there a port of GCC for the PIC?

Yes, low on the high temp. side, but OK since the 730 resides in the driver's compartment. I just wanted to mention it because others try to hide the fact.

Yes, the Qbasic code is a good starting point. From memory, the checksum algorithm is a little strange, but it works. Proof of concept?? Are you planning on marketing this thing down the road? If so, is a DIY kit planned or a tight-lipped I build it....you buy it thing?

J

RBob

iTrader: (1)

I designed and released the Lockers setup over 5 years ago. It takes a bit of skill to build and set up. More then many folks have. It is considered a secret of mine because the actual knowledge of it has languished and drifted into no-mans land. Very few people actually know about it, simply because of the skill and time required to build it.

In this case it would be an asset to the DIY community for me to actually build Lockers boards and offer them for a reasonable price.

As for what it is? In a nutshell it transmits all 256 bytes of ECM RAM plus eight 10-bit ADC channels at a rate of 17 times a second on a serial line (57Kb) to a PC/laptop/whatever.

The PC can either log that data to disk or tear down the packets in real time and display the information on the screen.

The high data rate along with the number of ECM RAM bytes transmitted makes it the best data logger available. It only works on C3 ECMs. Any of them: '8747, '7747, '148, '8063. . .

Yes, it does use a PIC. It handles the reading of the mirror RAM, packeting, checksumming, and transmitting of the data. It also provides the eight 10-bit ADC channels. The ADC data is sent along with the ECM data which means that it is syncronized to the ECM data stream.

RBob.

MonteCarSlow

The 730 data is under 4k (aujp data goes from $8000-$8989). I think you misunderstood what I'm doing with this 730, I'm replacing the entire eprom with nvsram and allowing the entire upper 32k of address space to be writeable. Probably a dumb idea.. I think I'll make sure the aldl write command doesn't overwrite the code area.

No secrets. Like I said, I was just kidding. Lockers is a bus sniffer for the C3 ecm. It sends a copy of all 255 memory bytes ($0000-$00FF) at 15 frames per second. RBob built it several years back. Search the board for lockers if it interests you. All the data to build your own is on the web.

Proof of concept... bad choice of words perhaps, probably reflects what most of my projects are (half finished). I have no plans to make $ from this, if it works I'd like to see it become a DIY kit.

Grumpy

Wow, I guess it has been that long ago.......
I'd like to know how many hours mine have on them, LOL

If you make any more, I'd buy a couple. Oops, add one for Doc...

dimented24x7

iTrader: (2)

Im horrible in high level languages. If you ever get something written, Id definatly be interested. The way I envision things on the ECM side is a small, stand alone patch ouside the cal. area that masks the interrupts and takes control from the main algorithms. It then uploads the new calibration via the ALDL and once the checksum is verified, the computer resets and off you go with the new cal. Obviously youd need some safe guards to prevent it from taking control while the engine is running and/or the car is moving.

I think a DIY kit would be a great idea. It would be really cool to have something that just plugs in place of the memcal.

junkcltr

iTrader: (1)

MonteCarSlow,
I understand you are dropping in the 32kx8 NVRAM in place of the PROM. Yes, the existing 730 data is less than 4K so the 0x1000-0x2FFF space is more than adequate. The 730 allows about 12k of data using factory code so I had that in mind.

The PROM(now NVRAM) is mapped in the upper space so you might find that you need to read/write the lower space (map the NVRAM into this space also).

I have never messed with the C3 ECMs but it is cool to see the hardware RBob made for figuring out stuff on the C3s.

That is great to hear maybe a DIY kit down the road. Any ECM innovation is always good to see.

junkcltr

iTrader: (1)

Actually, that isn't the way to go about updating the cal. data. The CPU will not reset. I have talked about this before in other posts when "prom emulators" were being discussed. There are two different theories on wacking the reset line. As it turns out, some of the "prom emulators" are not synced properly with the ECM and wack the reset line sometimes because it clobbers the ECM data and causes a fault.

The way the ALDL data will probably work is:
1) PC sends command to ECM along with a small amount of data (up to 256 bytes)
2) ECM accepts data & does checksum calc.
3) if good checksum, then move to cal. area

This is a standard way of doing things in data transfers. I don't think that the reset line will be affected. It is up to MonteCarSlow.

MonteCarSlow

That's the plan...

MonteCarSlow

A ram expanded P4 730 is now operational (I can read/write to it with a small program I wrote). I decided to map in 4kb of nvsram at 2000-2FFF and retain the 32 kb rom from 8000-FFFF. Replacing the 32kb rom with nvsram was tried, but it's not a wise modification for varies reasons.

The ram expansion modification is fairly straight forward because GM did most of the work already, but it does require a steady hand, a fine tip soldering iron and a pair of tweasers. Total cost: about $15 Cdn (which is going to bring the cost of a real-time programmable EFI system to $15+whatever you pay for a 730/749). Pics and a how-to will follow later.

I'm quite sure the source code modification will be minimal. The addresses in the code for cal lookup need to move to the 2000-2FFF block, on boot up need to checksum the nvsram and over write with known good cal stored in rom if it fails (and perhaps set a SES code...), and then modify ALDL mode 4 for byte/word write to anywhere in 2000-2FFF. There is already an aldl byte read command.

I'll gladly accept help in figuring out how to implement the mode 4 modification (or even add a mode 5 perhaps?)

Thanks to everyone that has contributed the documented hacks, without those this would not be possible...

This could open up a whole new world for further software hacks with about 1,600 extra bytes of ram available.

dimented24x7

iTrader: (2)

One of the problems with that is that if there are reoccuring time critical interrupts (I plan to have pulse accumulation that can interrupt quite often), they may end up interrupting the checksum routine. Could block all interrupts while this is happening but then then time critical stuff is lost. On the same note I guess one could do a sort of 'freeze frame', but even still there are some things that will see the internal CPU counter progressing along and may set some errors. This probably wont be an issue with the stock computer, but something that concerns me given what I plan to hook up to the pcm.

My idea of the reset was using the internal cop function. Simply stop servicing the cop, loop, and wait for a reset when done and allow a fresh restart, but I dont know if this will cause corruption of the NVRAM when the cpu comes back online.

dimented24x7

iTrader: (2)

Maybe even better is do do it byte or small cluster of bytes at a time, sort of what you suggested. Keeps the load on the cpu to a minimum. On the PC side this would appear as an 'update table' icon in the tuning softare. Press it and it spools the table out to the ecm. Then there would be a routine that simply takes in the start address of the table and writes/verifies a byte each time its run.

MonteCarSlow

I was thinking that only the delta and new checksum needs to be pushed to the ECM (only ~10 bytes to transmit if you change one item at a time in realtime). On linkup, the client sw would grab a complete copy of the nvsram before starting to edit.

dimented24x7

iTrader: (2)

Thats what I was thinking. Change only what changes in the tables and transmit/verify each byte. That way if theres a goober only one address is corrupted before an error becomes apparent.

Should probably also give the option of also doing a mass transfer on startup before the engine is run as well if you want to do the entire calibration. Lock the cpu in to do it quickly and when done jump to the power on/reset vector and do a warm reboot with the new cal.

MonteCarSlow

How to add 4kb nvsram to P4 ecm.

1) remove conformal coating on the solder pads for U3, U4, U8
- I used a soldering iron and solder wick to scrub it off
- be VERY gentle when using the above method
- use a chemical method if the above gives you second thoughts

2) install U8 (74HC00, 14 pin soic package)
- Digikey part number 296-14504-1-ND
- to solder an smt soic package can be a challenge
- clean the pads with solder wick (carefully!)
- add some solder to a corner pad
- using tweasers, align the device and reflow the corner pad
- this would have tacked the device down for you
- if not centered well, touch the corner pin with solder iron and try again
- now solder the opposite corner and if it's still aligned well do the rest

3) install U4 (74HC138, 16 pin soic package)
- Digikey part number 29601193-1-ND
- clean pads well
- tack the device down on pin 7 or 16
- solder all the pins except for 1,2,3 and 4
- using tweasers, carefully bend pins 1,2,3,4 so that you can:
- solder pin 5 to pin 4
- solder pin 3 to pad 4
- solder pin 2 to pad 3
- solder pin 1 to pad 2


4) take a 28 pin wire wrap DIP socket (I had some already)
- the ECM is setup for a 24 pin device, so we got to get creative
- cut pins 1,2,26,27 but leave a little bit behind
- cut pin 28 so that you can bend it over to where pin 26 would have
gone into the circuit board
- clean off some of the solder resist from the ground area where the
socket goes (we need to add a 0.1uF capacitor)
- install the socket into the board as shown in the pics
- install a 0.1uF capacitor between pin 26 (24 of the ECM's footprint
for the socket) and the ground plane under the socket,
- use the pics as a guide
- install a strap (wire) from pin 27 of socket and pin 8 of U8
- I used a ~13ohm resistor in the pictures, but wire is fine too
- install a strap from pin 26 of socket and pin 34 of U2
- this connects address line A13
- install a strap from pin 2 of socket and pin 33 of U2
- this connects address line A12
- install a strap from pin 1 of socket and pin 35 of U2
- this connects address line A14
- install a strap from pin 23 of socket to pin 12 of memcal socket
- I did this on the bottom side, it connects address A11
- instead of attaching straps for A12,A13,A14 to device U2,
you can attach all three to pin 28 of the socket
- I attached the address lines to U2 on purpose (so that I can address
the entire 32kb of nvsram if I so desired to in the future)
- attach a strap from pin 20 of socket to pin 13 of U4
- on the bottom side of the ecm, follow pin 22 of the socket to a
pair of smt pads for a smt resistor
- short the two pads together, or install a low ohm resistor (10-20 ohms)

5) install a 32k x 8 nvsram into your socket
- Digikey part number 296-9392-5-ND

That's it, you are done!

Use at your own risk. Off road use only, etc, etc...

The components mentioned are not rated for extreme temperature use, therefore this modication could make your ecm unstable at extreme temperatures.

MonteCarSlow

pictures...

MonteCarSlow

facinating... read though the diyefi archives and you'll find that someone has done byte write to sram via aldl *6* years ago

JP86SS

iTrader: (1)

You Rock
This is just plain cool. I wish I had the knowledge to make chips work the way I want them to.

A question that I had was, where will the initial code be stored that will be compared to prior to uploading to the NVSRAM ?
If using the code to do the upload, don't you end up with a chicken/egg thing there and have to transfer the control (so it must be somewhere other than the $8000-$FFFF range)
You mentioned some ROM, are you referencing the original memcal or chip in an adapter to run the operation until it can be transferred to the new chip?
Just trying to understand how you have that sequence of events figured out.
Jp

Hope you got the stuff I sent you. Should work flawless.

MonteCarSlow

The original memcal and 32k eprom will still reside at 8000-FFFF. The source code will need to be modified so that all lookups to the original calibration data area (from 8000 to about 89FF) are done to 2000-29FF instead. In the init routine, a checksum of the nvsram will need to be done (and if it fails, copy a baseline cal in the eprom from the original 8000-89FF location to 2000-29FF). Using this method you can still edit your bin with any editor because none of the calibration locations moved. To get the cal data to copy from the eprom to the nvsram (where the new source code would be looking for the cal data), you would just invalidate the checksum and reboot the ecm. The ecm would then copy the new cal data to the nvsram.

The mode 4 byte write command modification turned out to be easier then I thought (but I still need to verify that it works). In fact, if you replace the entire eprom with a nvsram of the same size, and apply a small mode 4 patch you can get up and running without the hw or source code modifcation I outlined above (but there is no fail safe if you accidently overwrite the actual code, which is why I choose not to do it that way). With the 4kb nvsram at 2000-2FFF, the eprom/memcal can be replaced with an oem bin and everything will still work should you strand yourself on the side of the road. An nvsram in the memcal requires wires to be attached from the ecm to the memcal, which makes the memcal permanent... (and you would need to swap the entire ECM if it screwed up while on the road). I guess a second (perhaps easier) option for nvsram expansion would be to produce a daughter board that plugs into the edge card connector on the ECM, would be easier to solder that up instead of the method I have shown (but then cost goes up and its no longer really DIY in my opinion)...

junkcltr

iTrader: (1)

I mentioned that the total on the NVRAM setup is about $40. In the end, when you go to a small PCB with the NVRAM and some glue logic (all through-hole) it comes out to about that price.
It is still a DIY project as it is all through-hole. You can fit quite a bit of logic in a small PLD.

Something to keep in mind. NONE of the "emulators" protect the code section. All of them can corrupt the code section of the MEMCAL. In fact, emulators with cables and more connectors have a much higher probability of messing up the code.

In terms of being stranded, less than three wire need to be soldered to the board. Removing the PCB and installing the stock MEMCAL would fix the problem if the code got messed up somehow.

It is great to see the progress you made with this. Yes, it is amazing what others have done years ago at DIY-EFI. They all had the bin switchers, emulators, added SRAM, etc. that others have grabbed and marketed. It is good to see you give them credit when the vendors out there won't say a word about it.

J

ryan.h

iTrader: (2)

I'm bumping this back up to the top as a newbie who needs more code space.

As I understand it, the NVRAM modification is ok to use only for data? i.e. no use for code?

How would one go about getting some extra code space, to make some use of that extra RAM?

JP86SS

iTrader: (1)

Finished product thread is here
https://www.thirdgen.org/techbb2/sho...64#post2740464

Can use it for everything, code and ram space.

ryan.h

iTrader: (2)

Yeah, I saw that, and the link to this thread. I like DIY mods.

Maybe I'm naive and/or ignorant, but why can't I just swap in something like the 29C512 for the stock eprom for more code space?

Z69

Not enough address space to access it I think.
The MPU will only recognize so many addresses.
There's lot's of room for code.
Ram can get a little short if you try to keep all the smog equipment though.

junkcltr

iTrader: (1)

Most ECMs have 32Kbytes reserved for code out of the 64Kbyte total memory space. Using the NVRAM would free up 4K of space that you could use as for code space. Move the CAL data that is currently in the code space to the NVRAM space.

A 29C512 is a 64kbyte chip and you probably only have a 32k byte mem. space on the processor side (ECM dependant).

ryan.h

iTrader: (2)

What would the "CAL data" be? all of the constant data, like "minimum TPS position for idle", etc at the beginning?

Secondly, I guess what I don't understand, is if you can add 4k with an external board, why can't you stick in the 64k chip, but only use/access/allocate 32k+4k of it?

Thirdly(?), if that's not possible, can I use an EPROM in place of the NVRAM just for data retention/security sake?

MonteCarSlow

The CAL data is the entire portion of the eprom where all the engine calibration data is stored. It's about 3kb of data, the rest is code blank space and code.

You can replace the whole eprom with NVRAM... been there, done it... it's even easier then building the 4kb module or soldering it into place where the 2kb ram goes.

B U T - what if you corrupt it?

I did it this way for a reason... (key OFF, wait for ecm to shutdown, key ON - corruption gone)

P.S. the 4kb nvram I used is actually 32kb, only 4kb of it is mapped into memory.

MonteCarSlow

There is a ton of free space in the eprom of an $8D calibration... what features are you coding??

junkcltr

iTrader: (1)

That is what I liked about your NVRAM module and bin hac. It uses the PROM if the NVRAM is corrupt for some reason.
Now if I can just figure out how to do the hac in the $58 BBZB because the ALDL is so much different than the $8D series. I need to mod the TCL script for the $58 vs. $8D ALDL difference. Great project.