james_adams2006

First off I'd like to thank dimented24x7 for his hard work he put into on the hack of the 411 12202088 OS because, frankly, without it I would have had no where to start nor knew what I was doing.


For the last few months, I have been taking the time to learn first off Motorola assembly language and secondly trying to finish out the remainder of parameters needed to be able to tune the trans in these PCM's without having to resort to EFILive or HP for this part. That now appears to be the last key to tuning (at least for this particular OS) since I have seen the progress on the program dimented put together for reflashing using the AVT cable.


I am by no means anywhere as knowledgeable in coding as some of the other members on here, but I feel I have made progress and have been able to isolate several tables pertaining at least to TCC pressure control, transmission related DTC fault processing enable bytes, and trans DTC fault max line pressure enable bytes. However, I can't give any guarantees on how long it will take for me to isolate the remainder of tables at least needed for minimal shift timing and shift pressure control. My goal is to at least initially identify all the tables that are available by using EFILive or HP so that one can have at least that level of tuning ability and then from there identify remaining tables (since there are so many more) that appear relevant for the needs of most.


I have taken this on first off because its interesting to just know how the algo's run in these PCM's giving a better understanding of what truly is occurring, secondly because I have some future projects (my Camaro is one of them) that will be swapped to an LS and I don't want to be locked into having to pay for licenses and such with EFI or HP, and thirdly, because I have this crazy idea that if I can fully decipher enough of the trans code section that I could rewrite the portions required to allow full control of a 4L80E Sixxer trans.... the six speed conversion valve body setup for 4L80E... because it is such a cool piece of hardware but really demands an OEM style PCM to control it with full DTC recognition capabilities and the same fine control as the OEM setup. Now I know that is a lloooonnnnggggg way away, and may never happen, but got to have goals, right?


Anyway, for now I figured I'd stick with isolating the tables that could benefit everyone else in the process of learning the in's and out's of the routines used for control and the I/O software interfacing. I'd like to ask anyone who has dealt with these PCM's more than I have if they have any information as to address locations of Steady State Adapts or Shift Adapts or any addresses in RAM of monitored trans related parameters. I have at least identified TCC status, commanded line pressure (PSC solenoid control pressure), PSC commanded amperage, and a few others along those lines, but the shift adapts would really help me out a lot and help me focus in on where they are to find the relevant tables faster.


So now that I've written a book, thanks to anyone that can help out.

james_adams2006

So here's what I have so far. Most of the upshift/downshift speed/Throttle tables and TCC control parameters are there along with the start of the pressure control tables. I've identified the tables that control shift adapt addition subtraction. There are a large number of entry conditions that can be altered to determine what warrants a "same shift" to allow updating shift adapt parameters and I'm going to define those out when I get a chance. There are still a number line pressure control tables I haven't identified yet such as gear transition line pressures so working on those. There are also several other TCC control parameters I know that are in the code to control delays and the operation of the 5 different modes that I think could be beneficial.


On a side note, for anyone who has tackled these Motorola based PCM's, have you encountered JSR routines that call $000AXXXX as the address? This isn't a physical memory address nor is it in RAM memory. I thought it may be a "A" line exception vector 10 pointed to by $00028, but this just points to the stop and wait for next interrupt routine. Does anybody know what it is calling?

james_adams2006

With a little more research, I think I answered my own question regarding the addressing. I believe it is the hardwired address of the BDLC (Byte Data Link Controller) chip. Either that or it is a hard addressed I/0 chip (however from what I can tell most of those interface through the QSM).