First off, your response in the other thread was very helpful. I was making the whole thing more difficult that it is. E6 detected lock-in tonight using the default 8192 baud rate. Now, why was I even messing around with the 160 baud stuff, anyway? Maybe by timing the first transmission just right, the program can lock itself in without hitting the "1" key? Or is that being too lazy?

So, here's another report that ECMscan works fine at least with the '86 Y body ECM ($32).

The '86 Y body ALDL has no pin M - everything is done through pin E. Doesn't affect anything, same pin functions just in a different location.

Mode 4 seems similar to mode 3 in that contents of any 8 bytes of ram can be read. What I don't understand right now is what the control words are all about. Are these the key to the power of this mode?

FWIW, here's what the $32 BUA disassembly has to say:

;MODE 4 WILL MODIFY ECM OPERATION
;& XMIT THE CONTENTS OF RAM,
;(0 *> 8 LOC'S) AS REQUESTED
;
;ALDL DEV MUST REQUEST MODE 4 BY
;XMITING THE FOLLOWING MSG TO
;THE ECM:
;
;MSG ID = 0x80
;MSG LEN 2n+1+10+85 = 0xnn
;MODE = 0x04
;CNTL WD 1 = 0xcc
;.
;.
;CNTL WD 10 = 0xcc
;ADD 1 MSB = 0xaa
;ADD 1 LSB = 0xaa
;.
;.
;ADD N MSB = 0xaa
;ADD N LSB = 0xaa
;CKSUM = 0xcc
;
;THE ECM WILL RESPOND WITH:
;
;MSG ID = 0x80
;MSG LEN n+1+85 = 0xnn
;MODE = 0x04
;ADD CONT = 0xdd
;.
;.
;ADD CONT = 0xdd
;CKSUM = 0xcc

 

Mode 4 is a carry over from the HUD and factory calibration team access to the ecm.
Not a HUD as you might be thinking of, just a box of stuff that sits on the dash. Somehow and emulator is tied into the setup, and couple kluge boxes. Used hand soldered memcals, and was rather prehistoric looking.
And some of them used an edge board connector to access the ecm.

 

Delving further into mode 4, I have figured out some of the command words. Recall that mode 4 allows control of many functions of the ECM directly through the serial connection. Each mode 4 transmission consists of a preamble (message id, message length, and mode), then 10 control words, then up to 8 RAM locations to fetch, and finally a checksum. The 10 control words are the meat & potatoes of mode 4 and consist of flag bytes and values as approximately follows:

; Control Word 1 [$0152]
; b0 = ALDL is controlling error lamp
; b1 = ALDL is controlling cooling fan
; Control Word 2 [$0153]
; b0 = turn ON error lamp
; b1 = turn on cooling fan
; Control Word 3 [$0154]
; b0 = commanding fuel
; b1 = set IAC mode
; b3 = disable EST
; b4 = reset BLM's
; b5 = reset IAC to max (255)
; b6 = clear system errors ($0005 - $0009)
; b7 = don't toggle COP2 every 6.25 ms
; Control Word 4 [$0155]
; b0 = commanding open loop
; b1 = IAC ???
; Control Word 5 [$0156]
; b0 = ALDL is controlling EGR
; b1 = ALDL is controlling A/C
; b2 = ALDL is controlling TCC
; b3 = ALDL is controlling CCP
; b5 = Enable AIR mod
; b6 = Change AIR PW
; Control Word 6 [$0157]
; AIR inj PW or purge duty cycle
; Control Word 7 [$0158]
; b0 & b1 = ALDL is controlling IAC
; b2 = ALDL is controlling AFR
; b3 & b4 = ALDL is controlling spark
; b5 1=subtract spark, 0=add spark
; Control Word 8 [$0159]
; IAC commanded speed or offset to move IAC
; Control Word 9 [$015A]
; commanded AFR
; Control Word 10 [$015B]
; commanded spark adv or retard

The [addresses] are locations in RAM where the commands are buffered.

This is preliminary information. I think I've caught all references to mode 4 code, but some areas need further work, in particular the spark routines are hard to follow. IAC references are also bleak.

Comments? Self tuning car, anyone?

Jim

 

Looking interesting...continue?