From my experience so far with the previous gen. vortec PCM, you can figure out some of the basics of how these work in 4 steps. The first three are easy. The last one is, well, rather hard.

Step 1 is to desolder the 28F400 flash chip (see the pic below, courtesy of Scuzz here on TGO). It seems there are a variety of ways to do this. My computer had the waterproofing splooge all over it, so I had to do it pin by pin, but theres stuff out there called ChipQuik thats low melt solder. I experimented with this on a similar size SMD, and its pretty easy to use. There are also SMD rework stations available that can be used to do this.

Step 2 is to read the flash chip. A PPII works quite well for this. I used my PPII along with the appropriate adaptor and was able to get a clean read from my chip.

Step 3 is to disassemble the bin. Since I dont have $$$ for the expensive programs like IDA, I used IRA (attached at bottom). Its a freeware program that somewhat handles the M68XXX instructions. Most of the basic stuff disassembles, but it fails to see the more complex addressing modes and CPU32 instructions. All and all, it does about 90% of the code, but the other 10% has to be done by hand using the programmers reference manual to decode the machine code.

Step 4 is the hard part. The older VPW based OBD-II PCMs use a datalink controller to communicate with the outside world. The DLC interfaces with other compliant devices such as scantools. In the OBD routines, the scantool data will give you about 30 freebies (OBD-II PIDs to be technically correct), such as the mass airflow rate, MAP kPa, A/D TPS, MPH, O2 data, etc. They as well as the units are defined in the SAE J1979 spec. The GM PCMs support MANY more PIDs, but they are custom PIDs that aren't defined per the SAE specs. GM only gives you the bare minimum as required by SAE (hmmm... I wonder why?). Even so, they are still little nuggets of gold that will get you in through the door. Ive been able to get pretty far with just these.

To find them, you need to trace the DLC to the address pins on the MPU to find out where the FIFO Rx/Tx buffers are located within the hardware addr. space. Once you find these, you can then start tracing them through the code. The first thing my 98 PCM did was to spool the data out of the Rx buffer and then ID/verify its contents. It then uploads this to a series of cycling buffers within the code. The software then fetches the frames one by one and reads in the request. By examining the three header bytes, you can find out what part of the code handles the diagnostics data.

The diagnostics data is handled in the following way in my PCM. The computer first took the requested PID and looked it up in a large index. If the PID was valid and a match was found, the cooresponding position in the index corresponds with the routine that will handle that PID request. The software then takes the offset and looks up the appropriate routine from a large index of OBD transmission routines. There is a routine for each PID to scale the value from the memory and then save it to be transmitted through the DLC.

The caveat with the later PCMs is that the chip that appears to be the datalink controller is different (looks more complex). I have only found the users manual for the earlier serial version of it thats in my PCM. Having the manual definatly makes it alot easier to interpret what the PCM is doing when it interfaces with the DLC.

 

IRApc

 

DIY EFI Enthusiasts' far and wide will celebrate the day you release the commented hac, while the merchants of overpriced tuning tools shall utter curses in your name.

 

The current overpriced tuning tools don't even have but a fraction of the tables and constants located, that the TBI PCM has in it. Its easy to see why some struggle with the wilder engine combinations and the newer PCMs.

 

That was my thought. There isnt enough tables defined. They have a broad selection of tables, but not alot of depth. Im hoping to have the engine part done before the middle of summer so I can at least have the car on the road during nice weather.

As for the $0D, it is actually somewhat similar to the later PCMs. Ive been stealing stuff from time to time to comment the later 98 PCM that I have, so the $0D does give a good idea of what is really in there to be tuned and tweaked.

Another thing I still have to figure out is how to flash these. I can hack a hole in the case and socket it and tune with my PP-II, but it would be nice to just flash it as needed when I make changes.

 

Hack a hypertech or similar handheld programmer

 

Are the pins/pads available for installing a BDM cable?

http://cmp.felk.cvut.cz/~pisa/m683xx/bdm_driver.html

 

Yes. All the pads are there to install a BDM interface and thats certainly an option. Id still like to look into flashing the PCM thru the OBD connector as its the cleanest way to do it.

 

My TCII cable and the older TCII software allows me to flash through the cable.
As I understand it, the software looks for something in a box about mid-cable to know that you have a legitamate copy and cable. The circuit in the cable is flashable also.
Some of the Honda tuners solder on a usb port to flash the honda ecu. There's some info on that at Moates.net under the honda chrome section.
Maybe something like that.
Ron

 

I was thinking that the way to flash these would be to just do it real time the way TP RT does it. You could put a routine within the PCM that would allow you to update one or two bytes at a time with the car running. The routine would take the 3 byte addr. of the cell and the new value to be written to the cell and write the data. It would then echo the OBD frame back in the normal fashion, but instead of the one or two databytes you originally sent, they would instead be the new values of the cells as read from the actual ROM. This would allow you to perform checks. If the CRC and frame are good, and the data matches, then you know you have a good write. In the tuning software, once your done editing a table, you would click a button at the bottom that updates the table. The software would then transmit only the changed cells and addresses of those cells to the PCM. Once your done editing, then rewrite and re-enable teh checksums. You could only do 10 cell updates a sec., but its faster then shutting down and doing a bulk write. The only thing that would ahve to be done is to either socket the PCM and write the needed routines using a prom programmer (I think the flash chips also work as conventional flash chips as well) or put an initial boot loader in the RAM and add the routines that way.

 

you mean your looking for something to solder in a 411 pcm to real time tune it? like the roadrunner that moates.net sells?

anyway good job starting to work on the code

i think tunerpro rt will recognise the roadrunner as i think it was used for the intial tuning on the pre-production unit

i think the hardest part will be cracking the code and making and xdf

you get that done and worst case senario you have to desolder chip and solding in an ostrich emulater adapter

it would be a cheap open software diy version of the roadrunner

 

Im actually talking about doing it right through the OBD-II port w/o any external hardware other then an OBD-II cable. Might as well try to use the PCM itself as its already there and capible of doing some basic updates while the car is in operation. Also, since the MPU itself is doing the updates, there are no potential issues with coordinaing read/writes of the same area of the ROM like you may have with a DIY emulator.
----------
Im already working with the 98 PCM, but havent spent alot of time yet with the OBD routines.

 

The problem though is that you cannot erase a single byte. You have to erase a whole block and then you can write to any byte in that block.


Your are probably familiar with it, but I did something very similar with the 730 ECM by adding a battery backed ram chip into the address space of the CPU and a little hack job to the mode 4 ALDL command. The calibration data stays in the ram and the (e)prom contains the code and a known good baseline calibration should the crc check of the ram fail on boot up.

 

i think an ebl like approach would work the best in the end another circuit board that is installed and soldered to the main board with a single usb plug
but unlike the roadrunner it would support datalogging and possibly auto tuning

 

IC. So a block loader will be needed in the RAM afterall if an update is required.

As far as teh memory goes, theres so much RAM in these that you probably could just upload the basic engine calibration to the RAM and so long as you dont unhook the battery, you could just point the base calibration addr. to the RAM and update the flash when needed.

 

I would wager one of the sectors in the flash is locked so that it cannot be erased. This sector would be what contains the boot up and flashing subroutines, just enough code to be able to talk over the OBD2 link and program the flash. Take my comments with a grain of salt, I have not toyed around with any of the PCM's yet.

 

The first sector contains the boot block, which I would also suspect is locked, or at the very least restricted access wise. Like you siad, it also does contain some basic OBD-II comm. routines. After the boot block are the various blocks containing the calibration and then the main system and OBD-II communications routines.

 

So let me just get this straight:

Your doing 1 of 2 things:

1. Hacking the 411 PCM to run TBI

or

2. Your planning on putting an LS1 based engine in your Camaro.

Which one of the two is it? Sorry if i've missed a major post, I just don't come here regularly enough to get the story.

PS: I've been spreading your $0d source all over a site called "FullsizeChevy.com", along with others from here, and she's spreading like the plague! (A good thing )

 

or option 3 running a sbc w/ a vortec crank and cam sensor on a express van calibration

but then again who would want modern seq. inj. with a modern mass air sensor

 

Actually the ls1 type PCM is a VERY powerful computer with enormous potential for just about any application you could come up with. If (when) a fully commented hack becomes available, the possibilities are almost endless.

 

Oh, this I know. I was just curious as to what Dimented's plans are.

 

Im going to be doing SFI for this next go around. Engines out of the car, so its a good time to replace the wire harness. I've been wanting to work with the vortec PCMs for quite some time now. I thought of maybe trying to retrofit it for TBI, but the ammount of effort would likely be too great, and it may not be possible to reconfigure how it fires very easily.

Right now Im working with the 98/99 PCM. I wanted to start with teh '411, but there wasnt enough info available yet. The 98/99 PCMs at least have some info posted on DIY-EFI. Enough to get started. Right now Im going though the spark and fuel routines. I will say one thing that the code is a bit interesting. Definatly alot different from what was in use before. Its much more formula based as opposed to just tables.

 

When I was working at MMS we were finding tables in the ls1 computers graphically, but I recall there weren't very many big 3d tables. We didnt (at that time) have the tech to use the aldl port to re-program ,so I was pulling the flash chips (got it down to under 15 minutes complete R&R). At the time none of us could read the code and didnt know how to disassemble it. But judging by the changes to the code we found made by hypertech, vortech and a few others they didnt know squat either!
At one point we even had an Emulator working, but it was very unreliable.

Now we also tried to look into tuning the TrailBlazers, and managed to pull the flash chip from a brand new one. What we found looked to be way more complex than the LS1 computers. There were several pairs of large 3d tables with corresponding 2d tables which I have always believed was used to interpolate between the tables. The flexible plastic film circuit board was a total disaster to try to re-solder a chip to

Anyhow, I was using a ziff socket in a modified LS1 computer for tuning and then soldering the customers chip into their computer when finished. My next step was to have been to open up a hypertech and socket the chip in one of those and just flash it through the port. Obviously just a hack and not a PROPER solution. I'm not sure how much of the code is in a hand held programmer but we were under the impression that it may contain the whole contents of the flash chip.

 

I started off by finding them graphically as well before I cracked the basic scantool interface routines. Good way to start out so at least you have some basic map of what teh calibration looks like. The only downside is that its nearly impossible to get the units of the tables in use or the axis. Good example is composite VE table, which is actually the cylinder volume x VE x scalar.

Also, just out of curiosity, how many tables did you manage to find that way? I found the MAF, basic SA and VE tables, but outside of that, it was hard to determine what everything else was.

 

You know after you get the 98 PCM running, and you do more work on the 0411, the truck guys are re-pinning their 96-99 trucks to run the 0411 PCM. I can get acess to the spreadsheet conversion for you. Lextech has compiled one for every year.

 

We immediatly found the MAF SA and VE tables too. using our dyno with a wideband we also found a WOT AFR table which was for sure the biggest help. changes to this table corresponded almost perfectly to the observed WOT AFR's.
keep in mind this was 7 years ago and I was very much a beginner. But we found probably around a dozen tables, and all of the constants changed by about 4 or 5 other "programmers" by doing file comparisons.
a testament to the power and flexability of these computers is that with so little programing capability we were able to make some real nice power, with some fairly drastic mods and only limited programming. Having a chassis dyno on site was a huge help too.

I do know that the f-body , corvette and pickup are all very similar, but the corvette had some extra code that we assumed was used for the "drive by wire" throttle.

 

The Corvettes weren't the only vehicles that drove by wire were they? I'm sure my next door neighbors 2002 2500HD w/ 6.0 has it.

- B

 

I only know up to the 2002 model year, and the only thing we worked on with drive by wire was the vettes, thats not to say some others didnt have it yet.

 

I think most cars/trucks had it after 2001 or so, but I could be wrong.

 

Its been a long time since I started messing with the '411, but Im finally getting to the point where I can actually swap it in the car and be able to tune with tunerpro. I still have a lot of work left to do, but it should be cool to have a PCM that can easily use the roadrunner or flashing thru the OBD port.

IMO, I dont like the software logic as much as whats in the blackbox vortecs. For a performance app., those are easier to use and more desirable as they are not a full MAF based calibration like teh '411. The '411 is more like what ford would use on their cars, in that everything is based on teh cylinder airmass. Thatll make the SA harder to deal with, but opens the door for easy conversion to 2/3 bar MAP.

Never the less, the hardware is way ahead of teh hodgepodge of stuff in the blackbox. Cant wait to get it in.

 

I dont recall if I ever got this from you? Do you still ahve access?

 

Yeah, I got it. Find it when I get home tonight.
Ron

 

I'm going to attach this .xls file, I hope. Not having a lot in attaching stuff lately. If not, send me email and I'll send it that way.
I have to give credit to Lextech for the spreadsheet. He has a different spreadsheet for 96, 97, 98, and 99, because they each wire a little differently.
If you don't have the 96, I can get any one of these years from him. He's done a lot with the 0411.
Let me know.
Ron

 

I have the 98/99 year. I do recall in there being some minor differences as they updated the PCMs for the 98/99 model years. If you have that one as well, that would be awsome.

 

PM me with email.
Thanks,
Ron